import os, json, urllib.request

URL = os.environ["REDMINE_URL"]
KEY = os.environ["REDMINE_API_KEY"]

i = json.load(urllib.request.urlopen(urllib.request.Request(
    URL + "/issues/517.json", headers={"X-Redmine-API-Key": KEY}), timeout=15))["issue"]

marker = "## Scope"
extra = """## Scope

**Per-task, per-turn awareness (Charles, 2026-08-29 ~09:20 — hard requirement):** the acting Cloudron account is selected PER TASK and applies to every action of that task's turns:
- Task-level source: Redmine custom field (configurable name, e.g. "cloudron-account") with fallback to a per-instance default acting identity.
- Turn-level: the conductor resolves the acting identity at turn start; ALL outbound actions in that turn (Redmine writeback, Discourse posts, Gitea calls, integrations) authenticate as that identity via its keyproxy refs from the per-Linux-account BW vault (#497 final model).
- Attribution: REPORT header + loop JSONL record acting identity per turn; usage accounting (from #490) aggregates per acting identity AND per Linux account.

Original scope follows:
"""
desc = i["description"].replace(marker, extra, 1)
body = json.dumps({"issue": {"description": desc,
    "notes": "Hard requirement added: acting cloudron identity is chosen per task (Redmine custom field + fallback) and stamped on every action of its turns; attribution + usage roll up per acting identity."}}).encode()
req = urllib.request.Request(URL + "/issues/517.json", data=body,
    headers={"X-Redmine-API-Key": KEY, "Content-Type": "application/json"}, method="PUT")
urllib.request.urlopen(req, timeout=15)
print("517 per-task/per-turn requirement recorded")