"""Seal only this owned evidence slice; never connects to DB or HTTP."""
import hashlib
import json
import os
import shutil
from pathlib import Path
ROOT=Path(__file__).parent
PRIVATE=ROOT/'private'
def digest(path):return hashlib.sha256(path.read_bytes()).hexdigest()

def seal():
    # Source/harness originals are recoverable without copying any original application secrets.
    payload=Path('/tmp/cdx-fl11-payload.MDT20O')
    original=PRIVATE/'original-harness'
    if payload.is_dir() and not original.exists():
        original.mkdir(mode=0o700)
        for path in payload.iterdir():
            if path.is_file() and path.suffix in ['.php','.json']:
                shutil.copyfile(path,original/path.name)
    removed_auth=[]
    for lane in ['B','C']:
        path=PRIVATE/f'{lane}-original/request.json'
        if not path.exists():continue
        token=json.loads(path.read_text())['token'].encode()
        for other in PRIVATE.rglob('*'):
            if other.is_file() and other!=path and other.name!='request.json':
                if token in other.read_bytes():raise RuntimeError('Unexpected secret outside owned auth request: '+str(other.relative_to(ROOT)))
        path.unlink();removed_auth.append(str(path.relative_to(ROOT)))
    for path in [payload,Path('/tmp/cdx-fl11-payload.MDT20O.tar.gz')]:
        if path.exists():
            if path.is_symlink() or path.resolve()!=Path('/private/tmp')/path.name:raise RuntimeError('Owned temporary path unexpectedly linked')
            if path.is_dir():shutil.rmtree(path)
            else:path.unlink()
    for directory in [PRIVATE,*[p for p in PRIVATE.rglob('*') if p.is_dir()]]:directory.chmod(0o700)
    for file in PRIVATE.rglob('*'):
        if file.is_file():file.chmod(0o600)
    from audit import verified
    report=verified()
    (ROOT/'verification.json').write_text(json.dumps(report,ensure_ascii=False,indent=2)+'\n')
    for lane in ['B','C']:
        cleanup=json.loads((PRIVATE/f'{lane}-original/cleanup.json').read_text())
        assert cleanup['port_closed'] and cleanup['original_parent_preserved'] and cleanup['database_DML']==0
    public=[];private=[]
    for file in sorted(ROOT.rglob('*')):
        if not file.is_file() or '__pycache__' in file.parts or file.name=='manifest.json':continue
        row={'path':str(file.relative_to(ROOT)),'bytes':file.stat().st_size,'sha256':digest(file)}
        (private if PRIVATE in file.parents else public).append(row)
    auth_paths=[f'private/{lane}-original/request.json' for lane in ['B','C']]
    assert all(not (ROOT/p).exists() for p in auth_paths)
    result={'task':'ZHCTPROMPT-20260928-SMART-CANTEEN-DUAL-DB-COMPAT-PLAN','public':public,'private':private,'actual_http':38,'positive_DB_methods':2,'nonDB_unreachable_methods':10,'raw_permissions':'directories0700/files0600','auth_request_files_removed':auth_paths,'business_marked_rows_retained_per_lane':1,'business_DDL':0,'business_HTTP_DML':0}
    (ROOT/'manifest.json').write_text(json.dumps(result,ensure_ascii=False,indent=2)+'\n')
    print(json.dumps({'public_files':len(public),'private_files':len(private),'manifest_sha256':digest(ROOT/'manifest.json'),'actual_http':38,'positive_DB_methods':2,'nonDB_unreachable_methods':10},ensure_ascii=False))

if __name__=='__main__':seal()