#!/usr/bin/env python3
"""Offline structural/export checks. No network, wallet execution or signature engine.
Usage: python verify-results.py.txt [package-directory] [--report private-report.json]
"""
import argparse, csv, hashlib, json, re
from pathlib import Path

COUNT = 0

def check(condition, message):
    global COUNT
    COUNT += 1
    if not condition:
        raise ValueError(message)

def digest(data):
    return hashlib.sha256(hashlib.sha256(data).digest()).digest()

def compact(n):
    if n < 253: return bytes([n])
    if n <= 0xffff: return b'\xfd' + n.to_bytes(2, 'little')
    if n <= 0xffffffff: return b'\xfe' + n.to_bytes(4, 'little')
    return b'\xff' + n.to_bytes(8, 'little')

class Reader:
    def __init__(self, data): self.data, self.pos = data, 0
    def take(self, n):
        check(n >= 0 and self.pos+n <= len(self.data), 'truncated transaction')
        b=self.data[self.pos:self.pos+n]; self.pos += n; return b
    def num(self, n): return int.from_bytes(self.take(n), 'little')
    def varint(self):
        n=self.num(1)
        if n < 253: return n
        width={253:2,254:4,255:8}[n]; value=self.num(width)
        check(value >= {253:253,254:65536,255:4294967296}[n], 'noncanonical CompactSize')
        check(value <= 1000000, 'unexpectedly large CompactSize')
        return value
    def blob(self): return self.take(self.varint())

def parse_tx(raw_hex):
    raw=bytes.fromhex(raw_hex); r=Reader(raw)
    v=r.take(4); n=r.varint(); witness=False
    if n == 0:
        flag=r.num(1)
        check(flag == 1, 'unsupported transaction flags (MWEB outside scope)')
        witness=True; n=r.varint()
    check(n > 0, 'no transparent inputs')
    vin=[]; vin_raw=[]
    for _ in range(n):
        start=r.pos; prev=r.take(32)[::-1].hex(); index=r.num(4)
        script=r.blob(); sequence=r.num(4)
        vin.append({'txid':prev,'vout':index,'script_sig':script.hex(),'sequence':sequence})
        vin_raw.append(raw[start:r.pos])
    m=r.varint(); outputs=[]; out_raw=[]
    for _ in range(m):
        start=r.pos; value=r.num(8); script=r.blob()
        outputs.append({'value_litoshis':value,'script_pub_key':script.hex()})
        out_raw.append(raw[start:r.pos])
    if witness:
        for item in vin:
            item['witness']=[r.blob().hex() for _ in range(r.varint())]
    lock=r.take(4)
    check(r.pos == len(raw), 'trailing transaction data')
    stripped=v+compact(n)+b''.join(vin_raw)+compact(m)+b''.join(out_raw)+lock
    return {'txid':digest(stripped)[::-1].hex(), 'wtxid':digest(raw)[::-1].hex(),
            'version':int.from_bytes(v,'little',signed=True),'locktime':int.from_bytes(lock,'little'),
            'inputs':vin,'outputs':outputs,'size':len(raw),
            'weight':len(stripped)*3+len(raw),'vsize':(len(stripped)*3+len(raw)+3)//4}

def script_pushes(script):
    r=Reader(bytes.fromhex(script)); stack=[]
    while r.pos < len(r.data):
        op=r.num(1)
        if op <= 75: stack.append(r.take(op))
        elif op == 76: stack.append(r.take(r.num(1)))
        elif op == 77: stack.append(r.take(r.num(2)))
        elif op == 78: stack.append(r.take(r.num(4)))
        else: stack.append(None)
    return stack

def csv_operand(script):
    raw=bytes.fromhex(script); r=Reader(raw); op=r.num(1)
    if 81 <= op <= 96: operand=op-80
    elif op == 0: operand=0
    elif op <= 75:
        b=r.take(op); operand=int.from_bytes(b,'little')
        if b and b[-1] & 128: operand=-(operand & ~(128 << (8*(len(b)-1))))
    else: raise ValueError('unsupported CSV operand encoding')
    check(r.take(3) == b'\xb2\x75\x21', 'expected CSV DROP and compressed public-key push')
    pub=r.take(33)
    check(pub[0] in (2,3), 'expected compressed public key')
    check(r.take(1) == b'\xac' and r.pos == len(raw), 'unexpected CSV script shape')
    return operand

