"""Mandatory C132 pre/post gate for reviewed deployment helpers; no deployment or service control."""
from pathlib import Path
import subprocess, tempfile, json, os

def assert_diagnostics_off(root, candidate_inertia=None, payload=None):
    root=Path(root).resolve()
    php=os.environ.get('INVESTMOZ_DEPLOY_PHP','C:/laragon/bin/php/php-8.5.11-Win32-vs17-x64/php.exe')
    args=[php,str(root/'tools/portal-diagnostics-deployment-guard.php'),'--root',str(root)]
    temp=None
    try:
        if payload is not None and 'config/inertia.php' in payload:
            # Only verified configuration bytes are written to a transient guard input. No secrets or destination changes.
            with tempfile.NamedTemporaryFile(suffix='.php',delete=False) as f:
                f.write(payload['config/inertia.php']);temp=Path(f.name)
            candidate_inertia=temp
        if candidate_inertia is not None:args+=['--candidate-inertia',str(candidate_inertia)]
        r=subprocess.run(args,capture_output=True,text=True)
        if r.returncode!=0:raise RuntimeError('C132 deployment blocked: diagnostics OFF could not be verified')
        proof=json.loads(r.stdout)
        if proof['result']!='passed':raise RuntimeError('C132 diagnostics guard failed')
        return proof
    finally:
        if temp is not None:temp.unlink()