"""HUX-11 foundation: identity, flags, tenant store, audit and the HTTP pipeline.

Security obligations exercised here: identity comes only from trusted headers
(relay/worker keys compared in constant time), every request lands in a
tenant-scoped directory, disabled cards are indistinguishable from unknown
routes, every read and denial leaves an audit outcome, and revisions guard
concurrent writers.
"""

from __future__ import annotations

import json
import sys
import threading
from http.client import HTTPConnection
from pathlib import Path

import pytest

ROOT = Path(__file__).resolve().parents[2]
FOUNDATION = ROOT / "dockerfiles" / "hermes-hux-foundation"
if str(FOUNDATION) not in sys.path:
    sys.path.insert(0, str(FOUNDATION))

from hux import audit, contracts, errors, flags, identity, store  # noqa: E402
from hux.http import Response, Router, page, serve  # noqa: E402
from hux.server import build_router  # noqa: E402

SCHEMAS = contracts.load_all()
HEADERS = {"X-Hermes-Tenant-Identity": "slot-3", "X-Hux-Subject": "usr_0123456789abcdef", "X-Hux-Surface": "chat", "X-Hux-Relay-Key": "rk"}
ALL_ON = ",".join(card["flag"] for card in contracts.load_flags()["cards"])


def ident(**overrides) -> identity.Identity:
    base = {"tenant_slot": "slot-3", "subject": "usr_0123456789abcdef", "surface": "chat", "trust": "router"}
    return identity.Identity(**{**base, **overrides})


# --- identity -------------------------------------------------------------------

def test_identity_from_router_headers():
    who = identity.resolve(HEADERS, {"HUX_ROUTER_KEY": "rk"})
    assert who == ident()
    assert contracts.validate("common.schema.json", who.record(), SCHEMAS, "/$defs/identity") == []


@pytest.mark.parametrize("bad", [
    {"X-Hermes-Tenant-Identity": ""}, {"X-Hermes-Tenant-Identity": "slot-x"}, {"X-Hux-Subject": "brad@bstein.dev"},
    {"X-Hux-Subject": ""}, {"X-Hux-Surface": "admin"}, {"X-Hux-Trust": "god"}, {"X-Hux-Surface": "worker"},
])
def test_identity_rejects_bad_headers(bad):
    with pytest.raises(errors.Unauthorized):
        identity.resolve({**HEADERS, **bad}, {"HUX_ROUTER_KEY": "rk"})


def test_relay_and_worker_need_their_keys():
    relay = {**HEADERS, "X-Hux-Trust": "relay", "X-Hux-Surface": "telegram"}
    with pytest.raises(errors.Unauthorized):
        identity.resolve(relay, {})
    with pytest.raises(errors.Unauthorized):
        identity.resolve({**relay, "X-Hux-Relay-Key": "nope"}, {"HUX_RELAY_KEY": "secret"})
    assert identity.resolve({**relay, "X-Hux-Relay-Key": "secret"}, {"HUX_RELAY_KEY": "secret"}).trust == "relay"
    worker = {**HEADERS, "X-Hux-Trust": "worker", "X-Hux-Surface": "worker", "X-Hux-Relay-Key": "wk"}
    assert identity.resolve(worker, {"HUX_WORKER_KEY": "wk"}).surface == "worker"
    assert identity.resolve(HEADERS, {"HUX_ROUTER_KEY": "rk"}).trust == "router"


