#!/usr/bin/env bash
set -Eeuo pipefail
umask 077

STEP_ID="${STEP_ID:?}"
STEP_DIR="${STEP_DIR:?}"
STEP_SHA256="${STEP_SHA256:?}"

REPORT="$STEP_DIR/report.txt"
FACTS="$STEP_DIR/facts.json"
VERIFY="$STEP_DIR/verify.txt"
ROLLBACK="$STEP_DIR/rollback.sh"
LOG="$STEP_DIR/main.log"
MODEL="$STEP_DIR/affected-system-model.txt"
METHODS="$STEP_DIR/methods-and-limitations.txt"
ACCESS_ROUTES="$STEP_DIR/access-routes.txt"
PLAN="$STEP_DIR/publication-plan.txt"
PUBLISH_OUTPUT="$STEP_DIR/publish-output.txt"
BEFORE_REPORTS="$STEP_DIR/before-step-reports.txt"
AFTER_REPORTS="$STEP_DIR/after-step-reports.txt"
MANIFEST="$STEP_DIR/published-files.sha256"
PUBLICATION_STATE="$STEP_DIR/publication-state.env"
PUBLISH_RAW="$STEP_DIR/publisher-stdout.tmp"

PUBLISHED_DIR=""
PUBLISHED_RELATIVE_PATH=""
PUBLISHED_FOLDER=""
STEP_REPORT_URL=""
PUBLIC_OBJECT_KIND=""
PREVIOUS_MOVED_COUNT="0"
PUBLICATION_STATE_CHANGE=false

R04F_DIR="/opt/router-ops/steps/20260715-155800_PRECHECK_VM130_ROUTER_PUBLISH_REPORT_CANDIDATE_R04F"
EXPECTED_R04F_RESULT="PASS_ROUTER_PUBLISH_REPORT_CANDIDATE_BUILT_AND_SANDBOX_TESTED"
EXPECTED_R04F_STEP_SHA256="52f8adb3deeebaf062e38c24c00ba5378ede9a504f7de93c6df9b0b625dfad0a"
EXPECTED_CANDIDATE_SHA256="e78430b57afbd0ae27fc575fc4de78bb267c76caf04ec935b01e9b2f89840e32"
EXPECTED_DIFF_SHA256="8f92ebfaaac5e247d499c45795bb4061b31cfa2992ed13005e449c6da6d8e792"

PUBLISHER="/opt/router-ops/bin/router-publish-report"
REINDEX="/opt/router-ops/bin/router-public-reindex"
DOMAIN="reports.secret-studio.ru"
PUBLIC_BASE="https://$DOMAIN"
PUBLIC_ROOT="/opt/router-ops/public"
TOKEN_FILE="$PUBLIC_ROOT/.router-public-token"
LABEL="step_direct_https_router_publish_report_candidate_r04f"

exec > >(tee -a "$LOG") 2>&1

progress() {
    printf '>>> [%s] %s\n' "$(date '+%F %T')" "$*"
}

stop_step() {
    local result="$1"
    local reason="${2:-unspecified}"

    trap - ERR
    set +e

    if [[ -n "$PUBLISHED_DIR" && -d "$PUBLISHED_DIR" ]]; then
        cat > "$REPORT" <<EOF
RESULT=$result
STOP_REASON=$reason
STEP_ID=$STEP_ID
STEP_REPORT_URL=${STEP_REPORT_URL:-PENDING}
COPY_VERIFY=PASS
STEP_SHA256=$STEP_SHA256
SOURCE_CODE_CHANGE=false
LIVE_INSTALL_PERFORMED=false
PUBLICATION_STATE_CHANGE=$PUBLICATION_STATE_CHANGE
CORE_POSTCHECK=FAIL
EXTERNAL_POSTCHECK=NOT_RUN
RUNTIME_IMPACT=false
TRAFFIC_INTERRUPTION=none
ROLLBACK_REQUIRED=true
EOF

        python3 - "$FACTS" "$STEP_ID" "$result" "$reason" \
            "${STEP_REPORT_URL:-PENDING}" \
            "$PUBLICATION_STATE_CHANGE" <<'PY'
import json
import sys
from datetime import datetime, timezone

output, step_id, result, reason, url, state_change = sys.argv[1:]

