//! `attest` — independently verify a CI run's evidence directory.
//!
//! Usage: `attest <dir>` (default `ci_out`). Exits non-zero if the recomputed
//! Merkle root does not match the claimed root, the leaf count is inconsistent,
//! or the leaves are missing. It deliberately ignores `compliance_report.json`.

use std::path::PathBuf;

fn main() {
    let dir = std::env::args().nth(1).unwrap_or_else(|| "ci_out".to_string());
    let path = PathBuf::from(&dir);
    match attestation::verify_dir(&path) {
        Ok(att) => {
            eprintln!("=== independent attestation of {dir} ===");
            eprintln!("  leaves: {}", att.leaf_count);
            eprintln!("  recomputed root: {:016x}", att.recomputed_root);
            match att.claimed_root {
                Some(r) => eprintln!("  claimed root:    {:016x}", r),
                None => eprintln!("  claimed root:    <missing>"),
            }
            eprintln!(
                "  full traces verified: {}/{} (reconstructed + leaf re-derived)",
                att.traces_verified, att.traces_total
            );
            for (name, ok) in &att.checks {
                eprintln!("  [{}] {}", if *ok { "PASS" } else { "FAIL" }, name);
            }
            if att.ok {
                eprintln!("ATTESTATION: PASS — leaves recompute to the claimed root.");
            } else {
                eprintln!("ATTESTATION: FAIL — evidence is inconsistent.");
                std::process::exit(1);
            }
        }
        Err(e) => {
            eprintln!("ATTESTATION: ERROR — {e}");
            std::process::exit(2);
        }
    }
}