from pathlib import Path
import hashlib,json,subprocess,copy,yaml,re,importlib.util,sys
p=Path(__file__).resolve().parent;r=Path('/home/worsch/net-kingdom');base='342a6f25af5cdc602841948f42759ea52ef1c8f5'
def git(root,*a):return subprocess.check_output(['git','-C',str(root),*a],text=True).strip()
assert git(r,'rev-parse','HEAD')==base
assert git(Path('/home/worsch/railiance-platform'),'rev-parse','HEAD')=='104ed90f42a9a86bf9fda343b49b65a85c9ee4b9'
template=Path('/home/worsch/railiance-platform/manifests/templates/keycape-issuer-eso.yaml')
assert hashlib.sha256(template.read_bytes()).hexdigest()=='e17498bd8a4c820041a4105e4efe9c60c6a50953db8f621ff54887080065c743'
name='security-case-type-revisions/1.3/oidc-browser-relying-party/type.yaml';old=(r/name).read_bytes();old_doc=yaml.safe_load(old)
assert hashlib.sha256(old).hexdigest()=='e75fe94110ef9fb7fb18072fe2856941b33507c99cb406d36576046481485d0a'
(p/'type.preimage.yaml').write_bytes(old)
patch=p.parent/'nk48-r5-f2-publication-r1/netkingdom-entry-point.conditional.patch'
assert hashlib.sha256(patch.read_bytes()).hexdigest()=='6784a21fbd10bd62712be2e0f4929034601c94629aa74ccaa2e93fc815eecd61'
subprocess.run(['git','apply','--check',str(patch.resolve())],cwd=r,check=True)
subprocess.run(['git','apply',str(patch.resolve())],cwd=r,check=True)
new=(r/name).read_bytes();new_doc=yaml.safe_load(new)
a=copy.deepcopy(old_doc);b=copy.deepcopy(new_doc)
for doc in [a,b]:
 step=next(x for x in doc['spec']['follow_through'] if x['id']=='deliver-secret');step['entry_point']='same-entry-removed-for-comparison'
assert a==b,'only entry_point may change'
assert old_doc['spec']['parameters']==new_doc['spec']['parameters']
assert old_doc['spec']['execution_descriptors']==new_doc['spec']['execution_descriptors']
assert new_doc.get('metadata',{}).get('status')==old_doc.get('metadata',{}).get('status')
# Compose by importing the read-only seven-adapter composer, never dispatch.
sys.path.insert(0,'/home/worsch/ops-warden/src');sys.dont_write_bytecode=True
module=r/'sso-mfa/k8s/keycape/compose-1.2-descriptors.py'
spec=importlib.util.spec_from_file_location('nk48_composer',module);c=importlib.util.module_from_spec(spec);spec.loader.exec_module(c)
artifact=r/'sso-mfa/k8s/keycape/descriptor-composition-1.3.candidate.json';before=artifact.read_bytes();doc=json.loads(before)
regenerated=(json.dumps(c.artifact(doc['check_config_digest'],doc['params'],'1.3'),indent=2,sort_keys=True)+'\n').encode()
assert regenerated==before,'Unexpected descriptor/artifact delta; inspect before writing'
(p/'composition-regenerated.json').write_bytes(regenerated)
wp=r/'workplans/NK-WP-0048-security-case-types.md';text=wp.read_text();(p/'workplan.preimage.md').write_text(text)
for task,status in [('NK-WP-0048-T33','done'),('NK-WP-0048-T34','progress')]:
 match=re.search(r'```task\nid: '+task+r'\n.*?```',text,re.S);assert match
 before_block=match.group();assert 'status: todo\n' in before_block
 text=text[:match.start()]+before_block.replace('status: todo\n','status: '+status+'\n')+text[match.end():]
needle='## T34 — Close the consumer configuration inverse finding'
completion="""2026-10-17 completed exact proposed-source reference correction: Platform
published template, metadata helper and eight focused tests in
`104ed90f42a9a86bf9fda343b49b65a85c9ee4b9`; independent source review
`nk48-r5-f2-review-r1` found no blocking source-fit defect. The proposed 1.3
entry now names ClusterSecretStore `openbao-keycape-{client_id}-issuer`, cluster
scope restricted to `sso`, and the exact Platform template digest. Only that
entry text changes; parameters and all seven descriptors are unchanged, and
regeneration produces the identical not-an-admission composition artifact.
This closes the coordinator's vague-reference source finding only. It supplies
no formal owner assent, existing live store, installed ESO compatibility,
real delivery/removal/session capability, grant or native acceptance; existing
RPF-1.3-T4 and T16 keep those obligations. F3 is independent and remains open.
Evidence: Custodian `nk48-r5-f2-publication-r1/` and
`nk48-issuer-reference-integration-r1/` under the existing 17 October packet.

"""
assert text.count(needle)==1;text=text.replace(needle,completion+needle)
needle='## T35 — Align source admission fixtures with the authenticated catalog and attended-session API'
note="""2026-10-17 implementation progress: the fresh independent Apps review
reproduced a missing fresh inverse-session boundary. Three new regressions fail
the original wrapper. Corrected r2 requires a separately authenticated inverse
session before the release-writer lock and revokes it on every exit; 19 tests /
33 subtests pass, and removing the session guard is detected. This remains a
source candidate: direct Apps source inspection found no real owner transaction,
durable journal, all-release-writer exclusion or inverse-session backend to bind.
The four exact missing owner facilities and smallest existing T05 implementation
are retained in Custodian `nk48-r5-f3-implementation-r2/owner-backend-next.md`.
T34 progresses for this correction and investigation; it does not claim the real
backend, accepted type placement, owner assent or F3 closure. The unsafe original
candidate/review remain frozen. Do not integrate its type prose as an implemented
capability or reuse the revoked hand-over session.

"""
assert text.count(needle)==1;text=text.replace(needle,note+needle)
text=text.replace('and `nk48-catalog-fixture-publication-r1/`. Canonical validation/publication
receipts belong in the latter packet when performed.','and `nk48-catalog-fixture-publication-r2/`. Root canonical validation passes
31 tests / 53 subtests against Warden `922c26d` (the same reviewed code plus
one normal allocator-only source UUID commit). Publication receipts belong
in that packet.')
wp.write_text(text)
(p/'verification.json').write_text(json.dumps({'status':'integrated-proposed-source-only','only_type_delta':'deliver-secret.entry_point','type_before_sha256':hashlib.sha256(old).hexdigest(),'type_after_sha256':hashlib.sha256(new).hexdigest(),'parameters_unchanged':True,'seven_descriptors_unchanged':True,'composition_byte_identical':True,'T33':'done: exact source reference only','T34':'progress: real owner backend absent','owner_assent':False,'native_action':False},indent=2)+'\n')
print('Applied exact issuer reference, verified unchanged descriptors/parameters/artifact; recorded bounded T33 completion and T34 progress.')