with open(output, "w", encoding="utf-8") as fh:
    json.dump(
        {
            "step_id": step_id,
            "timestamp": datetime.now(timezone.utc).astimezone().isoformat(),
            "result": result,
            "stop_reason": reason,
            "step_report_url": url,
            "source_code_change": False,
            "live_install_performed": False,
            "publication_state_change": state_change.lower() == "true",
            "runtime_impact": False,
            "core_postcheck": "FAIL",
        },
        fh,
        indent=2,
        ensure_ascii=False,
    )
    fh.write("\n")
PY

        cat > "$VERIFY" <<EOF
STEP_ID=$STEP_ID
RESULT=$result
STOP_REASON=$reason
COPY_VERIFY=PASS
STEP_SHA256=$STEP_SHA256
PUBLICATION_STATE_CHANGE=$PUBLICATION_STATE_CHANGE
CORE_POSTCHECK=FAIL
FINAL_POSTCHECK=FAIL
RUNTIME_IMPACT=false
EOF

        for file in "$REPORT" "$FACTS" "$VERIFY" "$ROLLBACK" "$LOG"; do
            [[ -f "$file" ]] || continue
            cp "$file" "$PUBLISHED_DIR/$(basename "$file")"
            chmod 644 "$PUBLISHED_DIR/$(basename "$file")"
        done

        "$REINDEX" >/dev/null 2>&1 || true
    fi

    {
        echo "RESULT=$result"
        echo "STOP_REASON=$reason"
        echo "STEP_REPORT_URL=${STEP_REPORT_URL:-PENDING_NOT_PUBLISHED}"
        echo "COPY_VERIFY=PASS"
        echo "STEP_SHA256=$STEP_SHA256"
        echo "STEP_WAS_NOT_STARTED=false"
        echo "RUNTIME_IMPACT=false"
    }

    exit 20
}

on_error() {
    local rc="$1"
    local line="$2"
    stop_step "STOP_UNHANDLED_STEP_ERROR" "rc=$rc line=$line"
}

trap 'on_error "$?" "$LINENO"' ERR

progress "validating R04F candidate evidence"

for cmd in sha256sum python3 curl find awk sed cp chmod sh grep comm xargs systemctl; do
    command -v "$cmd" >/dev/null 2>&1 ||
        stop_step "STOP_REQUIRED_COMMAND_MISSING" "$cmd"
done

[[ -x "$PUBLISHER" ]] ||
    stop_step "STOP_PUBLISHER_NOT_EXECUTABLE" "$PUBLISHER"

[[ -x "$REINDEX" ]] ||
    stop_step "STOP_REINDEX_NOT_EXECUTABLE" "$REINDEX"

[[ -d "$R04F_DIR" ]] ||
    stop_step "STOP_R04F_DIRECTORY_NOT_FOUND" "$R04F_DIR"

R04F_REPORT="$R04F_DIR/report.txt"
R04F_FACTS="$R04F_DIR/facts.json"
R04F_VERIFY="$R04F_DIR/verify.txt"
R04F_ROLLBACK="$R04F_DIR/rollback.txt"
R04F_STEP_CODE="$R04F_DIR/step-code.sh"
R04F_TRANSFER="$R04F_DIR/transfer-verify.txt"
R04F_LOG="$R04F_DIR/main.log"
R04F_CANDIDATE="$R04F_DIR/router-publish-report.candidate"
R04F_DIFF="$R04F_DIR/router-publish-report.candidate.diff"
R04F_LIVE_SOURCE="$R04F_DIR/router-publish-report.live-source"

for file in \
    "$R04F_REPORT" \
    "$R04F_FACTS" \
    "$R04F_VERIFY" \
    "$R04F_ROLLBACK" \
    "$R04F_STEP_CODE" \
    "$R04F_TRANSFER" \
    "$R04F_LOG" \
    "$R04F_CANDIDATE" \
    "$R04F_DIFF" \
    "$R04F_LIVE_SOURCE"; do
    [[ -f "$file" && -r "$file" ]] ||
        stop_step "STOP_R04F_ARTIFACT_MISSING" "$file"
done

grep -qx "RESULT=$EXPECTED_R04F_RESULT" "$R04F_REPORT" ||
    stop_step "STOP_R04F_RESULT_NOT_CONFIRMED" "$R04F_REPORT"

python3 -m json.tool "$R04F_FACTS" >/dev/null ||
    stop_step "STOP_R04F_FACTS_INVALID" "$R04F_FACTS"

R04F_STEP_SHA256="$(sha256sum "$R04F_STEP_CODE" | awk '{print $1}')"
CANDIDATE_SHA256="$(sha256sum "$R04F_CANDIDATE" | awk '{print $1}')"
DIFF_SHA256="$(sha256sum "$R04F_DIFF" | awk '{print $1}')"

