#!/usr/bin/env python3
# SPDX-License-Identifier: GPL-3.0-or-later
"""Tracked fail-closed guardrails for Phase-1.0AZ."""

from __future__ import annotations

import argparse
import json
from pathlib import Path
import unittest


PARSER = argparse.ArgumentParser()
PARSER.add_argument("--root", type=Path, required=True)
ROOT = PARSER.parse_args().root


class Phase10AZGuardrails(unittest.TestCase):
    @classmethod
    def setUpClass(cls) -> None:
        path = ROOT / "manifests/retroarch/phase-1.0az-host-av-source.json"
        cls.data = json.loads(path.read_text(encoding="utf-8"))

    def test_terminal_contract_is_strict(self) -> None:
        protocol = self.data["protocol"]
        self.assertEqual(protocol["magic"], "CHD10AV1")
        self.assertEqual(protocol["d14_numeric_stage"], 30)
        self.assertFalse(protocol["d12_terminal"])
        for key, value in protocol.items():
            if key not in ("magic", "d14_numeric_stage", "d12_terminal"):
                self.assertTrue(value, key)

    def test_scope_remains_host_only(self) -> None:
        self.assertTrue(self.data["decision"]["host_source_structure_complete"])
        self.assertFalse(any(self.data["scope"].values()))
        self.assertFalse(any(self.data["authorizations"].values()))

    def test_remote_and_next_gate_remain_closed(self) -> None:
        self.assertTrue(self.data["source_bindings"]["remote_push_verified"])
        decision = self.data["decision"]
        self.assertTrue(decision["remote_source_binding_complete"])
        self.assertTrue(decision["target_profile_reassessment_allowed"])
        self.assertFalse(decision["target_artifact_build_allowed"])
        self.assertFalse(decision["device_action_allowed"])


if __name__ == "__main__":
    unittest.main(argv=[__file__])