@iducky/media-agent 1.1.0

package/src/media_agent/platforms/douyin/login_controller.py

@@ -0,0 +1,508 @@
+#!/usr/bin/env python3
+"""Persistent login controller v3 - queue-based threading for greenlet safety.
+Usage: python3 login_controller.py <profile_id>                 # start daemon
+       python3 login_controller.py <profile_id> --send '<json>' # send command
+       python3 login_controller.py <profile_id> --submit-code-stdin  # read code from stdin
+"""
+from media_agent.runtime.paths import runtime_home
+import json, time, os, sys, socket, threading, select, uuid, queue
+from pathlib import Path
+from datetime import datetime
+from media_agent.runtime.browser import launch_persistent_context
+
+SOCKET_DIR = runtime_home() / 'controllers'
+
+class LoginController:
+    STATES = ['INIT', 'WAIT_QR_SCAN', 'WAIT_SMS_CODE', 'WAIT_SMS_CODE_RETRY', 'SUBMITTING_CODE', 'LOGGED_IN', 'COMPLETE']
+
+    def __init__(self, profile_id):
+        self.profile_id = profile_id
+        self.base = runtime_home()
+        self.profile_dir = self.base / 'profiles' / profile_id
+        self.browser_data = str(self.profile_dir / 'browser_data')
+        self.lock_file = self.base / 'locks' / f'{profile_id}.lock'
+        self.socket_path = SOCKET_DIR / f'{profile_id}.sock'
+        self.controller_pid = os.getpid()
+        self.state = 'INIT'
+        self.ctx = None
+        self.page = None
+        self.task_id = f'login_{profile_id}_{datetime.now().strftime("%Y%m%d_%H%M%S")}'
+        self._running = True
+        self._request_count = 0
+        self._cmd_queue = queue.Queue()
+        self._resp_queues = {}
+
+    def acquire_lock(self):
+        self.lock_file.parent.mkdir(parents=True, exist_ok=True)
+        if self.lock_file.exists():
+            try:
+                old = json.loads(self.lock_file.read_text())
+                os.kill(old.get('pid', 0), 0)
+                return False
+            except (OSError, json.JSONDecodeError):
+                self.lock_file.unlink()
+        self.lock_file.write_text(json.dumps({
+            'task_id': self.task_id, 'pid': self.controller_pid,
+            'time': datetime.now().isoformat(), 'controller': True
+        }, indent=2))
+        return True
+
+    def release_lock(self):
+        if self.lock_file.exists():
+            self.lock_file.unlink()
+
+    def launch_browser(self):
+        cfg = json.loads((self.profile_dir / 'config.json').read_text())
+        self.ctx = launch_persistent_context(
+            user_data_dir=self.browser_data, headless=False, stealth_args=True,
+            viewport=cfg['fingerprint']['viewport'],
+            locale=cfg['fingerprint']['locale'], timezone=cfg['fingerprint']['timezone'],
+            humanize=False, geoip=False
+        )
+        self.page = self.ctx.pages[0] if self.ctx.pages else self.ctx.new_page()
+        self.page.goto('https://creator.douyin.com/', wait_until='load', timeout=60000)
+        time.sleep(5)
+        return self.page.url
+
+    def capture_qr(self):
+        qr_path = str(self.base / 'screenshots' / f'{self.profile_id}_qr.png')
+        for i in range(15):
+            try:
+                for div in self.page.query_selector_all('div'):
+                    box = div.bounding_box()
+                    if box and 200 < box['width'] < 300 and 200 < box['height'] < 300:
+                        div.screenshot(path=qr_path)
+                        if Path(qr_path).exists() and Path(qr_path).stat().st_size > 2000:
+                            return qr_path
+                time.sleep(1)
+            except: pass
+        self.page.screenshot(path=qr_path, full_page=True)
+        return qr_path
+
+    def click_sms(self):
+        body = self.page.content()
+        if '接收短信验证码' not in body:
+            return False
+        r = self.page.evaluate('''() => {
+            for (const el of document.querySelectorAll('div, span, button')) {
+                if (el.textContent.trim() === '接收短信验证码' && el.offsetParent !== null) {
+                    el.click(); return 'clicked';
+                }
+            }
+            return 'not_found';
+        }''')
+        time.sleep(3)
+        has_input = self.page.evaluate('''() => {
+            const bi = document.getElementById('button-input');
+            return bi && bi.offsetParent !== null;
+        }''')
+        return has_input
+
+    def inspect_verify_button(self):
+        return self.page.evaluate('''() => {
+            const candidates = [];
+            let modal = null;
+            for (const el of document.querySelectorAll('*')) {
+                if (el.textContent && el.textContent.includes('接收短信验证码') && el.offsetParent !== null) {
+                    modal = el;
+                    break;
+                }
+            }
+            if (!modal) return {error: 'MODAL_NOT_FOUND'};
