#!/usr/bin/env python3
"""CI negative gates: prove unsafe inputs and deliberate faults fail closed."""
from __future__ import annotations

import os
import sys
import tempfile
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
sys.path.insert(0, str(ROOT / "hermes_overlay"))
sys.path.insert(0, str(ROOT / "scripts"))

from trading.config_validation import validate_configuration  # noqa: E402
from trading.futures_execution import is_execution_enabled  # noqa: E402
from ci_secret_scan import scan  # noqa: E402


def main() -> int:
    failures: list[str] = []
    if validate_configuration({"TRADING_MODE": "paper", "SYNC_INTERVAL": "0"}).safe:
        failures.append("zero sync interval did not fail")
    if validate_configuration({
        "TRADING_MODE": "live",
        "HERMES_EXECUTION_ENABLED": "true",
        "HERMES_NONPAPER_EXECUTION_ENABLED": "true",
        "FUTURES_API_KEY": "test-key-value-123456",
        "FUTURES_API_SECRET": "test-secret-value-123456",
    }).safe:
        failures.append("fully armed non-Paper config did not fail")
    previous = os.environ.pop("HERMES_EXECUTION_ENABLED", None)
    try:
        if is_execution_enabled():
            failures.append("execution kill switch did not default off")
    finally:
        if previous is not None:
            os.environ["HERMES_EXECUTION_ENABLED"] = previous
    with tempfile.TemporaryDirectory() as tmp:
        leak = Path(tmp) / "leak.txt"
        leak.write_text('api_key = "abcdefghijklmnopqrstuvwxyz123456"', encoding="utf-8")
        if not scan(Path(tmp), allow_fixtures=False):
            failures.append("secret fixture did not trigger scanner")
    for item in failures:
        print(f"ERROR: {item}")
    print(f"required_failure_checks={'PASS' if not failures else 'FAIL'}")
    return 1 if failures else 0


if __name__ == "__main__":
    raise SystemExit(main())