"""Seal the new private evidence only; never modifies previous batch evidence."""
import hashlib,json,os,subprocess,sys
from pathlib import Path
root=Path(__file__).parent
run=subprocess.run([sys.executable,str(root/'verify.py')],check=True,capture_output=True,text=True)
summary=json.loads(run.stdout)
for lane in ('B','C'):
    p=root/'private'/lane
    for name in ('auth.json','current.json','lease.json'):
        if (p/name).exists(): raise RuntimeError('Temporary credential copy remains')
    if not json.loads((p/'cleanup-source.json').read_text())['no_auth_copy']: raise RuntimeError('Auth cleanup missing')
for p in (root/'private').rglob('*'):
    if p.is_symlink(): raise RuntimeError('Evidence symlink')
    os.chmod(p,0o700 if p.is_dir() else 0o600)
os.chmod(root/'private',0o700)
files=[]
for p in sorted((root/'private').rglob('*')):
    if p.is_file() and p.name!='manifest.json':
        files.append({'path':str(p.relative_to(root/'private')),'bytes':p.stat().st_size,'sha256':hashlib.sha256(p.read_bytes()).hexdigest(),'mode':oct(p.stat().st_mode&0o777)})
manifest={'schema':1,'status':summary['status'],'files':files,'full_source_copies_archived':False,'temporary_auth_copies_archived':False,'original_173_file_seal_unchanged':True}
with (root/'private'/'manifest.json').open('x') as f: json.dump(manifest,f,ensure_ascii=False,indent=2)
os.chmod(root/'private'/'manifest.json',0o600)
summary['private_manifest_sha256']=hashlib.sha256((root/'private'/'manifest.json').read_bytes()).hexdigest()
summary['private_file_count']=len(files)
with (root/'summary.json').open('x') as f: json.dump(summary,f,ensure_ascii=False,indent=2)
print(json.dumps(summary,ensure_ascii=False,indent=2))