path = r"C:\Users\intel\AppData\Local\OptimusRuntime\Labs\AR74\10_ar84_trust_boundary\candidate_workspace\app\remediation\self_repair\promotion_executor.py"
with open(path, "r", encoding="utf-8") as f:
    content = f.read()

# 1. Update signature of execute_promotion to accept telemetry_audit and require_authenticated_provenance
old_sig = '''        incident_id: Optional[str] = None,
        rollback_plan: Optional[Dict[str, Any]] = None,
        enforce_observation_only: Optional[bool] = None,
    ) -> PromotionExecutionResult:'''

new_sig = '''        incident_id: Optional[str] = None,
        rollback_plan: Optional[Dict[str, Any]] = None,
        enforce_observation_only: Optional[bool] = None,
        telemetry_audit: Optional[Any] = None,
        require_authenticated_provenance: bool = True,
    ) -> PromotionExecutionResult:'''

if old_sig in content:
    content = content.replace(old_sig, new_sig, 1)
    print("Replaced signature")
else:
    print("Failed to replace signature")

# 2. Add telemetry_audit to details_payload and replay guard check
old_details = '''        details_payload: Dict[str, Any] = {"promotion_id": promo_id, "incident_id": incident_id}
        if rollback_plan:
            details_payload["rollback_plan"] = rollback_plan'''

new_details = '''        details_payload: Dict[str, Any] = {
            "promotion_id": promo_id,
            "incident_id": incident_id,
            "mission_id": incident_id,
            "telemetry_audit": telemetry_audit,
            "require_authenticated_provenance": require_authenticated_provenance,
        }
        if rollback_plan:
            details_payload["rollback_plan"] = rollback_plan

        # Replay guard check at executor gate if telemetry_audit is provided
        if require_authenticated_provenance and telemetry_audit:
            if hasattr(telemetry_audit, "verify_authenticity"):
                is_valid, reason = telemetry_audit.verify_authenticity(
                    expected_workspace_root=str(w_root),
                    enforce_replay_guard=True,
                )
                if not is_valid:
                    dec = PromotionDecision(
                        promotion_allowed=False,
                        decision="BLOCK",
                        reason_code=f"TELEMETRY_INVALID: {reason}",
                        target_file=target_file,
                        details=details_payload,
                    )
                    return PromotionExecutionResult(
                        promotion_id=promo_id,
                        target_file=target_file,
                        decision=dec,
                        auto_promotion=False,
                        promotion_verified=False,
                        production_file_changed=False,
                        error_message=f"PROMOTION_BLOCKED: {reason}",
                    )'''

if old_details in content:
    content = content.replace(old_details, new_details, 1)
    print("Replaced details and added replay guard")
else:
    print("Failed to replace details")

with open(path, "w", encoding="utf-8") as f:
    f.write(content)
print("Finished updating promotion_executor.py")