#!/usr/bin/env python3
"""Seal scratch evidence separately; never touches the 235-file CRUD/NoOp archive."""
import hashlib
import json
import os
from pathlib import Path
root = Path(__file__).parent / 'scratch-private-evidence'
records = []
for path in [root] + sorted(root.rglob('*')):
    os.chmod(path, 0o700 if path.is_dir() else 0o600)
    if path.is_file() and path.name != 'manifest.json':
        data = path.read_bytes()
        records.append({'path': str(path.relative_to(root)), 'bytes': len(data), 'sha256': hashlib.sha256(data).hexdigest()})
manifest = root / 'manifest.json'
manifest.write_text(json.dumps({'files': records}, ensure_ascii=False, indent=2) + '\n')
os.chmod(manifest, 0o600)
print(json.dumps({'files': len(records), 'manifest_sha256': hashlib.sha256(manifest.read_bytes()).hexdigest(), 'permissions': '0700/0600'}))