#!/usr/bin/env python3
"""Standalone verifier for the AGENTIC 75 product evidence bundle.

Imports no CAIN code. Standard library only. Run:
    python3 verify_agentic75.py

Checks:
  1. CATALOG.json has 75 unique SKUs and the status counts add up.
  2. Every DELIVERABLE SKU is in SELFTEST.json and verified.
  3. Every sample delivery manifest re-hashes to its report.md and findings.json.
  4. The manifest says unsigned, not a signature.
"""
import hashlib
import json
import sys
from pathlib import Path

HERE = Path(__file__).resolve().parent
bad = []

def sha(p):
    h = hashlib.sha256()
    with p.open("rb") as f:
        for c in iter(lambda: f.read(1 << 20), b""):
            h.update(c)
    return h.hexdigest()

def check(name, ok, why=""):
    print(("PASS  " if ok else "FAIL  ") + name + (("  -- " + why) if why and not ok else ""))
    if not ok:
        bad.append(name)

cat = json.loads((HERE / "CATALOG.json").read_text())
prods = cat.get("products", [])
check("catalog has 75 products", len(prods) == 75, str(len(prods)))
skus = [p.get("sku") for p in prods]
check("SKUs are unique", len(set(skus)) == 75)
counts = cat.get("counts", {})
check("status counts add to 75", sum(counts.values()) == 75, str(counts))
check("status vocabulary", set(counts) == {"DELIVERABLE", "PILOT", "ADVISORY", "DESIGN"})
check("DELIVERABLE count matches", counts.get("DELIVERABLE") == sum(1 for p in prods if p["status"] == "DELIVERABLE"))

st = json.loads((HERE / "SELFTEST.json").read_text())
results = st.get("results", [])
check("engine-backed results match DELIVERABLE", len(results) == counts.get("DELIVERABLE"), str(len(results)))
check("every engine-backed result verified", all(r.get("verified") for r in results))
check("every result names an engine", all(r.get("engine") for r in results))

for sku in st.get("samples", []):
    d = HERE / "deliveries" / sku
    m = json.loads((d / "manifest.json").read_text())
    for name, spec in (m.get("artifacts") or {}).items():
        f = d / name
        check(f"{sku}/{name} exists", f.is_file())
        if f.is_file():
            check(f"{sku}/{name} sha256", sha(f) == spec.get("sha256"))
            check(f"{sku}/{name} bytes", f.stat().st_size == spec.get("bytes"))
    check(f"{sku} manifest unsigned", m.get("signed") is False)

print()
print(f"{len(bad)} failure(s)")
sys.exit(1 if bad else 0)