"""Synthetic sandbox routing policy demonstration. No I/O beyond stdout.
Run: python3 routes.py > results.json
Not a vendor API test or a production security control.
"""
import json

manifest = {"host": "receiver.sandbox.example", "tenant": "test-tenant",
            "generation": "refresh-2026-10-29", "receiver": "crm-qa",
            "record_namespace": "sandbox"}
base = {**manifest, "credential_valid": True}
cases = [("approved sandbox", {}),
         ("production endpoint", {"host": "receiver.production.example"}),
         ("production tenant", {"tenant": "live-tenant"}),
         ("stale refresh generation", {"generation": "refresh-2026-10-01"}),
         ("unapproved receiver", {"receiver": "customer-notifications"}),
         ("production record namespace", {"record_namespace": "production"})]
results = []
for name, changes in cases:
    route = {**base, **changes}
    failures = [key for key, value in manifest.items() if route[key] != value]
    results.append({"case": name, "route": route,
                    "credential_only_accepts": route["credential_valid"],
                    "manifest_accepts": route["credential_valid"] and not failures,
                    "mismatched_fields": failures})
output = {"method": "synthetic exact-match routing policy; no network calls",
          "run_date": "2026-10-29", "manifest": manifest, "cases": results,
          "totals": {"cases": len(results),
                     "credential_only_accepted": sum(r["credential_only_accepts"] for r in results),
                     "manifest_accepted": sum(r["manifest_accepts"] for r in results),
                     "manifest_rejected": sum(not r["manifest_accepts"] for r in results)}}
print(json.dumps(output, indent=2))