#!/usr/bin/env bash
set +e
set +u
umask 077

STEP="STEP_050M07R10C_BUILD_CODE_TEST_WITH_HASH_DOMAIN_FIX"

TOKEN="e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4"
ROOT="/opt/router-ops"
STATE="$ROOT/state"
PUBROOT="$ROOT/public/r/$TOKEN"

CANONICAL_STATE="$STATE/current-vm101-canonical.env"
WORKFLOW_STATE="$STATE/current-m07-workflow.env"
MODEL_STATE="$STATE/current-vm101-model.env"
METHODS_STATE="$STATE/current-vm101-methods.env"
TUNNEL_STATE="$STATE/current-quick-tunnel.env"

R10B_WORKSPACE="$STATE/m07-single-target/code_test/20260712-112059_code_test_v2"

LOCAL_PLAN_SLUG="20260711-181158_local_architecture_plan_vm101_autonomous_hmn_recovery"
GLOBAL_PLAN_SLUG="20260711-123348_global_project_plan_wg_paid"
XS_MAP_SLUG="20260711-120734_xs_map_audit_repair_publish"

EXPECTED_SOURCE_SHA="3515205270211206a9f3a34bc5c62d94a9f14a54ad712d6fa7e9c7d50db1370a"
EXPECTED_SOURCE_LINES="66"

EXPECTED_SANITIZED_REGION_SHA="637eeaee0dd437ccd2eeaaffd6a136d40b39c7381eab50bb82e944d8af922b6a"
EXPECTED_RAW_REGION_SHA="01cfd55010cfd48b53704e49cb7b81368396191fd0013c6ce0301aeb73d98164"
EXPECTED_OLD_BLOCK_SHA="67ba2fa49b25b8474c1783c3a30fe23289d5ade166a7a9659c32d685b1155fa9"

EXPECTED_RUNTIME_SHA="1fd8d8b9258f7ca1d711323b7652f0b46991e1d17346b59e1d8ff5d71ba471d9"

TS="$(date -u +%Y%m%d-%H%M%S)"

REPORT_SLUG="${TS}_step050m07r10c_build_code_test_with_hash_domain_fix"
REPORT_DIR="$PUBROOT/$REPORT_SLUG"

WORKSPACE="$STATE/m07-single-target/code_test/${TS}_code_test_v3"
SOURCE_DIR="$WORKSPACE/source/root/hmn"
CANDIDATE_DIR="$WORKSPACE/candidate/root/hmn"
DIFF_DIR="$WORKSPACE/diffs"
TEST_DIR="$WORKSPACE/tests"
META_DIR="$WORKSPACE/metadata"

SOURCE_FILE="$SOURCE_DIR/hmn-code-test.sh"
CANDIDATE_FILE="$CANDIDATE_DIR/hmn-code-test.sh"
PRIVATE_DIFF="$DIFF_DIR/hmn-code-test.private.diff"

BASE=""
MODEL_ID=""
METHODS_ID=""

CANONICAL_WORKSPACE=""
CANONICAL_SOURCE=""
CANONICAL_RUNTIME=""
EDIT_MAP=""

SOURCE_SHA="UNRESOLVED"
SOURCE_LINES=0
RAW_REGION_SHA="UNRESOLVED"
SANITIZED_REGION_SHA="UNRESOLVED"
OLD_BLOCK_SHA="UNRESOLVED"
RUNTIME_SHA="UNRESOLVED"
CANDIDATE_SHA="UNRESOLVED"

PREREQUISITE_PASS=false
CONTRACT_AUDIT_PASS=false
TRANSFORM_PASS=false
SYNTAX_PASS=false
STATIC_PASS=false
DIFF_PASS=false
FIXTURE_PASS=false
PRIVATE_SHA_PASS=false
WORKFLOW_UPDATED=false
ALL_OK=false

FAILURE_REASON="NONE"
OPERATION_RESULT="CODE_TEST_CANDIDATE_NOT_READY"
NEXT_STEP="REPAIR_CODE_TEST_CANDIDATE"

mkdir -p \
  "$REPORT_DIR" \
  "$SOURCE_DIR" \
  "$CANDIDATE_DIR" \
  "$DIFF_DIR" \
  "$TEST_DIR" \
  "$META_DIR"

cp -a "$0" "$REPORT_DIR/step.sh"
chmod 600 "$REPORT_DIR/step.sh"

state_value() {
  local file="$1"
  local key="$2"

  sed -n "s/^${key}=//p" "$file" 2>/dev/null |
    tail -n1
}

file_sha() {
  sha256sum "$1" 2>/dev/null |
    awk '{print $1}'
}

publish_result() {
  local decision execution

  if [ "$ALL_OK" = "true" ]; then
    decision="PASS_${STEP}"
    execution="PASS"
  else
    decision="STOP_${STEP}_${FAILURE_REASON}"
    execution="STOP"
  fi

  [ -n "$BASE" ] ||
    BASE="$(state_value "$TUNNEL_STATE" QUICK_TUNNEL_URL)"

  [ -n "$MODEL_ID" ] ||
    MODEL_ID="$(state_value "$MODEL_STATE" VM101_MODEL_ID)"

  [ -n "$METHODS_ID" ] ||
    METHODS_ID="$(state_value "$METHODS_STATE" VM101_METHODS_ID)"

