"""Read-only verification of the nested-default admission evidence."""
from pathlib import Path
import hashlib
import json
import zipfile

root = Path(__file__).resolve().parent


def digest(data):
    return {'bytes': len(data), 'sha256': hashlib.sha256(data).hexdigest()}


def require(condition, message):
    if not condition:
        raise SystemExit(message)


def read_json(path):
    return json.loads(path.read_text(encoding='utf-8'))


manifest = read_json(root / 'files.json')
paths = {p.relative_to(root).as_posix() for p in root.rglob('*') if p.is_file() and p.name != 'files.json' and '__pycache__' not in p.parts}
require(paths == set(manifest), 'Archive membership mismatch')
for name, expected in manifest.items():
    require(digest((root / name).read_bytes()) == expected, f'File mismatch: {name}')
gate = root / 'admission-1'
result = read_json(gate / 'result.json')
started = read_json(gate / 'started.json')
require(all(result[k] == v for k, v in started.items()), 'Start/result mismatch')
require(result['exitCode'] == 0 and result['inputsUnchanged'], 'Gate failed or inputs changed')
for key, filename in (('inputs', 'inputs.json'), ('archive', 'inputs.zip'), ('stdout', 'stdout.log'), ('stderr', 'stderr.log')):
    require(digest((gate / filename).read_bytes()) == result[key], f'Receipt mismatch: {key}')
require(digest((root / 'gate.py').read_bytes()) == result['helper'], 'Runner mismatch')
inputs = read_json(gate / 'inputs.json')
require(len(inputs) == result['inputCount'] == 606, 'Input count mismatch')
with zipfile.ZipFile(gate / 'inputs.zip') as archive:
    require(len(archive.namelist()) == len(inputs) and set(archive.namelist()) == set(inputs), 'ZIP membership mismatch')
    for name, expected in inputs.items():
        require(digest(archive.read(name)) == expected, f'Input mismatch: {name}')
stdout = (gate / 'stdout.log').read_text(encoding='utf-8')
require('test result: ok. 10 passed; 0 failed; 0 ignored;' in stdout, 'Unexpected outcome')
tests = [s for s in stdout.splitlines() if s.startswith('test ') and ' ... ' in s]
require(len(tests) == 10 and all(s.endswith(' ... ok') for s in tests), 'Named test outcome mismatch')
artifacts = []
for line in stdout.splitlines():
    try:
        item = json.loads(line)
    except json.JSONDecodeError:
        continue
    if isinstance(item, dict) and item.get('reason') == 'compiler-artifact' and item.get('executable'):
        artifacts.append(item)
require(artifacts == [a['cargo'] for a in result['artifacts']] and len(artifacts) == 1, 'Artifact receipt mismatch')
print(f'Verified {len(manifest)} pinned files, 606 captured inputs and ten passing nested-admission tests.')
print('This verifies recorded Windows evidence; it does not rerun tests or establish compact writer acceptance.')