#!/usr/bin/env python3
"""Verify the KEYSTONE codebase-scan bundle. Python 3.8+ and `cryptography`; no CAIN code.

  python3 verify_bundle.py https://clawx.click/evidence/keystone-codebase-scan-2026-10-15/ [--root-key B64] [--keystone-key B64]

Checks: MANIFEST.json signed by the CAIN-42 evidence-root key; every file's SHA-256; the summary's counts
recomputed from findings.json; every KEYSTONE record's Ed25519 signature over its record_hash (pinned KEYSTONE
key, published at https://cainstudio.online/keystone/public-key) and its chain link to the previous record; the
KEYSTONE tally recomputed from the records. The source code in each record is withheld, so record_hash itself
cannot be recomputed here -- only its signature and the chain.
"""
import base64, collections, hashlib, json, os, sys, urllib.request
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey

def get(base, name):
    if base.startswith("http"):
        with urllib.request.urlopen(base.rstrip("/") + "/" + name, timeout=60) as r:
            return r.read()
    return open(os.path.join(base, name), "rb").read()

def sig_ok(pub, sig, data):
    try:
        Ed25519PublicKey.from_public_bytes(base64.b64decode(pub)).verify(base64.b64decode(sig), data)
        return True
    except Exception:
        return False

def main(a):
    base = a[0]
    rk = a[a.index("--root-key") + 1] if "--root-key" in a else None
    kk = a[a.index("--keystone-key") + 1] if "--keystone-key" in a else None
    ok = True
    def check(n, g, d=""):
        nonlocal ok
        ok &= bool(g)
        print(f"  [{'PASS' if g else 'FAIL'}] {n}" + (f" -- {d}" if d else ""))
    raw = get(base, "MANIFEST.json"); s = json.loads(get(base, "MANIFEST.sig.json"))
    dg = hashlib.sha256(raw).hexdigest()
    check("manifest digest", dg == s["manifest_sha256"])
    check("manifest signed by the evidence-root key" + ("" if rk else " (NOT pinned: pass --root-key)"),
          sig_ok(rk or s["evidence_root_public_key_b64"], s["signature_b64"], dg.encode()))
    man = json.loads(raw); files = {}
    for n, h in sorted(man["files"].items()):
        files[n] = get(base, n)
        check(f"sha256 {n}", hashlib.sha256(files[n]).hexdigest() == h)
    summ = json.loads(files["summary.json"]); fnd = json.loads(files["findings.json"])
    per = collections.defaultdict(set)
    for f in fnd["findings"]:
        per[f["path"]].add(f["severity"])
    stub = sum(1 for v in per.values() if "CRITICAL" in v)
    g = summ["falsework"]["grades"]
    check("FALSEWORK grades recomputed from findings",
          (g["STUB"], g["PARTIAL"], g["REAL"]) == (stub, len(per) - stub, summ["falsework"]["files_scanned"] - len(per)))
    recs = json.loads(files["keystone_records.json"])
    prev = None; tally = collections.Counter()
    for r in recs:
        check(f"KEYSTONE #{r['sequence']} signature", sig_ok(kk or r["public_key_b64"], r["signature_b64"], r["record_hash"].encode()))
        if prev is not None:
            check(f"KEYSTONE #{r['sequence']} chains to #{prev['sequence']}", r["prev_record_hash"] == prev["record_hash"])
        prev = r; tally[r["verdict"]] += 1
    check("KEYSTONE tally recomputed from records", dict(tally) == summ["keystone"]["by_verdict"])
    prev = hashlib.sha256(b"CAIN42/CODEBASE-SELF-CHECK/TICK/v1").hexdigest(); n = 0; good = True
    for ln in files["ticks.jsonl"].decode().splitlines():
        t = json.loads(ln); h = t.pop("hash"); n += 1
        good &= t["prev"] == prev and t["n"] == n and \
            hashlib.sha256(json.dumps(t, sort_keys=True, separators=(",", ":")).encode()).hexdigest() == h
        prev = h
    sc = summ.get("self_check", {})
    check(f"42-second self-check: {n} ticks, every one chained to the previous", good and n == sc.get("ticks") and
          (n == 0 or prev == sc.get("chain_head")))
    if not kk:
        print("  note: KEYSTONE key NOT pinned: pass --keystone-key")
    print("VERIFIED" if ok else "NOT VERIFIED")
    return 0 if ok else 1

if __name__ == "__main__":
    sys.exit(main(sys.argv[1:]))