  STEP_REPORT="${BASE}/r/${TOKEN}/${REPORT_SLUG}/"
  LOCAL_PLAN="${BASE}/r/${TOKEN}/${LOCAL_PLAN_SLUG}/"
  GLOBAL_PLAN="${BASE}/r/${TOKEN}/${GLOBAL_PLAN_SLUG}/"
  XS_MAP="${BASE}/r/${TOKEN}/${XS_MAP_SLUG}/"
  VM101_MODEL="${BASE}/r/${TOKEN}/${MODEL_ID}/"
  VM101_METHODS="${BASE}/r/${TOKEN}/${METHODS_ID}/"
  VM101_REFERENCE="${BASE}/r/${TOKEN}/vm101-reference/current/"
  VM101_CANONICAL="${BASE}/r/${TOKEN}/vm101-canonical/current/"
  REPORT_TXT="${STEP_REPORT}report.txt"
  FACTS_JSON="${STEP_REPORT}facts.json"

  python3 - \
    "$REPORT_DIR/facts.json" \
    "$STEP" \
    "$decision" \
    "$execution" \
    "$OPERATION_RESULT" \
    "$FAILURE_REASON" \
    "$WORKSPACE" \
    "$SOURCE_SHA" \
    "$SOURCE_LINES" \
    "$RAW_REGION_SHA" \
    "$SANITIZED_REGION_SHA" \
    "$OLD_BLOCK_SHA" \
    "$RUNTIME_SHA" \
    "$CANDIDATE_SHA" \
    "$PREREQUISITE_PASS" \
    "$CONTRACT_AUDIT_PASS" \
    "$TRANSFORM_PASS" \
    "$SYNTAX_PASS" \
    "$STATIC_PASS" \
    "$DIFF_PASS" \
    "$FIXTURE_PASS" \
    "$PRIVATE_SHA_PASS" \
    "$WORKFLOW_UPDATED" \
    "$ALL_OK" \
    "$NEXT_STEP" \
    "$STEP_REPORT" \
    "$LOCAL_PLAN" \
    "$GLOBAL_PLAN" \
    "$XS_MAP" \
    "$VM101_MODEL" \
    "$VM101_METHODS" \
    "$VM101_REFERENCE" \
    "$VM101_CANONICAL" <<'PY'
import json
import sys
from pathlib import Path

(
    output,
    step,
    decision,
    execution,
    operation,
    reason,
    workspace,
    source_sha,
    source_lines,
    raw_region_sha,
    sanitized_region_sha,
    old_block_sha,
    runtime_sha,
    candidate_sha,
    prerequisite_pass,
    contract_pass,
    transform_pass,
    syntax_pass,
    static_pass,
    diff_pass,
    fixture_pass,
    private_sha_pass,
    workflow_updated,
    all_ok,
    next_step,
    step_report,
    local_plan,
    global_plan,
    xs_map,
    model,
    methods,
    reference,
    canonical,
) = sys.argv[1:]

data = {
    "schema": "router-step-facts-v1",
    "step": step,

    "assessment": {
        "decision": decision,
        "step_execution": execution,
        "operation_result": operation,
        "production_health": "UNCHANGED_NOT_CONTACTED",
        "milestone_status": "M07_IN_PROGRESS",
        "all_ok": all_ok == "true",
        "failure_reason": (
            None if execution == "PASS" else reason
        ),
    },

    "hash_domain_correction": {
        "raw_source_region_sha256": raw_region_sha,
        "edit_map_sanitized_region_sha256":
            sanitized_region_sha,
        "comparison_rule":
            "raw and sanitized hashes are recorded separately",
        "canonical_modified": False,
    },

    "code_test": {
        "workspace": workspace,
        "source_sha256": source_sha,
        "source_line_count": int(source_lines),
        "exact_old_block_sha256": old_block_sha,
        "runtime_library_sha256": runtime_sha,
        "candidate_sha256": candidate_sha,
        "prerequisite_pass":
            prerequisite_pass == "true",
        "contract_audit_pass":
            contract_pass == "true",
        "transformation_pass":
            transform_pass == "true",
        "syntax_pass":
            syntax_pass == "true",
        "static_pass":
            static_pass == "true",
        "private_diff_review_pass":
            diff_pass == "true",
        "fixture_pass":
            fixture_pass == "true",
        "private_sha256_pass":
            private_sha_pass == "true",
        "installed": False,
    },

    "model_sync": {
        "required": False,
        "reason":
            "No file on live VM101 was changed",
        "preserved_model": model,
    },

    "methods_sync": {
        "required": False,
        "reason":
            "No new live VM101 command or tool was introduced",
        "preserved_methods": methods,
    },

    "workflow_state_updated":
        workflow_updated == "true",

    "safety": {
        "single_target": True,
        "local_only": True,
        "vm101_contacted": False,
        "vm101_modified": False,
        "installation_performed": False,
        "canonical_current_modified": False,
        "refresh_ran": False,
        "rebalance_ran": False,
        "services_restarted": False,
    },

    "mandatory_links": {
        "step_report": step_report,
        "local_plan": local_plan,
        "global_plan": global_plan,
        "xs_map": xs_map,
        "vm101_model": model,
        "vm101_methods": methods,
    },

