"""Synthetic/read-only public artifact probes; no main, provider, native or database access."""
import copy,datetime,importlib.util,json,sys
from pathlib import Path
root=Path(sys.argv[1]);sys.path.insert(0,str(root));import test_execution as tests
from authority_journal import fresh_scan,recovery_authority
results={}
fixture=tests.FixedNativeProgram();objects,payload=fixture.fixture();objects["pod_ephemeral_fixture"]=[{"name":"unrelated","image":"unrelated:mutable","securityContext":{"privileged":True}}]
# Maker fake transport has dedicated actual Pod-field injection; test checks before exec/effect.
fixture.test_actual_pod_ephemeral_container_refuses_before_native_effect();results["actual_ephemeral_custody_refusal"]=True
case=root.parent;pub=Path(sys.argv[2]);contract=json.loads((case/"fresh-scan-contract.json").read_text());receipt=json.loads((case/"fresh-scan-receipt-template.json").read_text());scan=json.loads((pub/"scan-receipt.json").read_text());receipt.update(completed_at="2026-10-11T09:40:00Z",db_metadata=scan["db_metadata"],db_sha256=scan["db_sha256"],full_report_sha256="a"*64,exit_code=0)
report=json.loads((pub/"trivy-full.json").read_text());fresh_scan(receipt,report,contract,datetime.datetime(2026,10,11,10,tzinfo=datetime.timezone.utc));results["actual_published_full_report_matches_contract"]=True
for label,mutate in [("empty",lambda x:x.update(Results=[{}])),("wrong_config",lambda x:x["Metadata"].update(ImageID="sha256:"+"f"*64)),("truncated",lambda x:x["Results"][0]["Packages"].pop()),("low_finding",lambda x:x["Results"][0].update(Vulnerabilities=[{"Severity":"LOW"}]))]:
 r=copy.deepcopy(report);mutate(r)
 try:fresh_scan(receipt,r,contract,datetime.datetime(2026,10,11,10,tzinfo=datetime.timezone.utc))
 except (ValueError,KeyError):results["scan_"+label+"_refused"]=True
fixture=tests.OutcomeMetadataAndOutage();probe,cache,journal,sealed,deps=fixture.recovery_fixture()
for label,mutate in [("boolean_status",lambda p:p.update(native_probe_status=True)),("foreign_release",lambda p:p.update(release_attempt_id="other")),("healthy_candidate",lambda p:p["failed_candidate"].update(ready_replicas=1)),("fresh_403",lambda p:p.update(native_probe_status=403))]:
 r=copy.deepcopy(probe);mutate(r)
 try:recovery_authority(r,cache,journal,"a"*64,tests.REVISION,sealed,deps,"rollback",tests.NOW)
 except ValueError:results["recovery_"+label+"_refused"]=True
try:recovery_authority(probe,cache,journal,"a"*64,tests.REVISION,sealed,deps,"rollback",tests.NOW+datetime.timedelta(minutes=31))
except ValueError:results["recovery_31min_refused"]=True
metadata=tests.OutcomeMetadataAndOutage();metadata.test_actual_command_mocked_opener_never_prints_private_fields();results["provider_command_synthetic_private_output_withheld"]=True
print(json.dumps(results,sort_keys=True))
if len(results)!=12 or not all(results.values()):raise SystemExit(1)
