#!/usr/bin/env python3
"""Read the two retained preflight reports that compare_bearer_roles.sh wrote."""
import json, sys
from pathlib import Path
root = Path(sys.argv[1])
reports = {}
for name in ("distinct", "reused"):
    result = json.loads((root / f"{name}.json").read_text())
    reports[name] = next(item for item in result["reports"]
                         if item["probe"] == "security.bearer_roles")
assert reports["distinct"]["severity"] == "ok"
assert reports["distinct"]["message"] == "4 bearer roles are usable and distinct"
assert reports["reused"]["severity"] == "error"
assert "session and admin credentials share one value" in reports["reused"]["message"]
assert (root / "reused.exit").read_text().strip() == "1"
print("OK role probe: four distinct dummy roles")
print("REFUSE role probe: reused session/admin value, exit 1")
print("OTHER PROBES retained separately; no launch, store or physical readiness claim")