"""Immutable new seal; no SQL/HTTP. Only tightens two canonical-copy log modes."""
from pathlib import Path
import json,hashlib,stat
HERE=Path(__file__).resolve().parent
RAW=Path('/tmp/cdx-ai-core-direct002-20261011')
out=HERE/'manifest.json'
assert not out.exists(),'Seal immutable once'
adjust=[]
for lane in ['B','C']:
 p=RAW/f'private-{lane}-final/runtime/log/20261011_sql.log'
 before=stat.S_IMODE(p.stat().st_mode);digest=hashlib.sha256(p.read_bytes()).hexdigest()
 assert before in [0o644,0o600]
 if before!=0o600:
  p.chmod(0o600);adjust.append({'path':str(p),'old_mode':oct(before),'new_mode':'0o600','sha256':digest,'bytes_unchanged':hashlib.sha256(p.read_bytes()).hexdigest()==digest,'canonical_copy_only':True})
def files(root):
 result=[]
 for p in sorted(root.rglob('*')):
  assert not p.is_symlink(),'Evidence symlink'
  if not p.is_file() or p==out:continue
  raw=p.read_bytes();result.append({'path':p.relative_to(root).as_posix(),'sha256':hashlib.sha256(raw).hexdigest(),'bytes':len(raw),'mode':oct(stat.S_IMODE(p.stat().st_mode))})
 return result
groups={}
for lane in ['B','C']:
 root=RAW/f'private-{lane}-final';assert stat.S_IMODE(root.stat().st_mode)==0o700
 entries=files(root);assert all(e['mode']=='0o600' for e in entries)
 groups[lane]={'root':str(root),'directory_mode':'0o700','files':entries}
data={'status':'SEALED_NEW_002_POSITIVE_CONTRACT_PASS','scope':'Exactly one fresh0.02 POST/side; old0.01 never replayed; original C0.01 DTO still missing; physical P0 remain open','public_files':files(HERE),'canonical_private_groups':groups,'canonical_copy_permission_adjustments':adjust,'old_manifest_sha256':'cfda90d3fb84df1c73920f7b831c64d85e28bdfbd4a4b965086fe05a96d57b15','old208_verified_immutable':True,'old_failed_snapshots_untouched':True,'source6168_each_actual_fileset_no_extras':True,'marked_business_rows_retained':True,'resources_cleaned':True}
out.write_text(json.dumps(data,ensure_ascii=False,indent=2)+'\n')
print(json.dumps({'public_files':len(data['public_files']),'private_files':{k:len(g['files']) for k,g in groups.items()},'manifest_sha256':hashlib.sha256(out.read_bytes()).hexdigest()}))