from pathlib import Path
import subprocess, hashlib, tempfile, os, json
out=Path(__file__).resolve().parent
root=Path('/mnt/storage/src/mosaic-stack-rocko-178')
paths=subprocess.check_output(['git','diff','--cached','--name-only'],cwd=root,text=True).splitlines()
assert len(paths)==11,paths
assert not subprocess.check_output(['git','diff','--name-only'],cwd=root), 'unstaged source changes'
subprocess.run(['git','diff','--cached','--check'],cwd=root,check=True)
(out/'base.txt').write_text(subprocess.check_output(['git','rev-parse','HEAD'],cwd=root,text=True))
(out/'changed-paths.txt').write_text('\n'.join(paths)+'\n')
(out/'build.patch').write_bytes(subprocess.check_output(['git','diff','--cached','--binary'],cwd=root))
manifest=''
for p in paths:
 raw=(root/p).read_bytes()
 assert raw==subprocess.check_output(['git','show',':'+p],cwd=root),p
 manifest+=hashlib.sha256(raw).hexdigest()+'  '+p+'\n'
(out/'candidate-manifest.sha256').write_text(manifest)
(out/'candidate.txt').write_text(hashlib.sha256(manifest.encode()).hexdigest()+'\n')
fd,idx=tempfile.mkstemp(prefix='verify-index-',dir='/mnt/storage/scratch/rocko-178');os.close(fd);os.unlink(idx)
env={**os.environ,'GIT_INDEX_FILE':idx}
try:
 subprocess.run(['git','read-tree',(out/'base.txt').read_text().strip()],cwd=root,env=env,check=True)
 subprocess.run(['git','apply','--cached',str(out/'build.patch')],cwd=root,env=env,check=True)
 for p in paths:
  assert subprocess.check_output(['git','show',':'+p],cwd=root,env=env)==(root/p).read_bytes(),p
finally:Path(idx).unlink(missing_ok=True)
pins=[]
for p in ['packages/bus/src/human.mjs','packages/bus/src/human-cli.mjs','packages/cli/src/transport.mjs','packages/webui/src/bus.mjs','packages/bus/tests/channel-proof.test.mjs']:
 raw=(root/p).read_bytes();assert raw==subprocess.check_output(['git','show','HEAD:'+p],cwd=root)
 pins.append({'path':p,'sha256':hashlib.sha256(raw).hexdigest(),'unchanged':True})
(out/'pins.json').write_text(json.dumps(pins,indent=2)+'\n')
(out/'verification.json').write_text(json.dumps({'staged_worktree_reconstructed_paths':len(paths),'pins_unchanged':len(pins),'source_commits':0},indent=2)+'\n')
print('VERIFIED',len(paths),'paths; candidate',hashlib.sha256(manifest.encode()).hexdigest())