import pathlib,json,re,os,subprocess,hashlib,tarfile,shutil
root=pathlib.Path('/tmp/lead-25666-r1/evidence')
public=root/'public'
public.mkdir(exist_ok=True)
# Keep credential-bearing source logs private; redact only credential values from public copies.
secrets=[v for k,v in os.environ.items() if re.search(r'TOKEN|SECRET|PASSWORD|API_KEY',k,re.I) and len(v)>12]
def sanitize(text):
 text=re.sub(r'((?:pairingUrl:|Pairing URL:)\s+)\S+',r'\1[REDACTED startup credential URL]',text)
 for value in secrets:text=text.replace(value,'[REDACTED environment credential]')
 return text
for run in sorted(root.iterdir()):
 if not run.is_dir() or not re.fullmatch(r'\d{8}T\d{6}Z',run.name):continue
 dest=public/run.name;dest.mkdir(exist_ok=True)
 for f in run.iterdir():
  if f.is_file() and f.suffix in ['.json','.log','.txt'] and f.name not in ['pair-private.log','server-private.log']:
   (dest/f.name).write_text(sanitize(f.read_text()))
 (dest/'server.log').write_text(sanitize((run/'server-private.log').read_text()))
 logs=run/'home/userdata/logs'
 for f in logs.rglob('*'):
  if f.is_file():
   target=dest/'logs'/f.relative_to(logs);target.parent.mkdir(parents=True,exist_ok=True)
   target.write_text(sanitize(f.read_text()))
 db=run/'home/userdata/statev2.sqlite'
 for table in ['orchestration_events','orchestration_command_receipts','orchestration_v2_projection_runs','orchestration_v2_projection_subagents','orchestration_v2_projection_checkpoints','orchestration_v2_effect_outbox']:
  text=subprocess.check_output(['sqlite3','-readonly','-json',str(db),'select * from '+table],text=True)
  (dest/(table+'.json')).write_text(sanitize(text or '[]\n'))
run=public/'20261027T062557Z'
verification=json.loads((run/'verification.json').read_text())
events=json.loads((run/'events.json').read_text())
lines=['R3 real app / Codex 0.163.0 / gpt-6.1-sol / T3CODE_DEV_SEED=0', 'head fdcf43b781a36813afeab8547a25adbde0c65b17','fresh home /tmp/lead-25666-r1/evidence/20261027T062557Z/home','']
for line in (run/'runtime.log').read_text().splitlines():
 try:d=json.loads(line)
 except:continue
 lines.append(d['utc']+' '+d['event'])
lines.extend(['','Acceptance receipt: '+json.dumps(verification['accept']),'Immediately preceding parent run event: '+json.dumps(verification['before']),'Persisted parent run event in acceptance commit: '+json.dumps(verification['atAccept']),'App-owned task '+verification['taskId']+' delivery='+verification['deliveryState'],''])
for e in events:
 p=json.loads(e['payload_json'])
 if e['event_type'] in ['run.created','run.updated','checkpoint.created','checkpoint.updated','subagent.updated']:
  details={k:p[k] for k in ['id','status','completedAt','checkpointId','completionWake','completionDelivery','ref','capturedAt','result'] if k in p}
  lines.append(f"seq={e['sequence']} utc={e['occurred_at']} {e['event_type']} "+json.dumps(details))
lines.extend(['','Stored checkpoint Git objects: '+json.dumps(verification['checkpointObjects'],indent=2),'','R3 demonstrates real provider integration and normal acceptance ordering. R1/R2 force the internal read/commit race; R3 does not.'])
(public/'r3-transcript.txt').write_text('\n'.join(lines)+'\n')
for name in ['matrix.md','environment.json','base-setup.log','r1-base.log','r2-head.log','r2-head-verbose.log','run-tests.sh','rpc-driver.mjs','gate.py','server-control.py','collect-evidence.py']:
 shutil.copyfile(root/name,public/name)
manifest={str(f.relative_to(public)):hashlib.sha256(f.read_bytes()).hexdigest() for f in sorted(public.rglob('*')) if f.is_file()}
(public/'sha256.json').write_text(json.dumps(manifest,indent=2)+'\n')
with tarfile.open(root/'full-evidence-logs.tar.gz','w:gz') as archive:
 for f in sorted(public.rglob('*')):
  if f.is_file():archive.add(f,arcname=str(f.relative_to(public)))
print(json.dumps({'publicFiles':len(manifest),'archiveBytes':(root/'full-evidence-logs.tar.gz').stat().st_size,'credentialFields':'startup pairing URLs and any matching environment secrets redacted; cookies, pairing command logs, databases and secrets directories excluded'}))