
trusted := "tools/gh/trusted"
prove := "uv run clauz3 prove --trusted-root " + trusted
# Proves each case in one process: *_pass.py must prove, *_fail.py must not.
prove-cases := "uv run python -m clauz3._prove_cases --trusted-root " + trusted

test: lint cases

lint:
    uv run clauz3 lint {{trusted}}/effects.py

# triage_trusted_pass.py:
#   Legit triage: download only member-posted release assets. Proves.
# injected_link_fail.py:
#   Injected literal URL is not a queried comment's column: proof fails.
# untrusted_author_fail.py:
#   URLs do come from comments, but the query wasn't members-only: proof fails.
# smuggled_download_fail.py:
#   One extra download not sourced from any comment: proof fails.
cases:
    {{prove-cases}} cases/*_pass.py cases/*_fail.py