    "additional_links": {
        "vm101_reference": reference,
        "vm101_canonical": canonical,
    },

    "next_step": next_step,
}

Path(output).write_text(
    json.dumps(
        data,
        ensure_ascii=False,
        indent=2,
    ) + "\n",
    encoding="utf-8",
)
PY

  cat > "$REPORT_DIR/report.txt" <<EOF
=== ${STEP} RESULT ===
step=${STEP}
decision=${decision}
step_execution=${execution}
operation_result=${OPERATION_RESULT}
production_health=UNCHANGED_NOT_CONTACTED
milestone_status=M07_IN_PROGRESS
all_ok=${ALL_OK}
failure_reason=${FAILURE_REASON}

hash_domain_correction:
  raw_source_region_sha256=${RAW_REGION_SHA}
  edit_map_sanitized_region_sha256=${SANITIZED_REGION_SHA}
  raw_and_sanitized_compared_directly=false
  canonical_current_modified=false

code_test:
  workspace=${WORKSPACE}
  source_sha256=${SOURCE_SHA}
  source_line_count=${SOURCE_LINES}
  exact_old_block_sha256=${OLD_BLOCK_SHA}
  runtime_library_sha256=${RUNTIME_SHA}
  candidate_sha256=${CANDIDATE_SHA}
  prerequisite_pass=${PREREQUISITE_PASS}
  contract_audit_pass=${CONTRACT_AUDIT_PASS}
  transformation_pass=${TRANSFORM_PASS}
  syntax_pass=${SYNTAX_PASS}
  static_pass=${STATIC_PASS}
  private_diff_review_pass=${DIFF_PASS}
  fixture_pass=${FIXTURE_PASS}
  private_sha256_pass=${PRIVATE_SHA_PASS}
  installed=false

safety:
  single_target=true
  local_only=true
  vm101_contacted=false
  vm101_modified=false
  installation_performed=false
  canonical_current_modified=false
  refresh_ran=false
  rebalance_ran=false
  services_restarted=false

next_step=${NEXT_STEP}

STEP_REPORT=${STEP_REPORT}
LOCAL_PLAN=${LOCAL_PLAN}
GLOBAL_PLAN=${GLOBAL_PLAN}
XS_MAP=${XS_MAP}
VM101_MODEL=${VM101_MODEL}
VM101_METHODS=${VM101_METHODS}

VM101_REFERENCE=${VM101_REFERENCE}
VM101_CANONICAL=${VM101_CANONICAL}
REPORT_TXT=${REPORT_TXT}
FACTS_JSON=${FACTS_JSON}
EOF

  cat > "$REPORT_DIR/index.html" <<EOF
<!doctype html>
<html lang="ru">
<head>
<meta charset="utf-8">
<title>${STEP}</title>
</head>
<body style="font-family:system-ui;max-width:1100px;margin:40px auto">
<h1>${STEP}</h1>

<h2>Результат</h2>
<ul>
<li><a href="report.txt">report.txt</a></li>
<li><a href="facts.json">facts.json</a></li>
<li><a href="contract-audit.json">Contract audit</a></li>
<li><a href="transformation.json">Transformation</a></li>
<li><a href="static-tests.json">Static tests</a></li>
<li><a href="diff-review.json">Diff review</a></li>
<li><a href="fixture-results.json">Fixture results</a></li>
<li><a href="step.sh">step.sh</a></li>
</ul>

<h2>Обязательные ссылки</h2>
<ul>
<li><a href="${STEP_REPORT}">Current STEP report</a></li>
<li><a href="${LOCAL_PLAN}">Local M07 plan</a></li>
<li><a href="${GLOBAL_PLAN}">Global project plan</a></li>
<li><a href="${XS_MAP}">XS Map</a></li>
<li><a href="${VM101_MODEL}">Timestamped VM101 model</a></li>
<li><a href="${VM101_METHODS}">Timestamped VM101 methods</a></li>
</ul>

<h2>Дополнительно</h2>
<ul>
<li><a href="${VM101_REFERENCE}">VM101 reference current</a></li>
<li><a href="${VM101_CANONICAL}">VM101 canonical current</a></li>
</ul>
</body>
</html>
EOF

  find "$REPORT_DIR" \
    -type f \
    ! -name SHA256SUMS \
    -print0 |
  sort -z |
  xargs -0 sha256sum \
    > "$REPORT_DIR/SHA256SUMS"

  chmod -R a+rX "$REPORT_DIR"

  echo
  echo "decision=$decision"
  echo "operation_result=$OPERATION_RESULT"
  echo "all_ok=$ALL_OK"
  echo "failure_reason=$FAILURE_REASON"

  echo
  echo "source_sha256=$SOURCE_SHA"
  echo "raw_region_sha256=$RAW_REGION_SHA"
  echo "sanitized_region_sha256=$SANITIZED_REGION_SHA"
  echo "exact_old_block_sha256=$OLD_BLOCK_SHA"
  echo "candidate_sha256=$CANDIDATE_SHA"

  echo
  echo "contract_audit_pass=$CONTRACT_AUDIT_PASS"
  echo "transform_pass=$TRANSFORM_PASS"
  echo "syntax_pass=$SYNTAX_PASS"
  echo "static_pass=$STATIC_PASS"
  echo "diff_pass=$DIFF_PASS"
  echo "fixture_pass=$FIXTURE_PASS"
  echo "private_sha_pass=$PRIVATE_SHA_PASS"
  echo "workflow_updated=$WORKFLOW_UPDATED"

