From 0aec85dabfa95f4de8113e0bb8b58ce52c9cab94 Mon Sep 17 00:00:00 2001
From: binrogithub <xpwilu@163.com>
Date: Sun, 8 Feb 2026 18:00:06 +0300
Subject: [PATCH] Add minimal evidence filtering

---
 gateway/__init__.py       |  0
 gateway/handlers.py       | 21 +++++++++++++++++++++
 hc_agent/__init__.py      |  0
 hc_agent/core/__init__.py |  0
 hc_agent/core/evidence.py | 29 +++++++++++++++++++++++++++++
 5 files changed, 50 insertions(+)
 create mode 100644 gateway/__init__.py
 create mode 100644 gateway/handlers.py
 create mode 100644 hc_agent/__init__.py
 create mode 100644 hc_agent/core/__init__.py
 create mode 100644 hc_agent/core/evidence.py

diff --git a/gateway/__init__.py b/gateway/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/gateway/handlers.py b/gateway/handlers.py
new file mode 100644
index 0000000000..da9348f2a8
--- /dev/null
+++ b/gateway/handlers.py
@@ -0,0 +1,21 @@
+"""Gateway handlers for evidence persistence."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Mapping
+
+from hc_agent.core.evidence import build_min_evidence
+
+
+def write_evidence_json(evidence: Mapping[str, object], output_dir: str | Path) -> Path:
+    """Write minimal evidence payload to evidence.json and return its path."""
+    output_path = Path(output_dir) / "evidence.json"
+    minimal_evidence = build_min_evidence(evidence)
+
+    output_path.write_text(
+        json.dumps(minimal_evidence, indent=2, sort_keys=True) + "\n",
+        encoding="utf-8",
+    )
+    return output_path
diff --git a/hc_agent/__init__.py b/hc_agent/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/hc_agent/core/__init__.py b/hc_agent/core/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/hc_agent/core/evidence.py b/hc_agent/core/evidence.py
new file mode 100644
index 0000000000..499af3b7be
--- /dev/null
+++ b/hc_agent/core/evidence.py
@@ -0,0 +1,29 @@
+"""Evidence filtering helpers."""
+
+from __future__ import annotations
+
+from typing import Mapping
+
+ALLOWED_EVIDENCE_KEYS: tuple[str, ...] = (
+    "service",
+    "endpoint",
+    "method",
+    "path",
+    "status",
+    "request_id",
+    "duration_ms",
+    "signature_sha256",
+)
+
+
+def build_min_evidence(evidence: Mapping[str, object] | None) -> dict[str, object]:
+    """Return a minimal evidence payload containing only allowed keys."""
+    if not evidence:
+        return {}
+
+    return {
+        key: evidence[key]
+        for key in ALLOWED_EVIDENCE_KEYS
+        if key in evidence
+    }
+