"""Local binary identity exercise; no registry, signature or cluster operations."""
import hashlib
import json
from pathlib import Path


def digest(data):
    return hashlib.sha256(data).hexdigest()


def approve(data, expected):
    if digest(data) != expected:
        raise ValueError("artifact checksum mismatch")


def reconcile(desired, actual):
    # Educational state assignment, not an Argo CD implementation.
    return dict(desired) if actual != desired else dict(actual)


def main():
    data = Path("dist/app").read_bytes()
    d = digest(data)
    approve(data, d)
    environments = {x: {"binary_sha256": d, "config": x} for x in ("dev", "staging", "prod")}
    assert len({x["binary_sha256"] for x in environments.values()}) == 1
    print("promotion: 3 configs, 1 unchanged binary checksum")
    Path("dist/promotion.json").write_text(json.dumps(environments, indent=2) + "\n")
    try:
        approve(data + b"tampered", d)
    except ValueError as e:
        print("negative fixture:", e)
    else:
        raise AssertionError("tampering accepted")
    desired = environments["prod"]
    drifted = {**desired, "config": "manual-edit"}
    actual = reconcile(desired, drifted)
    assert actual == desired
    assert reconcile(desired, actual) == actual
    print("reconcile model: drift repaired; second pass unchanged")

if __name__ == "__main__":
    main()