#!/usr/bin/env python3
"""Verify the exact public core snapshot without contacting its private forge."""
import hashlib
import json
from pathlib import Path

root = Path(__file__).resolve().parent.parent
pin = json.loads((root / 'CORE-SNAPSHOT.json').read_text())
snapshot = root / 'crates/sized-core'
actual = {str(p.relative_to(snapshot)): hashlib.sha256(p.read_bytes()).hexdigest()
          for p in snapshot.rglob('*') if p.is_file()}
if actual != pin['files']:
    raise SystemExit('Core snapshot differs from CORE-SNAPSHOT.json; review the upstream pin and every changed file.')
print(f"Core snapshot verified: {pin['revision']} ({len(actual)} files)")