"""Immutable Food phase seal; live auth/cache/source remain only for Root-requested reuse."""
import hashlib,json,os,subprocess,sys
from pathlib import Path
root=Path(__file__).parent
v=subprocess.run([sys.executable,str(root/'verify-food.py')],capture_output=True,text=True,check=True)
summary=json.loads(v.stdout); files=[]
for sub in ('B-main','C-main','B-readonly','C-readonly'):
 for p in sorted((root/'private'/sub).rglob('*')):
  if p.is_symlink():raise RuntimeError('No private evidence symlinks')
  os.chmod(p,0o700 if p.is_dir() else 0o600)
  if p.is_file():
   if p.name in ('auth.json','current.json','lease.json'):raise RuntimeError('Live auth/lease must not be archived')
   files.append({'path':str(p.relative_to(root/'private')),'bytes':p.stat().st_size,'sha256':hashlib.sha256(p.read_bytes()).hexdigest(),'mode':oct(p.stat().st_mode&0o777)})
manifest={'schema':1,'phase':'original Food21 HTTP incl B metadata tool failure; formal20; no retries of successful writes','files':files,'live_runtime_retained_for_next_read_source_plan':True,'temporary_auth_archived':False,'full_source_archived':False,'old_Activity_173_172_seals_modified':False}
f=root/'private'/'food-main-manifest.json'
with f.open('x') as h:json.dump(manifest,h,ensure_ascii=False,indent=2)
os.chmod(f,0o600);summary['manifest_sha256']=hashlib.sha256(f.read_bytes()).hexdigest();summary['private_files']=len(files)
with (root/'food-summary.json').open('x') as h:json.dump(summary,h,ensure_ascii=False,indent=2)
print(json.dumps({'checks':summary['checks'],'status':summary['status'],'private_files':len(files),'manifest_sha256':summary['manifest_sha256']},ensure_ascii=False))