import pathlib,json,sys,copy
LAB=pathlib.Path(__file__).resolve().parents[1]; sys.path.insert(0,str(LAB/'src'))
from update_trust_model import *
policy=json.loads((LAB/'fixture/trust-policy.json').read_text()); repo=json.loads((LAB/'fixture/baseline-repository.json').read_text()); checks=[]
def c(n,x): checks.append((n,bool(x)))
c('core_accept',verify_target('core/app-2.4.0.txt','targets',repo,policy)['decision']=='ACCEPT_TARGET')
c('plugin_accept',verify_target('plugins/widget-2.1.txt','plugins-team',repo,policy)['decision']=='ACCEPT_TARGET')
r=copy.deepcopy(repo); r['metadata']['snapshot']['version']=11; c('rollback',verify_target('core/app-2.4.0.txt','targets',r,policy)['decision']=='DENY_ROLLBACK_SNAPSHOT')
r=copy.deepcopy(repo); r['metadata']['timestamp']['expires']='2026-09-01T00:00:00Z'; c('expired',verify_target('core/app-2.4.0.txt','targets',r,policy)['decision']=='DENY_TIMESTAMP_EXPIRED')
r=copy.deepcopy(repo); x=r['metadata']['plugins-team']['targets'].pop('plugins/widget-2.1.txt'); r['metadata']['plugins-team']['targets']['core/widget-2.1.txt']=x; r['targets']['core/widget-2.1.txt']=r['targets'].pop('plugins/widget-2.1.txt'); c('delegation',verify_target('core/widget-2.1.txt','plugins-team',r,policy)['decision']=='DENY_DELEGATION_SCOPE')
row=build_evidence_row('core/app-2.4.0.txt','targets',repo,policy); c('row_complete',evidence_row_complete(row)); bad=dict(row); bad['expiry']=''; c('row_missing',not evidence_row_complete(bad)); extra=dict(row); extra['extra']='x'; c('row_extra',not evidence_row_complete(extra)); c('transfer',classify_transfer()['reuse_first_namespace'] is False); c('prod_false',policy['production_proof'] is False); c('network_false',policy['network'] is False)
for n,ok in checks: print(('PASS' if ok else 'FAIL'),n)
print(f'SUMMARY {sum(ok for _,ok in checks)}/{len(checks)} PASS'); raise SystemExit(0 if all(ok for _,ok in checks) else 1)