from __future__ import annotations

import hashlib
import json
from copy import deepcopy

PROTECTED = {"tenant_id", "policy_ref", "max_budget_usd"}

def canonical_json(value):
    return json.dumps(value, sort_keys=True, ensure_ascii=False,
                      separators=(",", ":"), allow_nan=False)

def digest(value):
    return hashlib.sha256(canonical_json(value).encode("utf-8")).hexdigest()

def resolve(base, overrides):
    result = deepcopy(base)
    for key, value in overrides.items():
        if key in PROTECTED and key in result and result[key] != value:
            raise PermissionError(f"protected configuration: {key}")
        if key not in result:
            raise ValueError(f"unknown configuration key: {key}")
        result[key] = deepcopy(value)
    return result

base = {
    "tenant_id": "studio-a",
    "policy_ref": "policy://execution@7",
    "max_budget_usd": 8.0,
    "model_profile": "balanced@4",
    "max_steps": 80,
}
resolved = resolve(base, {"model_profile": "quality@5"})
assert resolved["max_steps"] == 80
assert digest(resolved) == digest(resolve(base, {"model_profile": "quality@5"}))
try:
    resolve(base, {"max_budget_usd": 100.0})
except PermissionError:
    pass
else:
    raise AssertionError("budget override should be rejected")
print("local configuration checks passed")