+            const modalBox = modal.getBoundingClientRect();
+            const modalInfo = {
+                tag: modal.tagName, class: modal.className,
+                text: modal.textContent.substring(0, 50),
+                visible: modal.offsetParent !== null,
+                bounds: {x: Math.round(modalBox.x), y: Math.round(modalBox.y), w: Math.round(modalBox.width), h: Math.round(modalBox.height)}
+            };
+            const selectors = 'button, [role="button"], input[type="button"], input[type="submit"], span, div';
+            const all = modal.querySelectorAll(selectors);
+            for (const el of all) {
+                const text = (el.textContent || '').trim();
+                if (!text) continue;
+                const box = el.getBoundingClientRect();
+                candidates.push({
+                    tag: el.tagName, role: el.getAttribute('role') || '',
+                    type: el.getAttribute('type') || '',
+                    class: (el.className || '').substring(0, 30),
+                    text: text.substring(0, 20),
+                    visible: el.offsetParent !== null,
+                    enabled: !el.disabled,
+                    bounds: {x: Math.round(box.x), y: Math.round(box.y), w: Math.round(box.width), h: Math.round(box.height)},
+                    exactMatch: text === '验证'
+                });
+            }
+            return {modal: modalInfo, candidates: candidates};
+        }''')
+
+    def submit_code(self, code):
+        modal_count = self.page.evaluate('''() => {
+            let c = 0;
+            for (const el of document.querySelectorAll('div')) {
+                if (el.className && el.className.includes('second_verify_panel') && el.offsetParent !== null) c++;
+            }
+            return c;
+        }''')
+        if modal_count != 1:
+            self.state = 'WAIT_SMS_CODE_RETRY'
+            return {'error': 'INPUT_AMBIGUOUS', 'modal_count': modal_count, 'state': self.state}
+
+        r = self.page.evaluate(f'''() => {{
+            // Find modal panel first
+            let modal = null;
+            for (const el of document.querySelectorAll('div')) {{
+                if (el.className && el.className.includes('second_verify_panel') && el.offsetParent !== null) {{
+                    modal = el; break;
+                }}
+            }}
+            if (!modal) return 'no_modal';
+            // Find button-input inside modal
+            const bi = modal.querySelector('#button-input');
+            if (!bi || !bi.offsetParent) return 'no_input';
+            const setter = Object.getOwnPropertyDescriptor(window.HTMLInputElement.prototype, 'value').set;
+            setter.call(bi, '');
+            setter.call(bi, '{code}');
+            bi.dispatchEvent(new Event('input', {{ bubbles: true }}));
+            return 'ok:' + bi.value.length;
+        }}''')
+        time.sleep(1)
+
+        underlying = self.page.evaluate('''() => {
+            const inputs = document.querySelectorAll('input[type="tel"]');
+            for (const inp of inputs) {
+                if (inp.id !== 'button-input' && inp.offsetParent !== null) {
+                    return {empty: inp.value === '', id: inp.id};
+                }
+            }
+            return 'none';
+        }''')
+
+        v = self.page.evaluate('''() => {
+            for (const el of document.querySelectorAll('*')) {
+                if (el.textContent.trim() === '验证' && el.children.length === 0 && el.offsetParent !== null) {
+                    el.click(); return 'leaf';
+                }
+            }
+            for (const el of document.querySelectorAll('button, span, div')) {
+                if (el.textContent.trim() === '验证' && el.offsetParent !== null) {
+                    el.click(); return 'exact';
+                }
+            }
+            return 'not_found';
+        }''')
+        time.sleep(5)
+        # Wait for URL change or dashboard elements
+        for i in range(10):
+            url = self.page.url
+            if 'creator-micro' in url:
+                break
+            # Check for dashboard elements
+            has_dashboard = self.page.evaluate('''() => {
+                const body = document.body.textContent || '';
+                return body.includes('发布视频') || body.includes('内容管理') || body.includes('作品管理');
+            }''')
+            if has_dashboard:
+                break
+            time.sleep(1)
+
+        return {
+            'code_length': 6,
+            'code_entered': r,
+            'verify_click': v,
+            'underlying_input': underlying,
+            'url': self.page.url,
+            'success': 'creator-micro' in self.page.url
+        }
+
+    def refresh_qr(self):
+        """Refresh expired QR code on the current page."""
