"""cp-write-token/v1 context: env-only layer (WF-COMP-31c, AU-55b).

The per-step wfcw_ token is delivered by the dispatcher into the script
container only (Secret projection on K8s, create -> put_archive -> start on
Docker). The layer must therefore set the env contract and nothing else: no
ESO secret mount, no init script, no context files.
"""
from __future__ import annotations

from pathlib import Path

import yaml

_ROOT = Path(__file__).resolve().parents[2] / "harnesses"


def _load(kind_dir: str, name: str) -> dict:
    return yaml.safe_load((_ROOT / kind_dir / name / "v1" / "harness.yaml").read_text())


def test_cp_write_token_layer_sets_env_contract():
    doc = _load("contexts", "cp-write-token")
    assert doc["kind"] == "context"
    assert doc["name"] == "cp-write-token"
    assert doc["version"] == 1
    assert doc["env"] == {"CP_WRITE_TOKEN_FILE": "/run/agent/cp-write-token/token"}


def test_cp_write_token_layer_is_env_only():
    doc = _load("contexts", "cp-write-token")
    assert not doc.get("secrets_required"), "token is not an ESO mount (AU-55b)"
    assert not doc.get("scripts"), "no init script: the backend delivers the file"
    assert not doc.get("context_files")
    assert not doc.get("write_targets")
    assert doc.get("requires") == []
    assert doc.get("provides") == []
    assert not (_ROOT / "contexts" / "cp-write-token" / "v1" / "init.sh").exists()