"""Verify committed qualification identities before loading an isolated model fixture."""
from pathlib import Path
import hashlib


def verify_fixture(directory, manifest):
    directory = Path(directory).resolve()
    expected = set()
    for entry in manifest['files']:
        name = entry['file']
        if Path(name).name != name or name in ('.', '..'):
            raise ValueError('Artifact name escapes fixture directory.')
        file = directory / name
        if name in expected or file.is_symlink() or not file.is_file():
            raise ValueError('Missing, duplicate or linked model artifact: ' + name)
        expected.add(name)
        if file.stat().st_size != entry['bytes'] or hashlib.sha256(file.read_bytes()).hexdigest() != entry['sha256']:
            raise ValueError('Model artifact integrity mismatch: ' + name)
    if not expected or {p.name for p in directory.iterdir()} - expected - {'manifest.json', 'generation.log'}:
        raise ValueError('Unexpected artifact or empty manifest.')
    return directory