  echo
  echo "vm101_contacted=false"
  echo "vm101_modified=false"
  echo "installation_performed=false"

  echo
  echo "STEP_REPORT=$STEP_REPORT"
  echo "LOCAL_PLAN=$LOCAL_PLAN"
  echo "GLOBAL_PLAN=$GLOBAL_PLAN"
  echo "XS_MAP=$XS_MAP"
  echo "VM101_MODEL=$VM101_MODEL"
  echo "VM101_METHODS=$VM101_METHODS"

  echo
  echo "VM101_REFERENCE=$VM101_REFERENCE"
  echo "VM101_CANONICAL=$VM101_CANONICAL"
  echo "REPORT_TXT=$REPORT_TXT"
  echo "FACTS_JSON=$FACTS_JSON"

  exit 0
}

stop_step() {
  FAILURE_REASON="$1"
  ALL_OK=false
  publish_result
}

if [ "$(id -un)" != "ops" ]; then
  stop_step "WRONG_USER"
fi

for required in \
  "$CANONICAL_STATE" \
  "$WORKFLOW_STATE" \
  "$MODEL_STATE" \
  "$METHODS_STATE" \
  "$TUNNEL_STATE"
do
  if [ ! -s "$required" ]; then
    stop_step "REQUIRED_STATE_MISSING"
  fi
done

BASE="$(state_value "$TUNNEL_STATE" QUICK_TUNNEL_URL)"
MODEL_ID="$(state_value "$MODEL_STATE" VM101_MODEL_ID)"
METHODS_ID="$(state_value "$METHODS_STATE" VM101_METHODS_ID)"

if [ -z "$BASE" ] ||
   [ -z "$MODEL_ID" ] ||
   [ -z "$METHODS_ID" ]
then
  stop_step "PUBLICATION_STATE_INCOMPLETE"
fi

for required in \
  "$PUBROOT/$LOCAL_PLAN_SLUG" \
  "$PUBROOT/$GLOBAL_PLAN_SLUG" \
  "$PUBROOT/$XS_MAP_SLUG" \
  "$PUBROOT/$MODEL_ID" \
  "$PUBROOT/$METHODS_ID"
do
  if [ ! -d "$required" ]; then
    stop_step "MANDATORY_LINK_TARGET_MISSING"
  fi
done

CANONICAL_WORKSPACE="$(
  state_value \
    "$CANONICAL_STATE" \
    VM101_CANONICAL_PRIVATE_WORKSPACE
)"

if [ ! -d "$CANONICAL_WORKSPACE" ]; then
  stop_step "CANONICAL_WORKSPACE_MISSING"
fi

CANONICAL_SOURCE="$CANONICAL_WORKSPACE/source/root/hmn/hmn-code-test.sh"
CANONICAL_RUNTIME="$CANONICAL_WORKSPACE/candidate/usr/local/lib/router-egress-vm101-runtime.sh"
EDIT_MAP="$CANONICAL_WORKSPACE/contracts/edit-map.json"

for required in \
  "$CANONICAL_SOURCE" \
  "$CANONICAL_RUNTIME" \
  "$EDIT_MAP"
do
  if [ ! -s "$required" ]; then
    stop_step "CANONICAL_COMPONENT_MISSING"
  fi
done

SOURCE_SHA="$(file_sha "$CANONICAL_SOURCE")"
SOURCE_LINES="$(
  wc -l < "$CANONICAL_SOURCE" |
    tr -d '[:space:]'
)"
RUNTIME_SHA="$(file_sha "$CANONICAL_RUNTIME")"

if [ "$SOURCE_SHA" != "$EXPECTED_SOURCE_SHA" ]; then
  stop_step "SOURCE_SHA_MISMATCH"
fi

if [ "$SOURCE_LINES" != "$EXPECTED_SOURCE_LINES" ]; then
  stop_step "SOURCE_LINE_COUNT_MISMATCH"
fi

if [ "$RUNTIME_SHA" != "$EXPECTED_RUNTIME_SHA" ]; then
  stop_step "RUNTIME_LIBRARY_SHA_MISMATCH"
fi

cp -a "$CANONICAL_SOURCE" "$SOURCE_FILE"
chmod 600 "$SOURCE_FILE"

python3 - \
  "$SOURCE_FILE" \
  "$CANONICAL_RUNTIME" \
  "$EDIT_MAP" \
  "$CANDIDATE_FILE" \
  "$EXPECTED_SOURCE_SHA" \
  "$EXPECTED_SOURCE_LINES" \
  "$EXPECTED_SANITIZED_REGION_SHA" \
  "$EXPECTED_RAW_REGION_SHA" \
  "$EXPECTED_OLD_BLOCK_SHA" \
  "$META_DIR/contract-audit.json" \
  "$META_DIR/transformation.json" <<'PY'
import hashlib
import json
import sys
from pathlib import Path