[[ "$R04F_STEP_SHA256" == "$EXPECTED_R04F_STEP_SHA256" ]] ||
    stop_step "STOP_R04F_STEP_SHA256_MISMATCH" "$R04F_STEP_SHA256"

[[ "$CANDIDATE_SHA256" == "$EXPECTED_CANDIDATE_SHA256" ]] ||
    stop_step "STOP_CANDIDATE_SHA256_MISMATCH" "$CANDIDATE_SHA256"

[[ "$DIFF_SHA256" == "$EXPECTED_DIFF_SHA256" ]] ||
    stop_step "STOP_DIFF_SHA256_MISMATCH" "$DIFF_SHA256"

sh -n "$R04F_CANDIDATE" ||
    stop_step "STOP_CANDIDATE_SYNTAX_INVALID" "$R04F_CANDIDATE"

grep -qx 'LIVE_INSTALL_PERFORMED=false' "$R04F_VERIFY" ||
    stop_step "STOP_R04F_LIVE_INSTALL_FLAG_INVALID" "$R04F_VERIFY"

grep -qx 'SANDBOX_ROTATION=PASS' "$R04F_VERIFY" ||
    stop_step "STOP_R04F_SANDBOX_NOT_CONFIRMED" "$R04F_VERIFY"

progress "preparing publication artifacts"

cp -a "$R04F_REPORT" "$STEP_DIR/r04f-report.txt"
cp -a "$R04F_FACTS" "$STEP_DIR/r04f-facts.json"
cp -a "$R04F_VERIFY" "$STEP_DIR/r04f-verify.txt"
cp -a "$R04F_ROLLBACK" "$STEP_DIR/r04f-rollback.txt"
cp -a "$R04F_STEP_CODE" "$STEP_DIR/r04f-step-code.sh"
cp -a "$R04F_TRANSFER" "$STEP_DIR/r04f-transfer-verify.txt"
cp -a "$R04F_LOG" "$STEP_DIR/r04f-main.log"
cp -a "$R04F_CANDIDATE" "$STEP_DIR/r04f-router-publish-report.candidate"
cp -a "$R04F_DIFF" "$STEP_DIR/r04f-router-publish-report.candidate.diff"
cp -a "$R04F_LIVE_SOURCE" "$STEP_DIR/r04f-router-publish-report.live-source"

chmod 600 \
    "$STEP_DIR"/r04f-* \
    "$STEP_DIR/step-code.sh" \
    "$STEP_DIR/transfer-verify.txt"

TOKEN="$(cat "$TOKEN_FILE")"
TOKEN_ROOT="$PUBLIC_ROOT/r/$TOKEN"
LATEST_DIR="$TOKEN_ROOT/latest"
OLD_DIR="$TOKEN_ROOT/old"

[[ "$TOKEN" =~ ^[a-f0-9]{48}$ ]] ||
    stop_step "STOP_PUBLIC_TOKEN_INVALID" "$TOKEN"

[[ -d "$LATEST_DIR" && -d "$OLD_DIR" ]] ||
    stop_step "STOP_PUBLIC_LAYOUT_MISSING" "$TOKEN_ROOT"

find "$LATEST_DIR" \
    -mindepth 1 \
    -maxdepth 1 \
    -type d \
    -name '*_step*' \
    -printf '%f\n' |
LC_ALL=C sort > "$BEFORE_REPORTS"

cat > "$MODEL" <<EOF
AFFECTED_SYSTEM=VM130 public report evidence
LIVE_PUBLISHER=/opt/router-ops/bin/router-publish-report
CANDIDATE_SOURCE=$R04F_CANDIDATE
CANDIDATE_SHA256=$CANDIDATE_SHA256
LIVE_INSTALL_PERFORMED=false
CADDY_CHANGE=false
SERVICE_CHANGE=false
PUBLICATION_STATE_CHANGE=true
EOF

cat > "$METHODS" <<EOF
STEP_TYPE=evidence publication only
SOURCE_BASIS=exact R04F candidate built from live R04E source
PUBLICATION_METHOD=existing live router-publish-report
PUBLIC_POSTCHECK=direct Caddy HTTPS using --resolve plus file SHA256
EXTERNAL_POSTCHECK=assistant HTTPS fetch after terminal result
KNOWN_LIMITATION=live publisher currently rotates prior step-report folders into old
EOF

