import pathlib, re, sys, ast, json
ROOT=pathlib.Path(__file__).resolve().parents[2]
checks=[]
def c(n,x): checks.append((n,bool(x)))
py=[p for p in ROOT.rglob('*.py') if p.name not in {'static_preflight.py','static_preflight_q1.py'}]
forbidden={'requests','socket','paramiko','selenium','httpx','aiohttp','ftplib','telnetlib'}
seen=set()
for p in py:
    try: tree=ast.parse(p.read_text())
    except Exception: continue
    for node in ast.walk(tree):
        if isinstance(node,ast.Import):
            for n in node.names: seen.add(n.name.split('.')[0])
        elif isinstance(node,ast.ImportFrom) and node.module: seen.add(node.module.split('.')[0])
for m in sorted(forbidden): c('forbidden_import_'+m,m not in seen)
runtime='\n'.join(p.read_text(errors='ignore') for p in py)
c('no_network_calls',all(x not in runtime for x in ['urlopen(','requests.','socket.','httpx.','aiohttp.']))
req=json.loads((ROOT/'learner/requirements.json').read_text())
c('network_forbidden',req['network']=='forbidden')
c('real_credentials_forbidden',req['real_credentials']=='forbidden')
c('external_targets_forbidden',req['external_targets']=='forbidden')
c('hostile_payloads_forbidden',req['hostile_payloads']=='forbidden')
alltxt='\n'.join(p.read_text(errors='ignore') for p in ROOT.rglob('*') if p.is_file() and p.suffix in {'.py','.json','.md'})
c('synthetic_fixture','SEC006-SYNTHETIC-BROWSER-1' in alltxt)
c('csrf_negative','DENY_MISSING_CSRF' in alltxt)
c('cors_separate','cors_is_authorization' in alltxt)
c('csp_defense_in_depth','csp_is_primary_xss_defense' in alltxt)
c('evidence_template',(ROOT/'learner/evidence/Browser_Request_Boundary_Control_Record_v1.template.json').exists())
c('transfer_template',(ROOT/'learner/transfer/changed-context.template.json').exists())
for n,ok in checks: print(('PASS' if ok else 'FAIL'),n)
print(f'SUMMARY {sum(x[1] for x in checks)}/{len(checks)} PASS')
raise SystemExit(0 if all(x[1] for x in checks) else 1)