def test_router_key_is_required_and_secret_file_is_supported(tmp_path):
    """Same-pod callers cannot forge router trust; a projected 0400 secret file authenticates it."""
    bare = {key: value for key, value in HEADERS.items() if key != "X-Hux-Relay-Key"}
    with pytest.raises(errors.Unauthorized) as missing:
        identity.resolve(bare, {"HUX_ROUTER_KEY": "router-secret"})
    assert "router-secret" not in str(missing.value)
    with pytest.raises(errors.Unauthorized):
        identity.resolve(HEADERS, {"HUX_ROUTER_KEY": "router-secret", "HUX_RELAY_KEY": "rk"})
    key_file = tmp_path / "router-key"
    key_file.write_text("router-secret\n")
    key_file.chmod(0o400)
    authenticated = {**bare, "X-Hux-Relay-Key": "router-secret"}
    assert identity.resolve(authenticated, {"HUX_ROUTER_KEY_FILE": str(key_file)}).trust == "router"
    router = build_router(tmp_path / "data", {"HUX_FLAGS": ALL_ON, "HUX_ROUTER_KEY": "router-secret"})
    assert router.dispatch("GET", "/hux/v1/capabilities", bare, b"").status == 401
    assert not (tmp_path / "data" / "hux").exists()


@pytest.mark.parametrize("payload", [None, b"x" * (identity.MAX_KEY_BYTES + 1), b"\xff"])
def test_router_key_file_failures_are_unauthorized(tmp_path, payload):
    """Missing, oversized, and non-UTF-8 projected secrets fail closed without exceptions or values."""
    key_file = tmp_path / "router-key"
    if payload is not None:
        key_file.write_bytes(payload)
        key_file.chmod(0o400)
    with pytest.raises(errors.Unauthorized) as denied:
        identity.resolve(HEADERS, {"HUX_ROUTER_KEY_FILE": str(key_file)})
    assert "x" * 32 not in str(denied.value) and "\\xff" not in str(denied.value)


def test_router_trust_cannot_claim_worker_surface():
    """Even an authenticated BFF key cannot impersonate the separately keyed worker hop."""
    with pytest.raises(errors.Unauthorized, match="worker surface"):
        identity.resolve({**HEADERS, "X-Hux-Surface": "worker"}, {"HUX_ROUTER_KEY": "rk"})


def test_slot_must_match_the_pod_it_reaches():
    with pytest.raises(errors.Unauthorized):
        identity.resolve(HEADERS, {"HUX_TENANT_SLOT": "slot-4", "HUX_ROUTER_KEY": "rk"})
    assert identity.resolve(HEADERS, {"HUX_TENANT_SLOT": "slot-3", "HUX_ROUTER_KEY": "rk"}).tenant_slot == "slot-3"


def test_server_refuses_non_loopback_bind():
    from hux import server
    assert server.bind_address({}) == "127.0.0.1"
    with pytest.raises(SystemExit):
        server.bind_address({"HUX_BIND": "0.0.0.0"})


# --- flags ---------------------------------------------------------------------

def test_flags_fail_closed_and_capabilities_validate():
    off = flags.Flags({})
    assert not off.enabled("HUX-11")
    with pytest.raises(errors.FlagOff):
        off.require("HUX-01")
    partial = flags.Flags({"HUX_FLAGS": "hux.activity_timeline"})
    assert not partial.enabled("HUX-01")
    on = flags.Flags({"HUX_FLAGS": ALL_ON})
    record = on.capabilities(ident(), {"commit": "d3cbeb06" * 5, "image_digest": "sha256:" + "4a" * 32, "junk": "x"})
    assert contracts.validate_record(record, SCHEMAS) == []
    enabled = {card["card"]: card["enabled"] for card in record["cards"]}
    assert all(enabled[card] for card, routes in flags.CARD_ROUTES.items() if routes and card != "HUX-12")
    assert not enabled["HUX-12"]
    assert all(not enabled[card] for card, routes in flags.CARD_ROUTES.items() if not routes)
    assert {card["card"] for card in record["cards"]} == {f"HUX-{n:02d}" for n in range(1, 13)}
    assert not on.enabled("HUX-99")
    assert flags.build_from_environ({"HUX_BUILD_COMMIT": "abc"}) == {"commit": "abc", "image_digest": ""}
    release_commit = "d3cbeb06" * 5
    release_tag = f"git-{release_commit}-build-23-release"
    assert flags.build_from_environ({"HUX_IMAGE_TAG": release_tag}) == {
        "commit": release_commit,
        "image_digest": "",
    }
    with pytest.raises(ValueError):
        flags.build_from_environ({"HUX_IMAGE_TAG": "latest"})
    with pytest.raises(ValueError):
        flags.build_from_environ(
            {"HUX_IMAGE_TAG": release_tag, "HUX_BUILD_COMMIT": "a" * 40}
        )
    assert "commit" in flags.build_from_environ()


