# step: key release · wai-rs and key_release_verify.py
# order: 240
# features: key_release
# paths: wai/extensions/key-release.md
# independent: key-release live python3 -I live-conformance/key_release_verify.py live-conformance/keys
#
# The proxy form of wai.video.keys (extensions/key-release.md): the reference module's unit
# tests (the commitment list, the entitlement and the ticket round-trip and their rules
# refuse, each check of the decision in its order, offline licences and renewals, each own
# rule of the receipt, its strict signature, the CPIX reader and the derivation of a list
# from a CPIX document), form 1's unit tests (its legacy pin unchanged), and
# tests/key_release.rs (every file of the committed corpus regenerates byte for byte from
# its fixed seeds and no other file is there, every log gets its stated outcome, and the
# extension's tables are the reference's codes); and, in the step of every independent
# verifier above, the corpus's second implementation,
# key_release_verify.py, written from the extension's text and sharing no code with wai-rs,
# which reads the extension's tables, derives every list from its CPIX document with the
# standard library's XML parser, recomputes every decision of every log, verifies every
# signature with WAI's strict Ed25519 rule and BLAKE3 from claim-conformance, and requires
# every mutated copy of the corpus to fail; standard library only, run isolated (-I).
#
# The paths this step brings to the workflow's trigger, and why:
# wai/extensions/key-release.md: tests/key_release.rs requires this extension's §3.1, §3.2, §7.2
#   and §11 tables to be the reference's codes, key_release_verify.py reads those tables and §3.3,
#   and the registry's wire identifiers test reads its sections.
set -euo pipefail
(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib key_release::)
(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib wai_video_keys::)
(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test key_release)