import pathlib,ast,re
ROOT=pathlib.Path(__file__).resolve().parents[1]; checks=[]
def c(n,x): checks.append((n,bool(x)))
src=(ROOT/'src/upload_boundary.py').read_text(); tree=ast.parse(src)
imports={n.names[0].name for n in ast.walk(tree) if isinstance(n,(ast.Import,))} | {n.module for n in ast.walk(tree) if isinstance(n,ast.ImportFrom) and n.module}
for bad in ['requests','socket','httpx','aiohttp','openai','anthropic','subprocess']:
 c('no_import_'+bad,bad not in imports)
for token in ['DENY_UNAUTHORIZED_UPLOADER','DENY_EXTENSION_NOT_ALLOWED','DENY_SIZE_LIMIT','DENY_TYPE_EVIDENCE_MISMATCH','DENY_STORAGE_IDENTITY_MISSING','DENY_PUBLIC_RAW_STORAGE','DENY_REQUIRED_GATE_MISSING','PROMOTE_APPROVED_REPRESENTATION']:
 c('decision_'+token,token in src)
c('quarantine_state','QUARANTINED' in src); c('promoted_state','PROMOTED' in src); c('record_fields','REQUIRED_RECORD_FIELDS' in src); c('no_eval','eval(' not in src); c('no_exec','exec(' not in src); c('no_absolute_tmp','/etc/' not in src and 'C:\\' not in src)
for n,ok in checks: print(('PASS' if ok else 'FAIL'),n)
print(f'SUMMARY {sum(x[1] for x in checks)}/{len(checks)} PASS'); raise SystemExit(0 if all(x[1] for x in checks) else 1)