(
    source_name,
    runtime_name,
    edit_map_name,
    candidate_name,
    expected_source_sha,
    expected_source_lines,
    expected_sanitized_sha,
    expected_raw_sha,
    expected_old_block_sha,
    audit_name,
    transformation_name,
) = sys.argv[1:]

source_path = Path(source_name)
runtime_path = Path(runtime_name)
edit_map_path = Path(edit_map_name)
candidate_path = Path(candidate_name)

raw = source_path.read_bytes()
source_sha = hashlib.sha256(raw).hexdigest()
source_text = raw.decode("utf-8")
source_lines = source_text.splitlines(keepends=True)

edit_map = json.loads(
    edit_map_path.read_text(encoding="utf-8")
)

target = next(
    item
    for item in edit_map["targets"]
    if item["label"] == "code_test"
)

region = next(
    item
    for item in target["regions"]
    if item["region_id"] == "code_test-r1"
)

start_line = int(region["start_line"])
end_line = int(region["end_line"])
sanitized_sha = region["sanitized_sha256"]

raw_region = "".join(
    source_lines[start_line - 1:end_line]
)

raw_region_sha = hashlib.sha256(
    raw_region.encode("utf-8")
).hexdigest()

old_block = """ACTIVE="$(ip route show table 200 | awk '/^default dev /{print $3; exit}')"

if [ "${HMN_REQUEST_IFACE:-auto}" != "auto" ]; then
  ACTIVE="$HMN_REQUEST_IFACE"
fi

if [ -z "${ACTIVE:-}" ]; then
  echo "ERROR: не нашёл active VPN interface в table 200."
  ip route show table 200
  exit 1
fi
"""

old_block_sha = hashlib.sha256(
    old_block.encode("utf-8")
).hexdigest()

checks = {
    "source_sha":
        source_sha == expected_source_sha,

    "source_line_count":
        len(source_lines) == int(expected_source_lines),

    "edit_map_source_sha":
        target["source_sha256"] == expected_source_sha,

    "edit_map_source_lines":
        target["source_line_count"]
        == int(expected_source_lines),

    "region_coordinates":
        start_line == 13 and end_line == 39,

    "sanitized_region_sha":
        sanitized_sha == expected_sanitized_sha,

    "raw_region_sha":
        raw_region_sha == expected_raw_sha,

    "exact_old_block_sha":
        old_block_sha == expected_old_block_sha,

    "exact_old_block_occurs_once":
        source_text.count(old_block) == 1,

    "runtime_helper_present":
        "vm101_healthy_bootstrap_iface"
        in runtime_path.read_text(
            encoding="utf-8",
            errors="strict",
        ),
}

failures = [
    name
    for name, passed in checks.items()
    if not passed
]

audit = {
    "schema":
        "vm101-code-test-hash-domain-audit-v1",

    "source_sha256":
        source_sha,

    "source_line_count":
        len(source_lines),

    "region": {
        "region_id":
            "code_test-r1",

        "start_line":
            start_line,

        "end_line":
            end_line,

        "raw_source_sha256":
            raw_region_sha,

        "edit_map_sanitized_sha256":
            sanitized_sha,

        "hash_domains_are_distinct":
            True,
    },

    "exact_old_block_sha256":
        old_block_sha,

    "checks":
        checks,

    "failures":
        failures,
}

Path(audit_name).write_text(
    json.dumps(
        audit,
        ensure_ascii=False,
        indent=2,
    ) + "\n",
    encoding="utf-8",
)

if failures:
    raise SystemExit(
        "CONTRACT_AUDIT_FAILED:"
        + ",".join(failures)
    )

new_block = """# BEGIN CANONICAL_M07_CODE_TEST_SELECTOR
VM101_RUNTIME_LIB="${VM101_RUNTIME_LIB:-/usr/local/lib/router-egress-vm101-runtime.sh}"

if [ ! -r "$VM101_RUNTIME_LIB" ]; then
  echo "ERROR: runtime library not found: $VM101_RUNTIME_LIB"
  exit 1
fi

. "$VM101_RUNTIME_LIB"

PREFERRED_ACTIVE=""

if [ "${HMN_REQUEST_IFACE:-auto}" != "auto" ]; then
  PREFERRED_ACTIVE="$HMN_REQUEST_IFACE"
else
  PREFERRED_ACTIVE="$(
    ip route show table 200 2>/dev/null |
      awk '/^default dev /{print $3; exit}'
  )"
fi

ACTIVE="$(
  vm101_healthy_bootstrap_iface \
    "$PREFERRED_ACTIVE" \
    2>/dev/null ||
  true
)"

if [ -z "${ACTIVE:-}" ]; then
  echo "ERROR: no strict healthy VPN interface among vpn1-vpn5."
  exit 1
fi
# END CANONICAL_M07_CODE_TEST_SELECTOR
"""

candidate_text = source_text.replace(
    old_block,
    new_block,
    1,
)

if candidate_text == source_text:
    raise SystemExit("CANDIDATE_NOT_CHANGED")

if not candidate_text.endswith("\n"):
    candidate_text += "\n"

candidate_path.write_text(
    candidate_text,
    encoding="utf-8",
)

candidate_sha = hashlib.sha256(
    candidate_text.encode("utf-8")
).hexdigest()

Path(transformation_name).write_text(
    json.dumps({
        "schema":
            "vm101-code-test-transformation-v3",

