feat: audit media catalog integrity

tests/test_media_assets.py

@@ -5,7 +5,7 @@ import io
 import pytest
 from PIL import Image
 
-from rf4_research.media_assets import extract_media_candidates, inspect_image, merge_manifest, review_asset, store_asset
+from rf4_research.media_assets import audit_media_catalog, extract_media_candidates, inspect_image, merge_manifest, review_asset, store_asset
 
 
 def test_extracts_and_classifies_unique_https_media() -> None:
@@ -59,3 +59,20 @@ def test_review_requires_stored_asset_and_canonical_mapping(tmp_path: Path) -> N
         review_asset(path, asset_url=item.asset_url, decision="approved", entity_type="fish")
     reviewed = review_asset(path, asset_url=item.asset_url, decision="approved", entity_type="fish", entity_key="pike", note="matched by name")
     assert (reviewed["status"], reviewed["entity_key"]) == ("approved", "pike")
+
+
+def test_catalog_audit_detects_tampering_and_orphans(tmp_path: Path) -> None:
+    item = extract_media_candidates('<img src="/fish/pike.png">', source_page="https://example.test")[0]
+    path = tmp_path / "manifest.json"
+    manifest = merge_manifest(path, [item])
+    image = io.BytesIO()
+    Image.new("RGB", (2, 2)).save(image, format="PNG")
+    digest, relative, width, height, mime = store_asset(tmp_path, image.getvalue(), content_type="image/png", source_url=item.asset_url)
+    manifest["assets"][0].update({"status": "stored", "sha256": digest, "local_path": relative, "width": width, "height": height, "content_type": mime})
+    path.write_text(__import__("json").dumps(manifest), encoding="utf-8")
+    assert audit_media_catalog(tmp_path)["issues"] == []
+    (tmp_path / relative).write_bytes(b"changed")
+    (tmp_path / "files" / "orphan.png").write_bytes(b"orphan")
+    report = audit_media_catalog(tmp_path)
+    assert any("SHA-256 mismatch" in issue for issue in report["issues"])
+    assert "files/orphan.png" in report["orphaned_files"]