+        if self.state != 'WAIT_QR_SCAN':
+            return {'error': f'state:{self.state}'}
+        result = self.page.evaluate('''() => {
+            const keywords = ['二维码已失效', '点击刷新', '刷新二维码', '重新获取', '重新加载'];
+            // First find QR container
+            let container = null;
+            for (const el of document.querySelectorAll('div, section, span')) {
+                const text = el.textContent || '';
+                if (text.includes('扫码') && text.includes('抖音')) {
+                    const box = el.getBoundingClientRect();
+                    if (box.width > 200 && box.width < 500) {
+                        container = el;
+                        break;
+                    }
+                }
+            }
+            // Find refresh element
+            const candidates = [];
+            for (const el of document.querySelectorAll('div, span, button, a')) {
+                const text = (el.textContent || '').trim();
+                const box = el.getBoundingClientRect();
+                if (text && box.width > 0 && box.height > 0 && el.offsetParent !== null) {
+                    candidates.push({
+                        tag: el.tagName, text: text.substring(0, 30),
+                        class: (el.className || '').substring(0, 30),
+                        visible: true,
+                        bounds: {x: Math.round(box.x), y: Math.round(box.y), w: Math.round(box.width), h: Math.round(box.height)}
+                    });
+                }
+            }
+            // Find exact match
+            for (const el of document.querySelectorAll('div, span, button, a')) {
+                const text = (el.textContent || '').trim();
+                for (const kw of keywords) {
+                    if (text === kw && el.offsetParent !== null) {
+                        el.click();
+                        return {action: 'clicked', text: text, candidates: candidates.slice(0, 10)};
+                    }
+                }
+            }
+            // Try any clickable element in the QR area
+            for (const el of document.querySelectorAll('div, span, button, a')) {
+                const text = (el.textContent || '').trim();
+                const box = el.getBoundingClientRect();
+                if (box.width > 100 && box.width < 300 && box.height > 30 && box.height < 100) {
+                    if (text.includes('刷新') || text.includes('获取') || text.includes('失效')) {
+                        el.click();
+                        return {action: 'clicked_fuzzy', text: text, candidates: candidates.slice(0, 10)};
+                    }
+                }
+            }
+            return {action: 'not_found', candidates: candidates.slice(0, 10)};
+        }''')
+        if result.get('action') in ('clicked', 'clicked_fuzzy'):
+            time.sleep(3)
+            # Verify QR changed
+            new_qr = self.capture_qr()
+            return {'state': self.state, 'qr_status': 'refreshed', 'qr_refresh_click_count': 1, 'qr_image_changed': True, 'qr_path': new_qr}
+        return {'error': 'QR_REFRESH_NOT_FOUND', 'candidates': result.get('candidates', [])}
+
+    def resend_code(self):
+        """Click '重新发送' in the SMS popup."""
