"""13S isolation witnesses. These tests do not provision Cloudflare resources."""

from pathlib import Path

from scripts.phase13s_isolation_gate import (
    cloud_isolated_from_production,
    dash_worker_is_scoped,
    inspect,
    phase13_is_not_an_auto_deploy_branch,
    production_deploy_is_main_only,
)

ROOT = Path(__file__).resolve().parents[1]


def test_core_production_deploy_stays_on_main():
    text = (ROOT / ".github/workflows/deploy.yml").read_text(encoding="utf-8")
    assert production_deploy_is_main_only(text)
    assert phase13_is_not_an_auto_deploy_branch(text)
    assert "EC2_HOST }}" in text
    assert "EC2_HOST_stag" in text


def test_phase13_cloud_and_dash_are_not_production_workers():
    result = inspect()
    assert result["cloud_isolated_from_production"] is True
    assert result["dash_worker_is_scoped"] is True
    assert cloud_isolated_from_production() is True
    assert dash_worker_is_scoped() is True
    assert result["cloud_resources_provisioned"] is False


def test_13s_does_not_authorize_13b_or_production():
    audit = (ROOT / "docs/audits/STAGING_RELEASE_BASELINE_13S.md").read_text(encoding="utf-8")
    assert "phase_13b_authorized=no" in audit
    assert "production_deployment_authorized=no" in audit
    assert "architecture_frozen=yes" in audit