#!/usr/bin/env python3
"""Verify files in the credential-redacted research master. Offline; standard library only."""
from pathlib import Path
import hashlib
import json
import sys

def main() -> int:
    root = Path(__file__).resolve().parent.parent
    try:
        manifest = json.loads((root / "BUNDLE_SHA256.json").read_text(encoding="utf-8"))
    except (OSError, ValueError) as exc:
        print(f"Cannot read bundle manifest: {exc}", file=sys.stderr)
        return 2
    failures = []
    for relative, expected in manifest.items():
        path = (root / relative).resolve()
        if not path.is_relative_to(root):
            failures.append(f"UNSAFE PATH: {relative}")
            continue
        try:
            digest = hashlib.sha256(path.read_bytes()).hexdigest()
        except OSError:
            failures.append(f"MISSING: {relative}")
            continue
        if digest != expected:
            failures.append(f"CHANGED: {relative}")
    if failures:
        print("\n".join(failures))
        return 1
    print(f"PASS: {len(manifest)} stored files match the bundle manifest.")
    return 0

if __name__ == "__main__":
    raise SystemExit(main())