cat > "$ACCESS_ROUTES" <<EOF
VM130=10.71.100.84
PUBLIC_IPV4=95.165.105.4
PUBLIC_DOMAIN=$PUBLIC_BASE/
LATEST_ROOT_URL=$PUBLIC_BASE/latest/
OLD_ROOT_URL=$PUBLIC_BASE/old/
EOF

cat > "$PLAN" <<EOF
CHANGE_SCOPE=publication tree only
SOURCE_CODE_CHANGE=false
LIVE_INSTALL_PERFORMED=false
CADDY_CHANGE=false
SERVICE_CHANGE=false
PUBLISH_LABEL=$LABEL
EXPECTED_PUBLIC_OBJECT_KIND=step-report
EXPECTED_CANDIDATE_SHA256=$EXPECTED_CANDIDATE_SHA256
EXPECTED_DIFF_SHA256=$EXPECTED_DIFF_SHA256
EOF

: > "$REPORT"
: > "$FACTS"
: > "$VERIFY"
: > "$ROLLBACK"
: > "$MANIFEST"
: > "$PUBLICATION_STATE"
: > "$PUBLISH_OUTPUT"
: > "$AFTER_REPORTS"
: > "$PUBLISH_RAW"

PUBLISH_FILES=(
    "$STEP_DIR/step-code.sh"
    "$STEP_DIR/transfer-verify.txt"
    "$REPORT"
    "$FACTS"
    "$VERIFY"
    "$ROLLBACK"
    "$LOG"
    "$MODEL"
    "$METHODS"
    "$ACCESS_ROUTES"
    "$PLAN"
    "$PUBLISH_OUTPUT"
    "$BEFORE_REPORTS"
    "$AFTER_REPORTS"
    "$MANIFEST"
    "$PUBLICATION_STATE"
    "$STEP_DIR/r04f-report.txt"
    "$STEP_DIR/r04f-facts.json"
    "$STEP_DIR/r04f-verify.txt"
    "$STEP_DIR/r04f-rollback.txt"
    "$STEP_DIR/r04f-step-code.sh"
    "$STEP_DIR/r04f-transfer-verify.txt"
    "$STEP_DIR/r04f-main.log"
    "$STEP_DIR/r04f-router-publish-report.candidate"
    "$STEP_DIR/r04f-router-publish-report.candidate.diff"
    "$STEP_DIR/r04f-router-publish-report.live-source"
)

for file in "${PUBLISH_FILES[@]}"; do
    [[ -f "$file" ]] ||
        stop_step "STOP_PREPARED_ARTIFACT_MISSING" "$file"
done

progress "publishing R04F candidate evidence"

if ! "$PUBLISHER" "$LABEL" "${PUBLISH_FILES[@]}" > "$PUBLISH_RAW"; then
    stop_step "STOP_PUBLISHER_COMMAND_FAILED" "$PUBLISH_RAW"
fi

cp "$PUBLISH_RAW" "$PUBLISH_OUTPUT"

PUBLISHED_DIR="$(
    awk -F= '$1=="PUBLISHED_DIR" {print substr($0,index($0,"=")+1)}' \
        "$PUBLISH_OUTPUT" |
    tail -n 1
)"
PUBLISHED_RELATIVE_PATH="$(
    awk -F= '$1=="PUBLISHED_RELATIVE_PATH" {print substr($0,index($0,"=")+1)}' \
        "$PUBLISH_OUTPUT" |
    tail -n 1
)"
PUBLIC_OBJECT_KIND="$(
    awk -F= '$1=="PUBLIC_OBJECT_KIND" {print $2}' \
        "$PUBLISH_OUTPUT" |
    tail -n 1
)"
PREVIOUS_MOVED_COUNT="$(
    awk -F= '$1=="PREVIOUS_MOVED_COUNT" {print $2}' \
        "$PUBLISH_OUTPUT" |
    tail -n 1
)"

[[ -n "$PUBLISHED_DIR" && -d "$PUBLISHED_DIR" ]] ||
    stop_step "STOP_PUBLISHED_DIRECTORY_MISSING" "$PUBLISHED_DIR"

[[ "$PUBLISHED_RELATIVE_PATH" == latest/* ]] ||
    stop_step "STOP_PUBLISHED_RELATIVE_PATH_INVALID" "$PUBLISHED_RELATIVE_PATH"

