import pathlib,json,ast
ROOT=pathlib.Path(__file__).resolve().parents[1]; checks=[]
def c(n,x): checks.append((n,bool(x)))
req=json.loads((ROOT/'requirements.json').read_text()); c('network_forbidden',req['network']=='forbidden'); c('external_targets_forbidden',req['external_targets']=='forbidden'); c('real_credentials_forbidden',req['real_credentials']=='forbidden'); c('hostile_payloads_forbidden',req['hostile_payloads']=='forbidden'); c('database_forbidden',req['database_connection']=='forbidden'); c('synthetic_only',req['fixture']=='synthetic_local_only')
files=[ROOT/'src/injection_boundary.py',ROOT/'src/run_local_lab.py',ROOT/'test/public-contract.test.py']; tree='\n'.join(p.read_text() for p in files)
for token in ['requests','httpx','aiohttp','socket','urllib.request','subprocess','paramiko','selenium']:
    c('deny_import_'+token, token not in tree)
fx=(ROOT/'fixture/baseline-injection.json').read_text(); c('fixture_marker','SEC007-SYNTHETIC-INJECTION-1' in fx); c('no_external_url','http://' not in fx and 'https://' not in fx); c('no_script_tag','<script' not in fx.lower()); c('no_sql_comment','--' not in fx); c('no_union_token',' union ' not in fx.lower()); c('no_live_db_uri','postgres://' not in fx and 'mysql://' not in fx); c('record_template',(ROOT/'evidence/Injection_Defense_Boundary_Matrix_v1.template.json').exists())
for n,ok in checks: print(('PASS' if ok else 'FAIL'),n)
print(f'SUMMARY {sum(x[1] for x in checks)}/{len(checks)} PASS'); raise SystemExit(0 if all(x[1] for x in checks) else 1)