from __future__ import annotations

from pathlib import Path

ROOT = Path(__file__).resolve().parents[2]
MIGRATION = ROOT / "migrations/versions/20260813_497_agent_runtime_critical_hardening.py"
DEPLOYMENT = ROOT / "deployment/migrations/versions/20260813_497_agent_runtime_critical_hardening.py"


def test_critical_hardening_migration_is_after_496_and_contains_atomic_claim_and_runtime_boundary():
    source = MIGRATION.read_text(encoding="utf-8")
    assert 'revision = "20260813_497"' in source
    assert 'down_revision = "20260813_496"' in source
    for required in (
        "agent_runtime_authorize", "FOR UPDATE", "request_digest", "idempotency_key",
        "dataops_agent_runtime_owner", "dataops_agent_runtime", "SECURITY DEFINER",
        "REVOKE ALL ON TABLE public.agent_invocation_audits", "governance_task_reviews",
        "data_incidents", "approval_task_uid", "clock_timestamp()",
        "t.business_domain_uid=p_domain::text",
        "END; $agent_runtime_authorize$;",
        "p_payload->>'request_digest')",
        "agent runtime role-init is required before migration 20260813_497",
        "agent_runtime_transition", "agent_runtime_canary_transition",
        "runtime recovery approval required", "generation fence conflict",
    ):
        assert required in source
    for forbidden in ("raw_input", "raw_output", "secret_value"):
        assert forbidden not in source
    assert MIGRATION.read_bytes() == DEPLOYMENT.read_bytes()