# step: age assurance · wai-rs and age_assurance_verify.py
# order: 520
# features: age_assurance
# paths: wai/extensions/age-assurance.md
# independent: age-assurance live python3 -I live-conformance/age_assurance_verify.py live-conformance/age
#
# wai.age.assurance (extensions/age-assurance.md): the reference module's unit tests (the
# pinned AlgorithmIdentifier and RFC 9578's first vector through this module, the
# TokenChallenge read exactly, the suppression floor, the grant attribute `age`, a span's
# coverage) and tests/age_assurance.rs (vectors.json regenerates byte for byte from its
# fixed seeds and no other file is there, wai-rs gives every case its stated outcome, and
# §11 lists exactly the reference's codes, each of which the corpus gives); and, in the
# step of every independent verifier above, the
# corpus's second implementation, age_assurance_verify.py, written from the extension's
# text and sharing no code with wai-rs, which reads every record, writes JCS and verifies
# every token's RSASSA-PSS itself, reads rooms with live_rooms_verify.py, checks signatures
# with WAI's strict Ed25519 rule and BLAKE3 from claim-conformance, reads the extension's
# reason table, requires every mutated copy of the corpus to fail, and drops each of its
# own checks in turn and requires the corpus to catch the weakened verifier; standard
# library only, run isolated (-I).
#
# The paths this step brings to the workflow's trigger, and why:
# wai/extensions/age-assurance.md: tests/age_assurance.rs requires this extension's §11 to list
#   the codes the reference reports, age_assurance_verify.py reads that table, and the registry's
#   wire identifiers test reads its sections.
set -euo pipefail
(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib age_assurance::)
(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test age_assurance)