import hashlib,json,os,subprocess,sys
from pathlib import Path

slice_dir=Path(__file__).resolve().parent
private=slice_dir/'private-evidence'
phase=sys.argv[1]
assert phase in ('original','final')
output=private/(phase+'-manifest.json')
assert not output.exists(), 'Do not overwrite a sealed manifest'
if phase=='original':
    for label,options,rc in [('original-native',['--native-date'],0),('original-legacy',[],2)]:
        result=subprocess.run(['python3',str(slice_dir/'verify-http.py'),*options],capture_output=True,text=True)
        assert result.returncode==rc,(result.returncode,result.stderr)
        (private/(label+'.json')).write_text(result.stdout)
    for label,files,rc in [('tdd-original',['source/application/p/logic/Nutrition.php','source/application/p/logic/NutritionTime.php'],2),('tdd-candidate',['Nutrition.candidate.php','NutritionTime.candidate.php'],0)]:
        runtime='/tmp/cdx-nutrition-read5-B-20261011/'
        result=subprocess.run(['docker','exec','zhctapp_v2_0','/usr/local/php7.3/bin/php',runtime+'DateResponseContract.check.php',*[runtime+f for f in files]],capture_output=True,text=True)
        assert result.returncode==rc,(result.returncode,result.stderr)
        (private/(label+'.json')).write_text(result.stdout)
else:
    result=subprocess.run(['python3',str(slice_dir/'verify-http.py'),'--suffix=-retest'],capture_output=True,text=True)
    assert result.returncode==0,result.stderr
    (private/'final-verification.json').write_text(result.stdout)
manifest={}
for f in sorted(private.rglob('*')):
    assert not f.is_symlink()
    if f.is_dir(): os.chmod(f,0o700);continue
    os.chmod(f,0o600)
    manifest[str(f.relative_to(private))]={'bytes':f.stat().st_size,'sha256':hashlib.sha256(f.read_bytes()).hexdigest()}
output.write_text(json.dumps(manifest,indent=2)+'\n');os.chmod(output,0o600)
print(json.dumps({'manifest':output.name,'files':len(manifest),'sha256':hashlib.sha256(output.read_bytes()).hexdigest()}))