#!/usr/bin/env python3
"""Sixth handoff: fresh artifact integrity checks; no research calculations rerun."""
from pathlib import Path
from hashlib import sha256
import io, json, zipfile

ROOT = Path(__file__).resolve().parents[2]
OUT = Path(__file__).resolve().parent
def digest(b): return sha256(b).hexdigest()
def meta(path):
    p=ROOT/path; b=p.read_bytes()
    return {'path':str(path),'bytes':len(b),'sha256':digest(b),'readable':True}
def entries(man):
    f=man['files']
    return [dict(v,path=k) for k,v in f.items()] if isinstance(f,dict) else f
def verify_zip_data(label,b,manifest=None,prefix=''):
    with zipfile.ZipFile(io.BytesIO(b)) as z:
        names=[i.filename for i in z.infolist() if not i.is_dir()]
        assert len(names)==len(set(names)),label
        assert z.testzip() is None,label
        r={'path':label,'bytes':len(b),'sha256':digest(b),'members':len(names),'zip_crc_passed':True}
        if manifest:
            raw=z.read(manifest); man=json.loads(raw); rows=entries(man)
            for row in rows:
                data=z.read(prefix+row['path'])
                assert digest(data)==row['sha256'],(label,row['path'],'hash')
                assert len(data)==row['bytes'],(label,row['path'],'bytes')
            listed={prefix+row['path'] for row in rows}
            assert listed==set(names)-{manifest},(label,'manifest scope')
            r.update(manifest=manifest,manifest_sha256=digest(raw),manifest_payloads_verified=len(rows),manifest_covers_every_other_payload=True)
        return r

result={'audit':'Sixth handoff C479 fresh access and archive integrity','date_UTC':'2026-09-25',
        'research_reexecuted':False,'verification_kind':'Read bytes, SHA256, ZIP CRC, manifests and certificate bindings; historical research conclusions not re-proved.'}
controls=[
 ('File_18','project_sources/40-File_18.Chronological_Data_Tables-20260919-141048-.md','68301ab760bfbe2e874aedc5c8d943ced7a6219d34bc2859332a70713f9630d5'),
 ('File_09','project_sources/32-File_09.Cumulative_Architecture-9-.md','45851004c5864229ebf6a896f9099819a08d8926715d3e97e4bc3985c4a3876e'),
 ('C265_certificate','active_c265/active/latest/C265/CERTIFICATE.json','112bdcdd23e7580512f6b6a1c4222f746e6552f71b92755932397dbd25dce2de'),
 ('C127_graph','active_c265/active/graph/C127_GRAPH.json','d7be8886117c8c550e39f8846862ec613f621c0ed560d4c9d8c89446fae53503'),
 ('C479_certificate','axis_ledger_work/C479/CERTIFICATE.json','ed81ad0635fbdf2d21e17da032c15b384bdb9ded8b500333c548a637f7ce1612')]
result['controls']=[]
for name,p,h in controls:
    r=meta(p); assert r['sha256']==h
    (ROOT/p).read_text(); r.update(control=name,expected_sha256=h,expected_hash_matches=True,text_decoded=True)
    result['controls'].append(r)
graph=json.loads((ROOT/controls[3][1]).read_text())
result['graph_counts']=graph['counts']

cp='active_c265/active/latest/490d_Mirror_Restart_Checkpoint_After_C265_20260923.md'
cp_meta=meta(cp); cp_text=(ROOT/cp).read_text()
active_manifest=json.loads((ROOT/'active_c265/PACKAGE_MANIFEST.json').read_text())
for row in entries(active_manifest):
    data=(ROOT/'active_c265'/row['path']).read_bytes()
    assert len(data)==row['bytes'] and digest(data)==row['sha256'],row['path']
assert cp_meta['sha256']==active_manifest['files'][cp.removeprefix('active_c265/')]['sha256']
result['C265_checkpoint']={**cp_meta,'matches_active_package_manifest':True,'text_decoded':True,'opening':cp_text.splitlines()[0]}
result['extracted_active_C265_manifest']={'payloads_verified':len(entries(active_manifest)),'passed':True}

packet=ROOT/'axis_ledger_work/C479'
art=json.loads((packet/'ARTIFACT_MANIFEST.json').read_text())
for row in entries(art):
    data=(packet/row['path']).read_bytes()
    assert len(data)==row['bytes'] and digest(data)==row['sha256'],row['path']
cert=json.loads((packet/'CERTIFICATE.json').read_text())
for key,p in cert['bindings'].items(): assert digest((packet/p).read_bytes())==cert[key+'_sha256'],key
src=json.loads((packet/'SOURCE_MANIFEST.json').read_text())
for name,row in src.items():
    b=(packet/'sources'/name).read_bytes()
    assert len(b)==row['bytes'] and digest(b)==row['sha256'],name
    assert digest(Path(row['original_workspace_path']).read_bytes())==row['sha256'],name
assert cert['status']=='completed' and cert['next_step_executed'] is False
result['C479_packet']={'payloads_verified':len(entries(art)),'certificate_bindings_verified':len(cert['bindings']),
 'source_snapshots_and_originals_verified':len(src),'status':cert['status'],'next_step_executed':cert['next_step_executed'],
 'checkpoint':meta('axis_ledger_work/C479/'+cert['bindings']['checkpoint']),
 'report':meta('axis_ledger_work/C479/'+cert['bindings']['report'])}
result['C479_packet']['checkpoint']['text_decoded']=True
(packet/cert['bindings']['checkpoint']).read_text()