def csv_ok(version, sequence, operand):
    if operand is None: return True
    if operand < 0: return False
    if operand & 0x80000000: return True
    if (version & 0xffffffff) < 2 or sequence & 0x80000000: return False
    mask=0x400000 | 0xffff
    return bool(sequence & 0x400000) == bool(operand & 0x400000) and (sequence & mask) >= (operand & mask)

def admission(value):
    if isinstance(value,str): value=json.loads(value)
    if isinstance(value,list):
        check(len(value)==1,'expected single-candidate admission result'); value=value[0]
    if isinstance(value,dict) and 'stdout' in value:
        return admission(value['stdout'])
    check(isinstance(value,dict) and isinstance(value.get('allowed'),bool), 'missing admission verdict')
    return value

def objects(value):
    if isinstance(value,dict):
        yield value
        for child in value.values(): yield from objects(child)
    elif isinstance(value,list):
        for child in value: yield from objects(child)

def collect_blocks(value):
    records={}
    for item in objects(value):
        if isinstance(item.get('height'),int) and isinstance(item.get('time'),int):
            h=item['height']; t=item['time']
            if h in records: check(records[h]['time']==t, 'inconsistent block timestamp at same height')
            records[h]=item
    return records

def mtp(blocks, height):
    heights=list(range(max(0,height-10),height+1))
    if all(h in blocks for h in heights):
        times=sorted(blocks[h]['time'] for h in heights)
        return times[len(times)//2]
    return None

def flag_privacy(value):
    expanded=list(objects(value))
    for item in list(expanded):
        if isinstance(item.get('stdout'),str):
            try: expanded.extend(objects(json.loads(item['stdout'])))
            except (ValueError,TypeError): pass
    for item in expanded:
        for key,val in item.items():
            if key.lower() in ('rpcpassword','private_key','privkey','seed','mnemonic','cookie') and val:
                check(isinstance(val,str) and any(s in val.lower() for s in ('redact','placeholder','generated','not stored')), 'possible secret field: '+key)
        if item.get('method')=='dumpprivkey':
            check('redact' in str(item.get('stdout','')).lower(), 'unredacted dumpprivkey output')
    text=json.dumps(value)
    check(not re.search(r'-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY',text), 'private-key PEM marker')
    check(not re.search(r'\b(?:xprv|tprv|Ltpv|ltpv)[1-9A-HJ-NP-Za-km-z]{40,}',text), 'extended private-key marker')
    alphabet='123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz'
    for token in re.findall(r'(?<![A-Za-z0-9])[1-9A-HJ-NP-Za-km-z]{51,52}(?![A-Za-z0-9])',text):
        n=0
        for char in token: n=n*58+alphabet.index(char)
        data=b'\0'*(len(token)-len(token.lstrip('1')))+n.to_bytes((n.bit_length()+7)//8,'big')
        is_wif=len(data) in (37,38) and data[0] in (0x80,0xb0,0xef) and digest(data[:-4])[:4]==data[-4:]
        check(not is_wif,'Base58Check private-key material in public JSON')
    check(not re.search(r'__cookie__:[A-Za-z0-9+/=_-]{32,}',text),'possible RPC cookie in public JSON')



