plugin-scanner 2.0.830__tar.gz → 2.0.831__tar.gz

{plugin_scanner-2.0.830 → plugin_scanner-2.0.831}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.830
+Version: 2.0.831
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.830 → plugin_scanner-2.0.831}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.830"
+version = "2.0.831"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.830 → plugin_scanner-2.0.831}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.830"
+version = "2.0.831"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.830 → plugin_scanner-2.0.831}/src/codex_plugin_scanner/guard/cli/commands_dispatch_trust.py

@@ -13,8 +13,9 @@ from ..adapters.base import HarnessContext
 from ..config import GuardConfig
 from ..daemon.manager import _guard_daemon_url_port, load_guard_daemon_url, read_approval_center_locator
 from ..local_trust_contract import TrustStatus
+from ..local_trust_controller import macos_native_backend_supported, resolve_passive_trust_state
 from ..policy_integrity import is_remote_policy_source
-from ..store import GuardStore, SystemKeyringSecretStore
+from ..store import GuardStore
 from .commands_support_interaction import _emit
 
 
@@ -30,49 +31,9 @@ def _require_guard_store(store: GuardStore | None) -> GuardStore:
     return _shared_require_guard_store(store)
 
 
-def _degraded_safe_trust_status() -> dict[str, object]:
-    return TrustStatus(
-        runtime_protection="degraded",
-        remembered_rules="disabled_degraded",
-        cloud_policies="setup_unavailable",
-        backend="degraded-safe",
-        setup_available=False,
-    ).to_dict()
-
-
-def _unsupported_backend_payload(*, command: str, backend: str) -> dict[str, object]:
-    return {
-        "generated_at": _now(),
-        "command": command,
-        "backend_requested": backend,
-        "backend": backend,
-        "runtime_protection": "degraded",
-        "remembered_rules": "disabled_degraded",
-        "cloud_policies": "setup_unavailable",
-        "degraded_reasons": ["trust_backend_unavailable"],
-        "degraded_reason_labels": {"trust_backend_unavailable": "Local trust backend unavailable"},
-        "setup_available": backend == "macos-native",
-        "no_ui_passive": True,
-        "passive_prompt_allowed": False,
-        "one_time_approvals": "available",
-        "durable_local_rules": "limited",
-        "cloud_policy_status": "setup_unavailable",
-        "error": (
-            f"Backend {backend!r} is not available for passive {command}. "
-            "Guard will not probe it in the background because that could open an OS credential prompt."
-        ),
-        "next_action": "Use --backend auto or run an explicit setup command when a backend is available.",
-    }
-
-
 def _trust_status_payload(store: GuardStore, *, command: str, backend: str) -> dict[str, object]:
-    if backend == "degraded-safe":
-        trust_status = _degraded_safe_trust_status()
-    else:
-        status_payload = store.get_policy_integrity_status()
-        trust_status = status_payload.get("trust_status")
-        if not isinstance(trust_status, dict):
-            trust_status = TrustStatus.from_policy_integrity_state(status_payload).to_dict()
+    resolved = resolve_passive_trust_state(store, backend_requested=backend)
+    trust_status = resolved.trust_status.to_dict()
     degraded_reasons = trust_status.get("degraded_reasons")
     reasons = (
         [reason for reason in degraded_reasons if isinstance(reason, str)] if isinstance(degraded_reasons, list) else []
@@ -80,11 +41,31 @@ def _trust_status_payload(store: GuardStore, *, command: str, backend: str) -> d
     runtime_protection = str(trust_status.get("runtime_protection") or "unknown")
     remembered_rules = str(trust_status.get("remembered_rules") or "unknown")
     cloud_policies = str(trust_status.get("cloud_policies") or "unknown")
+    actual_backend = trust_status.get("backend")
+    backend_name = (
+        str(actual_backend)
+        if isinstance(actual_backend, str) and actual_backend and actual_backend != "unknown"
+        else resolved.backend_selected
+    )
+    mode = resolved.mode
+    if mode == "unsupported":
+        message = "This local trust backend is unsupported on this platform. Runtime blocking stays active."
+    elif mode == "setup_required":
+        message = "Local trust setup is available. Broad remembered local rules stay limited until you finish it."
+    elif remembered_rules != "enforced":
+        message = (
+            "Guard is blocking risky actions. Broad remembered local rules are limited until local trust is protected."
+        )
+    else:
+        message = "Guard local trust is protected. Remembered local rules are enforced."
     return {
         "generated_at": _now(),
         "command": command,
-        "backend_requested": backend,
-        "backend": trust_status.get("backend") or "unknown",
+        "mode": mode,
+        "backend_requested": resolved.backend_requested,
+        "backend_selected": resolved.backend_selected,
+        "backend_supported": resolved.backend_supported,
+        "backend": backend_name or "unknown",
         "runtime_protection": runtime_protection,
         "remembered_rules": remembered_rules,
         "cloud_policies": cloud_policies,
@@ -96,11 +77,7 @@ def _trust_status_payload(store: GuardStore, *, command: str, backend: str) -> d
         "one_time_approvals": "available",
         "durable_local_rules": "enforced" if remembered_rules == "enforced" else "limited",
         "cloud_policy_status": cloud_policies,
-        "message": (
-            "Guard is blocking risky actions. Broad remembered local rules are limited until local trust is protected."
-            if remembered_rules != "enforced"
-            else "Guard local trust is protected. Remembered local rules are enforced."
-        ),
+        "message": message,
     }
 