archives=[
 ('upload/490d_Complete_Study_Handoff_20260917(3).zip','490d_Fresh_Start_20260917/MANIFEST.json','490d_Fresh_Start_20260917/'),
 ('upload/490d_C01_C265_Complete_Window_Archive_20260923(1).zip','PACKAGE_MANIFEST.json',''),
 ('upload/490d_C265_Compact_Restart_Kit_20260923(1).zip','PACKAGE_MANIFEST.json',''),
 ('deliverables/490d_C479_Compact_Restart_Kit_20260925.zip','ARCHIVE_MANIFEST.json',''),
 ('deliverables/490d_C470_C479_Continuation_Archive_20260925.zip','ARCHIVE_MANIFEST.json','')]
result['archives']=[]
for p,manifest,prefix in archives:
    r=verify_zip_data(p,(ROOT/p).read_bytes(),manifest,prefix)
    result['archives'].append(r)
    print(json.dumps(r),flush=True)
sept=result['archives'][0]
assert sept['bytes']==159771259 and sept['sha256']=='a24741428ab6b1f88577b4571597b442dd35d069664e56dd1e29c3c354157a19'
sept['matches_original_expected_size_and_hash']=True
result['September17_supersession']='The intact current original exactly matches the recorded expected 159771259 bytes and SHA256. The September23 handoff warning about the partial local copy is historical and superseded for this attached original.'

result['older_reference_archives']=[]
with zipfile.ZipFile(ROOT/archives[0][0]) as z:
    prefix=archives[0][2]
    idx=json.loads(z.read(prefix+'ARCHIVE_INDEX.json'))
    for row in idx:
        member=prefix+row['path']; b=z.read(member)
        r=verify_zip_data(archives[0][0]+'::'+member,b)
        assert len(b)==row['bytes'] and digest(b)==row['sha256']
        assert r['members']==row['members']
        r.update(matches_archived_expected_hash_and_size=True,archive_key=row['key'],recorded_library_file_id=row['library_file_id'],nested_manifest_status='Not separately audited; whole ZIP hash matches archived index and fresh CRC passes.')
        result['older_reference_archives'].append(r)
with zipfile.ZipFile(ROOT/archives[1][0]) as z:
    names=[i.filename for i in z.infolist() if i.filename.startswith('workspace/upload/') and i.filename.endswith('.zip')]
    for member in names:
        r=verify_zip_data(archives[1][0]+'::'+member,z.read(member))
        r['matches_outer_manifest']=True
        r['nested_manifest_status']='Not separately audited; nested ZIP bytes authenticated by fresh full-window manifest, and fresh nested CRC passes.'
        result['older_reference_archives'].append(r)
    locator=json.loads(z.read('490d_C01_C265_Report_Locator_20260923.json'))
    records=locator['records']; checks=[]
    for row in records:
        # Content availability and exact report bytes; recorded result status remains historical.
        report=z.read(row['full_archive_report'])
        assert digest(report)==row['report_sha256']
        result_obj=json.loads(z.read(row['full_archive_results']))
        checks.append({'step':row['step'],'report':row['full_archive_report'],'report_sha256':digest(report),
            'results':row['full_archive_results'],'result_json_parseable':True})
    assert len(checks)==265
    result['C01_C265_locator_access']={'canonical_reports':len(checks),'reports_match_locator_hashes':True,'result_json_files_accessible':len(checks),
       'locator_sha256':digest(z.read('490d_C01_C265_Report_Locator_20260923.json')),'note':'Exact bytes checked without reading historical report narratives or reexecuting research. Passing scientific-result status remains inherited from the sealed records.','records':checks}

inventory=json.loads((ROOT/'active_c265/PROJECT_SOURCE_INVENTORY.json').read_text())
result['project_sources']=[]
for name,row in inventory.items():
    r=meta('project_sources/'+name)
    assert r['bytes']==row['bytes'] and r['sha256']==row['sha256'],name
    r['matches_C265_inventory']=True
    result['project_sources'].append(r)
result['all_checks_passed']=True
out=OUT/'ACCESS_ARCHIVE_VERIFICATION.json'
out.write_text(json.dumps(result,indent=2)+'\n')
print(json.dumps({'output':str(out),'all_checks_passed':True,'archives':len(result['archives']),'older_reference_archives':len(result['older_reference_archives']),'project_sources':len(result['project_sources'])}),flush=True)