from pathlib import Path
import ast

ROOT = Path(__file__).resolve().parents[1]


def test_r7_amendment_module_is_valid_and_fail_closed():
    text = (
        ROOT
        / "active-runtime/app/aios_task_deterministic_execution_amendment.py"
    ).read_text()
    ast.parse(text)
    assert "validate_execution_envelope" in text
    assert "SIGNED_EXECUTION_AMENDMENT_REQUIRED" in text
    assert "BEFORE UPDATE OF status ON tasks" in text
    assert "APPLY_STATES" in text
    assert '"FAILED"' in text and '"QUEUED"' in text
    assert "AMENDMENT_EXECUTION_OPERATIONS_REQUIRED" in text
    assert "AMENDMENT_PROTECTED_WRITE_FORBIDDEN" in text


def test_bridge_unit_keeps_strict_sandbox_and_required_projection():
    text = (
        ROOT
        / "deploy/systemd/aios-chatgpt-bridge-v2-staging.service"
    ).read_text()
    assert "ProtectSystem=strict" in text
    assert "ProtectHome=true" in text
    assert (
        "LoadCredential=gitea_token:"
    ) in text
    assert "/data/aios-gitops/repo.git/worktrees" in text