<?php
$root=getenv('PM_ROOT');$path=parse_url($_SERVER['REQUEST_URI'],PHP_URL_PATH);
if($path!=='/p/securityAudit/lists'||$_SERVER['REQUEST_METHOD']!=='POST'){http_response_code(403);exit;}
foreach(json_decode(file_get_contents(__DIR__.'/private-source-lock.json'),true)as $file=>$sha)if(hash_file('sha256',__DIR__.'/source/application/'.$file)!==$sha){http_response_code(403);exit;}
require __DIR__.'/oracle.php';$post=$_POST;$spec=json_decode(file_get_contents(__DIR__.'/private-spec.json'),true);$case=$_SERVER['HTTP_X_CDX_CASE']??'';$matches=array_values(array_filter($spec,static function($s)use($case){return $s['label']===$case;}));
if(count($matches)!==1){http_response_code(403);exit;}$expected=array_map('strval',$matches[0]['params']);ksort($expected);$actual=$post;ksort($actual);if($actual!==$expected){http_response_code(403);exit;}
$before=$source();$beforeActor=$actorNow();$check($actor===$beforeActor,'Actual actor drift');
ob_start();register_shutdown_function(static function()use($case,$post,$before,$beforeActor,$source,$actorNow):void{try{$entry=['label'=>$case,'phase'=>$_SERVER['HTTP_X_CDX_PHASE']??'initial','params'=>$post,'status'=>http_response_code(),'response'=>(string)ob_get_contents(),'source_before'=>$before,'source_after'=>$source(),'actor_before'=>$beforeActor,'actor_after'=>$actorNow()];if(strlen($entry['response'])>2097152)throw new RuntimeException('Response cap2MiB');file_put_contents(__DIR__.'/private-wire.jsonl',json_encode($entry,JSON_UNESCAPED_UNICODE)."\n",FILE_APPEND);chmod(__DIR__.'/private-wire.jsonl',0600);}catch(Throwable $e){file_put_contents(__DIR__.'/private-audit-error',hash('sha256',$e->getMessage()));chmod(__DIR__.'/private-audit-error',0600);}});
$_SERVER['PATH_INFO']=$path;require $root.'/env.php';if(!function_exists('json')){function json($data=[],$code=200,array $header=[],$options=[]){return \think\Response::create($data,'json',$code,$header,$options);}}
require $root.'/external_stubs.php';define('APP_PATH',__DIR__.'/source/application/');define('RUNTIME_PATH',__DIR__.'/runtime/');require $root.'/thinkphp/base.php';\think\App::initCommon();\think\Log::init(['type'=>'File','path'=>__DIR__.'/runtime/safe-log/','level'=>['no_raw_application_log']]);\think\Config::set(['type'=>'File','path'=>__DIR__.'/cache/','prefix'=>'SECURITY10_'],'cache');\think\Config::set('redis',[]);$database=require $root.'/application/database.php';\think\Config::set($database,'database');\think\Db::clear();\think\App::run()->send();