def bind_exports(results, trace, folder, parsed, blocks, candidates, byid):
    from decimal import Decimal
    meta=results['metadata']
    check(meta['chain']=='regtest' and meta['externalPeers']==0,'unexpected experiment scope')
    check(meta['coreVersion']=='/LitecoinCore:0.21.5.8/','unexpected declared Core version')
    check(meta['source_commit']=='ec1b6489a900d09cf5991e220dce089c77a232a2','source pin mismatch')
    check(meta['daemonSHA256']=='7430c6d0d4cb59d355361a0b90ffbfc4ac725609483e04c242bf95372cc9b8fe','declared daemon hash mismatch')
    check(meta['cliSHA256']=='6f835854576a473599f89b9842bf7855dabda1183f5a707ac5d5e15aa48761d8','declared CLI hash mismatch')
    check(hashlib.sha256((folder/'relative-lock-test.py.txt').read_bytes()).hexdigest()==meta['runnerSHA256'],'runner export hash mismatch')
    check(results['error'] is None and meta['allAssertionsPassed'] is True,'recorded run incomplete')
    check(all(item['passed'] is True for item in results['checks']),'recorded runtime assertion failed')
    check(results['cleanup']['process_stopped'] and results['cleanup']['temporary_datadir_removed'],'recorded cleanup incomplete')
    funding={}
    for item in results['funding']:
        tx=parse_tx(item['raw_hex'])
        check(tx['txid']==item['txid'],'funding txid mismatch')
        funding[tx['txid']]=tx
        for point in item['outpoints'].values():
            check(point['txid']==tx['txid'],'funding outpoint txid mismatch')
            out=tx['outputs'][point['vout']]
            check(out['value_litoshis']==point['value_litoshis'],'funding outpoint value mismatch')
            check(out['script_pub_key']==point['script_pub_key'],'funding outpoint script mismatch')
    signing_outputs=set()
    for record in objects(trace):
        if str(record.get('method','')).startswith('signrawtransaction') and record.get('exitCode')==0:
            try: out=json.loads(record['stdout'])
            except (ValueError,TypeError): continue
            if isinstance(out,dict) and out.get('complete') is True: signing_outputs.add(out.get('hex'))
    for cid,c in candidates.items():
        if not c.get('redeem_script'):
            check(c['raw_hex'] in signing_outputs,cid+': exact ordinary candidate absent from complete Core signing result')
        else:
            # CSV fixtures are manually signed by the public runner, not by a wallet RPC.
            # Check encoding/commitment only; this does not verify ECDSA correctness.
            signature=script_pushes(parsed[cid]['inputs'][0]['script_sig'])[0]
            check(signature is not None and 9<=len(signature)<=73,cid+': missing DER signature encoding')
            check(signature[-1]==1 and signature[0]==0x30 and signature[1]==len(signature)-3,cid+': expected DER SIGHASH_ALL encoding')
            check(signature[2]==2,cid+': missing DER R integer')
            rlen=signature[3]; spos=4+rlen
            check(spos+2<len(signature) and signature[spos]==2,cid+': missing DER S integer')
            check(spos+2+signature[spos+1]==len(signature)-1,cid+': DER integer-length mismatch')
        tx=parsed[cid]; point=c['point']; parent=funding[point['txid']]
        check(hashlib.sha256(bytes.fromhex(c['raw_hex'])).hexdigest()==c['sha256'],cid+': signed-byte SHA256 mismatch')
        source=parent['outputs'][point['vout']]
        check(source['script_pub_key']==point['script_pub_key'],cid+': actual funding script mismatch')
        check(source['value_litoshis']==point['value_litoshis']==100000000,cid+': funding must be exactly one LTC')
        check(len(tx['outputs'])==1 and tx['outputs'][0]['value_litoshis']==99990000,cid+': sole output must be 0.9999 LTC')
        check(source['value_litoshis']-sum(o['value_litoshis'] for o in tx['outputs'])==c['fee_litoshis']==10000,cid+': raw fee mismatch')
        decoded=c['decoded']
        for field in ('txid','version','locktime','size','weight','vsize'):
            check(decoded[field]==tx[field],cid+': recorded decode '+field+' mismatch')
        check(decoded['hash']==tx['wtxid'],cid+': recorded decode wtxid mismatch')
        for a,b in zip(tx['inputs'],decoded['vin']):
            check((a['txid'],a['vout'],a['sequence'])==(b['txid'],b['vout'],b['sequence']),cid+': decoded input mismatch')
    records=list(objects(trace)); tip=None; endpoint=None; clock=None
    observed=[]; generated=[]; header_records={}; block_records={}
    for item in records:
        method=item.get('method')
        if method is None: continue
        out=None
        if item.get('exitCode')==0:
            try: out=json.loads(item['stdout'])
            except (ValueError,TypeError): pass
        if method=='setmocktime' and item.get('exitCode')==0: clock=int(item['params'][0])
        if method=='getblockchaininfo' and isinstance(out,dict):
            tip=out['blocks']; endpoint=out['mediantime']
        if method=='getblockheader' and isinstance(out,dict): header_records[out['hash']]=out
        if method=='getblock' and isinstance(out,dict): block_records[out['hash']]=out
        if method=='testmempoolaccept' and out is not None:
            raws=item['params'][0]
            if isinstance(raws,str): raws=json.loads(raws)
            check(len(raws)==1,'unexpected package admission in trace')
            matching=[cid for cid,c in candidates.items() if c['raw_hex']==raws[0]]
            check(len(matching)==1,'trace admission does not use one exact recorded signed candidate')
            observed.append({'candidate':matching[0],'tip':tip,'mtp':endpoint,'clock':clock,'verdict':admission(out)})
        if method=='generateblock': generated.append((item,out))