def test_every_declared_route_belongs_to_exactly_one_card():
    seen: dict[str, str] = {}
    for card, routes in flags.CARD_ROUTES.items():
        for route in routes:
            assert route.startswith("/hux/v1/")
            assert route not in seen, f"{route} owned by {seen[route]} and {card}"
            seen[route] = card


# --- store ---------------------------------------------------------------------

def test_store_paths_are_tenant_scoped_and_ids_validated(tmp_path):
    a = store.TenantStore(tmp_path, ident())
    b = store.TenantStore(tmp_path, ident(subject="usr_fedcba9876543210"))
    assert a.root != b.root and a.root.parent == b.root.parent
    a.put("things", {"id": "thg_0001", "v": 1})
    assert not b.exists("things", "thg_0001")
    with pytest.raises(errors.Invalid):
        a.get("things", "../../etc/passwd")
    with pytest.raises(errors.Invalid):
        a.put("things", {"id": "no-prefix"})
    with pytest.raises(errors.Invalid):
        a.append("ledger", "../x", {})
    with pytest.raises(errors.NotFound):
        a.get("things", "thg_9999")
    assert store.ID_RE.match(store.new_id("evt"))
    assert store.now_iso().endswith("Z")


def test_store_revisions_and_conflicts(tmp_path):
    s = store.TenantStore(tmp_path, ident())
    first = s.put("docs", {"id": "doc_0001", "n": 1})
    assert first["revision"] == 1
    second = s.put("docs", {"id": "doc_0001", "n": 2}, expected_revision=1)
    assert second["revision"] == 2
    with pytest.raises(errors.Conflict):
        s.put("docs", {"id": "doc_0001", "n": 3}, expected_revision=1)
    with pytest.raises(errors.Conflict):
        s.put("docs", {"id": "doc_0002", "n": 1}, expected_revision=4)
    assert s.put("docs", {"id": "doc_0003"}, expected_revision=0)["revision"] == 1
    assert s.count("docs") == 2
    assert [d["id"] for d in s.scan("docs")] == ["doc_0001", "doc_0003"]
    assert list(s.scan("nothing")) == []
    s.delete("docs", "doc_0003")
    s.delete("docs", "doc_0003")
    assert s.count("docs") == 1


def test_store_bounds(tmp_path, monkeypatch):
    s = store.TenantStore(tmp_path, ident())
    with pytest.raises(errors.TooLarge):
        s.put("docs", {"id": "doc_0001", "blob": "x" * store.MAX_RECORD_BYTES})
    with pytest.raises(errors.TooLarge):
        s.append("ledger", "big", {"blob": "x" * store.MAX_RECORD_BYTES})
    monkeypatch.setattr(store, "MAX_FAMILY_RECORDS", 1)
    s.put("docs", {"id": "doc_0001"})
    with pytest.raises(errors.TooLarge):
        s.put("docs", {"id": "doc_0002"})
    s.put("docs", {"id": "doc_0001", "again": True})


def test_store_ledgers_survive_torn_writes(tmp_path):
    s = store.TenantStore(tmp_path, ident())
    s.append("ledger", "conv_1", {"seq": 1})
    s.append("ledger", "conv_1", {"seq": 2})
    path = s.root / "ledger" / "conv_1.jsonl"
    with open(path, "ab") as handle:
        handle.write(b'{"seq": 3, "tru')
    assert [r["seq"] for r in s.read("ledger", "conv_1")] == [1, 2]
    assert s.read("ledger", "missing") == []
    assert s.ledgers("ledger") == ["conv_1"] and s.ledgers("none") == []
    s.rewrite("ledger", "conv_1", [{"seq": 9}])
    assert s.read("ledger", "conv_1") == [{"seq": 9}]


