"""Deterministic credential-version model. No real credentials or services."""
import csv,json
from pathlib import Path
ROOT=Path(__file__).resolve().parent
rows=[]
for policy in ('revoke_early','gate_on_adoption'):
 accepted={'old'};pointer='old';consumers={'api':'old','worker':'old'}
 for step in range(6):
  action=['initial','publish_new','api_refresh','try_revoke','worker_refresh','final_revoke'][step]
  if step==1:accepted.add('new');pointer='new'
  if step==2:consumers['api']=pointer
  if step==3:
   if policy=='revoke_early' or all(v=='new' for v in consumers.values()):accepted.discard('old')
   else:action='hold_revocation'
  if step==4:consumers['worker']=pointer
  if step==5:accepted.discard('old')
  for consumer,version in consumers.items():
   rows.append(dict(policy=policy,step=step,action=action,consumer=consumer,version=version,accepted=','.join(sorted(accepted)),new_authentication=version in accepted))
failed={p:sum(not r['new_authentication'] for r in rows if r['policy']==p)for p in ('revoke_early','gate_on_adoption')}
assert len(rows)==24 and failed=={'revoke_early':1,'gate_on_adoption':0}
assert all(r['accepted']=='new' for r in rows if r['step']==5)
with (ROOT/'trace.csv').open('w',newline='') as f:w=csv.DictWriter(f,fieldnames=list(rows[0]));w.writeheader();w.writerows(rows)
(ROOT/'results.json').write_text(json.dumps(dict(probes=len(rows),consumers=2,steps=6,failedNewAuthentication=failed,scope='Known consumers, immediate propagation, fresh authentication only. Existing sessions and real secret stores are not modeled.'),indent=2)+'\n')
print(json.dumps(failed))