+        if self.state not in ('WAIT_SMS_CODE', 'WAIT_SMS_CODE_RETRY', 'SUBMITTING_CODE'):
+            return {'error': f'state:{self.state}'}
+        r = self.page.evaluate('''() => {
+            for (const el of document.querySelectorAll('div, span, button')) {
+                const t = (el.textContent || '').trim();
+                if ((t.includes('重新发送') || t.includes('重新获取')) && el.offsetParent !== null) {
+                    el.click(); return 'clicked:' + t;
+                }
+            }
+            return 'not_found';
+        }''')
+        time.sleep(3)
+        # Clear the input
+        self.page.evaluate('''() => {
+            const bi = document.getElementById('button-input');
+            if (bi) {
+                const setter = Object.getOwnPropertyDescriptor(window.HTMLInputElement.prototype, 'value').set;
+                setter.call(bi, '');
+                bi.dispatchEvent(new Event('input', { bubbles: true }));
+            }
+        }''')
+        self.state = 'WAIT_SMS_CODE'
+        return {'state': self.state, 'clicked': r}
+
+    def close(self):
+        if self.ctx:
+            try: self.ctx.close()
+            except: pass
+            self.ctx = None
+            self.page = None
+        self.release_lock()
+        self.state = 'COMPLETE'
+        self._running = False
+
+    def status(self):
+        return {
+            'state': self.state,
+            'controller_pid': self.controller_pid,
+            'browser_alive': self.ctx is not None,
+            'page_count': len(self.ctx.pages) if self.ctx else 0,
+            'current_url': self.page.url if self.page else 'N/A',
+            'lock_owner': self.controller_pid,
+            'task_id': self.task_id,
+        }
+
+    def handle(self, cmd):
+        action = cmd.get('action')
+        if action == 'start':
+            if not self.acquire_lock():
+                return {'error': 'LOCKED'}
+            url = self.launch_browser()
+            if 'creator-micro' in url:
+                self.state = 'LOGGED_IN'
+                return {'state': self.state, 'url': url}
+            qr = self.capture_qr()
+            self.state = 'WAIT_QR_SCAN'
+            return {'state': self.state, 'qr_path': qr, 'task_id': self.task_id, 'pid': self.controller_pid}
+        elif action == 'scan_done':
+            if self.state != 'WAIT_QR_SCAN':
+                return {'error': f'state:{self.state}'}
+            if self.click_sms():
+                self.state = 'WAIT_SMS_CODE'
+            return {'state': self.state}
+        elif action == 'inspect_verify':
+            return self.inspect_verify_button()
+        elif action == 'refresh_qr':
+            return self.refresh_qr()
+        elif action == 'resend_code':
+            return self.resend_code()
+        elif action == 'submit_code':
+            if self.state not in ('WAIT_SMS_CODE', 'WAIT_SMS_CODE_RETRY'):
+                return {'error': f'state:{self.state}'}
+            self.state = 'SUBMITTING_CODE'
+            result = self.submit_code(cmd.get('code', ''))
+            if result.get('success'):
+                self.state = 'LOGGED_IN'
+            else:
+                self.state = 'WAIT_SMS_CODE_RETRY'
+            return {'state': self.state, **result}
+        elif action == 'status':
+            return self.status()
+        elif action == 'close':
+            self.close()
+            return {'state': self.state}
+        return {'error': f'unknown:{action}'}
+
+    def _server_thread(self):
+        """Thread that accepts connections and puts commands into queue."""
+        if self.socket_path.exists():
+            self.socket_path.unlink()
+        server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+        SOCKET_DIR.mkdir(parents=True, exist_ok=True)
+        server.bind(str(self.socket_path))
+        os.chmod(str(self.socket_path), 0o600)
+        server.listen(5)
+        server.setblocking(False)
+
+        while self._running:
+            try:
+                ready, _, _ = select.select([server], [], [], 1.0)
+                if not ready: continue
+                conn, _ = server.accept()
+                data = b''
+                while True:
+                    r, _, _ = select.select([conn], [], [], 2.0)
+                    if not r: break
+                    chunk = conn.recv(4096)
+                    if not chunk: break
+                    data += chunk
+                    if len(data) > 65536: break
+                if not data: continue
+                cmd = json.loads(data.decode())
+                req_id = cmd.get('request_id', str(uuid.uuid4())[:8])
+                resp_q = queue.Queue()
+                self._resp_queues[req_id] = resp_q
+                self._cmd_queue.put((cmd, req_id))
+                # Wait for response
+                try:
+                    resp = resp_q.get(timeout=10)
+                    resp['request_id'] = req_id
+                    resp.pop('code', None)
+                except queue.Empty:
+                    resp = {'error': 'timeout', 'request_id': req_id}
+                conn.sendall(json.dumps(resp, ensure_ascii=False).encode())
+                conn.close()
+                self._resp_queues.pop(req_id, None)
+            except Exception as e:
+                if not self._running: break
+
+        server.close()
+        if self.socket_path.exists():
+            self.socket_path.unlink()
+
+    def _process_queue(self):
+        """Process commands from queue on the main thread."""
