"""Pure offline asset verification, including the immutable old 208-asset seal."""
from pathlib import Path
import json,hashlib,stat
HERE=Path(__file__).resolve().parent
OLD=HERE.parent/'parallel-ai-core-scan-pay-20261011'
RAW=Path('/tmp/cdx-ai-core-direct002-20261011')
def load(p):return json.loads(p.read_text())
def sha(p):return hashlib.sha256(p.read_bytes()).hexdigest()
checks=0
def need(ok,label):
 global checks
 checks+=1
 if not ok:raise AssertionError(label)
manifest=OLD/'manifest.json'
need(sha(manifest)=='cfda90d3fb84df1c73920f7b831c64d85e28bdfbd4a4b965086fe05a96d57b15','Old manifest byte exact immutable')
old=load(manifest);oldcount=0
for root,entries in [(OLD,old['public_files'])]+[(Path(g['root']),g['files']) for g in old['canonical_private_groups'].values()]:
 for e in entries:
  p=root/e['path'];need(p.is_file() and not p.is_symlink() and sha(p)==e['sha256'] and p.stat().st_size==e['bytes'] and oct(stat.S_IMODE(p.stat().st_mode))==e['mode'],'Every old208 asset SHA/bytes/mode');oldcount+=1
need(oldcount==208,'Old complete208 count')
pins=load(HERE/'source-frozen-sha.json')['files'];need(len(pins)==6168,'Source6168')
for lane in ['B','C']:
 p=RAW/f'private-{lane}-final';s=load(p/'source-actual-fileset.json');need(s['actual_regular_files']==6168 and s['appledouble_magic_count']==0 and set(s['files'])==set(pins),'Actual complete source set and magic0 '+lane)
 for n,h in pins.items():need(s['files'][n]['sha256']==h and not any(v.startswith('._') for v in Path(n).parts),'Every actual source SHA/name '+lane)
 w=load(p/'wire.json');pre=load(p/'included-before-send.json')
 for n,h in pre.items():need(w['included_source_sha256'][n]==pins[n]==h,'Before-send includes exact frozen source')
 need(len(w['included_source_sha256'])==212,'Actual included212')
 need(load(p/'observer-tests.json')['order']==['save','send','observe','error'],'Source-format response observer error isolation')
 need(load(p/'cache-cleanup.json')['shared_cache_touched'] is False and len(load(p/'cache-cleanup.json')['own_cache_files_removed'])==3,'Only three exact own cache files cleaned')
 for f in (p/'cache-cleanup.json').parent.rglob('*'):
  if f.is_file():need(not f.is_symlink(),'No private evidence symlink')
frozen=load(HERE/'pre-HTTP-tool-freeze.json')
for n,v in frozen['files'].items():need(sha(HERE/n)==v['sha256'] and (HERE/n).stat().st_size==v['bytes'],'Pre-HTTP tool/oracle freeze unchanged '+n)
print(json.dumps({'checks':checks,'old_assets_immutable':oldcount,'actual_source_files_each':6168,'actualincluded_each':212,'SQL':0,'HTTP':0},indent=2))