        "source_sha256":
            source_sha,

        "source_line_count":
            len(source_lines),

        "region": {
            "region_id":
                "code_test-r1",

            "raw_source_sha256":
                raw_region_sha,

            "edit_map_sanitized_sha256":
                sanitized_sha,
        },

        "exact_old_block_sha256":
            old_block_sha,

        "candidate_sha256":
            candidate_sha,

        "whole_file_generated":
            True,

        "installation_performed":
            False,
    }, ensure_ascii=False, indent=2) + "\n",
    encoding="utf-8",
)
PY

TRANSFORM_RC=$?

cp -a \
  "$META_DIR/contract-audit.json" \
  "$REPORT_DIR/contract-audit.json" \
  2>/dev/null || true

if [ "$TRANSFORM_RC" -ne 0 ]; then
  stop_step "CONTRACT_AUDIT_OR_TRANSFORMATION_FAILED"
fi

cp -a \
  "$META_DIR/transformation.json" \
  "$REPORT_DIR/transformation.json"

RAW_REGION_SHA="$(
  python3 -c '
import json
import sys
data = json.load(open(sys.argv[1]))
print(data["region"]["raw_source_sha256"])
' "$META_DIR/transformation.json"
)"

SANITIZED_REGION_SHA="$(
  python3 -c '
import json
import sys
data = json.load(open(sys.argv[1]))
print(data["region"]["edit_map_sanitized_sha256"])
' "$META_DIR/transformation.json"
)"

OLD_BLOCK_SHA="$(
  python3 -c '
import json
import sys
data = json.load(open(sys.argv[1]))
print(data["exact_old_block_sha256"])
' "$META_DIR/transformation.json"
)"

CANDIDATE_SHA="$(file_sha "$CANDIDATE_FILE")"

PREREQUISITE_PASS=true
CONTRACT_AUDIT_PASS=true
TRANSFORM_PASS=true

sh -n "$CANDIDATE_FILE" \
  > "$REPORT_DIR/syntax-check.txt" \
  2>&1

if [ "$?" -ne 0 ]; then
  stop_step "CANDIDATE_SYNTAX_FAILED"
fi

SYNTAX_PASS=true

diff -u \
  "$SOURCE_FILE" \
  "$CANDIDATE_FILE" \
  > "$PRIVATE_DIFF"

if [ "$?" -ne 1 ]; then
  stop_step "UNIFIED_DIFF_FAILED"
fi

python3 - \
  "$SOURCE_FILE" \
  "$CANDIDATE_FILE" \
  "$PRIVATE_DIFF" \
  "$META_DIR/static-tests.json" \
  "$META_DIR/diff-review.json" <<'PY'
import json
import sys
from pathlib import Path

source = Path(sys.argv[1]).read_text(
    encoding="utf-8"
)

candidate = Path(sys.argv[2]).read_text(
    encoding="utf-8"
)

diff_lines = Path(sys.argv[3]).read_text(
    encoding="utf-8"
).splitlines()

source_lines = source.splitlines(keepends=True)

prefix = "".join(source_lines[:20])
suffix = "".join(source_lines[31:])

removed = [
    line[1:]
    for line in diff_lines
    if line.startswith("-")
    and not line.startswith("---")
]

expected_removed = [
    line.rstrip("\n")
    for line in source_lines[20:31]
]

static_checks = {
    "whole_shell_file":
        candidate.startswith("#!/bin/ash"),

    "runtime_library_default":
        (
            'VM101_RUNTIME_LIB="${VM101_RUNTIME_LIB:-'
            '/usr/local/lib/router-egress-vm101-runtime.sh}"'
        ) in candidate,

    "runtime_library_sourced":
        '. "$VM101_RUNTIME_LIB"' in candidate,

    "healthy_helper_used":
        "vm101_healthy_bootstrap_iface"
        in candidate,

    "explicit_interface_preserved":
        'PREFERRED_ACTIVE="$HMN_REQUEST_IFACE"'
        in candidate,

    "table200_optional":
        "ip route show table 200 2>/dev/null"
        in candidate,

    "table200_reference_count":
        candidate.count("table 200") == 1,

    "legacy_hard_error_removed":
        "не нашёл active VPN interface в table 200"
        not in candidate,

    "strict_empty_result_rejected":
        "no strict healthy VPN interface among vpn1-vpn5"
        in candidate,

    "selector_markers_unique":
        candidate.count(
            "# BEGIN CANONICAL_M07_CODE_TEST_SELECTOR"
        ) == 1
        and candidate.count(
            "# END CANONICAL_M07_CODE_TEST_SELECTOR"
        ) == 1,

    "prefix_preserved":
        candidate.startswith(prefix),

    "suffix_preserved":
        candidate.endswith(suffix),
}

review_checks = {
    "only_expected_lines_removed":
        removed == expected_removed,

    "prefix_unchanged":
        candidate.startswith(prefix),

    "suffix_unchanged":
        candidate.endswith(suffix),

    "single_shebang":
        candidate.count("#!/bin/ash") == 1,
}

static_failures = [
    name
    for name, passed in static_checks.items()
    if not passed
]

review_failures = [
    name
    for name, passed in review_checks.items()
    if not passed
]

Path(sys.argv[4]).write_text(
    json.dumps({
        "schema":
            "vm101-code-test-static-tests-v3",
        "passed":
            not static_failures,
        "checks":
            static_checks,
        "failures":
            static_failures,
    }, ensure_ascii=False, indent=2) + "\n",
    encoding="utf-8",
)

