#!/usr/bin/env python3
"""Seal only task-owned private evidence; no runtime auth/config files are copied."""
import hashlib
import json
import os
from pathlib import Path

root = Path(__file__).parent / 'private-evidence'
records = []
for directory in [root] + sorted(path for path in root.rglob('*') if path.is_dir()):
    os.chmod(directory, 0o700)
for path in sorted(path for path in root.rglob('*') if path.is_file() and path.name != 'manifest.json'):
    if path.name in ('private-request.json', 'database.php', 'config.php', 'source.tgz', 'phase.json'):
        raise RuntimeError('Forbidden auth/runtime content')
    os.chmod(path, 0o600)
    data = path.read_bytes()
    records.append({'path': str(path.relative_to(root)), 'bytes': len(data), 'sha256': hashlib.sha256(data).hexdigest()})
manifest = root / 'manifest.json'
manifest.write_text(json.dumps({'files': records}, ensure_ascii=False, indent=2) + '\n')
os.chmod(manifest, 0o600)
print(json.dumps({'files': len(records), 'manifest_sha256': hashlib.sha256(manifest.read_bytes()).hexdigest(), 'permissions': '0700/0600'}))