"""Synthetic local reference, checked against Eventus Engine 7897a80.

Place this file in an authorized engine checkout. From its root:
    PYTHONPATH=src python3 inspect-run.py
Requires Python 3.11+ and the checkout's existing jsonschema dependency.
No network, database, provider call or external action is used.
The caller-supplied handler is pure; dry-run is not a sandbox for arbitrary code.
"""
import json

from eventus_engine import Orchestrator, RunEnvelope
from eventus_engine.authorization import (
    AuthorizationDenied, NamespaceOperation, PrincipalType, principal_for_namespace,
)
from eventus_engine.validation import validate_contract

run = RunEnvelope(
    namespace_id="demo.review",
    workflow_id="inspect-approved-material",
    workflow_version="1.0.0",
    context_version="ctx-1",
    model_route="general",
    run_id="run-review-1",
    created_at="2026-10-17T12:00:00+00:00",
)
principal = principal_for_namespace(
    "workflow:reference", PrincipalType.WORKFLOW,
    "demo.review", NamespaceOperation.EXECUTE,
)
result = Orchestrator().execute(run, lambda _: {"planned": True}, principal)
assert result["production_effect"] is False
wrong_principal = principal_for_namespace(
    "workflow:other", PrincipalType.WORKFLOW,
    "demo", NamespaceOperation.EXECUTE,
)
try:
    Orchestrator().validate(run, wrong_principal)
except AuthorizationDenied:
    print("Parent namespace grant rejected: expected.")
else:
    raise AssertionError("Expected exact namespace isolation")
print("Pure in-memory handler completed. No external effect requested.")
print(json.dumps(validate_contract(run), indent=2))