#!/usr/bin/env python3
"""Independent verifier for the sealed v4 evidence package."""

from __future__ import annotations

import hashlib
import json
import os
import stat
from pathlib import Path
from typing import Any

ROOT = Path(__file__).parent
ARCHIVE = Path("/home/cube/.hermes/profiles/dualcoachtest/data/post-lifecycle-cleanup-archives/task26-current-4a6c7ee5-20260817")
V3 = ROOT.parent / "task26-post-lifecycle-cleanup-v3-4a6c7ee5-st_01a00e50"
EXCLUDED = {"inventory.json", "SEAL.json"}


def canon(value: Any) -> bytes:
    return (json.dumps(value, sort_keys=True, separators=(",", ":")) + "\n").encode()


def sha(path: Path) -> str:
    return hashlib.sha256(path.read_bytes()).hexdigest()


def archive_root() -> tuple[str, int]:
    rows: list[dict[str, str]] = []
    for base, dirs, files in os.walk(ARCHIVE, followlinks=False):
        dirs.sort()
        files.sort()
        for name in dirs:
            path = Path(base) / name
            st = path.lstat()
            assert stat.S_ISDIR(st.st_mode), path
            rows.append({"path": path.relative_to(ARCHIVE).as_posix(), "type": "D", "mode": f"{stat.S_IMODE(st.st_mode):04o}"})
        for name in files:
            path = Path(base) / name
            st = path.lstat()
            assert stat.S_ISREG(st.st_mode), path
            rows.append({"path": path.relative_to(ARCHIVE).as_posix(), "type": "F", "mode": f"{stat.S_IMODE(st.st_mode):04o}", "sha256": sha(path)})
    return hashlib.sha256(canon(rows)).hexdigest(), len(rows)


def main() -> int:
    inventory_raw = (ROOT / "inventory.json").read_bytes()
    inventory = json.loads(inventory_raw)
    seal = json.loads((ROOT / "SEAL.json").read_text())
    actual_paths = {p.relative_to(ROOT).as_posix() for p in ROOT.iterdir() if p.is_file()} - EXCLUDED
    claimed_paths = {row["path"] for row in inventory["entries"]}
    assert actual_paths == claimed_paths, (actual_paths - claimed_paths, claimed_paths - actual_paths)
    for row in inventory["entries"]:
        path = ROOT / row["path"]
        assert path.stat().st_size == row["size"]
        assert f"{stat.S_IMODE(path.stat().st_mode):04o}" == row["mode"]
        assert sha(path) == row["sha256"]
    assert inventory["root_sha256"] == hashlib.sha256(canon(inventory["entries"])).hexdigest()
    assert seal["inventory_sha256"] == hashlib.sha256(inventory_raw).hexdigest()
    assert seal["evidence_root_sha256"] == inventory["root_sha256"]
    assert seal["controller_sha256"] == sha(ROOT / "cleanup_controller.py")
    assert seal["v3_seal_sha256"] == sha(V3 / "SEAL.json")
    archive_sha, archive_entries = archive_root()
    assert seal["archive_root_sha256"] == archive_sha
    result = {"schema": "task26-cleanup-v4-successor-seal-verification-v1", "status": "PASS", "evidence_entries": len(inventory["entries"]), "archive_entries": archive_entries, "archive_root_sha256": archive_sha, "v3_seal_sha256": seal["v3_seal_sha256"], "checks": len(inventory["entries"]) + 8}
    print(json.dumps(result, sort_keys=True, separators=(",", ":")))
    return 0


if __name__ == "__main__":
    raise SystemExit(main())