import importlib.util,json,os,pathlib,shutil
from build import R,g,HEAD,OLD
os.umask(0o077)
def main():
 assert not (R/'plan.json').exists()
 assert g.sh(['git','-C',str(g.REPO),'rev-parse','HEAD']).strip()==HEAD
 assert not g.sh(['git','-C',str(g.REPO),'status','--porcelain']).strip()
 built=json.loads((OLD/'build.json').read_text())
 assert json.loads(g.sh(['docker','image','inspect',built['image_id']]))[0]['Id']==built['image_id']
 files=list((g.REPO/'app').rglob('*.py'))
 assert all(g.sha(p)==g.sha(OLD/'snapshot'/p.relative_to(g.REPO)) for p in files)
 assert g.sha(g.REPO/'docker/entrypoint.sh')==g.sha(OLD/'snapshot/docker/entrypoint.sh')
 (R/'build.json').write_text(json.dumps(built))
 (R/'source.json').write_bytes((OLD/'source.json').read_bytes())
 prior=pathlib.Path('/tmp/codex/ltb1021/2026-09-11_contextra-metadata-auth_r01')
 shutil.copyfile(prior/'firewall.py',R/'firewall.py')
 spec=importlib.util.spec_from_file_location('prior_prepare',prior/'prepare.py')
 m=importlib.util.module_from_spec(spec);spec.loader.exec_module(m)
 m.C=R/'controls';m.main()
 p=json.loads((R/'plan.json').read_text());C=pathlib.Path(p['controls'])
 diag=R/'diagnostics';diag.mkdir(mode=0o700)
 override=g.yaml.safe_load((C/'compose.yaml').read_text())
 override['services']['redis'].pop('ports')
 app=override['services']['analytics'];app['image']=built['image_id']
 app['environment']['CONTEXTRA_START_DIAGNOSTICS_DIR']='/run/contextra-boundary'
 app['volumes'].append({'type':'bind','source':str(diag),'target':'/run/contextra-boundary','bind':{'create_host_path':False}})
 (C/'compose.yaml').write_text(g.yaml.safe_dump(override))
 p['control_hashes']={str(x):g.sha(x) for x in C.iterdir() if x.is_file()}
 rendered=json.loads(g.sh(p['compose']+['config','--format','json']))
 assert not rendered['services']['redis'].get('ports')
 assert rendered['services']['analytics']['image']==built['image_id']
 p['difference']='No host LAN publish/firewall; diagnostics enabled; image/stream/display/capture otherwise preserved'
 p['reuse']=dict(app_files_equal=len(files),image=built['image_id'],build_runs=0)
 (R/'plan.json').write_text(json.dumps(p,indent=2))
 print(json.dumps(dict(actual_gate='PASS',source_image_equal=True,redis_empty=True,lan_publish=0,build_runs=0)))
if __name__=='__main__':main()