#!/usr/bin/env python3
"""Cold, dependency-free verifier for the TELOS v2 evidence capsule."""
import argparse,base64,hashlib,json
from pathlib import Path
from ed25519_pure import verify as ed25519_verify
ROOT=Path(__file__).resolve().parent
C=lambda o: json.dumps(o,sort_keys=True,separators=(",",":"),ensure_ascii=False).encode()
H=lambda b: hashlib.sha256(b).hexdigest()
def check(tamper=False):
    m=json.loads((ROOT/"capsule/signed_capsule_manifest.json").read_text()); sp=m["signed_payload"]
    pub=base64.b64decode(m["public_key"]); errors=[]
    if not ed25519_verify(base64.b64decode(m["signature"]),C(sp),pub): errors.append("manifest_signature")
    for rel,expected in sp["artifacts"].items():
        p=ROOT/rel
        if not p.exists() or H(p.read_bytes())!=expected: errors.append("artifact:"+rel)
    recs=[json.loads((ROOT/p).read_text()) for p in sp["receipt_paths"]]
    if tamper and len(recs)>2: recs[len(recs)//2]["signed_payload"]["public_description"] += " [TAMPERED]"
    prev=None
    for i,r in enumerate(recs):
        if r["sequence"]!=i or r["prev_hash"]!=prev: errors.append(f"chain:{i}")
        x=dict(r); got=x.pop("entry_hash",None)
        if H(C(x))!=got: errors.append(f"entry_hash:{i}")
        if not ed25519_verify(base64.b64decode(r["signature"]),C(r["signed_payload"]),pub): errors.append(f"leaf_signature:{i}")
        prev=got
    if prev!=sp["capsule_head"]: errors.append("capsule_head")
    valid=not errors
    print(json.dumps({"valid":valid,"tamper_mode":tamper,"receipt_count":len(recs),"signer_fingerprint":H(pub),"capsule_head":sp["capsule_head"],"errors":errors},sort_keys=True))
    return valid
if __name__=="__main__":
    a=argparse.ArgumentParser(); a.add_argument("--tamper",action="store_true"); x=a.parse_args(); ok=check(x.tamper)
    raise SystemExit(0 if (ok and not x.tamper) or ((not ok) and x.tamper) else 1)