    check(len(observed)==len(byid),'RPC admission count differs from case table')
    remaining=list(observed)
    for name,case in byid.items():
        matches=[x for x in remaining if x['candidate']==case['candidate'] and x['tip']==case['tip_height'] and x['mtp']==case['median_time_past'] and x['verdict']==admission(case['admission']) and (x['clock'] is None or x['clock']==case['mock_time'])]
        check(bool(matches),name+': exact bytes/admission/chain checkpoint not found in RPC trace')
        remaining.remove(matches[0])
        verdict=admission(case['admission'])
        if verdict['allowed']:
            check(int(Decimal(str(verdict['fees']['base']))*100000000)==10000,name+': admitted fee differs from raw fee')
    check(not remaining,'unbound RPC admission results')
    fresh=candidates['fresh-output-sequence5']['point']['txid']
    fresh_heights=[b['height'] for b in block_records.values() if fresh in [t['txid'] if isinstance(t,dict) else t for t in b['tx']]]
    check(len(set(fresh_heights))==1,'fresh funding lacks unique raw getblock inclusion evidence')
    for case in byid.values():
        if candidates[case['candidate']]['point']['txid']==fresh and case['parent_height'] is not None:
            check(case['parent_height']==fresh_heights[0],'fresh input age anchored to wrong raw block height')
    for h,block in blocks.items():
        check(block['hash'] in header_records,'block observation has no raw RPC header record')
        header=header_records[block['hash']]
        for field in ('height','time','mediantime'):check(block[field]==header[field],'header observation field mismatch')
        computed=mtp(blocks,h)
        if computed is not None:check(computed==block['mediantime'],'block MTP differs from 11-timestamp median')
    attempts=results['block_validations']
    check(len(attempts)==len(generated),'block attempt count differs from RPC trace')
    for attempt,(item,out) in zip(attempts,generated):
        raw_list=item['params'][1]
        if isinstance(raw_list,str):raw_list=json.loads(raw_list)
        check(raw_list==[candidates[cid]['raw_hex'] for cid in attempt['candidates']],attempt['id']+': block attempt uses different signed bytes')
        before=attempt['before']; after=attempt['after']; accepted=attempt['accepted']
        check(before['candidate_height']==before['tip_height']+1,'block before-height equation')
        check(after['tip_height']==before['tip_height']+(1 if accepted else 0),'block after-height equation')
        check(accepted==(item['exitCode']==0),attempt['id']+': acceptance/exit status mismatch')
        if accepted:
            check(attempt['result']==out and attempt['height']==after['tip_height'],'accepted block result mismatch')
            block_hash=out['hash']
            check(block_hash in block_records,'accepted block lacks raw getblock record')
            block=block_records[block_hash]
            txids=[x['txid'] if isinstance(x,dict) else x for x in block['tx']]
            check(txids==attempt['included_txids'],'block inclusion export differs from RPC')
            check(block['height']==attempt['height'],'accepted block height mismatch')
            check(all(parsed[cid]['txid'] in txids for cid in attempt['candidates']),'requested candidate missing from accepted block')
        else:
            check(attempt['result']['rpcError']==item,'rejected block export differs from RPC')
            check('bad-txns-nonfinal' in item['stderr'],'unexpected rejection reason')
    with (folder/'blocks.csv').open(encoding='utf-8',newline='') as stream: block_rows=list(csv.DictReader(stream))
    check(len(block_rows)==len(blocks),'blocks.csv row count mismatch')
    for row in block_rows:
        block=blocks[int(row['height'])]
        for key in ('hash','height','time','mediantime'):check(row[key]==str(block[key]),'blocks.csv field mismatch')
    original=candidates['ordinary-original']; later=candidates['ordinary-rebuilt-later']; delayed=candidates['ordinary-delayed-first-sign']
    check(original['point']['txid']==later['point']['txid'] and original['point']['vout']==later['point']['vout'],'rebuilt candidate uses different input')
    check(original['created_at_tip']<later['created_at_tip'],'rebuilt candidate was not recorded later')
    check(delayed['point']['parent_height']==original['point']['parent_height'] and delayed['created_at_tip']==later['created_at_tip'],'delayed-first-sign age/control mismatch')
    check(original['raw_hex']!=later['raw_hex'] and original['txid']!=later['txid'],'rebuilt candidate not actually distinct')
    time=meta['time_origin']; origin=mtp(blocks,time['origin_block_height'])
    check(time['origin_block_height']==time['parent_height']-1,'relative-time origin is not funding predecessor')
    check(origin==time['origin_mtp'],'time origin MTP mismatch')
    check(time['sequence']==0x400001 and time['units']==1 and time['seconds_per_unit']==512,'time encoding mismatch')
    check(origin+512==time['first_eligible_previous_block_mtp'],'time boundary mismatch')
    for case in byid.values():
        if parsed[case['candidate']]['inputs'][0]['sequence'] & 0x400000 and not parsed[case['candidate']]['inputs'][0]['sequence'] & 0x80000000:
            check(case['parent_height']==time['parent_height'],'time input height differs from source metadata')
    for file in folder.iterdir():
        if file.is_file() and file.suffix in ('.json','.csv','.txt'):
            flag_privacy(file.read_text(encoding='utf-8'))
    return {'funding_transactions':len(funding),'trace_admissions_bound':len(observed),'block_attempts_bound':len(attempts),'accepted_blocks':sum(a['accepted'] for a in attempts)}

