<?php
// Root authorized destruction of the exact transient secret-bearing HTTP response.
$file=__DIR__.'/evidence/include-p1.result.json';$raw=file_get_contents($file);$result=json_decode($raw,true);$body=$result['body'];$request=json_decode(file_get_contents(__DIR__.'/private-request.json'),true);
$root=getenv('GP_ROOT');$cfg=(static function($path){return require $path;})($root.'/application/database.php');$secrets=[$request['token']];
$walk=null;$walk=static function($value,$key='')use(&$walk,&$secrets){if(is_array($value)){foreach($value as $k=>$v)$walk($v,(string)$k);}elseif(is_scalar($value)&&preg_match('/pass|pwd|token|secret|key|credential|username|hostname|database/i',$key)&&strlen((string)$value)>=4)$secrets[]=(string)$value;};$walk($cfg);
foreach(getenv()as $key=>$value)if(preg_match('/pass|pwd|token|secret|key|credential/i',$key)&&strlen($value)>=4)$secrets[]=$value;
$variants=[];foreach(array_unique($secrets)as $secret)foreach([$secret,htmlspecialchars($secret,ENT_QUOTES,'UTF-8'),rawurlencode($secret),urlencode($secret)]as $variant)if($variant!=='')$variants[$variant]=true;
$matches=0;foreach(array_keys($variants)as $secret)if(strpos($body,$secret)!==false)$matches++;
$redacted="HTTP 500 bootstrap failure: private poc/config.php was absent before application/database bootstrap. Entire debug HTML removed because its environment contained credentials. No original HTML bytes retained in this derivative.";
$proof=['HTTP'=>500,'layer'=>'tool bootstrap before any PDO/SQL','SQL'=>0,'DML'=>0,'original_body_sha256'=>hash('sha256',$body),'original_body_bytes'=>strlen($body),'original_result_file_sha256'=>hash('sha256',$raw),'original_result_file_bytes'=>strlen($raw),'redacted_body'=>$redacted,'entire_debug_HTML_redacted'=>true,'known_secret_variants_checked'=>count($variants),'variants_matching_original'=>$matches,'stable_derivative_secret_matches'=>0,'original_bytes_reconstructible'=>false];
$encoded=json_encode($proof,JSON_PRETTY_PRINT|JSON_UNESCAPED_UNICODE);foreach(array_keys($variants)as $secret)if(strpos($encoded,$secret)!==false)throw new RuntimeException('Secret still in derivative');
$target=__DIR__.'/evidence/include-p1.bootstrap-failure.redacted.json';if(file_exists($target))throw new RuntimeException('No redaction overwrite');file_put_contents($target,$encoded);chmod($target,0600);
if(!unlink($file))throw new RuntimeException('Exact secret response removal');$receipt=['target'=>'evidence/include-p1.result.json','deleted'=>!file_exists($file),'bytes'=>$proof['original_result_file_bytes'],'sha256'=>$proof['original_result_file_sha256'],'recoverable'=>false,'reason'=>'secret-bearing temporary debug HTML; redacted derivative/body hash retained'];file_put_contents(__DIR__.'/evidence/bootstrap-secret-removal.json',json_encode($receipt));chmod(__DIR__.'/evidence/bootstrap-secret-removal.json',0600);
echo json_encode(['removed_exact_secret_response'=>true,'known_secret_variants_checked'=>count($variants),'original_matches'=>$matches,'stable_derivative_secret_matches'=>0]),"\n";