from pathlib import Path
import json,sys
R=Path(__file__).resolve().parents[1]; checks=[]
def ck(n,v): checks.append((n,bool(v)))
b=json.loads((R/'fixture/baseline-system.json').read_text()); p=json.loads((R/'fixture/golden-policy.json').read_text()); cases=json.loads((R/'fixture/probe-cases.json').read_text())['cases']
ck('two assets',b['assets']==['DOCUMENT_CONTENT','DOCUMENT_METADATA']); ck('actors include owner', 'owner' in b['actors']); ck('actors include collaborator','collaborator' in b['actors']); ck('unauthenticated actor','unauthenticated' in b['actors']); ck('three entry points',len(b['entry_points'])==3); ck('baseline boundary exact',b['trust_boundaries']==[{'id':'TB-INTERNET-APP','from':'client','to':'application_service'}]); ck('storage baseline internal',b['components']['storage_adapter']['zone']=='APP_CONTROLLED'); ck('document authn',b['policy']['document_read_requires_authentication'] is True); ck('document authz',b['policy']['document_read_requires_owner_or_collaborator'] is True); ck('metadata authn',b['policy']['metadata_requires_authentication'] is True); ck('record field count',len(b['record_fields'])==11); ck('residual field','Residual Risk' in b['record_fields']); ck('owner decision field','Owner Decision Needed' in b['record_fields']); ck('six probes',len(cases)==6); ck('four forbidden',len(p['forbidden_conclusions'])==4); ck('fixture exists',(R/'src/threat_model_fixture.py').exists()); ck('runner exists',(R/'src/run_local_lab.py').exists()); ck('submission template',(R/'submission/decision.template.json').exists()); ck('transfer template',(R/'transfer/changed-context.template.json').exists()); ck('evidence template',(R/'evidence/Bounded_Threat_Model_Record_v1.template.json').exists())
for c in cases: ck('case class '+c['id'],bool(c['expected_class']))
for n,v in checks: print(('PASS' if v else 'FAIL'),n)
print(f'{sum(v for _,v in checks)}/{len(checks)} PASS'); sys.exit(0 if all(v for _,v in checks) else 1)