 
@@ -303,15 +280,6 @@ def build_trust_explain_payload(store: GuardStore, *, rule_id: int, backend: str
     }
 
 
-def _macos_native_backend_supported(store: GuardStore) -> bool:
-    secret_store = getattr(store, "_policy_integrity_secret_store", None)
-    return (
-        sys.platform == "darwin"
-        and isinstance(secret_store, SystemKeyringSecretStore)
-        and secret_store._supports_native_macos_security_reads()
-    )
-
-
 def _run_guard_trust_command(
     args: argparse.Namespace,
     *,
@@ -327,10 +295,6 @@ def _run_guard_trust_command(
     store = _require_guard_store(store)
     trust_command = getattr(args, "trust_command", None) or "status"
     backend = str(getattr(args, "backend", None) or "auto")
-    if backend == "macos-native" and not _macos_native_backend_supported(store):
-        payload = _unsupported_backend_payload(command=trust_command, backend=backend)
-        _emit(f"trust.{trust_command}", payload, getattr(args, "json", False))
-        return 2
     payload = (
         build_trust_doctor_payload(store, backend=backend)
         if trust_command == "doctor"
@@ -345,8 +309,8 @@ def _run_guard_trust_command(
             _emit("trust.test", payload, getattr(args, "json", False))
             return 2
         payload["probe"] = "passive_no_ui"
-        payload["ok"] = payload["passive_prompt_allowed"] is False
-        payload["trust_health"] = "protected" if payload["remembered_rules"] == "enforced" else "degraded_safe"
+        payload["ok"] = payload["passive_prompt_allowed"] is False and payload.get("mode") != "unsupported"
+        payload["trust_health"] = str(payload.get("mode") or "degraded_safe")
         _emit("trust.test", payload, getattr(args, "json", False))
         return 0
     if trust_command == "explain":
@@ -392,7 +356,7 @@ def _run_guard_trust_command(
             )
             _emit(f"trust.{trust_command}", payload, getattr(args, "json", False))
             return 2
-        if not _macos_native_backend_supported(store):
+        if not macos_native_backend_supported(store):
             payload["error"] = (
                 f"macOS native trust {trust_command} is unavailable. "
                 "Guard will not fall back to a prompt-capable backend."

