import pathlib,json,ast,sys
ROOT=pathlib.Path(__file__).resolve().parents[1]; checks=[]
def c(n,x): checks.append((n,bool(x)))
policy=json.loads((ROOT/'fixture/golden-policy.json').read_text()); tool=json.loads((ROOT/'toolchain-policy.json').read_text()); src=(ROOT/'src/secret_scope.py').read_text(); tree=ast.parse(src)
c('local_only',tool['local_only'] is True); c('network_forbidden',tool['network_forbidden'] is True); c('external_manager_forbidden',tool['external_secret_manager_forbidden'] is True); c('real_credentials_forbidden',tool['real_credentials_forbidden'] is True); c('secret_values_forbidden',tool['secret_values_forbidden'] is True)
imports={n.names[0].name.split('.')[0] for n in ast.walk(tree) if isinstance(n,ast.Import)} | {n.module.split('.')[0] for n in ast.walk(tree) if isinstance(n,ast.ImportFrom) and n.module}
for bad in ['requests','socket','httpx','aiohttp','boto3','hvac','openai','anthropic','subprocess']:
    c('no_'+bad,bad not in imports)
c('wildcard_forbidden',policy['wildcard_secret_access_forbidden'] is True); c('evidence_secret_forbidden',policy['secret_values_in_evidence_forbidden'] is True); c('audit_plaintext_forbidden',policy['audit_plaintext_forbidden'] is True); c('production_false',policy['production_proof'] is False); c('rotation_requires_revoke',policy['rotation_requires']['old_revoked'] is True); c('rotation_requires_consumers',policy['rotation_requires']['consumers_updated'] is True); c('three_identities',len(policy['identity_access'])==3); c('no_secret_values_in_policy',all(k not in json.dumps(policy).lower() for k in ['actual_password','real_token','secret_value":"'])); c('source_file_exists',(ROOT/'src/secret_scope.py').is_file()); c('transfer_blank',json.loads((ROOT/'transfer/changed-context.template.json').read_text())['final_decision']=='')
for n,ok in checks: print(('PASS' if ok else 'FAIL'),n)
print(f'SUMMARY {sum(ok for _,ok in checks)}/{len(checks)} PASS'); raise SystemExit(0 if all(ok for _,ok in checks) else 1)