"""Read-only archive integrity verifier; no imports of historical evaluators."""
from pathlib import Path, PurePosixPath
import hashlib
import json
import stat

ROOT = Path(__file__).resolve().parent
PIN = '0893f3a3f0c52bc65b6b9e4d2fabdb9e76c64db973ba074ef2f1e7625500250f'


def sha(path):
    return hashlib.sha256(path.read_bytes()).hexdigest()


def read(path):
    return json.loads(path.read_text(encoding='utf-8'))


def require(condition, message):
    if not condition:
        raise AssertionError(message)


def relative(path):
    parsed = PurePosixPath(path)
    require(bool(parsed.parts) and not parsed.is_absolute() and parsed.as_posix() == path
            and all(part not in ('', '.', '..') for part in parsed.parts)
            and '\\' not in path and ':' not in path, 'Unsafe manifest path: ' + path)
    return path


def main():
    manifest = read(ROOT / 'MANIFEST.json')
    expected = manifest['files']
    require(len(expected) == manifest['file_count'], 'Archive manifest file count')
    actual = {}
    for path in ROOT.rglob('*'):
        info = path.lstat()
        require(not path.is_symlink() and not (getattr(info, 'st_file_attributes', 0) & 0x400), 'Archive reparse/symlink refused')
        if stat.S_ISREG(info.st_mode) and path != ROOT / 'MANIFEST.json':
            name = path.relative_to(ROOT).as_posix()
            actual[name] = {'sha256': sha(path), 'bytes': info.st_size}
    require(all(relative(p) for p in expected), 'Archive paths')
    require(actual == expected, 'Exact archive file set, sizes and hashes')
    require(sum(v['bytes'] for v in actual.values()) == manifest['total_bytes'], 'Archive byte count')
    payload = ROOT / 'payload'
    original_path = payload / 'evidence-manifest.json'
    require(sha(original_path) == PIN == manifest['original_manifest_sha256'], 'Frozen original manifest identity')
    original = read(original_path)
    require(original['file_count'] == len(original['files']) == 38 and original['total_bytes'] == 1147293, 'Original 38-payload inventory')
    require({p.removeprefix('payload/'): v for p, v in actual.items() if p.startswith('payload/') and p != 'payload/evidence-manifest.json'} == original['files'], 'Whitelist copy equals all original payloads')
    require(not any(Path(p).suffix.lower() in {'.exe', '.dll', '.zip', '.pdb'} or '/profile/' in p or '/extracted/' in p for p in actual), 'No package binaries or profiles')
    artifact = read(payload / 'artifact-result.json')
    server = read(payload / 'server-result.json')
    require(artifact['status'] == server['status'] == 'PASS', 'Stored terminal scopes')
    require(artifact['archive']['file_count'] == len(artifact['archive']['files']) == 559, 'Stored complete package map')
    require(artifact['archive']['sha256'] == 'd7228c542f162663933ea002739a78c722bcca41e437df63b7c868ea2af201f1', 'Stored ZIP identity')
    for scope, result in [('artifact', artifact), ('server', server)]:
        command = read(payload / (scope + '-command.json'))
        require(command['exit_code'] == 0 and command['script_unchanged'] and command['frozen_inputs_unchanged'], 'Stored successful immutable invocation: ' + scope)
        require(command['script_sha256'] == result['script_sha256'] == sha(payload / 'review.py'), 'Exact executed evaluator source: ' + scope)
        require(command['frozen_inputs_sha256'] == result['frozen_inputs_sha256'] == sha(payload / 'frozen-inputs.json'), 'Exact frozen input binding: ' + scope)
        for stream in ('stdout', 'stderr'):
            require(command[stream + '_sha256'] == sha(payload / (scope + '-' + stream + '.log')), 'Exact command stream: ' + scope + '/' + stream)
    http = sorted((payload / 'server-run').glob('http-*.json'))
    require(len(http) == 7, 'Seven original HTTP receipts')
    for path in http:
        record = read(path)
        require(record['body_sha256'] == sha(path.with_suffix('.body')), 'HTTP response body receipt: ' + path.name)
    persisted = payload / 'server-run/data' / (server['persistence']['resource_id'] + '.json')
    require(sha(persisted) == server['persistence']['disk_sha256'] and read(persisted) == server['persistence']['expected'], 'Stored complete durable envelope')
    require(persisted.read_bytes() == (payload / 'server-run/http-05.body').read_bytes() == (payload / 'server-run/http-07.body').read_bytes(), 'Stored first GET, restart GET and disk bytes agree')
    require([p['exit_after_explicit_terminate'] for p in server['processes']] == [1, 1], 'Explicit Windows termination codes retained')
    require(read(payload / 'process-readback.json')['remaining'] == [], 'Stored later process-absence observation')
    print(json.dumps({'status': 'PASS', 'scope': 'Preserved archive integrity and receipt consistency only; no application or runtime checks rerun.',
                      'original_payloads': original['file_count'], 'archive_files_excluding_manifest': len(actual),
                      'archive_bytes_excluding_manifest': manifest['total_bytes'],
                      'manifest_sha256': sha(ROOT / 'MANIFEST.json')}, indent=2))


if __name__ == '__main__':
    main()