verify_package.py

#!/usr/bin/env python3
"""Verify static Space metadata, file hashes, source pins, and inert content."""

from __future__ import annotations

import hashlib
import json
import re
import sys
from pathlib import Path


PACKAGE = Path(__file__).resolve().parent
MANIFEST = json.loads((PACKAGE / "hash_manifest.json").read_text(encoding="utf-8"))
MINIMUM_PAGES_TEXT_CHARACTERS = 200


def sha256(path: Path) -> str:
    digest = hashlib.sha256()
    with path.open("rb") as handle:
        for block in iter(lambda: handle.read(1024 * 1024), b""):
            digest.update(block)
    return digest.hexdigest()


def check(condition: bool, message: str) -> bool:
    if condition:
        print(f"PASS {message}")
        return True
    print(f"FAIL {message}", file=sys.stderr)
    return False


def front_matter(text: str) -> dict[str, str]:
    lines = text.splitlines()
    if not lines or lines[0] != "---":
        return {}
    values: dict[str, str] = {}
    for line in lines[1:]:
        if line == "---":
            return values
        if ":" in line:
            key, value = line.split(":", 1)
            values[key.strip()] = value.strip().strip('"')
    return {}


def front_matter_tags(text: str) -> set[str]:
    lines = text.splitlines()
    if not lines or lines[0] != "---":
        return set()
    tags: set[str] = set()
    reading_tags = False
    for line in lines[1:]:
        if line == "---":
            return tags
        if line == "tags:":
            reading_tags = True
            continue
        if reading_tags and line.startswith("  - "):
            tags.add(line.removeprefix("  - ").strip())
            continue
        if line and not line.startswith(" "):
            reading_tags = False
    return tags


def pages_markdown_files(package: Path = PACKAGE) -> list[Path]:
    pages_directory = package / "pages"
    return sorted(path for path in pages_directory.glob("**/*.md") if path.is_file())


def stripped_markdown(text: str) -> str:
    text = re.sub(r"\[([^\]]+)\]\([^)]*\)", r"\1", text)
    text = re.sub(r"`([^`]*)`", r"\1", text)
    text = re.sub(r"(?m)^\s{0,3}[#>*-]+\s?", "", text)
    return re.sub(r"\s+", " ", text).strip()


def mapped_author_claims(page_files: list[Path]) -> list[str]:
    claims: list[str] = []
    pattern = re.compile(r"^## Author claim mapped\s*$\n(.*?)(?=^## |\Z)", re.MULTILINE | re.DOTALL)
    for page in page_files:
        match = pattern.search(page.read_text(encoding="utf-8"))
        if match:
            claims.append(stripped_markdown(match.group(1)))
    return claims


def main() -> int:
    checks: list[bool] = []
    required = ["README.md", "index.html", "styles.css", "LICENSE", "hash_manifest.json", "verify_package.py"]
    required.extend(MANIFEST["mapped_claim_pages"])
    checks.append(check(all((PACKAGE / item).is_file() for item in required), "required static files exist"))

    metadata = front_matter((PACKAGE / "README.md").read_text(encoding="utf-8"))
    checks.append(check(metadata.get("sdk") == "static", "README sdk is static"))
    checks.append(check(metadata.get("app_file") == "index.html", "README app_file is index.html"))
    discovery_tags = set(MANIFEST["required_discovery_tags"])
    checks.append(check(discovery_tags.issubset(front_matter_tags((PACKAGE / "README.md").read_text(encoding="utf-8"))), "README has required discovery tags"))

    page_files = pages_markdown_files()
    page_text = "\n".join(stripped_markdown(page.read_text(encoding="utf-8")) for page in page_files)
    checks.append(check(bool(page_files), "pages Markdown inputs exist"))
    checks.append(check(len(page_text) >= MINIMUM_PAGES_TEXT_CHARACTERS, "pages stripped Markdown meets minimum length"))
    mapped_pages = set(MANIFEST["mapped_claim_pages"])
    actual_page_paths = {page.relative_to(PACKAGE).as_posix() for page in page_files}
    checks.append(check(mapped_pages.issubset(actual_page_paths), "mapped claim pages are judge inputs"))
    claims = mapped_author_claims(page_files)
    checks.append(check(len(claims) == len(mapped_pages) and len(claims) == len(set(claims)), "claim wording is complete and non-duplicated"))
    checks.append(check(not (PACKAGE / "claims").exists(), "no duplicate legacy claim directory"))

    allowlist = set(MANIFEST["public_release_allowlist"])
    actual_files = {
        path.relative_to(PACKAGE).as_posix()
        for path in PACKAGE.rglob("*")
        if path.is_file() and "__pycache__" not in path.parts
    }
    checks.append(check(actual_files == allowlist, "public release allowlist is exact"))

    for relative, expected in MANIFEST["package_file_sha256"].items():
        path = PACKAGE / relative
        checks.append(check(path.is_file() and sha256(path) == expected, f"hash matches: {relative}"))

    source_artifacts = MANIFEST["official_source_artifacts"]
    checks.append(check(MANIFEST["claim_feed"]["immutable_revision"] == "arXiv:2606.21528v1", "claim-feed revision is pinned"))
    checks.append(check(all(item.get("sha256") and item.get("etag") for item in source_artifacts), "source hashes and ETags are pinned"))
    checks.append(check(MANIFEST["package"]["evidence_tier"] == "source/theorem crosswalk", "evidence tier is explicit"))
    checks.append(check(not MANIFEST["package"]["redistributes_paper_or_source_archive"], "no paper or source archive redistribution"))

    package_text = "\n".join(
        path.read_text(encoding="utf-8")
        for path in PACKAGE.rglob("*")
        if path.is_file() and path.suffix in {".md", ".html", ".css", ".json"}
    )
    forbidden = ["/" + "Users/", "file:" + "//", "<" + "script", "javascript" + ":", "hf" + "_"]
    checks.append(check(not any(token in package_text for token in forbidden), "no private paths, tokens, or active content markers"))

    if all(checks):
        print("PASS static release candidate is internally consistent")
        return 0
    return 1


if __name__ == "__main__":
    raise SystemExit(main())