#!/usr/bin/env python3
"""Offline file and claim-boundary verifier. No independent effect-truth attestation."""
import hashlib,json,re,sys
from collections import Counter
from html.parser import HTMLParser
from pathlib import Path
PIN='sha256:e59916435390e59ed72c63d6ce368ed7750b23cb5fb28701c4c63972ffdc3425'
API='fa0231990d56ad5f329afd3bc9d4bb8a8de50c56c8e54016fdfceb78961474d0'
FILES={'index.html','summary.json','METHODS.md','verify_public.py','SHA256SUMS.txt'}
CASES={'g1_preflight','g1_epoch_changed_at_commit','g2_preflight','g2_policy_version_changed_at_commit','g3_preflight','g3_context_changed_at_commit','g4_preflight','g4_expired_at_commit','f1_preflight','f1_first_commit','f1_second_evaluation_same_effect_id','f1_second_commit_new_decision_same_effect_id','s1_original_evaluation','s1_superseding_evaluation','s1_successor_commit'}
EXPECT={'g1_epoch_changed_at_commit':'REVIEW','g2_policy_version_changed_at_commit':'REVIEW','g3_context_changed_at_commit':'BLOCK','g4_expired_at_commit':'BLOCK','f1_first_commit':'PROCEED','f1_second_commit_new_decision_same_effect_id':'BLOCK','s1_successor_commit':'PROCEED'}

def hold(x): raise ValueError('HOLD='+x)
class Parse(HTMLParser):
    def __init__(self):super().__init__();self.links=[];self.rows=[]
    def handle_starttag(self,t,attrs):
        a=dict(attrs)
        if t in ('script','iframe','object','embed','form','img','svg','video','audio','canvas','link'):hold('ACTIVE_HTML')
        if any(k.lower().startswith('on') for k in a) or 'src' in a:hold('EVENT_HTML')
        if t=='a':self.links.append(a.get('href',''))
        if t=='tr' and 'data-case' in a:self.rows.append(a['data-case'])
def main():
    if len(sys.argv)!=2:hold('DIRECTORY_REQUIRED')
    d=Path(sys.argv[1])
    if d.is_symlink() or not d.is_dir() or {p.name for p in d.iterdir()}!=FILES:hold('FILESET')
    for p in d.iterdir():
        if p.is_symlink() or not p.is_file() or p.stat().st_size>250000:hold('FILETYPE')
    dig={}
    for line in (d/'SHA256SUMS.txt').read_text(encoding='ascii').splitlines():
        m=re.fullmatch(r'([0-9a-f]{64})  ([A-Za-z0-9_.-]+)',line)
        if not m or m[2] in dig:hold('MANIFEST')
        dig[m[2]]=m[1]
    if set(dig)!=FILES-{'SHA256SUMS.txt'}:hold('MANIFEST_SET')
    for n,h in dig.items():
        if hashlib.sha256((d/n).read_bytes()).hexdigest()!=h:hold('HASH_'+n)
    j=json.loads((d/'summary.json').read_text(encoding='utf8'))
    if set(j)!={'package','version','publication_status','public_release_authorized','research_scope','source_model_version','engine_image_id','openapi_sha256','metrics','limits','results'}:hold('TOP_LEVEL')
    if (j['package']!='E2E_EG_OPEN_LAB_STATIC_PUBLIC_REFERENCE' or j['version']!='0.1.0' or
        j['publication_status']!='PUBLISHED_STATIC_RESEARCH_REFERENCE' or j['public_release_authorized'] is not True or
        j['research_scope']!='SCOPED_SYNTHETIC_ENGINE_TRANSCRIPT' or j['source_model_version']!='E2E-Endpoint-Contract/0.2.0' or
        j['engine_image_id']!=PIN or j['openapi_sha256']!=API):hold('PUBLIC_SCOPE')
    m=j['metrics'];l=j['limits']
    if tuple(m.get(k) for k in ('typed_decisions','source_http_events','source_strict_checks','supported_realized_effects'))!=(15,22,8,0):hold('METRICS')
    if m.get('dispositions')!={'BLOCK':3,'PROCEED':10,'REVIEW':2}:hold('DISPOSITIONS')
    expected_limits={'real_effect_executed','third_party_reproduced','independent_physical_oracle','revocation_tested','engine_request_hash_canonicalization_verified','kvm4_host_attested_by_image_node_profile','externally_timestamped_or_signed'}
    if set(l)!=expected_limits or any(v is not False for v in l.values()):hold('LIMITS')
    rows=j['results']
    if not isinstance(rows,list) or len(rows)!=15 or {r.get('case_id') for r in rows}!=CASES:hold('CASESET')
    if len({r['case_id'] for r in rows})!=15:hold('DUPLICATES')
    allowed={'case_id','fact_support','authority_status','execution_disposition','continuity_status','requires_reevaluation'}
    for r in rows:
        if (set(r)!=allowed or r['fact_support']!='INDETERMINATE' or
            r['authority_status'] not in ('AUTHORIZED','UNAUTHORIZED','UNKNOWN') or
            r['execution_disposition'] not in ('PROCEED','REVIEW','HOLD','BLOCK') or
            type(r['requires_reevaluation']) is not bool or not isinstance(r['continuity_status'],str) or len(r['continuity_status'])>120):hold('ROW')
        if r['case_id'] in EXPECT and r['execution_disposition']!=EXPECT[r['case_id']]:hold('EXPECTED_DECISION')
    if dict(Counter(r['execution_disposition'] for r in rows))!=m['dispositions']:hold('METRIC_CALC')
    page=(d/'index.html').read_text(encoding='utf8');method=(d/'METHODS.md').read_text(encoding='utf8')
    if ('STATIC RESEARCH EVIDENCE — MODEL-RELATIVE, NOT CERTIFIED.' not in page or
        '<meta name="robots" content="index,follow">' not in page or
        'default-src \'none\'' not in page or '<script' in page or 'noindex,nofollow' in page or
        'APPROVAL PENDING' in page):hold('HTML_RELEASE')
    hp=Parse();hp.feed(page)
    if len(hp.rows)!=15 or set(hp.rows)!=CASES or set(hp.links)!={'summary.json','METHODS.md','verify_public.py','SHA256SUMS.txt','/v0.1.0/index.json'}:hold('HTML_LINKS_ROWS')
    for name in ('index.html','summary.json','METHODS.md'):
        t=(d/name).read_text(encoding='utf8')
        if any(v in t for v in ('request_wire_b64','response_wire_b64','decision_state_sha256','prior_decision_id','/root/','/v2/test/revoke')):hold('PRIVATE_TRACE')
    if 'No public live evaluator' not in method or 'No independent physical effect oracle' not in method:hold('METHOD_BOUNDARY')
    print('PUBLIC_STATIC_DATA_SEMANTICS=PASS CASES=15 FACT_CERTIFICATES=0')
    print('STATIC_FILE_SHA256=PASS FILES=4')
    print('LIMITATION=NO_EXTERNAL_ENGINE_REPRODUCTION_OR_PHYSICAL_ORACLE')
if __name__=='__main__':
    try:main()
    except Exception as e:
        print(str(e) if str(e).startswith('HOLD=') else 'HOLD=VERIFY_'+type(e).__name__,file=sys.stderr);sys.exit(2)