"""Read only archive bytes and recorded receipt relationships; never publish."""
from pathlib import Path
import hashlib
import json

BASE = Path(__file__).resolve().parent
def sha(p):
    return hashlib.sha256(p.read_bytes()).hexdigest()
def read(p):
    return json.loads((BASE/p).read_text(encoding='utf-8'))
def check(ok, label):
    if not ok:
        raise SystemExit('FAIL: '+label)

manifest = read('MANIFEST.json')
check({p.relative_to(BASE).as_posix() for p in BASE.rglob('*') if p.is_file()} - {'MANIFEST.json'} == {r['path'] for r in manifest['files']}, 'file set')
for r in manifest['files']:
    p = BASE/r['path']
    check(p.resolve().is_relative_to(BASE) and p.stat().st_size == r['bytes'] and sha(p) == r['sha256'], r['path'])
check(sha(BASE/'ORIGINALS.json') == '1c6eedd5a7c0937eda5961db48d1107fd4b005d47c026936d248b7aa1d86a300', 'original whitelist pin')
originals = read('ORIGINALS.json')['files']
check(len(originals) == 34, 'original count')
for r in originals:
    check(sha(BASE/r['path']) == r['sha256'] and (BASE/r['path']).stat().st_size == r['bytes'], 'original '+r['path'])
p = 'payload/publication/'
target = '802855f7e6f2f00a107a12196b458b267f586b8d'
tag = 'v0.2.0-preview.navigation.20260911'
bindings = read(p+'bindings.json')
check(sha(BASE/p/'RELEASE-NOTES.md') == bindings['notesSha256'], 'notes binding')
check(sha(BASE/p/'VALIDATION.md') == bindings['validationSha256'], 'validation binding')
failed = read(p+'runs/tag-first-20260912/result.json')
check(failed['success'] is False and failed['error'] == 'Published source branch changed', 'failed first preflight')
for attempt in ['tag-inspected-source-20260912','create-first-20260912','upload-first-20260912','publish-first-20260912']:
    r = read(p+'runs/'+attempt+'/result.json')
    check(r['success'] is True and r['target'] == target and r['tag'] == tag, attempt)
upload = read(p+'runs/upload-first-20260912/result.json')
published = read(p+'runs/publish-first-20260912/result.json')
check(published['releaseId'] == read(p+'release-created.json')['releaseId'] == 4 and published['draft'] is False and published['prerelease'] is True, 'published prerelease ownership')
check(upload['assets'] == published['assets'] and len(published['assets']) == 3, 'asset consistency')
expected = [(10,32971712,'d7228c542f162663933ea002739a78c722bcca41e437df63b7c868ea2af201f1'),(11,144,'435b6fff3fbc1640b4db31c5d848dbcde101aa54cc86fe0eef9c8da6a501ccac'),(12,6987,'9abcb45e665e2bf553a6ef91f1e73fd403d7c9552b01962d0d9713cf52660ff2')]
check([(a['id'],a['bytes'],a['sha256']) for a in published['assets']] == expected, 'asset pins')
check(published['finished'] == '2026-09-12T10:54:02.303380+00:00', 'terminal publication time')
raw = (BASE/p/'before-source-advance/publish.py').read_bytes()
guard = b"if not __debug__:\n    raise RuntimeError('Publication requires Python assertions; optimized execution is refused.')\n\n"
check(raw.count(guard) == 1, 'exact reconstruction guard')
reconstructed = BASE/'reconstructed/original-reviewed-publish.py'
check(reconstructed.read_bytes() == raw.replace(guard,b'',1) and sha(reconstructed) == 'e679a84845303db6582753b525bb3c2d184e6139e5651560fce8c876eae42c99', 'byte-proved reconstruction')
check('SOURCE_BRANCH_HEAD = ' in (BASE/p/'publish.py').read_text(encoding='utf-8') and '0c9ee1505774a0f64c5f3a58b0da64a4673d5000' in (BASE/p/'publish.py').read_text(encoding='utf-8'), 'separate source branch pin')
check(read(p+'acceptance-records-push-result.json')['target'] == 'f5e1c734dadd6e0203288065dac7b2e3f140cacf' and read(p+'acceptance-records-push-result.json')['success'], 'acceptance record push')
print('PASS publication archive: 34 originals; exact reconstructed initial adapter; failed preflight retained; tag/release 4/three asset receipt relationships. No network or runtime work rerun.')