from pathlib import Path
import json,hashlib,stat
here=Path(__file__).resolve().parent
raw=Path('/tmp/cdx-ai-core-scan-pay-20261011')
out=here/'manifest.json'
if out.exists(): raise SystemExit('Seal immutable once')
def files(root):
    result=[]
    for p in sorted(root.rglob('*')):
        if p.is_symlink(): raise SystemExit('Evidence symlink '+str(p))
        if not p.is_file(): continue
        if root==here and p.name=='manifest.json':continue
        b=p.read_bytes();result.append({'path':p.relative_to(root).as_posix(),'sha256':hashlib.sha256(b).hexdigest(),'bytes':len(b),'mode':oct(stat.S_IMODE(p.stat().st_mode))})
    return result
groups={}
for lane in ['B','C']:
    root=raw/f'private-{lane}-final'
    if stat.S_IMODE(root.stat().st_mode)!=0o700: raise SystemExit('Canonical private directory mode')
    entries=files(root)
    if any(e['mode']!='0o600' for e in entries):raise SystemExit('Canonical raw file mode')
    groups[lane]={'root':str(root),'directory_mode':'0o700','files':entries}
data={'status':'SEALED_001_PARTIAL_LIMITED','scope':'Original 0.01 actual batch only. New0.02 is proposal, not executed.','public_files':files(here),'canonical_private_groups':groups,'original_failed_snapshots_preserved_not_rewritten':True,'source_clone_manifest':'source-frozen-sha.json','no_source_copy_in_control':True}
out.write_text(json.dumps(data,ensure_ascii=False,indent=2)+'\n')
print(json.dumps({'public_files':len(data['public_files']),'private_files':{k:len(v['files']) for k,v in groups.items()},'manifest_sha256':hashlib.sha256(out.read_bytes()).hexdigest()}))