#!/usr/bin/env python3
"""Verify committed repository payload on any clone, without data or model imports."""
import hashlib
from pathlib import Path
import sys

root = Path(__file__).resolve().parents[1]
manifest = root / "registry/repository-files.sha256"
errors, count = [], 0
for line in manifest.read_text(encoding="utf-8").splitlines():
    digest, name = line.split("  ", 1)
    path = Path(name)
    if path.is_absolute() or ".." in path.parts:
        errors.append("unsafe path: " + name)
        continue
    target = root / path
    count += 1
    if not target.is_file() or hashlib.sha256(target.read_bytes()).hexdigest() != digest:
        errors.append(name)
print(f"verified={count} mismatches={len(errors)}")
for error in errors:
    print(error)
sys.exit(int(bool(errors)))