def test_store_blobs_and_manifest(tmp_path):
    s = store.TenantStore(tmp_path, ident())
    digest = "ab" * 32
    s.put_blob(digest, b"hello")
    s.put_blob(digest, b"ignored")
    assert s.get_blob(digest) == b"hello"
    with pytest.raises(errors.NotFound):
        s.get_blob("cd" * 32)
    with pytest.raises(errors.Invalid):
        s.put_blob("../x", b"")
    with pytest.raises(errors.Invalid):
        s.get_blob("zz")
    manifest = s.manifest("1.0.0")
    assert contracts.validate_record(manifest, SCHEMAS) == []
    assert s.manifest("1.9.0") == manifest


def test_store_locks_serialise_concurrent_writers(tmp_path):
    s = store.TenantStore(tmp_path, ident())
    s.put("docs", {"id": "doc_0001", "n": 0})

    def bump() -> None:
        for _ in range(20):
            with s.lock("docs"):
                current = s.get("docs", "doc_0001")
                s.put("docs", {**current, "n": current["n"] + 1}, expected_revision=current["revision"])

    workers = [threading.Thread(target=bump) for _ in range(4)]
    for worker in workers:
        worker.start()
    for worker in workers:
        worker.join()
    assert s.get("docs", "doc_0001")["n"] == 80


# --- audit ---------------------------------------------------------------------

def test_audit_rows_validate_and_never_carry_bodies(tmp_path):
    s = store.TenantStore(tmp_path, ident())
    row = audit.record(s, ident(), "memory.read", "mem_0001", "deny", "not owner")
    assert contracts.validate("common.schema.json", row, SCHEMAS, "/$defs/audit_outcome") == []
    with pytest.raises(ValueError):
        audit.record(s, ident(), "x.y", "r", "maybe")
    for _ in range(5):
        audit.record(s, ident(), "memory.read", "mem_0002", "allow")
    assert len(audit.recent(s, limit=3)) == 3
    assert audit.recent(s)[0]["outcome"] == "deny"


# --- http pipeline ---------------------------------------------------------------

def _router(tmp_path, flags_value=ALL_ON, environ=None) -> Router:
    env = {"HUX_FLAGS": flags_value, "HUX_ROUTER_KEY": "rk", **(environ or {})}
    return build_router(tmp_path, env)


def _call(router, method, path, headers=HEADERS, body=b"") -> tuple[int, dict]:
    response = router.dispatch(method, path, headers, body)
    return response.status, response.body


def test_capabilities_and_manifest_roundtrip(tmp_path):
    router = _router(tmp_path, environ={"HUX_BUILD_COMMIT": "d3cbeb06" * 5})
    status, body = _call(router, "GET", "/hux/v1/capabilities")
    assert status == 200 and contracts.validate_record(body, SCHEMAS) == []
    assert body["server"] == {"commit": "d3cbeb06" * 5}
    status, body = _call(router, "GET", "/hux/v1/manifest")
    assert status == 200 and body["schema"] == "hux.manifest.v1"
    rows = audit.recent(store.TenantStore(tmp_path, ident()))
    assert [r["action"] for r in rows] == ["foundation.capabilities", "foundation.manifest"]


def test_flag_off_and_unknown_route_look_the_same(tmp_path):
    off = _router(tmp_path, flags_value="")
    status, body = _call(off, "GET", "/hux/v1/capabilities")
    assert (status, body["code"]) == (404, "flag_off")
    status, body = _call(off, "GET", "/hux/v1/nothing")
    assert (status, body["code"]) == (404, "not_found")
    assert contracts.validate_record(body, SCHEMAS) == []
    status, body = _call(off, "POST", "/hux/v1/capabilities")
    assert status == 405
    outcomes = [r["outcome"] for r in audit.recent(store.TenantStore(tmp_path, ident()))]
    assert outcomes == ["flag_off", "not_found", "not_found"]


