#!/usr/bin/env bash
set -Eeuo pipefail
umask 077
export PATH='/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
STEP_ID='STEP_050M07R20QL_ZERO_HEALTHY_DIRECT_BOOTSTRAP_DESIGN'
TARGET_PACKAGE_SHA='a9fb38453ade9d806e7fd4e51ba1531f028996310062394193789f42ef5426f3'
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
BUNDLE_ROOT="${BUNDLE_ROOT:-$SCRIPT_DIR}"; export BUNDLE_ROOT
BASE="${ROUTER_OPS_BASE:-/opt/router-ops}"; CONTRACT_ROOT="${ROUTER_CONTRACT_ROOT:-/opt/router-ops}"
WORKFLOW_LIB="${ROUTER_STEP_WORKFLOW_LIB:-$CONTRACT_ROOT/lib/router-step-workflow.sh}"; FINALIZER="${ROUTER_STEP_FINALIZE_BIN:-$CONTRACT_ROOT/bin/router-step-finalize}"; SAFE_PAYLOAD="${ROUTER_PUBLIC_SAFE_PAYLOAD_BIN:-$CONTRACT_ROOT/bin/router-public-safe-payload}"; POLICY_LIB="${ROUTER_PUBLICATION_POLICY_LIB:-$CONTRACT_ROOT/lib/router-publication-policy.sh}"
RUN_ID="$(date -u +%Y%m%d-%H%M%S)-$$"; RUN_DIR="${ROUTER_STEP_RUN_DIR:-$BASE/state/step-runs/$STEP_ID/$RUN_ID}"; CURRENT_FILE="$RUN_DIR/workflow-current.txt"; EVENTS_FILE="$RUN_DIR/workflow-events.tsv"; EVIDENCE_DIR="$RUN_DIR/evidence"; REPORT_DIR="$RUN_DIR/report"; PUBLIC_PAYLOAD="$RUN_DIR/public-payload"; FINAL_ENV="$RUN_DIR/finalize.txt"; LOCK_FILE="${ROUTER_STEP_LOCK_FILE:-$BASE/state/locks/${STEP_ID}.lock}"
CURRENT_PHASE=bootstrap; CORE_CHANGE_COMPLETE=false
archive_latest(){ "$BUNDLE_ROOT/scripts/archive-latest.sh"; }
source "$WORKFLOW_LIB"
publish_stop_report(){
 local phase="$1" line="$2" rc="$3"
 python3 "$BUNDLE_ROOT/scripts/build_stop_report.py" --step-id "$STEP_ID" --phase "$phase" --line "$line" --rc "$rc" --output "$REPORT_DIR" --release-info "$BUNDLE_ROOT/release-info.json" --installer-sha "$BUNDLE_ROOT/installer.sha256" --bundle-manifest "$BUNDLE_ROOT/manifest.sha256" || return 1
 cp "$BUNDLE_ROOT/install.sh" "$REPORT_DIR/executed-step.sh"
 local args=("$REPORT_DIR/report.txt" report.txt "$REPORT_DIR/facts.json" facts.json "$REPORT_DIR/facts-public.html" facts-public.html "$REPORT_DIR/verify-public.html" verify-public.html "$REPORT_DIR/rollback-public.html" rollback-public.html "$REPORT_DIR/release-info.json" release-info.json "$REPORT_DIR/installer.sha256" installer.sha256 "$REPORT_DIR/bundle-manifest.sha256" bundle-manifest.sha256 "$REPORT_DIR/executed-step.sh" executed-step.sh)
 for f in preflight-main.txt preflight.txt vm100-source-check.txt vm101-source-check.txt pve-preflight.txt vm100-preflight.txt vm101-preflight.txt audit.txt audit-source.json audit-source-excerpts.txt postcheck.txt source-publish.txt model-methods.txt project-source.txt; do [[ ! -f "$EVIDENCE_DIR/$f" ]] || { cp "$EVIDENCE_DIR/$f" "$REPORT_DIR/$f"; args+=("$REPORT_DIR/$f" "$f"); }; done
 ROUTER_PUBLICATION_POLICY_LIB="$POLICY_LIB" "$SAFE_PAYLOAD" "$PUBLIC_PAYLOAD" "${args[@]}" || return 1
 "$FINALIZER" --label step050m07r20ql_zero_healthy_direct_bootstrap_design --payload-dir "$PUBLIC_PAYLOAD" --workflow-current "$CURRENT_FILE" --workflow-events "$EVENTS_FILE" --output-env "$FINAL_ENV" --expect-kind step-report
}
stop(){