[[ "$PUBLIC_OBJECT_KIND" == "step-report" ]] ||
    stop_step "STOP_PUBLIC_OBJECT_KIND_INVALID" "$PUBLIC_OBJECT_KIND"

PUBLICATION_STATE_CHANGE=true
PUBLISHED_FOLDER="$(basename "$PUBLISHED_DIR")"
STEP_REPORT_URL="$PUBLIC_BASE/latest/$PUBLISHED_FOLDER/"
FACTS_URL="${STEP_REPORT_URL}facts.json"
VERIFY_URL="${STEP_REPORT_URL}verify.txt"
ROLLBACK_URL="${STEP_REPORT_URL}rollback.sh"
CANDIDATE_URL="${STEP_REPORT_URL}r04f-router-publish-report.candidate"
DIFF_URL="${STEP_REPORT_URL}r04f-router-publish-report.candidate.diff"

find "$LATEST_DIR" \
    -mindepth 1 \
    -maxdepth 1 \
    -type d \
    -name '*_step*' \
    -printf '%f\n' |
LC_ALL=C sort > "$AFTER_REPORTS"

mapfile -t MOVED_NAMES < <(
    comm -23 "$BEFORE_REPORTS" "$AFTER_REPORTS"
)

ACTUAL_MOVED_COUNT="${#MOVED_NAMES[@]}"

if [[ "$ACTUAL_MOVED_COUNT" -ne "$PREVIOUS_MOVED_COUNT" ]]; then
    stop_step \
        "STOP_PUBLICATION_MOVED_COUNT_MISMATCH" \
        "expected=$PREVIOUS_MOVED_COUNT actual=$ACTUAL_MOVED_COUNT"
fi

{
    echo "PUBLISHED_DIR=$PUBLISHED_DIR"
    echo "PUBLISHED_RELATIVE_PATH=$PUBLISHED_RELATIVE_PATH"
    echo "PUBLISHED_FOLDER=$PUBLISHED_FOLDER"
    echo "PUBLIC_OBJECT_KIND=$PUBLIC_OBJECT_KIND"
    echo "PREVIOUS_MOVED_COUNT=$PREVIOUS_MOVED_COUNT"
    printf 'MOVED_NAME=%s\n' "${MOVED_NAMES[@]}"
} > "$PUBLICATION_STATE"

cat > "$ROLLBACK" <<EOF
#!/usr/bin/env bash
set -Eeuo pipefail

PUBLISHED_DIR='$PUBLISHED_DIR'
LATEST_DIR='$LATEST_DIR'
OLD_DIR='$OLD_DIR'
REINDEX='$REINDEX'

rm -rf "\$PUBLISHED_DIR"
EOF

for moved in "${MOVED_NAMES[@]}"; do
    printf 'if [[ -d %q && ! -e %q ]]; then mv %q %q; fi\n' \
        "$OLD_DIR/$moved" \
        "$LATEST_DIR/$moved" \
        "$OLD_DIR/$moved" \
        "$LATEST_DIR/$moved" \
        >> "$ROLLBACK"
done

cat >> "$ROLLBACK" <<'EOF'
"$REINDEX" >/dev/null
echo "ROLLBACK_RESULT=PASS"
EOF

chmod 700 "$ROLLBACK"

progress "finalizing report and independent post-check"

LOCAL_M07_PLAN_URL="$PUBLIC_BASE/latest/20260713-193942_local_architecture_plan_vm101_autonomous_hmn_recovery/"
GLOBAL_PROJECT_PLAN_URL="$PUBLIC_BASE/latest/20260711-123348_global_project_plan_wg_paid/"
ACCESS_MAP_URL="$PUBLIC_BASE/latest/20260714-092500_access_map_canonical_current/"
VM100_PUBLIC_URL="$PUBLIC_BASE/latest/20260713-182653_vm100_git_source_097755408853/"
VM101_PUBLIC_URL="$PUBLIC_BASE/latest/20260713-192042_vm101_git_source_027589515a26/"
VM121_PUBLIC_URL="$PUBLIC_BASE/latest/20260713-182700_vm121_git_source_93e0e5a31f09/"
VM101_MODEL_URL="$PUBLIC_BASE/latest/20260713-192030_vm101_model_hmn_download_selector_r13a/"
VM101_METHODS_URL="$PUBLIC_BASE/latest/20260713-193942_vm101_methods_machine_git_count_contract_r13b/"
VM130_SOURCE_URL="$PUBLIC_BASE/latest/20260714-085433_vm130_router_ops_source_snapshot_r13f/"
LATEST_ROOT_URL="$PUBLIC_BASE/latest/"
OLD_ROOT_URL="$PUBLIC_BASE/old/"