{plugin_scanner-2.0.830 → plugin_scanner-2.0.831}/src/codex_plugin_scanner/guard/cli/render.py

@@ -727,6 +727,7 @@ def _render_doctor(console: Console, payload: dict[str, object]) -> None:
 
 def _build_trust_doctor_panel(trust: dict[str, object]) -> Panel:
     body = Table.grid(padding=(0, 1))
+    body.add_row("Mode", str(trust.get("mode") or "unknown"))
     body.add_row("Runtime", str(trust.get("runtime_protection") or "unknown"))
     body.add_row("Remembered rules", str(trust.get("remembered_rules") or "unknown"))
     body.add_row("Cloud policies", str(trust.get("cloud_policies") or "unknown"))

plugin_scanner-2.0.831/src/codex_plugin_scanner/guard/local_trust_controller.py

@@ -0,0 +1,176 @@
+"""Local trust backend selection and passive status resolution."""
+
+from __future__ import annotations
+
+import sys
+from dataclasses import dataclass
+
+from .local_trust_contract import (
+    POLICY_INTEGRITY_REASON_BACKEND_TIMEOUT,
+    LocalTrustMode,
+    TrustBackend,
+    TrustBackendUnavailableError,
+    TrustStatus,
+    degraded_reason_for_backend_error,
+    run_trust_backend_check,
+    select_trust_backend,
+)
+from .store import GuardStore, SystemKeyringSecretStore
+
+PASSIVE_TRUST_TIMEOUT_SECONDS = 0.25
+
+
+def macos_native_backend_supported(store: GuardStore) -> bool:
+    secret_store = getattr(store, "_policy_integrity_secret_store", None)
+    return (
+        sys.platform == "darwin"
+        and isinstance(secret_store, SystemKeyringSecretStore)
+        and secret_store._supports_native_macos_security_reads()
+    )
+
+
+def _degraded_safe_status(*, backend: str, reason: str, setup_available: bool = False) -> TrustStatus:
+    return TrustStatus(
+        runtime_protection="degraded",
+        remembered_rules="disabled_degraded",
+        cloud_policies="setup_unavailable",
+        backend=backend,
+        degraded_reasons=(reason,),
+        setup_available=setup_available,
+    )
+
+
+class _DegradedSafeTrustBackend:
+    name = "degraded-safe"
+    priority = 0
+    supported = True
+    passive_no_ui_safe = True
+
+    def status(self) -> TrustStatus:
+        return _degraded_safe_status(backend=self.name, reason="trust_backend_unavailable")
+
+    def sign(self, payload: bytes) -> str:
+        raise TrustBackendUnavailableError("degraded_safe_backend_has_no_signing_material")
+
+    def verify(self, payload: bytes, signature: str) -> bool:
+        del payload, signature
+        return False
+
+    def setup(self) -> TrustStatus:
+        return self.status()
+
+    def revoke(self) -> TrustStatus:
+        return self.status()
+
+
+class _MacOSNativeTrustBackend:
+    name = "macos-native"
+    priority = 100
+
+    def __init__(self, store: GuardStore) -> None:
+        self._store = store
+        self.supported = sys.platform == "darwin"
+        self.passive_no_ui_safe = macos_native_backend_supported(store)
+
+    def status(self) -> TrustStatus:
+        return TrustStatus.from_policy_integrity_state(self._store.get_policy_integrity_status())
+
+    def sign(self, payload: bytes) -> str:
+        raise TrustBackendUnavailableError("macos_native_backend_signing_is_managed_by_guard_store")
+
+    def verify(self, payload: bytes, signature: str) -> bool:
+        del payload, signature
+        return False
+
