from pathlib import Path
import subprocess,sys,json,os,re
R=Path(__file__).resolve().parents[1]; q1=R/'src/static_preflight_q1.py'
cp=subprocess.run([sys.executable,str(q1)],cwd=R,text=True,capture_output=True,env={**os.environ,'PYTHONDONTWRITEBYTECODE':'1'}); print(cp.stdout,end='')
m=re.findall(r'SUMMARY\s+(\d+)/(\d+)\s+PASS',cp.stdout); bp,bt=(map(int,m[-1]) if m else (0,1)); checks=[]
def ck(n,v): checks.append((n,bool(v)))
g=json.loads((R/'fixture/golden-policy.json').read_text()); b=json.loads((R/'fixture/baseline-mfa.json').read_text()); p=json.loads((R/'fixture/probe-cases.json').read_text()); req=json.loads((R/'requirements.json').read_text()); tr=json.loads((R/'transfer/changed-context.template.json').read_text()); et=json.loads((R/'evidence/MFA_Recovery_Control_Record_v1.template.json').read_text())
ck('golden window bounded',g.get('verification_window')==1); ck('golden attempts bounded',g.get('max_attempts')==3); ck('golden replay on',g.get('totp_replay_protection') is True); ck('golden recovery single use',g.get('recovery_single_use') is True); ck('golden digest only',g.get('recovery_digest_only') is True); ck('golden regen revokes',g.get('regeneration_revokes_old_set') is True); ck('golden raw logging off',g.get('raw_secret_logging') is False)
ck('baseline synthetic',b.get('synthetic_only') is True and b.get('real_credentials') is False); ck('baseline sha1',b.get('totp',{}).get('algorithm')=='SHA1'); ck('baseline policy align',b.get('totp',{}).get('verification_window')==g.get('verification_window') and b.get('totp',{}).get('max_attempts')==g.get('max_attempts') and b.get('totp',{}).get('time_step')==g.get('time_step') and b.get('totp',{}).get('digits')==g.get('digits')); ck('baseline single use',b.get('recovery',{}).get('single_use') is True); ck('reuse probe rejects',any(x.get('id')=='RECOVERY_REUSE' and x.get('expect')=='RECOVERY_CODE_REUSED_OR_INVALID' for x in p.get('probes',[]))); ck('requirements local',req.get('network')=='forbidden' and req.get('external_targets')=='forbidden' and req.get('real_credentials')=='forbidden' and req.get('external_dependencies')==[]); ck('transfer non equivalence',tr.get('factor_equivalence_claimed') is False); ck('learner template blank',all(v=='' for v in et.get('rows',[{}])[0].values()))
for n,v in checks: print(('PASS' if v else 'FAIL'),n)
p=bp+sum(v for _,v in checks);t=bt+len(checks);print(f'SUMMARY {p}/{t} PASS');sys.exit(0 if cp.returncode==0 and p==t else 1)