def test_unauthorized_requests_never_touch_storage(tmp_path):
    router = _router(tmp_path)
    status, body = _call(router, "GET", "/hux/v1/capabilities", headers={})
    assert (status, body["code"]) == (401, "unauthorized")
    assert not (tmp_path / "hux").exists()


def test_body_decoding_and_request_helpers(tmp_path):
    router = _router(tmp_path)
    captured = {}

    def echo(request):
        captured.update(body=request.body, if_match=request.if_match(), key=request.idempotency_key(), q=request.query)
        return page([request.body], None)

    router.add("POST", "/hux/v1/echo/{id}", "HUX-11", "test.echo", echo)
    status, body = _call(router, "POST", "/hux/v1/echo/abc?x=1&x=2", {**HEADERS, "If-Match": "3", "Idempotency-Key": "run:1234567"}, b'{"a": 1}')
    assert status == 200 and body == {"items": [{"a": 1}], "next": None}
    assert captured == {"body": {"a": 1}, "if_match": 3, "key": "run:1234567", "q": {"x": "2"}}
    assert _call(router, "POST", "/hux/v1/echo/abc", HEADERS, b"{oops")[1]["code"] == "invalid"
    assert _call(router, "POST", "/hux/v1/echo/abc", HEADERS, b"x" * (1024 * 1024 + 1))[1]["code"] == "too_large"
    assert _call(router, "POST", "/hux/v1/echo/abc", {**HEADERS, "If-Match": "abc"})[1]["code"] == "invalid"
    assert _call(router, "POST", "/hux/v1/echo/abc", {**HEADERS, "Idempotency-Key": "!"})[1]["code"] == "invalid"
    _, body = _call(router, "POST", "/hux/v1/echo/abc", HEADERS)
    assert body["items"] == [None]


def test_handler_errors_are_audited_with_outcome(tmp_path):
    router = _router(tmp_path)

    def conflict(request):
        raise errors.Conflict("stale")

    def denied(request):
        raise errors.Forbidden("not yours")

    router.add("GET", "/hux/v1/c", "HUX-11", "test.conflict", conflict)
    router.add("GET", "/hux/v1/d", "HUX-11", "test.denied", denied)
    assert _call(router, "GET", "/hux/v1/c")[0] == 409
    assert _call(router, "GET", "/hux/v1/d")[0] == 403
    outcomes = [(r["action"], r["outcome"]) for r in audit.recent(store.TenantStore(tmp_path, ident()))]
    assert outcomes == [("test.conflict", "conflict"), ("test.denied", "deny")]


def test_real_server_serves_json_and_sse(tmp_path):
    router = _router(tmp_path)

    def stream(request):
        return Response(200, stream=lambda: (b"id: 1\ndata: {}\n\n", b"id: 2\ndata: {}\n\n"))

    router.add("GET", "/hux/v1/s", "HUX-11", "test.stream", stream)
    server = serve(router, "127.0.0.1", 0)
    thread = threading.Thread(target=server.serve_forever, daemon=True)
    thread.start()
    try:
        conn = HTTPConnection("127.0.0.1", server.server_address[1], timeout=5)
        conn.request("GET", "/healthz")
        assert json.loads(conn.getresponse().read())["status"] == "ok"
        conn.request("GET", "/hux/v1/capabilities", headers=HEADERS)
        reply = conn.getresponse()
        assert reply.status == 200 and json.loads(reply.read())["schema"] == "hux.capabilities.v1"
        conn.request("POST", "/hux/v1/capabilities", body=b"{}", headers={**HEADERS, "Content-Length": "2"})
        assert conn.getresponse().status == 405
        conn.request("GET", "/hux/v1/s", headers=HEADERS)
        reply = conn.getresponse()
        assert reply.getheader("Content-Type") == "text/event-stream"
        assert reply.getheader("Cache-Control") == "no-store"
        assert reply.read() == b"id: 1\ndata: {}\n\nid: 2\ndata: {}\n\n"
    finally:
        server.shutdown()
        server.server_close()


