"""Integrity-only sample verification, not ERS/TSA validation. Python 3 stdlib."""
import pathlib,json,hashlib,sys
root=pathlib.Path(sys.argv[1]).resolve()
manifest=json.loads((root/'manifest.json').read_text())
expected={x['path'] for x in manifest['files']}
actual={str(p.relative_to(root)) for p in root.rglob('*') if p.is_file()}-{'manifest.json','README.md'}
if actual != expected: raise SystemExit('FAIL: file inventory mismatch')
for item in manifest['files']:
 p=(root/item['path']).resolve()
 if root not in p.parents: raise SystemExit('FAIL: unsafe path')
 data=p.read_bytes()
 if len(data)!=item['bytes'] or hashlib.sha256(data).hexdigest()!=item['sha256']: raise SystemExit('FAIL: '+item['path'])
print('PASS: sample byte integrity only; no trusted timestamp or ERS validated')