# step: forensic watermark sessions · wai-rs and live_watermark_verify.py
# order: 670
# features: live_watermark
# paths: wai/extensions/forensic-watermark.md
# independent: live-watermark live python3 -I live-conformance/live_watermark_verify.py live-conformance/watermark
#
# wai.live.watermark (extensions/forensic-watermark.md): the reference module's unit tests
# (the CBOR reader's deterministic-encoding rules, tokens of both COSE structures and
# every mode read and their rules refuse, a record's rules, big-endian bit addressing,
# the exact match and the binding) and tests/live_watermark.rs (vectors.json regenerates
# byte for byte from its fixed seeds and no other file is there, wai-rs gives every
# token, session list, match and disclosure its stated outcome, and §11 lists exactly the
# reference's codes, each of which the corpus gives); and, in the step of every
# independent verifier above, the corpus's second
# implementation, live_watermark_verify.py, written from the extension's text and sharing
# no code with wai-rs, which reads rooms with live_rooms_verify.py and tokens with a CBOR
# reader of its own, requires every mutated copy of the corpus to fail, and drops each of
# its own checks in turn and requires the corpus to catch the weakened verifier; standard
# library only, run isolated (-I).
#
# The paths this step brings to the workflow's trigger, and why:
# wai/extensions/forensic-watermark.md: tests/live_watermark.rs requires this extension's §11 to
#   list the codes the reference reports, live_watermark_verify.py reads that table, and the
#   registry's wire identifiers test reads its sections.
set -euo pipefail
(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib live_watermark::)
(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test live_watermark)