"""Read-only verification of an EXISTING Paper VIII certificate directory.
No generating replacement rows before validation. Reject unlisted files, duplicate
keys, symbolic links, wrong constants, malformed rows and tampered manifest data.
python verify_external_bundle.py PATH_TO_CERTIFICATE_DIRECTORY
"""
from pathlib import Path
from hashlib import sha256
from collections import Counter
import argparse
import json
import sys
import omega_reference_checker as ref

def require(ok,message):
    if not ok:raise ValueError(message)

def load_json(text):
    def pairs(items):
        d={}
        for k,v in items:
            require(k not in d,'duplicate JSON key');d[k]=v
        return d
    def bad(x):raise ValueError('nonfinite JSON token '+x)
    return json.loads(text,object_pairs_hook=pairs,parse_constant=bad)

def compare(a,b,message):require(ref.canonical(a)==ref.canonical(b),message)

def verify(folder):
    folder=Path(folder)
    expected_names={'CERTIFICATE.json'}|{f'block_{j:02d}.jsonl' for j in range(32)}
    require(folder.is_dir() and not folder.is_symlink(),'regular certificate directory required')
    require({p.name for p in folder.iterdir()}==expected_names,'missing or extra certificate file')
    for name in expected_names:
        p=folder/name;require(p.is_file() and not p.is_symlink(),'regular non-symlink files required')
    certificate=load_json((folder/'CERTIFICATE.json').read_bytes())
    require(type(certificate) is dict,'manifest object required')
    blocks=certificate.get('blocks');require(type(blocks) is list and len(blocks)==32,'32 manifest blocks required')
    observed=[];hist=Counter();images=Counter();transitions=0
    for job in range(32):
        name=f'block_{job:02d}.jsonl';data=(folder/name).read_bytes()
        rows=[load_json(line) for line in data.splitlines()]
        depths=ref.check_block(rows,job);hist.update(depths);transitions+=sum(depths)
        count=len({ref.step(d) for d in range(job*1024,(job+1)*1024)});images[count]+=1
        block={'index':job,'start':job*1024,'end':(job+1)*1024-1,'rows':1024,'images':count,'file':name,'sha256':sha256(data).hexdigest()}
        compare(blocks[job],block,'block metadata or hash mismatch');observed.append(block)
    # Check every other manifest claim against exact recomputation. Structure below
    # matches the frozen reference generator, including rejection-control outcomes.
    expected=expected_manifest(observed,hist,images)
    compare(certificate,expected,'manifest contents differ from recomputed predicates')
    return {'status':'PASS','rows':32768,'transitions':transitions,'blocks':32,'monomials':56,
            'certificate_sha256':sha256((folder/'CERTIFICATE.json').read_bytes()).hexdigest()}

def expected_manifest(blocks,hist,images):
    require([hist[i] for i in range(11)]==ref.EXPECTED_DEPTHS,'wrong depth histogram')
    require(images=={348:9,349:23},'wrong block image counts')
    return {'schema':'OMEGA_PAPER_VIII_CERTIFICATE/1.0','result':'PASS',
            'map':{'Q':ref.Q,'S':ref.S},'domain':{'first':0,'last':ref.N},
            'checker_sha256':sha256(Path(ref.__file__).read_bytes()).hexdigest(),
            'arithmetic':ref.arithmetic(),'cubature':ref.cubature(),
            'depth_histogram':ref.EXPECTED_DEPTHS,'ledger_rows':ref.N+1,
            'ledger_steps':sum(k*v for k,v in hist.items()),
            'rejected_controls':ref.rejection_controls(),'blocks':blocks}

if __name__=='__main__':
    parser=argparse.ArgumentParser(description=__doc__);parser.add_argument('directory');args=parser.parse_args()
    try: print(json.dumps(verify(args.directory),sort_keys=True));sys.exit(0)
    except (ValueError,TypeError,KeyError,OSError) as e:print('FAIL:',e,file=sys.stderr);sys.exit(1)