cat > "$FACTS" <<EOF
{
  "step_id": "$STEP_ID",
  "result": "PASS_R04F_CANDIDATE_EVIDENCE_PUBLISHED_LOCAL",
  "source_code_change": false,
  "live_install_performed": false,
  "publication_state_change": true,
  "runtime_impact": false,
  "candidate_sha256": "$CANDIDATE_SHA256",
  "diff_sha256": "$DIFF_SHA256",
  "r04f_step_sha256": "$R04F_STEP_SHA256",
  "published_dir": "$PUBLISHED_DIR",
  "published_relative_path": "$PUBLISHED_RELATIVE_PATH",
  "step_report_url": "$STEP_REPORT_URL",
  "candidate_url": "$CANDIDATE_URL",
  "diff_url": "$DIFF_URL",
  "public_object_kind": "$PUBLIC_OBJECT_KIND",
  "previous_moved_count": $PREVIOUS_MOVED_COUNT,
  "external_postcheck": "pending_assistant"
}
EOF

python3 -m json.tool "$FACTS" >/dev/null ||
    stop_step "STOP_FINAL_FACTS_INVALID" "$FACTS"

cat > "$REPORT" <<EOF
RESULT=PASS_R04F_CANDIDATE_EVIDENCE_PUBLISHED_LOCAL
STEP_ID=$STEP_ID
STEP_REPORT_URL=$STEP_REPORT_URL
LOCAL_M07_PLAN_URL=$LOCAL_M07_PLAN_URL
GLOBAL_PROJECT_PLAN_URL=$GLOBAL_PROJECT_PLAN_URL
ACCESS_MAP_URL=$ACCESS_MAP_URL
VM100_PUBLIC_URL=$VM100_PUBLIC_URL
VM101_PUBLIC_URL=$VM101_PUBLIC_URL
VM121_PUBLIC_URL=$VM121_PUBLIC_URL
VM101_MODEL_URL=$VM101_MODEL_URL
VM101_METHODS_URL=$VM101_METHODS_URL
VM130_SOURCE_URL=$VM130_SOURCE_URL
LATEST_ROOT_URL=$LATEST_ROOT_URL
OLD_ROOT_URL=$OLD_ROOT_URL
FACTS_URL=$FACTS_URL
VERIFY_URL=$VERIFY_URL
ROLLBACK_URL=$ROLLBACK_URL
CANDIDATE_URL=$CANDIDATE_URL
DIFF_URL=$DIFF_URL
PUBLIC_OBJECT_KIND=$PUBLIC_OBJECT_KIND
PREVIOUS_MOVED_COUNT=$PREVIOUS_MOVED_COUNT
COPY_VERIFY=PASS
STEP_SHA256=$STEP_SHA256
R04F_STEP_SHA256=$R04F_STEP_SHA256
CANDIDATE_SHA256=$CANDIDATE_SHA256
DIFF_SHA256=$DIFF_SHA256
SOURCE_CODE_CHANGE=false
LIVE_INSTALL_PERFORMED=false
PUBLICATION_STATE_CHANGE=true
ACTIVE_SOURCES_UNCHANGED=true
CORE_POSTCHECK=PENDING
EXTERNAL_POSTCHECK=PENDING_ASSISTANT
RUNTIME_IMPACT=false
TRAFFIC_INTERRUPTION=none
ROLLBACK_REQUIRED=true
VM130_SOURCE_STATUS=previous_confirmed_unchanged_by_this_step
EOF

for file in \
    "$REPORT" \
    "$FACTS" \
    "$VERIFY" \
    "$ROLLBACK" \
    "$LOG" \
    "$PUBLISH_OUTPUT" \
    "$AFTER_REPORTS" \
    "$MANIFEST" \
    "$PUBLICATION_STATE"; do
    cp "$file" "$PUBLISHED_DIR/$(basename "$file")"
    chmod 644 "$PUBLISHED_DIR/$(basename "$file")"
done

chmod 755 "$PUBLISHED_DIR"

