"""Read-only fresh comparison against the retained verified-client baseline."""
from pathlib import Path
import hashlib
import json
import shlex
import subprocess

BASE = Path(__file__).resolve().parent
RECEIVER = BASE / 'receiver-rollout-r4'
pod = json.loads((RECEIVER / 'delivered-runtime.json').read_text())['api_pod']

def owner(args, content=None):
    r = subprocess.run(['ssh', 'railiance01',
                        'KUBECONFIG=/etc/rancher/k3s/k3s.yaml ' + shlex.join(args)],
                       input=content, capture_output=True, text=True, timeout=45)
    assert r.returncode == 0, 'private-owner-read-refused'
    return json.loads(r.stdout)

actual = owner(['kubectl', '-n', 'state-hub', 'get', 'pod', pod['name'], '-o', 'json'])
assert actual['metadata']['uid'] == pod['uid']
helper = BASE.parent / 'netkingdom-target-2026-10-16/cluster-historical-publication-r1/postdeployment-verifier-r1/snapshot_full_row_hashes.py'
assert hashlib.sha256(helper.read_bytes()).hexdigest() == 'f01e93c0fcb4ca155bdf76813626c33e4343f6a8caec2870ab1d785243c60479'
result = owner(['kubectl', '-n', 'state-hub', 'exec', '-i', pod['name'], '-c', 'state-hub', '--', 'python', '-'], helper.read_text())
assert result['status'] == 'captured_readonly'
baseline = json.loads((RECEIVER / 'after-verified-client.json').read_text())
original = json.loads((RECEIVER / 'before-full-row-hashes.json').read_text())
result.update(current_verified_baseline_equal=result['tables'] == baseline['tables'],
              original_rows_equal=result['tables'] == original['tables'],
              original_failed_comparison_retained=True, original_preimages_restored=False)
(BASE / 'rollout-close-current-full-row-hashes.json').write_text(json.dumps(result, indent=2) + '\n')
assert result['current_verified_baseline_equal']
print(json.dumps({'status': 'verified-current-baseline', 'historical_rows': 18,
                  'original_failed_comparison_retained': True,
                  'original_preimages_restored': False}))