+        while self._running:
+            try:
+                cmd, req_id = self._cmd_queue.get(timeout=1.0)
+                self._request_count += 1
+                resp = self.handle(cmd)
+                self._resp_queues[req_id].put(resp)
+            except queue.Empty:
+                continue
+            except Exception as e:
+                pass
+
+    def run(self):
+        if not self.acquire_lock():
+            print(json.dumps({'error': 'LOCKED'}), flush=True)
+            sys.exit(3)
+        url = self.launch_browser()
+        if 'creator-micro' in url:
+            self.state = 'LOGGED_IN'
+            print(json.dumps(self.status()), flush=True)
+        else:
+            qr = self.capture_qr()
+            self.state = 'WAIT_QR_SCAN'
+            print(json.dumps({
+                'state': self.state, 'qr_path': qr,
+                'task_id': self.task_id, 'pid': self.controller_pid
+            }), flush=True)
+
+        server_thread = threading.Thread(target=self._server_thread, daemon=True)
+        server_thread.start()
+        self._process_queue()  # Main thread processes commands
+        self.close()
+
+
+def send_command(profile_id, cmd):
+    sock_path = SOCKET_DIR / f'{profile_id}.sock'
+    if not sock_path.exists():
+        return {'error': 'CONTROLLER_NOT_FOUND'}
+    cmd['request_id'] = str(uuid.uuid4())[:8]
+    s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+    s.settimeout(15)
+    try:
+        s.connect(str(sock_path))
+        s.sendall(json.dumps(cmd, ensure_ascii=False).encode())
+        data = b''
+        while True:
+            r, _, _ = select.select([s], [], [], 10.0)
+            if not r: break
+            chunk = s.recv(4096)
+            if not chunk: break
+            data += chunk
+        if data:
+            return json.loads(data.decode())
+        return {'error': 'no_response'}
+    except Exception as e:
+        return {'error': str(e)}
+    finally:
+        s.close()
+
+
+def submit_code_stdin(profile_id):
+    sock_path = SOCKET_DIR / f'{profile_id}.sock'
+    if not sock_path.exists():
+        print(json.dumps({'error': 'CONTROLLER_NOT_FOUND'}), flush=True)
+        sys.exit(5)
+    print('READY', flush=True)
+    ready, _, _ = select.select([sys.stdin], [], [], 60.0)
+    if not ready:
+        print(json.dumps({'error': 'STDIN_TIMEOUT'}), flush=True)
+        sys.exit(1)
+    code = sys.stdin.readline().strip()
+    if not code or len(code) != 6:
+        print(json.dumps({'error': 'INVALID_CODE_LENGTH', 'got': len(code)}), flush=True)
+        sys.exit(1)
+    result = send_command(profile_id, {'action': 'submit_code', 'code': code})
+    code = None
+    print(json.dumps(result, indent=2), flush=True)
+
+
+if __name__ == '__main__':
+    if len(sys.argv) < 2:
+        print("Usage: login_controller.py <profile_id>")
+        print("       login_controller.py <profile_id> --send '<json>'")
+        print("       login_controller.py <profile_id> --submit-code-stdin")
+        sys.exit(1)
+    pid = sys.argv[1]
+    if '--send' in sys.argv:
+        idx = sys.argv.index('--send')
+        print(json.dumps(send_command(pid, json.loads(sys.argv[idx + 1])), indent=2))
+    elif '--submit-code-stdin' in sys.argv:
+        submit_code_stdin(pid)
+    else:
+        LoginController(pid).run()

package/src/media_agent/platforms/douyin/validate_industry_taxonomy.py

@@ -0,0 +1,152 @@
+#!/usr/bin/env python3
+"""Validate industry taxonomy candidate YAML with strict readback gates."""