REPORT_CODE="$(
    curl -sS \
        --connect-timeout 5 \
        --max-time 20 \
        --resolve "$DOMAIN:443:10.71.100.84" \
        -o "$STEP_DIR/report-fetch.txt" \
        -w '%{http_code}' \
        "${STEP_REPORT_URL}report.txt" 2>/dev/null ||
    true
)"
CANDIDATE_CODE="$(
    curl -sS \
        --connect-timeout 5 \
        --max-time 20 \
        --resolve "$DOMAIN:443:10.71.100.84" \
        -o "$STEP_DIR/candidate-fetch.txt" \
        -w '%{http_code}' \
        "$CANDIDATE_URL" 2>/dev/null ||
    true
)"
DIFF_CODE="$(
    curl -sS \
        --connect-timeout 5 \
        --max-time 20 \
        --resolve "$DOMAIN:443:10.71.100.84" \
        -o "$STEP_DIR/diff-fetch.txt" \
        -w '%{http_code}' \
        "$DIFF_URL" 2>/dev/null ||
    true
)"
LATEST_CODE="$(
    curl -sS \
        --connect-timeout 5 \
        --max-time 20 \
        --resolve "$DOMAIN:443:10.71.100.84" \
        -o /dev/null \
        -w '%{http_code}' \
        "$LATEST_ROOT_URL" 2>/dev/null ||
    true
)"
OLD_CODE="$(
    curl -sS \
        --connect-timeout 5 \
        --max-time 20 \
        --resolve "$DOMAIN:443:10.71.100.84" \
        -o /dev/null \
        -w '%{http_code}' \
        "$OLD_ROOT_URL" 2>/dev/null ||
    true
)"

REPORT_CODE="${REPORT_CODE:-000}"
CANDIDATE_CODE="${CANDIDATE_CODE:-000}"
DIFF_CODE="${DIFF_CODE:-000}"
LATEST_CODE="${LATEST_CODE:-000}"
OLD_CODE="${OLD_CODE:-000}"

FETCHED_CANDIDATE_SHA256="MISSING"
FETCHED_DIFF_SHA256="MISSING"

if [[ -f "$STEP_DIR/candidate-fetch.txt" ]]; then
    FETCHED_CANDIDATE_SHA256="$(
        sha256sum "$STEP_DIR/candidate-fetch.txt" |
        awk '{print $1}'
    )"
fi

if [[ -f "$STEP_DIR/diff-fetch.txt" ]]; then
    FETCHED_DIFF_SHA256="$(
        sha256sum "$STEP_DIR/diff-fetch.txt" |
        awk '{print $1}'
    )"
fi

LATEST_STEP_REPORT_COUNT="$(
    find "$LATEST_DIR" \
        -mindepth 1 \
        -maxdepth 1 \
        -type d \
        -name '*_step*' |
    wc -l |
    tr -d ' '
)"

CADDY_ACTIVE="$(systemctl is-active caddy 2>/dev/null || true)"

CORE_POSTCHECK=FAIL

if [[ "$REPORT_CODE" == "200" ]] &&
   [[ "$CANDIDATE_CODE" == "200" ]] &&
   [[ "$DIFF_CODE" == "200" ]] &&
   [[ "$LATEST_CODE" == "200" ]] &&
   [[ "$OLD_CODE" == "200" ]] &&
   [[ "$FETCHED_CANDIDATE_SHA256" == "$CANDIDATE_SHA256" ]] &&
   [[ "$FETCHED_DIFF_SHA256" == "$DIFF_SHA256" ]] &&
   [[ "$LATEST_STEP_REPORT_COUNT" -eq 1 ]] &&
   [[ "$CADDY_ACTIVE" == "active" ]]; then
    CORE_POSTCHECK=PASS
fi