+    def setup(self) -> TrustStatus:
+        raise TrustBackendUnavailableError("macos_native_backend_setup_is_managed_by_guard_store")
+
+    def revoke(self) -> TrustStatus:
+        raise TrustBackendUnavailableError("macos_native_backend_reset_is_managed_by_guard_store")
+
+
+@dataclass(frozen=True)
+class ResolvedTrustState:
+    mode: LocalTrustMode
+    backend_requested: str
+    backend_selected: str
+    backend_supported: bool
+    passive_no_ui_safe: bool
+    trust_status: TrustStatus
+
+
+def _trust_backends(store: GuardStore) -> tuple[TrustBackend, ...]:
+    return (_MacOSNativeTrustBackend(store), _DegradedSafeTrustBackend())
+
+
+def _backend_by_name(store: GuardStore, backend_requested: str) -> TrustBackend:
+    backends = {backend.name: backend for backend in _trust_backends(store)}
+    return backends.get(backend_requested, _DegradedSafeTrustBackend())
+
+
+def _trust_mode_for_backend(
+    trust_status: TrustStatus,
+    *,
+    backend_requested: str,
+    backend_selected: str,
+    backend_supported: bool,
+    passive_no_ui_safe: bool,
+) -> LocalTrustMode:
+    if trust_status.runtime_protection == "protected" and trust_status.remembered_rules == "enforced":
+        return "protected"
+    if backend_requested != "auto" and not backend_supported:
+        return "unsupported"
+    if backend_selected == "macos-native" and passive_no_ui_safe and trust_status.setup_available:
+        return "setup_required"
+    return "degraded_safe"
+
+
+def resolve_passive_trust_state(
+    store: GuardStore,
+    *,
+    backend_requested: str,
+    timeout_seconds: float = PASSIVE_TRUST_TIMEOUT_SECONDS,
+) -> ResolvedTrustState:
+    if backend_requested == "auto":
+        selected = select_trust_backend(_trust_backends(store), passive=True) or _DegradedSafeTrustBackend()
+    else:
+        selected = _backend_by_name(store, backend_requested)
+    timeout_result = _degraded_safe_status(
+        backend=selected.name,
+        reason=POLICY_INTEGRITY_REASON_BACKEND_TIMEOUT,
+        setup_available=bool(selected.name == "macos-native" and selected.supported and selected.passive_no_ui_safe),
+    )
+    trust_status = run_trust_backend_check(
+        selected.status,
+        timeout_seconds=timeout_seconds,
+        timeout_result=timeout_result,
+        on_error=lambda error: _degraded_safe_status(
+            backend=selected.name,
+            reason=degraded_reason_for_backend_error(error),
+            setup_available=bool(
+                selected.name == "macos-native" and selected.supported and selected.passive_no_ui_safe
+            ),
+        ),
+    )
+    return ResolvedTrustState(
+        mode=_trust_mode_for_backend(
+            trust_status,
+            backend_requested=backend_requested,
+            backend_selected=selected.name,
+            backend_supported=selected.supported,
+            passive_no_ui_safe=selected.passive_no_ui_safe,
+        ),
+        backend_requested=backend_requested,
+        backend_selected=selected.name,
+        backend_supported=selected.supported,
+        passive_no_ui_safe=selected.passive_no_ui_safe,
+        trust_status=trust_status,
+    )
+
+
+__all__ = [
+    "PASSIVE_TRUST_TIMEOUT_SECONDS",
+    "ResolvedTrustState",
+    "macos_native_backend_supported",
+    "resolve_passive_trust_state",
+]