def verify(folder, skip_checksums=False):
    results=json.loads((folder/'results.json').read_text(encoding='utf-8'))
    trace=json.loads((folder/'rpc-trace.json').read_text(encoding='utf-8'))
    candidates=results['candidates']; cases=results['cases']; parsed={}; operands={}
    check(bool(candidates) and bool(cases),'empty results')
    for cid,c in candidates.items():
        t=parse_tx(c['raw_hex']); parsed[cid]=t
        check(t['txid']==c['txid'],cid+': txid mismatch')
        check(t['version']==c['version'],cid+': version mismatch')
        check(t['locktime']==c['locktime'],cid+': locktime mismatch')
        check(t['locktime']==0,cid+': absolute locktime outside this model')
        check(len(t['inputs'])==1,cid+': expected one controlled input')
        inp=t['inputs'][0]; p=c['point']
        check(inp['sequence']==c['sequence'],cid+': sequence mismatch')
        check((inp['txid'],inp['vout'])==(p['txid'],p['vout']),cid+': input outpoint mismatch')
        check(int(p['value_litoshis']) >= sum(x['value_litoshis'] for x in t['outputs']),cid+': negative transparent fee')
        redeem=c.get('redeem_script')
        operands[cid]=csv_operand(redeem) if redeem else None
        if redeem:
            check(operands[cid]==5,cid+': paper scope requires mandatory CSV operand5')
            expected='a914'+hashlib.new('ripemd160',hashlib.sha256(bytes.fromhex(redeem)).digest()).hexdigest()+'87'
            check(expected==p['script_pub_key'],cid+': redeem script does not match funding P2SH')
            check(script_pushes(inp['script_sig'])[-1]==bytes.fromhex(redeem),cid+': scriptSig does not carry recorded redeem script')
    blocks=collect_blocks(results.get('blocks',[])); time_cases=0
    byid={}
    for case in cases:
        name=case['id']; cid=case['candidate']; c=candidates[cid]; t=parsed[cid]
        check(name not in byid,'duplicate case ID'); byid[name]=case
        tip=case['tip_height']; candidate=case['candidate_height']; h=case.get('parent_height')
        check(candidate==tip+1,name+': candidate height must be next block')
        confirmations=case['parent_confirmations']
        check(confirmations==(tip-h+1 if h is not None else 0),name+': parent confirmation equation')
        tip_mtp=mtp(blocks,tip)
        if tip_mtp is not None: check(tip_mtp==case['median_time_past'],name+': tip MTP reconstruction')
        seq=c['sequence']; age=True
        if (t['version'] & 0xffffffff)>=2 and not seq & 0x80000000:
            count=seq & 0xffff
            if seq & 0x400000:
                time_cases += 1
                origin=case['median_time_past'] if h is None else mtp(blocks,max(h-1,0))
                if origin is None:
                    origin=case.get('parent_previous_median_time_past',c['point'].get('parent_previous_median_time_past'))
                check(isinstance(origin,int),name+': missing source for relative-time origin MTP')
                age=case['median_time_past'] > origin+(count<<9)-1
            else:
                parent_h=candidate if h is None else h
                age=candidate > parent_h+count-1
        guard=csv_ok(t['version'],seq,operands[cid])
        model=age and guard
        verdict=admission(case['admission'])
        check(verdict['allowed']==case['expected_allowed'],name+': observed/expected mismatch')
        check(verdict['allowed']==model,name+': relative-age/CSV model disagrees')
        if 'txid' in verdict: check(verdict['txid']==t['txid'],name+': admission txid mismatch')
    with (folder/'cases.csv').open(encoding='utf-8',newline='') as stream:
        rows=list(csv.DictReader(stream))