def test_all_errors_serialise_to_contract():
    for cls in (errors.Unauthorized, errors.Forbidden, errors.NotFound, errors.FlagOff, errors.Conflict, errors.Invalid, errors.TooLarge, errors.ApprovalRequired, errors.BudgetExhausted):
        record = cls("m" * 300, ["d" * 300] * 40).record()
        assert contracts.validate_record(record, SCHEMAS) == [], cls
    limited = errors.RateLimited(7)
    assert limited.retry_after == 7 and contracts.validate_record(limited.record(), SCHEMAS) == []


def test_foundation_sources_stay_under_500_lines():
    for path in sorted(FOUNDATION.rglob("*.py")):
        assert len(path.read_text().splitlines()) <= 500, path


def test_per_route_body_cap(tmp_path):
    router = _router(tmp_path)
    router.add("POST", "/hux/v1/big", "HUX-11", "test.big", lambda request: page([len(json.dumps(request.body))]), max_body=4 * 1024 * 1024)
    payload = json.dumps({"blob": "x" * (2 * 1024 * 1024)}).encode()
    assert _call(router, "POST", "/hux/v1/big", HEADERS, payload)[0] == 200
    assert _call(router, "POST", "/hux/v1/echo", HEADERS, payload)[0] == 404
    router.add("POST", "/hux/v1/small", "HUX-11", "test.small", lambda request: page([]))
    assert _call(router, "POST", "/hux/v1/small", HEADERS, payload)[1]["code"] == "too_large"


def test_server_main_wires_environment(tmp_path, monkeypatch):
    from hux import server
    seen = {}

    class Fake:
        def serve_forever(self):
            seen["served"] = True

        def server_close(self):
            seen["closed"] = True

    monkeypatch.setattr(server, "serve", lambda router, host, port: seen.update(root=router.data_root, host=host, port=port) or Fake())
    monkeypatch.setenv("HUX_DATA_ROOT", str(tmp_path))
    monkeypatch.setenv("HUX_PORT", "8791")
    server.main()
    assert seen == {"root": tmp_path, "host": "127.0.0.1", "port": 8791, "served": True, "closed": True}


# --- F2: worker allowlist, internal errors, health -----------------------------------

WORKER = {**HEADERS, "X-Hux-Surface": "worker", "X-Hux-Trust": "worker", "X-Hux-Relay-Key": "wk"}


def test_worker_trust_reaches_only_the_allowlisted_routes(tmp_path):
    """F2 (high) / SO-08: ``trust: worker`` gets 403 on every route outside ``flags.WORKER_ROUTES``, before the flag check."""
    router = _router(tmp_path, environ={"HUX_WORKER_KEY": "wk"})
    denied = [
        ("GET", "/hux/v1/memory/mem_0001aaaa"), ("GET", "/hux/v1/memory/export"), ("GET", "/hux/v1/conversations"),
        ("GET", "/hux/v1/conversations/conv_0001abcd/events"), ("GET", "/hux/v1/approvals"), ("PUT", "/hux/v1/policy"),
        ("GET", "/hux/v1/artifacts"), ("POST", "/hux/v1/conversations/conv_0001abcd/forget"), ("GET", "/hux/v1/privacy/audit"),
    ]
    for method, path in denied:
        status, body = _call(router, method, path, WORKER, b"{}" if method != "GET" else b"")
        assert (status, body["code"]) == (403, "forbidden"), (method, path)
    for method, path in [("GET", "/hux/v1/capabilities"), ("GET", "/hux/v1/runs/run_1/budget"), ("GET", "/hux/v1/privacy/policy"), ("GET", "/hux/v1/memory")]:
        assert _call(router, method, path, WORKER)[0] == 200, (method, path)
    rows = audit.recent(store.TenantStore(tmp_path, identity.resolve(WORKER, {"HUX_WORKER_KEY": "wk"})))
    assert [r["outcome"] for r in rows if r["action"] == "memory.read" or r["action"].startswith("policy")][:1] == ["deny"]
    assert all(r["outcome"] == "deny" for r in rows if r["action"] == "approvals.list")
    off = _router(tmp_path, flags_value="", environ={"HUX_WORKER_KEY": "wk"})
    assert _call(off, "GET", "/hux/v1/approvals", WORKER)[0] == 403, "the allowlist answers before the flag does"
    assert _call(off, "GET", "/hux/v1/capabilities", HEADERS)[0] == 404, "humans still see flag-off as not found"
    assert not flags.worker_may_call("GET", "/hux/v1/releases") and not flags.worker_may_call("GET", "/hux/v1/policy")
    assert all(any(t == route.template for _, t in flags.WORKER_ROUTES if route.method == _) or (route.method, route.template) not in flags.WORKER_ROUTES for route in router.routes)