{plugin_scanner-2.0.830 → plugin_scanner-2.0.831}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.830"
+__version__ = "2.0.831"

{plugin_scanner-2.0.830 → plugin_scanner-2.0.831}/tests/test_guard_policy_integrity.py

@@ -1058,12 +1058,10 @@ def test_remote_policy_integrity_failure_does_not_emit_local_rule_event(
 
     assert resolved is None
     assert any(
-        event.get("payload", {}).get("artifact_id") == "codex:project:remote-tampered"
-        for event in integrity_events
+        event.get("payload", {}).get("artifact_id") == "codex:project:remote-tampered" for event in integrity_events
     )
     assert not any(
-        event.get("payload", {}).get("artifact_id") == "codex:project:remote-tampered"
-        for event in ignored_events
+        event.get("payload", {}).get("artifact_id") == "codex:project:remote-tampered" for event in ignored_events
     )
 
 
@@ -1460,9 +1458,7 @@ def test_guard_doctor_includes_safe_trust_diagnostics(tmp_path: Path, capsys) ->
     assert trust_payload["one_time_approvals"] == "available"
     assert trust_payload["durable_local_rules"] in {"enforced", "limited"}
     assert trust_payload["checks"]["passive_no_ui"] is True
-    assert trust_payload["checks"]["runtime_protection"] is (
-        trust_payload["runtime_protection"] == "protected"
-    )
+    assert trust_payload["checks"]["runtime_protection"] is (trust_payload["runtime_protection"] == "protected")
     assert trust_payload["official_install"]["package"] == "hol-guard"
     assert trust_payload["official_install"]["update_command"] == "hol-guard update"
     assert trust_payload["approval_center"]["active"] is False
@@ -1497,6 +1493,7 @@ def test_trust_cli_doctor_human_output_uses_trust_renderer(tmp_path: Path, capsy
 
     assert rc == 0
     assert "Local trust" in output
+    assert "Mode" in output
     assert "Passive OS prompts" in output
     assert "Install mode" in output
     assert "hol-guard update" in output
@@ -1721,51 +1718,6 @@ def test_trust_cli_explain_reports_guard_cloud_rule(tmp_path: Path, capsys) -> N
     assert "integrity_status" not in payload["rule"]
 
 
-def test_trust_cli_rejects_unavailable_backend_status(tmp_path: Path, capsys) -> None:
-    home_dir = tmp_path / "home"
-    rc = main(
-        [
-            "guard",
-            "trust",
-            "status",
-            "--backend",
-            "macos-native",
-            "--home",
-            str(home_dir),
-            "--json",
-        ]
-    )
-    payload = json.loads(capsys.readouterr().out)
-
-    assert rc == 2
-    assert payload["backend_requested"] == "macos-native"
-    assert "not available for passive status" in payload["error"]
-    assert payload["passive_prompt_allowed"] is False
-
-
-def test_trust_cli_degraded_safe_backend_is_explicit(tmp_path: Path, capsys) -> None:
-    home_dir = tmp_path / "home"
-    rc = main(
-        [
-            "guard",
-            "trust",
-            "status",
-            "--backend",
-            "degraded-safe",
-            "--home",
-            str(home_dir),
-            "--json",
-        ]
-    )
-    payload = json.loads(capsys.readouterr().out)
-
-    assert rc == 0
-    assert payload["backend_requested"] == "degraded-safe"
-    assert payload["backend"] == "degraded-safe"
-    assert payload["remembered_rules"] == "disabled_degraded"
-    assert payload["durable_local_rules"] == "limited"
-
-
 def test_trust_cli_doctor_degraded_safe_does_not_pass_runtime_check(tmp_path: Path, capsys) -> None:
     home_dir = tmp_path / "home"
     rc = main(

