import ast,json,pathlib,sys
LAB=pathlib.Path(__file__).resolve().parents[1]; checks=[]
def c(n,x): checks.append((n,bool(x)))
req=json.loads((LAB/'requirements.json').read_text()); tool=json.loads((LAB/'toolchain-policy.json').read_text()); pol=json.loads((LAB/'fixture/golden-policy.json').read_text())
for k in ['real_certificates_forbidden','real_private_keys_forbidden','external_target_forbidden','network_forbidden','external_identity_plane_forbidden','production_proof_forbidden']: c('req_'+k,req.get(k) is True)
c('tool_local',tool.get('local_only') is True); c('tool_network',tool.get('network_forbidden') is True); c('tool_external',tool.get('external_target_forbidden') is True); c('tool_realcert',tool.get('real_certificates_forbidden') is True); c('tool_realkey',tool.get('real_private_keys_forbidden') is True); c('tool_identity_plane',tool.get('external_identity_plane_forbidden') is True); c('tool_prod',tool.get('production_proof') is False)
c('policy_local',pol.get('local_only') is True); c('policy_prod_false',pol.get('production_proof') is False); c('policy_realcert_false',pol.get('real_certificates') is False); c('policy_realkey_false',pol.get('real_private_keys') is False); c('policy_external_identity_false',pol.get('external_identity_plane') is False); c('policy_network_false',pol.get('network') is False); c('tls_current',pol.get('current_tls_spec')=='RFC9846'); c('rfc8446_obsolete','RFC8446' in pol.get('obsolete_tls13_specs',[])); c('contexts_exact',set(pol.get('contexts',{}))=={'internal_api','admin_endpoint'}); c('authn_not_authz',pol['authorization']['authentication_is_not_authorization'] is True); c('wildcard_forbidden',pol['authorization']['wildcard_actions_forbidden'] is True)
for f in [LAB/'src/identity_boundary.py',LAB/'src/run_local_lab.py']:
 tree=ast.parse(f.read_text()); imports={n.names[0].name.split('.')[0] for n in ast.walk(tree) if isinstance(n,ast.Import)} | {n.module.split('.')[0] for n in ast.walk(tree) if isinstance(n,ast.ImportFrom) and n.module}; c('no_network_'+f.name,not imports.intersection({'requests','socket','httpx','aiohttp','urllib','boto3','openai','anthropic','ssl','cryptography','Crypto'})); c('no_shell_'+f.name,'subprocess' not in imports)
c('transfer_blank',json.loads((LAB/'transfer/changed-context.template.json').read_text())['final_decision']==''); c('owner_blank',json.loads((LAB/'submission/decision.template.json').read_text())['owner_acceptance']=='')
for n,ok in checks: print(('PASS' if ok else 'FAIL'),n)
print(f'SUMMARY {sum(ok for _,ok in checks)}/{len(checks)} PASS'); raise SystemExit(0 if all(ok for _,ok in checks) else 1)