Path(sys.argv[5]).write_text(
    json.dumps({
        "schema":
            "vm101-code-test-diff-review-v3",
        "passed":
            not review_failures,
        "checks":
            review_checks,
        "failures":
            review_failures,
    }, ensure_ascii=False, indent=2) + "\n",
    encoding="utf-8",
)

if static_failures:
    raise SystemExit(20)

if review_failures:
    raise SystemExit(21)
PY

STATIC_RC=$?

cp -a \
  "$META_DIR/static-tests.json" \
  "$REPORT_DIR/static-tests.json" \
  2>/dev/null || true

cp -a \
  "$META_DIR/diff-review.json" \
  "$REPORT_DIR/diff-review.json" \
  2>/dev/null || true

if [ "$STATIC_RC" -eq 20 ]; then
  stop_step "STATIC_TESTS_FAILED"
fi

if [ "$STATIC_RC" -eq 21 ]; then
  stop_step "DIFF_REVIEW_FAILED"
fi

if [ "$STATIC_RC" -ne 0 ]; then
  stop_step "STATIC_OR_DIFF_TEST_ERROR"
fi

STATIC_PASS=true
DIFF_PASS=true

python3 - \
  "$CANDIDATE_FILE" \
  "$TEST_DIR/selector-under-test.sh" <<'PY'
import sys
from pathlib import Path

text = Path(sys.argv[1]).read_text(
    encoding="utf-8"
)

start_marker = "# BEGIN CANONICAL_M07_CODE_TEST_SELECTOR"
end_marker = "# END CANONICAL_M07_CODE_TEST_SELECTOR"

start = text.index(start_marker)
end = text.index(end_marker, start) + len(end_marker)

Path(sys.argv[2]).write_text(
    text[start:end] + "\n",
    encoding="utf-8",
)
PY

if [ "$?" -ne 0 ]; then
  stop_step "SELECTOR_EXTRACTION_FAILED"
fi

FAKE_BIN="$TEST_DIR/fake-bin"
FAKE_RUNTIME="$TEST_DIR/fake-runtime.sh"
FIXTURE_RUNNER="$TEST_DIR/run-fixture.sh"

mkdir -p "$FAKE_BIN"

cat > "$FAKE_BIN/ip" <<'EOF'
#!/bin/sh

if [ "$#" -ge 4 ] &&
   [ "$1" = "route" ] &&
   [ "$2" = "show" ] &&
   [ "$3" = "table" ] &&
   [ "$4" = "200" ]
then
  if [ -n "${FIXTURE_TABLE200:-}" ]; then
    printf 'default dev %s\n' "$FIXTURE_TABLE200"
  fi

  exit 0
fi

exit 1
EOF

cat > "$FAKE_RUNTIME" <<'EOF'
#!/bin/sh

vm101_healthy_bootstrap_iface() {
  printf '%s\n' "${1:-}" > "$FIXTURE_ARG_FILE"
  printf '%s\n' "${FIXTURE_RESULT:-}"
}
EOF

cat > "$FIXTURE_RUNNER" <<'EOF'
#!/bin/sh
set -u

. "$SELECTOR_FILE"
printf 'ACTIVE=%s\n' "$ACTIVE"
EOF

chmod 700 \
  "$FAKE_BIN/ip" \
  "$FAKE_RUNTIME" \
  "$FIXTURE_RUNNER"

: > "$TEST_DIR/results.tsv"

run_fixture() {
  local name="$1"
  local request="$2"
  local table200="$3"
  local result="$4"
  local expected_rc="$5"
  local expected_active="$6"
  local expected_arg="$7"

  local arg_file="$TEST_DIR/${name}.arg"
  local stdout_file="$TEST_DIR/${name}.stdout"
  local stderr_file="$TEST_DIR/${name}.stderr"

  rm -f "$arg_file" "$stdout_file" "$stderr_file"

  PATH="$FAKE_BIN:$PATH" \
  VM101_RUNTIME_LIB="$FAKE_RUNTIME" \
  FIXTURE_ARG_FILE="$arg_file" \
  FIXTURE_TABLE200="$table200" \
  FIXTURE_RESULT="$result" \
  HMN_REQUEST_IFACE="$request" \
  SELECTOR_FILE="$TEST_DIR/selector-under-test.sh" \
    sh "$FIXTURE_RUNNER" \
      > "$stdout_file" \
      2> "$stderr_file"

  local actual_rc=$?
  local actual_active
  local actual_arg
  local passed=true

  actual_active="$(
    sed -n 's/^ACTIVE=//p' "$stdout_file" |
      tail -n1
  )"

  actual_arg="$(cat "$arg_file" 2>/dev/null)"