def test_new_backend_cards_declare_routes_and_enable_with_dependencies():
    """F12: each shipped backend card is route-backed and its full flag chain enables."""
    shipped = {"HUX-06", "HUX-07", "HUX-09", "HUX-12"}
    configured = flags.Flags({"HUX_FLAGS": ALL_ON})
    assert all(flags.CARD_ROUTES[card] for card in shipped)
    assert all(configured.enabled(card) for card in shipped - {"HUX-12"})
    assert not configured.enabled("HUX-12")


def test_unexpected_handler_exceptions_become_a_500_error_record(tmp_path):
    """F2: a non-HuxError in a handler never propagates; the caller sees ``hux.error.v1`` 500 with no detail and the audit says deny."""
    router = _router(tmp_path)

    def boom(request):
        raise RuntimeError("secret stack detail")

    router.add("GET", "/hux/v1/boom", "HUX-11", "test.boom", boom)
    status, body = _call(router, "GET", "/hux/v1/boom")
    assert status == 500 and body == {"schema": "hux.error.v1", "status": 500, "code": "invalid", "message": "internal error"}
    assert contracts.validate_record(body, SCHEMAS) == []
    rows = [(r["action"], r["outcome"], r.get("reason")) for r in audit.recent(store.TenantStore(tmp_path, ident()))]
    assert rows[-1] == ("test.boom", "deny", "internal error")


def test_healthz_reports_the_contract_version(tmp_path):
    """F2: /healthz carries ``flags.CONTRACT_VERSION`` rather than a hard-coded string."""
    server = serve(_router(tmp_path), "127.0.0.1", 0)
    threading.Thread(target=server.serve_forever, daemon=True).start()
    try:
        conn = HTTPConnection("127.0.0.1", server.server_address[1], timeout=5)
        conn.request("GET", "/healthz")
        body = json.loads(conn.getresponse().read())
        assert body["status"] == "ok" and body["contract_version"] == flags.CONTRACT_VERSION
        assert body["retention"]["enabled"] is True
    finally:
        server.shutdown()
        server.server_close()


def test_no_outbound_network_client_in_the_service(tmp_path):
    """F13 / SO-29: no hux module imports urllib.request, requests, httpx or socket; http.server is the only http.* import."""
    import re
    banned = re.compile(r"^\s*(?:import|from)\s+(urllib\.request|requests|httpx|socket|http\.client)\b", re.MULTILINE)
    for path in sorted((FOUNDATION / "hux").glob("*.py")):
        assert banned.search(path.read_text()) is None, path
        http_imports = re.findall(r"^\s*from\s+(http\.\w+)\s+import", path.read_text(), re.MULTILINE)
        assert set(http_imports) <= {"http.server"}, (path, http_imports)