#!/usr/bin/env python3
# SPDX-License-Identifier: GPL-3.0-or-later
import argparse,hashlib,json,unittest
from pathlib import Path
parser=argparse.ArgumentParser();parser.add_argument("--root",type=Path,required=True);root=parser.parse_args().root
class Phase10CXGuardrails(unittest.TestCase):
 @classmethod
 def setUpClass(cls):cls.data=json.loads((root/"manifests/retroarch/phase-1.0cx-isolated-reproducibility-build-gate.json").read_text())
 def test_gate(self):
  p=root/"manifests/retroarch/phase-1.0cw-launch-canary-artifact-audit.json";self.assertEqual(hashlib.sha256(p.read_bytes()).hexdigest(),self.data["source_bindings"]["phase10cw_manifest_sha256"])
  i=self.data["isolation"];self.assertTrue(i["mounted_stage_absent"] and i["native_root_absent"] and i["source_commit_exact"]);self.assertFalse(i["current_objects_reused"])
  o=self.data["one_shot"];self.assertEqual(o["attempts_authorized"],1);self.assertFalse(o["automatic_retry"] or o["cleanup_authorized"])
  a=self.data["authorizations"]
  for k in ("artifact_execution_eligible","artifact_transfer_eligible","artifact_installation_eligible","network_access_authorized","ps5_connection_authorized","device_transfer_authorized","device_execution_authorized"):self.assertFalse(a[k],k)
if __name__=="__main__":unittest.main(argv=[__file__])