  [ "$actual_rc" -eq "$expected_rc" ] ||
    passed=false

  [ "$actual_active" = "$expected_active" ] ||
    passed=false

  [ "$actual_arg" = "$expected_arg" ] ||
    passed=false

  printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \
    "$name" \
    "$passed" \
    "$actual_rc" \
    "$actual_active" \
    "$actual_arg" \
    "$expected_active" \
    "$expected_arg" \
    >> "$TEST_DIR/results.tsv"
}

run_fixture \
  auto_table200_preferred \
  auto vpn4 vpn4 0 vpn4 vpn4

run_fixture \
  auto_without_table200 \
  auto "" vpn1 0 vpn1 ""

run_fixture \
  explicit_interface_preferred \
  vpn3 vpn4 vpn3 0 vpn3 vpn3

run_fixture \
  no_healthy_interface_refused \
  auto vpn2 "" 1 "" vpn2

python3 - \
  "$TEST_DIR/results.tsv" \
  "$META_DIR/fixture-results.json" <<'PY'
import csv
import json
import sys
from pathlib import Path

rows = []

with Path(sys.argv[1]).open(
    encoding="utf-8",
    newline="",
) as handle:
    for row in csv.reader(handle, delimiter="\t"):
        (
            name,
            passed,
            actual_rc,
            actual_active,
            actual_arg,
            expected_active,
            expected_arg,
        ) = row

        rows.append({
            "name": name,
            "passed": passed == "true",
            "actual_rc": int(actual_rc),
            "actual_active": actual_active,
            "actual_helper_argument": actual_arg,
            "expected_active": expected_active,
            "expected_helper_argument": expected_arg,
        })

failures = [
    row["name"]
    for row in rows
    if not row["passed"]
]

Path(sys.argv[2]).write_text(
    json.dumps({
        "schema":
            "vm101-code-test-fixtures-v3",
        "passed":
            not failures,
        "case_count":
            len(rows),
        "pass_count":
            sum(1 for row in rows if row["passed"]),
        "failure_count":
            len(failures),
        "cases":
            rows,
        "failures":
            failures,
    }, ensure_ascii=False, indent=2) + "\n",
    encoding="utf-8",
)

if failures:
    raise SystemExit(30)
PY

if [ "$?" -ne 0 ]; then
  cp -a \
    "$META_DIR/fixture-results.json" \
    "$REPORT_DIR/fixture-results.json" \
    2>/dev/null || true

  stop_step "FIXTURE_TEST_FAILED"
fi

cp -a \
  "$META_DIR/fixture-results.json" \
  "$REPORT_DIR/fixture-results.json"

FIXTURE_PASS=true

(
  cd "$WORKSPACE" || exit 1

  find . \
    -type f \
    ! -name SHA256SUMS \
    -print0 |
  sort -z |
  xargs -0 sha256sum \
    > SHA256SUMS

  sha256sum -c SHA256SUMS
) > "$REPORT_DIR/private-sha256-check.txt" 2>&1

if [ "$?" -ne 0 ]; then
  stop_step "PRIVATE_WORKSPACE_SHA256_FAILED"
fi

PRIVATE_SHA_PASS=true

python3 - \
  "$WORKFLOW_STATE" \
  "$WORKSPACE" \
  "$SOURCE_SHA" \
  "$RAW_REGION_SHA" \
  "$SANITIZED_REGION_SHA" \
  "$OLD_BLOCK_SHA" \
  "$CANDIDATE_SHA" \
  "$BASE/r/$TOKEN/$REPORT_SLUG/" \
  "$BASE/r/$TOKEN/$MODEL_ID/" \
  "$BASE/r/$TOKEN/$METHODS_ID/" <<'PY'
import sys
from pathlib import Path

path = Path(sys.argv[1])

updates = {
    "M07_NEXT_TARGET":
        "code_test",

    "M07_CODE_TEST_WORKSPACE":
        sys.argv[2],

    "M07_CODE_TEST_SOURCE_SHA256":
        sys.argv[3],

    "M07_CODE_TEST_RAW_REGION_SHA256":
        sys.argv[4],

    "M07_CODE_TEST_SANITIZED_REGION_SHA256":
        sys.argv[5],

    "M07_CODE_TEST_OLD_BLOCK_SHA256":
        sys.argv[6],

    "M07_CODE_TEST_CANDIDATE_SHA256":
        sys.argv[7],

    "M07_CODE_TEST_STATUS":
        "CANDIDATE_TESTED_NOT_INSTALLED",

    "M07_R10C_REPORT":
        sys.argv[8],

    "M07_VM101_MODEL_URL":
        sys.argv[9],

    "M07_VM101_METHODS_URL":
        sys.argv[10],

    "M07_NEXT_STEP":
        "REVIEW_CODE_TEST_DIFF_AND_BUILD_BUNDLE",
}

lines = path.read_text(
    encoding="utf-8",
    errors="replace",
).splitlines()

result = []
seen = set()

for line in lines:
    if "=" not in line:
        result.append(line)
        continue

    key, _ = line.split("=", 1)

    if key in updates:
        result.append(f"{key}={updates[key]}")
        seen.add(key)
    else:
        result.append(line)

for key, value in updates.items():
    if key not in seen:
        result.append(f"{key}={value}")

path.write_text(
    "\n".join(result) + "\n",
    encoding="utf-8",
)
PY

if [ "$?" -ne 0 ]; then
  stop_step "WORKFLOW_STATE_UPDATE_FAILED"
fi

chmod 600 "$WORKFLOW_STATE"
WORKFLOW_UPDATED=true

ALL_OK=true
OPERATION_RESULT="CODE_TEST_CANDIDATE_BUILT_AND_TESTED_WITH_HASH_DOMAINS_SEPARATED"
NEXT_STEP="REVIEW_CODE_TEST_DIFF_AND_BUILD_BUNDLE"

publish_result