import hashlib,json,os,stat
from pathlib import Path
HERE=Path(__file__).resolve().parent
assert not (HERE/'manifest.json').exists(),'No reseal'
old=json.loads((HERE.parent/'manifest-blocked4.json').read_text())
for r in old['files']:
    p=HERE.parent/r['path'];assert p.stat().st_size==r['bytes'] and hashlib.sha256(p.read_bytes()).hexdigest()==r['sha256'] and oct(stat.S_IMODE(p.stat().st_mode))==r['mode'],r['path']
rows=[]
for p in sorted(HERE.rglob('*')):
    rel=p.relative_to(HERE);assert not p.is_symlink(),str(rel)
    if 'private' in rel.parts:os.chmod(p,0o700 if p.is_dir() else 0o600)
    if p.is_file():b=p.read_bytes();rows.append({'path':str(rel),'bytes':len(b),'sha256':hashlib.sha256(b).hexdigest(),'mode':oct(stat.S_IMODE(p.stat().st_mode))})
out={'scope':'Original business retry4 only; no candidate HTTP','prior_failed4_manifest_file_sha256':hashlib.sha256((HERE.parent/'manifest-blocked4.json').read_bytes()).hexdigest(),'prior_failed4_files_unchanged':len(old['files']),'oracle_dependency_sha256':hashlib.sha256((HERE.parent/'oracle-original.py').read_bytes()).hexdigest(),'files':rows};out['seal_sha256']=hashlib.sha256(json.dumps(out,ensure_ascii=False,sort_keys=True,separators=(',',':')).encode()).hexdigest();f=HERE/'manifest.json';f.write_text(json.dumps(out,ensure_ascii=False,indent=2)+'\n');print(json.dumps({'files':len(rows),'file_sha256':hashlib.sha256(f.read_bytes()).hexdigest(),'canonical_sha256':out['seal_sha256'],'prior_failed4_unchanged':len(old['files'])}))