#!/usr/bin/env python3
"""V009D.2 identity/precommit verifier (existence-only timestamp REMOVED).

Timestamp crypto is performed by D_VERIFIER/verify_rfc3161.py.
"""
from __future__ import annotations

import hashlib
import json
import sys
from pathlib import Path

EXPECTED_CORE = "9698dec931047ba3e022a882f4563b63b7e5a5a9ed0f1ae9c4bf7eb13ab7b720"
EXPECTED_LM = "a072820df215850e4de545f1d37fdba3572579fac5d11d16e5582e38e2a5ce93"
EXPECTED_COMP = "ecae625ba78f818739c8bdd5554e10ac973dd4be078b3a7f38b5223ef019b653"
EXPECTED_PRE = "737de14bac0f55bf3d89c691cbe40b3cea83a42f51fb6620443d56bc01c5fab1"


def main() -> int:
    pkg = Path(__file__).resolve().parent.parent
    out = {"OVERALL": "FAIL", "PRIVATE_PROGRAM_ZK": "PENDING", "GENESIS_TIMESTAMP": "DEFERRED_TO_RFC3161_STRICT"}
    gen = json.loads((pkg / "genesis" / "GENESIS.json").read_text(encoding="utf-8"))
    st = json.loads((pkg / "status.json").read_text(encoding="utf-8"))
    if gen.get("core_edge_master_root") != EXPECTED_CORE or st.get("core_edge_master_root") != EXPECTED_CORE:
        out["error"] = "core root mismatch"
        print(json.dumps(out, indent=2))
        return 1
    if gen.get("live_management_master_root") != EXPECTED_LM:
        out["error"] = "management root mismatch"
        print(json.dumps(out, indent=2))
        return 1
    if gen.get("current_live_composite_root") != EXPECTED_COMP:
        out["error"] = "composite root mismatch"
        print(json.dumps(out, indent=2))
        return 1
    if gen.get("CORE_ONLY_FALLBACK_ALLOWED") != "NO":
        out["error"] = "core-only fallback allowed"
        print(json.dumps(out, indent=2))
        return 1
    if gen.get("PROSPECTIVE_COMPUTATION_SCOPE") != "FULL_FROZEN_FLOW_WITH_MANAGEMENT":
        out["error"] = "scope mismatch"
        print(json.dumps(out, indent=2))
        return 1
    d1 = pkg / "v009d1_bridge" / "V009D1_SUPERSESSION.json"
    if not d1.exists():
        out["error"] = "missing V009D1 supersession"
        print(json.dumps(out, indent=2))
        return 1
    can = (pkg / "precommit" / "TOX_V009D2_FULL_FLOW_PRECOMMIT.canonical").read_bytes()
    sid = (pkg / "precommit" / "TOX_V009D2_FULL_FLOW_PRECOMMIT.sha256").read_text().strip().split()[0]
    got = hashlib.sha256(b"TOX_V009D2_FULL_FLOW_PRECOMMIT_v1|" + can).hexdigest()
    if got != sid or sid != EXPECTED_PRE or sid != gen.get("genesis_precommit_sha256"):
        out["error"] = "precommit sha mismatch"
        print(json.dumps(out, indent=2))
        return 1
    # receipts must exist (crypto checked elsewhere)
    a = pkg / "genesis" / "timestamp_receipts" / "ANCHOR_A_RECEIPT.tsr"
    b = pkg / "genesis" / "timestamp_receipts" / "ANCHOR_B_RECEIPT.tsr"
    if not a.exists() or not b.exists():
        out["error"] = "missing anchors"
        print(json.dumps(out, indent=2))
        return 1
    out.update(
        {
            "OVERALL": "PASS",
            "FULL_FLOW_PRECOMMIT_BEFORE_OBSERVATIONS": "YES",
            "MASTER_ROOT": "PASS",
            "MANAGEMENT_ROOT": "PASS",
            "COMPOSITE_ROOT": "PASS",
            "PRECOMMIT": "PASS",
            "RECEIPTS_PRESENT": "YES",
            "GENESIS_TIMESTAMP": "DEFERRED_TO_RFC3161_STRICT",
            "PRIVATE_PROGRAM_ZK": "PENDING",
        }
    )
    print(json.dumps(out, indent=2))
    return 0


if __name__ == "__main__":
    raise SystemExit(main())