    check(len(rows)==len(cases),'CSV case count mismatch')
    for row in rows:
        case=byid[row['case']]; c=candidates[case['candidate']]
        for field,expected in [('candidate',case['candidate']),('version',c['version']),('sequence',c['sequence']),('tip_height',case['tip_height']),('candidate_height',case['candidate_height']),('parent_confirmations',case['parent_confirmations']),('median_time_past',case['median_time_past'])]:
            check(str(row[field])==str(expected),row['case']+': CSV '+field+' mismatch')
        check(row['allowed'].lower()==str(admission(case['admission'])['allowed']).lower(),row['case']+': CSV verdict mismatch')
        for field in ('parent_height','mock_time'):
            expected=case[field]
            check(row[field]==('' if expected is None else str(expected)),row['case']+': CSV '+field+' mismatch')
        check(row['reject_reason']==admission(case['admission']).get('reject-reason',''),row['case']+': CSV rejection text mismatch')
    for item in objects(trace):
        if item.get('method')=='decoderawtransaction' and item.get('exitCode')==0:
            try: decoded=json.loads(item['stdout'])
            except (ValueError,TypeError): continue
            if isinstance(decoded,dict) and decoded.get('txid') in {t['txid'] for t in parsed.values()}:
                t=next(t for t in parsed.values() if t['txid']==decoded['txid'])
                check(decoded['version']==t['version'],'RPC decode version mismatch')
                check(decoded['locktime']==t['locktime'],'RPC decode locktime mismatch')
                check(decoded.get('hash',t['wtxid'])==t['wtxid'],'RPC decode wtxid mismatch')
    bindings=bind_exports(results,trace,folder,parsed,blocks,candidates,byid)
    flag_privacy(results); flag_privacy(trace)
    checksum_count=0
    if not skip_checksums:
        for line in (folder/'SHA256SUMS.txt').read_text(encoding='utf-8').splitlines():
            if not line.strip(): continue
            expected,name=line.split(None,1); name=name.lstrip('*')
            path=Path(name)
            check(not path.is_absolute() and '..' not in path.parts,'unsafe checksum path')
            check(hashlib.sha256((folder/path).read_bytes()).hexdigest()==expected,'checksum mismatch: '+name)
            checksum_count += 1
        check(checksum_count>0,'empty checksum list')
    return {'status':'passed','checks':COUNT,'candidate_count':len(candidates),'case_count':len(cases),
            'relative_time_cases':time_cases,'reconstructed_block_records':len(blocks),'checksum_files':checksum_count,'bindings':bindings,
            'limits':['No cryptographic signature or public-key validity verification.','No independent Core execution or binary provenance attestation.','No mainnet inference, timing guarantee, wallet compatibility or production-contract audit.','Privacy checks are structural and not proof that every possible secret encoding is absent.']}

if __name__=='__main__':
    ap=argparse.ArgumentParser(description=__doc__)
    ap.add_argument('directory',nargs='?',default=str(Path(__file__).resolve().parent))
    ap.add_argument('--report',type=Path)
    ap.add_argument('--skip-checksums',action='store_true',help='development-only: report excludes package checksums')
    args=ap.parse_args()
    try:
        report=verify(Path(args.directory),args.skip_checksums)
    except Exception as exc:
        report={'status':'failed','checks':COUNT,'error':str(exc)}
    if args.report: args.report.write_text(json.dumps(report,indent=2)+'\n',encoding='utf-8')
    print(json.dumps(report,indent=2))
    raise SystemExit(0 if report['status']=='passed' else 1)