<?php
declare(strict_types=1);
// Credential-free actor identity and original full-row hash only; no DB/HTTP.
require __DIR__.'/common.php';$runtime=$argv[1]??'';if(!is_dir($runtime)||is_link($runtime)){exit(78);}putenv('SM7_RUNTIME='.$runtime);$actor=smLoad('actor-private.json');$baseline=smLoad('actor-baseline-private.json');$changes=[];$specPath=$runtime.'/spec-private.json';if(is_file($specPath)){$spec=json_decode(file_get_contents($specPath),false,512,JSON_THROW_ON_ERROR);$old=hash_file('sha256',$specPath);foreach($spec as $case){$row=$case->before->source_sets->actor[0];$case->before->source_sets->actor=[(object)['id'=>$row->id,'uuid'=>$row->uuid,'account'=>$row->account,'type'=>$row->type,'status'=>$row->status,'full_row_digest'=>(object)$baseline['actor_digest']]];$sets=json_decode(json_encode($case->before->source_sets,JSON_UNESCAPED_UNICODE|JSON_PRESERVE_ZERO_FRACTION|JSON_THROW_ON_ERROR),true,512,JSON_THROW_ON_ERROR);$case->before->source_digest=hash('sha256',serialize($sets));}smSave('spec-private.json',$spec);$changes['spec']=['old_sha256'=>$old,'new_sha256'=>hash_file('sha256',$specPath)];}
$old=hash_file('sha256',$runtime.'/actor-private.json');smSave('actor-private.json',['id'=>$actor['id'],'uuid'=>$actor['uuid'],'marker'=>$actor['marker']]);$changes['actor']=['old_sha256'=>$old,'new_sha256'=>hash_file('sha256',$runtime.'/actor-private.json')];smSave('actor-evidence-sanitized-private.json',['changes'=>$changes,'database_operations'=>0,'business_http_replayed'=>0,'credential_values_retained'=>false]);echo json_encode(['actor_credentials_retained'=>false,'database_operations'=>0,'business_http_replayed'=>0]),PHP_EOL;