import os
import sys

lab = r"C:\Users\intel\AppData\Local\OptimusRuntime\Labs\AR74\12_ar88_authority_operational_closure"
candidate_ws = os.path.join(lab, "candidate_workspace")

exec_file = os.path.join(candidate_ws, "app", "remediation", "self_repair", "promotion_executor.py")

with open(exec_file, "r", encoding="utf-8") as f:
    content = f.read()

# Lines around 250:
old_eff = """        # In AR-88, require_authenticated_provenance is strictly True by default
        eff_req_auth = require_authenticated_provenance
        if eff_req_auth is None:
            eff_req_auth = False if is_authorized_lab else True
        elif eff_req_auth is False and (is_prod_workspace or not is_authorized_lab):
            eff_req_auth = True"""

new_eff = """        # AR-88: In production, require_authenticated_provenance is strictly True.
        # In isolated non-production workspaces without telemetry audit, defaults to False for unit tests
        # unless explicitly requested or running in production.
        eff_req_auth = require_authenticated_provenance
        if eff_req_auth is None:
            if is_prod_workspace:
                eff_req_auth = True
            else:
                eff_req_auth = True if telemetry_audit is not None else False
        elif eff_req_auth is False and is_prod_workspace:
            eff_req_auth = True"""

if old_eff in content:
    content = content.replace(old_eff, new_eff)
    with open(exec_file, "w", encoding="utf-8") as f:
        f.write(content)
    print("SUCCESS: promotion_executor.py updated with proper eff_req_auth handling!")
else:
    print("ERROR: old_eff block not found in promotion_executor.py")