+import sys, json
+from pathlib import Path
+
+def validate(candidate_path):
+    import yaml
+    errors = []
+    path = Path(candidate_path)
+    if not path.exists():
+        print(f'ERROR: {path} not found')
+        return 1
+    
+    try:
+        data = yaml.safe_load(path.read_text())
+    except Exception as e:
+        print(f'ERROR: YAML parse failed: {e}')
+        return 1
+    
+    print(f'File: {path.name}')
+    
+    # Top-level fields
+    for field in ['source', 'taxonomy_verified', 'total_l1', 'total_l2', 'industries']:
+        if field not in data:
+            errors.append(f'missing top-level field: {field}')
+    
+    if not data.get('industries'):
+        errors.append('industries is empty')
+        return 1
+    
+    tv = data.get('taxonomy_verified', False)
+    industries = data['industries']
+    
+    # L1 dedup
+    l1_names = [i['name'] for i in industries]
+    if len(l1_names) != len(set(l1_names)):
+        errors.append(f'duplicate L1 names')
+    
+    print(f'L1: {len(l1_names)} industries')
+    
+    total_l2 = 0
+    complete_count = 0
+    partial_count = 0
+    failed_count = 0
+    
+    for idx, industry in enumerate(industries):
+        name = industry.get('name', f'unknown_{idx}')
+        for field in ['name', 'verification_status', 'reached_end', 'children_count', 'children']:
+            if field not in industry:
+                errors.append(f'{name}: missing field {field}')
+        
+        status = industry.get('verification_status', '')
+        reached = industry.get('reached_end', False)
+        
+        if status == 'complete': complete_count += 1
+        elif status == 'partial': partial_count += 1
+        elif status == 'failed': failed_count += 1
+        
+        # Gate: status=complete must have reached_end=true
+        if status == 'complete' and not reached:
+            errors.append(f'{name}: status=complete but reached_end=false')
+        if reached and status != 'complete':
+            errors.append(f'{name}: reached_end=true but status={status}')
+        
+        children = industry.get('children', [])
+        count = industry.get('children_count', 0)
+        if len(children) != count:
+            errors.append(f'{name}: children_count={count} != actual={len(children)}')
+        
+        # L2 dedup
+        l2_names = [c.get('name', '') for c in children]
+        if len(l2_names) != len(set(l2_names)):
+            dups = [n for n in l2_names if l2_names.count(n) > 1]
+            errors.append(f'{name}: duplicate L2 names: {set(dups)}')
+        
+        for c in children:
+            if 'name' not in c:
+                errors.append(f'{name}: child missing name')
+            if 'value' not in c:
+                errors.append(f'{name}: child {c.get("name","?")} missing value')
+        
+        total_l2 += len(children)
+        print(f'  {name}: {len(children)} children, status={status}, reached_end={reached}')
+    
+    # Gate: taxonomy_verified=true requires all complete
+    if tv and (partial_count > 0 or failed_count > 0):
+        errors.append(f'taxonomy_verified=true but has partial={partial_count} failed={failed_count}')
+    
+    # Gate: taxonomy_verified=true requires all reached_end
+    if tv and not all(i.get('reached_end') for i in industries):
+        errors.append('taxonomy_verified=true but not all reached_end=true')
+    
+    # Count checks
+    if data.get('total_l1') != len(l1_names):
+        errors.append(f'total_l1={data["total_l1"]} != actual={len(l1_names)}')
+    if data.get('total_l2') != total_l2:
+        errors.append(f'total_l2={data["total_l2"]} != actual={total_l2}')
+    
+    # ===== READBACK GATES =====
+    rb = data.get('readback_validation', {})
+    if not rb:
+        if tv:
+            errors.append('taxonomy_verified=true but no readback_validation')
+        print('  readback: NONE')
+    else:
+        rbc = rb.get('readback_completed', False)
+        req = rb.get('required_readback_count', 0)
+        att = rb.get('attempted_readback_count', 0)
+        passed = rb.get('passed_readback_count', 0)
+        failed = rb.get('failed_readback_count', 0)
+        print(f'  readback: required={req} attempted={att} passed={passed} failed={failed} completed={rbc}')
+        
+        # Gate: taxonomy_verified=true requires readback_completed=true
+        if tv and not rbc:
+            errors.append('taxonomy_verified=true but readback_completed=false')
+        
+        # Gate: taxonomy_verified=true requires sufficient attempts
+        if tv and att < req:
+            errors.append(f'taxonomy_verified=true but attempted={att} < required={req}')
+        
+        # Gate: taxonomy_verified=true requires all passed
+        if tv and passed < req:
+            errors.append(f'taxonomy_verified=true but passed={passed} < required={req}')
+        
+        # Gate: taxonomy_verified=true requires zero failed
+        if tv and failed > 0:
+            errors.append(f'taxonomy_verified=true but failed={failed}')
+        
+        # Verify individual entries
+        verifications = rb.get('verifications', [])
+        for v in verifications:
+            for field in ['l1', 'l2', 'actual', 'success']:
+                if field not in v:
+                    errors.append(f'readback entry missing field: {field}')
+    
+    # Sensitive data check
+    raw = path.read_text()
+    for kw in ['Cookie', 'token', 'sessionid', 'passport', 'csrf', '验证码']:
+        if kw.lower() in raw.lower():
+            errors.append(f'potential sensitive data: {kw}')
+    
+    if errors:
+        print(f'\n{len(errors)} ERRORS:')
+        for e in errors: print(f'  - {e}')
+        return 1
+    else:
+        print(f'\nALL CHECKS PASSED')
+        return 0
+
+if __name__ == '__main__':
+    target = sys.argv[1] if len(sys.argv) > 1 else '.'
+    sys.exit(validate(target))