Seal Phase 4AH conditional KC drive audit and source accounting

tools/publish_phase4ah.py

@@ -0,0 +1,42 @@
+"""Publish only small sealed conditional-audit evidence, not bulk backup."""
+import json
+from pathlib import Path
+import shutil
+import sys
+
+ROOT = Path('/data/digital-drosophila')
+MODEL = ROOT / 'models/male-cns-lif/kc-drive-audit-v1'
+EXP = ROOT / 'experiments/phase4ah-kc-drive-audit'
+sys.path.insert(0, str(MODEL))
+from context import check, digest, save
+sys.path.insert(0, str(ROOT / 'models/male-cns-lif/terminal-scope-diagnostic-v1'))
+from diagnostic import manifest_check
+
+
+def main():
+    check()
+    verification = {str(p.relative_to(ROOT)): manifest_check(p, digest) for p in (MODEL, EXP)}
+    assert all(v['pass'] for v in verification.values())
+    registry = ROOT / 'registry/phase4ah-kc-drive-audit'
+    registry.mkdir(exist_ok=False)
+    records = []
+    manifest = json.loads((EXP / 'manifest.json').read_text())
+    for p in [EXP / r['path'] for r in manifest['files']] + [EXP / 'manifest.json', EXP / 'checksums.sha256']:
+        if p.stat().st_size > 4 * 1024**2 or p.suffix not in ('.json', '.csv', '.md', '.sha256'):
+            continue
+        target = registry / 'evidence' / p.relative_to(EXP)
+        target.parent.mkdir(parents=True, exist_ok=True)
+        with p.open('rb') as src, target.open('xb') as dst:
+            shutil.copyfileobj(src, dst)
+        assert digest(target) == digest(p)
+        records.append(dict(source=str(p.relative_to(ROOT)), copy=str(target.relative_to(registry)),
+                            bytes=p.stat().st_size, sha256=digest(p)))
+    save(registry / 'evidence-index.json', records)
+    save(registry / 'seal-verification.json', verification)
+    with (EXP / 'REPORT.md').open('rb') as src, (ROOT / 'docs/progress/phase4ah-kc-drive-audit.md').open('xb') as dst:
+        shutil.copyfileobj(src, dst)
+    print(json.dumps(dict(copied=len(records), verification=verification)), flush=True)
+
+
+if __name__ == '__main__':
+    main()