import hashlib,json,shutil,stat,sys
from pathlib import Path
P=Path(__file__).resolve().parent
manifest=P/'first-phase/seal.json'
def collect():
    files={}
    for directory in [P/'first-phase',P/'private/first-phase']:
        for file in sorted(directory.rglob('*')):
            if file==manifest or file.is_dir():continue
            assert not file.is_symlink()
            rel=file.relative_to(P).as_posix();assert file.name!='tokens.json'
            if rel.startswith('private/'):
                assert stat.S_IMODE(file.stat().st_mode)==0o600,rel
            files[rel]={'bytes':file.stat().st_size,'sha256':hashlib.sha256(file.read_bytes()).hexdigest()}
    for directory in (P/'private/first-phase').rglob('*'):
        if directory.is_dir():assert stat.S_IMODE(directory.stat().st_mode)==0o700
    return files
if '--verify' in sys.argv:
    original=json.loads(manifest.read_text());assert collect()==original['files'];print(json.dumps({'first_phase_seal_valid':True,'files':len(original['files'])}))
else:
    assert not manifest.exists(),'Do not overwrite first phase'
    for name in ['PROPOSAL.md','machine-plan.json','cases-B.json','cases-C.json','source-frozen-sha.json','first-phase-manifest.json','first-phase-verification.json','allergy-contract-original.json','allergy-contract-candidate.json','master-write-contract-original.json','master-write-contract-candidate.json']:
        shutil.copy2(P/name,P/'first-phase'/name)
    for name in ['NativePdo.php','common.php','router.php','launch.php','probe.php','setup.php','run-first.php','run-reads.php','run-retry.php','test-gate.php','MasterOmittedAllergyContract.check.php','verify-first.py','run-contracts.py','build-plan.py','capture-first.py','seal-first.py']:
        shutil.copy2(P/name,P/'first-phase/tools'/name)
    value={'scope':'Only original first phase, full task incomplete; active runtime excluded','HTTP_B':6,'HTTP_C':4,'current_own_clone_model_sha':'8ea785ca5c8717185284e582f253f53fc713b955a4847b150a9c547b8f782d14','Root_main_model_sha':'a81a7a4eff91aec6745517a26a8794f8ccda4edf633c993406d5c557525d6afd','files':collect()}
    data=json.dumps(value,ensure_ascii=False,indent=2)+'\n';manifest.write_text(data);print(json.dumps({'first_phase_seal_sha256':hashlib.sha256(data.encode()).hexdigest(),'files':len(value['files'])}))