import pathlib,json,subprocess,stat,shutil
root=pathlib.Path('/home/ps/huobao-gpu-selection')
# The extra provider file contains only node names, URLs and token-file paths.
(root/'extra-providers.json').chmod(0o644)
d=json.loads(subprocess.check_output(['docker','inspect','canvas-h3-prompt-normalizer-healthy-20261026'],text=True))[0]
tokens=pathlib.Path(next(m['Source'] for m in d['Mounts'] if m['Destination']=='/run/h3-workers'))
files=[p for p in tokens.iterdir() if p.name!='huobao-gpu1.token' and p.is_file()]
print('Existing token file permissions',[(p.name,oct(stat.S_IMODE(p.stat().st_mode)),p.stat().st_uid,p.stat().st_gid) for p in files])
assert shutil.which('setfacl'),'A named service-user ACL is required; keep the private token unchanged otherwise'
target=tokens/'huobao-gpu1.token'
assert stat.S_IMODE(target.stat().st_mode)&0o007==0,'Token must not be world-readable'
subprocess.run(['setfacl','-m','u:65534:r--',str(target)],check=True)
assert stat.S_IMODE(target.stat().st_mode)&0o007==0
print('Only the existing normalizer service UID 65534 receives read access; token remains inaccessible to other users')