import ast,json,pathlib,sys
LAB=pathlib.Path(__file__).resolve().parents[1]; checks=[]
def c(n,x): checks.append((n,bool(x)))
req=json.loads((LAB/'requirements.json').read_text()); tool=json.loads((LAB/'toolchain-policy.json').read_text()); pol=json.loads((LAB/'fixture/golden-policy.json').read_text())
for k in ['real_key_material_forbidden','custom_crypto_forbidden','external_target_forbidden','network_forbidden','external_key_manager_forbidden','production_proof_forbidden']: c('req_'+k,req.get(k) is True)
c('tool_local',tool.get('local_only') is True); c('tool_network',tool.get('network_forbidden') is True); c('tool_external',tool.get('external_target_forbidden') is True); c('tool_realkey',tool.get('real_key_material_forbidden') is True); c('tool_customcrypto',tool.get('custom_crypto_forbidden') is True); c('tool_external_km',tool.get('external_key_manager_forbidden') is True); c('tool_prod',tool.get('production_proof') is False)
c('policy_local',pol.get('local_only') is True); c('policy_prod_false',pol.get('production_proof') is False); c('policy_realkey_false',pol.get('real_key_material') is False); c('policy_customcrypto_false',pol.get('custom_crypto') is False); c('contexts_exact',set(pol.get('contexts',{}))=={'primary_database','backup_archive'}); c('universal_false',pol['rotation']['universal_cryptoperiod'] is False)
for f in [LAB/'src/key_boundary.py',LAB/'src/run_local_lab.py']:
 tree=ast.parse(f.read_text()); imports={n.names[0].name.split('.')[0] for n in ast.walk(tree) if isinstance(n,ast.Import)} | {n.module.split('.')[0] for n in ast.walk(tree) if isinstance(n,ast.ImportFrom) and n.module}; c('no_network_'+f.name,not imports.intersection({'requests','socket','httpx','aiohttp','urllib','boto3','openai','anthropic','cryptography','Crypto'})); c('no_shell_'+f.name,'subprocess' not in imports)
c('transfer_blank',json.loads((LAB/'transfer/changed-context.template.json').read_text())['final_decision']==''); c('owner_blank',json.loads((LAB/'submission/decision.template.json').read_text())['owner_acceptance']=='')
for n,ok in checks: print(('PASS' if ok else 'FAIL'),n)
print(f'SUMMARY {sum(ok for _,ok in checks)}/{len(checks)} PASS'); raise SystemExit(0 if all(ok for _,ok in checks) else 1)