cat > "$VERIFY" <<EOF
STEP_ID=$STEP_ID
RESULT=PASS_R04F_CANDIDATE_EVIDENCE_PUBLISHED_LOCAL
COPY_VERIFY=PASS
STEP_SHA256=$STEP_SHA256
R04F_RESULT=$EXPECTED_R04F_RESULT
R04F_STEP_SHA256=$R04F_STEP_SHA256
CANDIDATE_SHA256=$CANDIDATE_SHA256
DIFF_SHA256=$DIFF_SHA256
CANDIDATE_SYNTAX_CHECK=PASS
SOURCE_CODE_CHANGE=false
LIVE_INSTALL_PERFORMED=false
PUBLICATION_STATE_CHANGE=true
PUBLISHED_DIR=$PUBLISHED_DIR
PUBLISHED_RELATIVE_PATH=$PUBLISHED_RELATIVE_PATH
PUBLIC_OBJECT_KIND=$PUBLIC_OBJECT_KIND
PREVIOUS_MOVED_COUNT=$PREVIOUS_MOVED_COUNT
ACTUAL_MOVED_COUNT=$ACTUAL_MOVED_COUNT
LATEST_STEP_REPORT_COUNT=$LATEST_STEP_REPORT_COUNT
REPORT_CODE=$REPORT_CODE
CANDIDATE_CODE=$CANDIDATE_CODE
DIFF_CODE=$DIFF_CODE
LATEST_CODE=$LATEST_CODE
OLD_CODE=$OLD_CODE
FETCHED_CANDIDATE_SHA256=$FETCHED_CANDIDATE_SHA256
FETCHED_DIFF_SHA256=$FETCHED_DIFF_SHA256
CADDY_ACTIVE=$CADDY_ACTIVE
CORE_POSTCHECK=$CORE_POSTCHECK
EXTERNAL_POSTCHECK=PENDING_ASSISTANT
RUNTIME_IMPACT=false
FINAL_POSTCHECK=$CORE_POSTCHECK
EOF

if [[ "$CORE_POSTCHECK" != "PASS" ]]; then
    cp "$VERIFY" "$PUBLISHED_DIR/verify.txt"
    chmod 644 "$PUBLISHED_DIR/verify.txt"
    stop_step "STOP_R04F_EVIDENCE_PUBLICATION_POSTCHECK_FAILED" "$VERIFY"
fi

sed -i 's/^CORE_POSTCHECK=PENDING$/CORE_POSTCHECK=PASS/' "$REPORT"

(
    cd "$STEP_DIR"
    find . \
        -maxdepth 1 \
        -type f \
        ! -name 'main.log' \
        ! -name 'published-files.sha256' \
        ! -name 'publisher-stdout.tmp' \
        -print0 |
    LC_ALL=C sort -z |
    xargs -0 sha256sum
) > "$MANIFEST"

for file in \
    "$REPORT" \
    "$FACTS" \
    "$VERIFY" \
    "$ROLLBACK" \
    "$LOG" \
    "$PUBLISH_OUTPUT" \
    "$AFTER_REPORTS" \
    "$MANIFEST" \
    "$PUBLICATION_STATE"; do
    cp "$file" "$PUBLISHED_DIR/$(basename "$file")"
    chmod 644 "$PUBLISHED_DIR/$(basename "$file")"
done

"$REINDEX" >/dev/null

FINAL_REPORT_CODE="$(
    curl -sS \
        --connect-timeout 5 \
        --max-time 20 \
        --resolve "$DOMAIN:443:10.71.100.84" \
        -o /dev/null \
        -w '%{http_code}' \
        "${STEP_REPORT_URL}report.txt" 2>/dev/null ||
    true
)"
FINAL_VERIFY_CODE="$(
    curl -sS \
        --connect-timeout 5 \
        --max-time 20 \
        --resolve "$DOMAIN:443:10.71.100.84" \
        -o /dev/null \
        -w '%{http_code}' \
        "$VERIFY_URL" 2>/dev/null ||
    true
)"

if [[ "$FINAL_REPORT_CODE" != "200" ||
      "$FINAL_VERIFY_CODE" != "200" ]]; then
    stop_step \
        "STOP_R04F_EVIDENCE_FINAL_HTTP_CHECK_FAILED" \
        "report=$FINAL_REPORT_CODE verify=$FINAL_VERIFY_CODE"
fi

progress "candidate evidence publication complete"

cat <<EOF
RESULT=PASS_R04F_CANDIDATE_EVIDENCE_PUBLISHED_LOCAL
STEP_REPORT_URL=$STEP_REPORT_URL
LOCAL_M07_PLAN_URL=$LOCAL_M07_PLAN_URL
GLOBAL_PROJECT_PLAN_URL=$GLOBAL_PROJECT_PLAN_URL
ACCESS_MAP_URL=$ACCESS_MAP_URL
VM100_PUBLIC_URL=$VM100_PUBLIC_URL
VM101_PUBLIC_URL=$VM101_PUBLIC_URL
VM121_PUBLIC_URL=$VM121_PUBLIC_URL
VM101_MODEL_URL=$VM101_MODEL_URL
VM101_METHODS_URL=$VM101_METHODS_URL
VM130_SOURCE_URL=$VM130_SOURCE_URL
COPY_VERIFY=PASS
STEP_SHA256=$STEP_SHA256
RUNTIME_IMPACT=false
EOF