Actually it needs to be done in each iteration of the loop. For instance you start with 6 hashes you will not need to duplicate a hash in the first step, but in the second step you will be left with 3 hashes and you will need to duplicate the last one to make it 4.

The XOR tells us which intermediate hash in a given level we want to remember so we can verify that a specific block hash is in a particular merkle tree.

For instance with the merkle root for the first 6 hashes of the chain:

                    root = h01234545
         h0123                    h4545
  h01           h23          h45        h45
bh0  bh1       bh2 bh3      bh4 bh5

If you want to verify that bh2 is part of the chain knowing root, you need branch = [bh3, h01, h4545]
2^1 = 3 (pick the 4th hash in level 0, bh3)
2>>1 = 1
1 ^ 1 = 0 (pick the 1st hash in level 1, h01)
1 >> 1 = 0
0^1 = 1 (pick the 2nd hash in level 2, h4545)

ìndex is 0 based, so If you have a list of 4 hashes index can not be more than 3.

So i think my assertion assert index <= len(hashes) should probably be assert index < len(hashes)