plugin_scanner-2.0.831/tests/test_guard_trust_cli_passive_backend.py

@@ -0,0 +1,177 @@
+"""Regression tests for passive Guard trust backend behavior."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+import pytest
+
+from codex_plugin_scanner.cli import main
+from codex_plugin_scanner.guard import store as guard_store_module
+from codex_plugin_scanner.guard.cli import commands_dispatch_trust as trust_dispatch_module
+from codex_plugin_scanner.guard.local_trust_contract import TrustStatus
+from codex_plugin_scanner.guard.local_trust_controller import _trust_mode_for_backend
+from codex_plugin_scanner.guard.store import SystemKeyringSecretStore
+
+
+@pytest.fixture(autouse=True)
+def _fake_policy_integrity_keyring(install_fake_system_keyring) -> None:
+    install_fake_system_keyring()
+
+
+@pytest.fixture(autouse=True)
+def _default_store_platform(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(guard_store_module.sys, "platform", "linux", raising=False)
+
+
+def _enable_macos_native_policy_integrity(
+    monkeypatch: pytest.MonkeyPatch,
+    install_fake_system_keyring,
+):
+    fake_keyring = install_fake_system_keyring()
+    monkeypatch.setattr(guard_store_module.sys, "platform", "darwin", raising=False)
+    monkeypatch.setattr(
+        SystemKeyringSecretStore,
+        "_supports_native_macos_security_reads",
+        classmethod(lambda cls: True),
+    )
+    monkeypatch.setattr(
+        SystemKeyringSecretStore,
+        "_get_secret_without_macos_ui",
+        lambda self, secret_id: fake_keyring.get_password(self.service_name, secret_id),
+    )
+    return fake_keyring
+
+
+def test_trust_cli_reports_unsupported_backend_status_without_prompt_error(tmp_path: Path, capsys) -> None:
+    home_dir = tmp_path / "home"
+    rc = main(
+        [
+            "guard",
+            "trust",
+            "status",
+            "--backend",
+            "macos-native",
+            "--home",
+            str(home_dir),
+            "--json",
+        ]
+    )
+    payload = json.loads(capsys.readouterr().out)
+
+    assert rc == 0
+    assert payload["mode"] == "unsupported"
+    assert payload["backend_requested"] == "macos-native"
+    assert payload["message"].startswith("This local trust backend is unsupported")
+    assert payload["passive_prompt_allowed"] is False
+
+
+def test_trust_cli_degraded_safe_backend_is_explicit(tmp_path: Path, capsys) -> None:
+    home_dir = tmp_path / "home"
+    rc = main(
+        [
+            "guard",
+            "trust",
+            "status",
+            "--backend",
+            "degraded-safe",
+            "--home",
+            str(home_dir),
+            "--json",
+        ]
+    )
+    payload = json.loads(capsys.readouterr().out)
+
+    assert rc == 0
+    assert payload["backend_requested"] == "degraded-safe"
+    assert payload["backend"] == "degraded-safe"
+    assert payload["remembered_rules"] == "disabled_degraded"
+    assert payload["durable_local_rules"] == "limited"
+
+
+def test_trust_cli_macos_native_status_reports_setup_required_when_passive_backend_is_ready(
+    tmp_path: Path,
+    capsys,
+    monkeypatch: pytest.MonkeyPatch,
+    install_fake_system_keyring,
+) -> None:
+    _enable_macos_native_policy_integrity(monkeypatch, install_fake_system_keyring)
+    home_dir = tmp_path / "home"
+
+    rc = main(
+        [
+            "guard",
+            "trust",
+            "status",
+            "--backend",
+            "macos-native",
+            "--home",
+            str(home_dir),
+            "--json",
+        ]
+    )
+    payload = json.loads(capsys.readouterr().out)
+
+    assert rc == 0
+    assert payload["mode"] == "setup_required"
+    assert payload["backend_requested"] == "macos-native"
+    assert payload["backend_selected"] == "macos-native"
+    assert payload["setup_available"] is True
+    assert payload["passive_prompt_allowed"] is False
+
+
+def test_trust_cli_macos_native_test_stays_prompt_free_when_backend_is_unavailable(
+    tmp_path: Path,
+    capsys,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    home_dir = tmp_path / "home"
+    monkeypatch.setattr(trust_dispatch_module.sys, "platform", "darwin", raising=False)
+    monkeypatch.setattr(guard_store_module.sys, "platform", "darwin", raising=False)
+    monkeypatch.setattr(
+        SystemKeyringSecretStore,
+        "_supports_native_macos_security_reads",
+        classmethod(lambda cls: False),
+    )
+
+    rc = main(
+        [
+            "guard",
+            "trust",
+            "test",
+            "--backend",
+            "macos-native",
+            "--home",
+            str(home_dir),
+            "--no-ui",
+            "--json",
+        ]
+    )
+    payload = json.loads(capsys.readouterr().out)
+
+    assert rc == 0
+    assert payload["mode"] == "degraded_safe"
+    assert payload["ok"] is True
+    assert payload["trust_health"] == "degraded_safe"
+    assert payload["passive_prompt_allowed"] is False
+
+
+def test_trust_mode_can_report_protected_even_for_degraded_safe_request() -> None:
+    trust_status = TrustStatus(
+        runtime_protection="protected",
+        remembered_rules="enforced",
+        cloud_policies="available",
+        backend="degraded-safe",
+    )
+
+    assert (
+        _trust_mode_for_backend(
+            trust_status,
+            backend_requested="degraded-safe",
+            backend_selected="degraded-safe",
+            backend_supported=True,
+            passive_no_ui_safe=True,
+        )
+        == "protected"
+    )