 local line="$1" rc="$2"; trap - ERR; set +e; local guard="$RUN_DIR/.stop-handler-running"; mkdir -p "$RUN_DIR" >/dev/null 2>&1 || true; mkdir "$guard" 2>/dev/null || exit "$rc"; local phase="${CURRENT_PHASE:-unknown}"; [[ ! -f "$CURRENT_FILE" ]] || router_step_phase_fail "$phase" "line=$line rc=$rc" >/dev/null 2>&1 || true; publish_stop_report "$phase" "$line" "$rc" || true; archive_latest; [[ ! -f "$FINAL_ENV" ]] || cat "$FINAL_ENV"; echo RESULT=STOP_R20QL_ZERO_HEALTHY_DIRECT_BOOTSTRAP_DESIGN; echo STOP_PHASE="$phase"; echo STOP_LINE="$line"; echo STOP_RC="$rc"; echo RUNTIME_IMPACT=false; exit "$rc"
}
trap 'stop "$LINENO" "$?"' ERR
mkdir -p "$RUN_DIR" "$EVIDENCE_DIR" "$REPORT_DIR" "$PUBLIC_PAYLOAD" "$(dirname "$LOCK_FILE")"; exec 9>"$LOCK_FILE"; flock -n 9
router_step_workflow_init "$CURRENT_FILE" "$EVENTS_FILE" preflight audit postcheck source_publish model_methods project_source report_build
CURRENT_PHASE=preflight; router_step_phase_begin preflight
"$BUNDLE_ROOT/scripts/preflight.sh" "$EVIDENCE_DIR" | tee "$EVIDENCE_DIR/preflight-main.txt"; grep -Fqx RESULT=PASS_R20QL_PREFLIGHT "$EVIDENCE_DIR/preflight-main.txt"; cp "$EVIDENCE_DIR/preflight-main.txt" "$EVIDENCE_DIR/preflight.txt"; router_step_phase_complete preflight exact_sources_normal_runtime_and_direct_disabled_verified
CURRENT_PHASE=audit; router_step_phase_begin audit
if [[ -n "${ROUTER_R20QL_AUDIT_PHASE_FIXTURE:-}" ]]; then cat "$ROUTER_R20QL_AUDIT_PHASE_FIXTURE"; else "$BUNDLE_ROOT/scripts/apply-audit.sh" "$TARGET_PACKAGE_SHA" "$RUN_DIR/audit-work"; cp "$RUN_DIR/audit-work/source/audit.json" "$EVIDENCE_DIR/audit-source.json"; cp "$RUN_DIR/audit-work/source/source-excerpts.txt" "$EVIDENCE_DIR/audit-source-excerpts.txt"; fi | tee "$EVIDENCE_DIR/audit.txt"
grep -Fqx RESULT=PASS_R20QL_AUDIT "$EVIDENCE_DIR/audit.txt"; grep -Fqx AUDIT_CONCLUSION=MINIMAL_ZERO_HEALTHY_FOUNDATION_REQUIRED "$EVIDENCE_DIR/audit.txt"; [[ -n "${ROUTER_R20QL_AUDIT_PHASE_FIXTURE:-}" ]] || { test -s "$EVIDENCE_DIR/audit-source.json"; test -s "$EVIDENCE_DIR/audit-source-excerpts.txt"; }; router_step_phase_complete audit exact_zero_healthy_implementation_boundary_proven
CURRENT_PHASE=postcheck; router_step_phase_begin postcheck
if [[ -n "${ROUTER_R20QL_POSTCHECK_PHASE_FIXTURE:-}" ]]; then cat "$ROUTER_R20QL_POSTCHECK_PHASE_FIXTURE"; else "$BUNDLE_ROOT/scripts/postcheck-run.sh" "$RUN_DIR/postcheck-work"; fi | tee "$EVIDENCE_DIR/postcheck.txt"; grep -Fqx RESULT=PASS_R20QL_POSTCHECK "$EVIDENCE_DIR/postcheck.txt"; grep -Fqx RUNTIME_STATE_CHANGE=false "$EVIDENCE_DIR/postcheck.txt"; router_step_phase_complete postcheck no_runtime_or_source_change_proven
CURRENT_PHASE=source_publish; router_step_phase_begin source_publish
if [[ -n "${ROUTER_R20QL_SOURCE_PHASE_FIXTURE:-}" ]]; then cat "$ROUTER_R20QL_SOURCE_PHASE_FIXTURE"; else "$BUNDLE_ROOT/scripts/source-verify.sh"; fi | tee "$EVIDENCE_DIR/source-publish.txt"; grep -Fqx RESULT=PASS_R20QL_SOURCE_VERIFY "$EVIDENCE_DIR/source-publish.txt"; router_step_phase_complete source_publish unchanged_machine_git_sources_reused
CURRENT_PHASE=model_methods; router_step_phase_begin model_methods
if [[ -n "${ROUTER_R20QL_MODEL_METHODS_PHASE_FIXTURE:-}" ]]; then cat "$ROUTER_R20QL_MODEL_METHODS_PHASE_FIXTURE"; else "$BUNDLE_ROOT/scripts/publish-model-methods.sh" "$EVIDENCE_DIR/audit.txt" "$EVIDENCE_DIR/preflight.txt" "$EVIDENCE_DIR/source-publish.txt" "$RUN_DIR/model-methods"; fi | tee "$EVIDENCE_DIR/model-methods.txt"; grep -Fqx RESULT=PASS_R20QL_MODEL_METHODS_PUBLISH "$EVIDENCE_DIR/model-methods.txt"; grep -Fqx VM101_MODEL_FRESH=true "$EVIDENCE_DIR/model-methods.txt"; grep -Fqx VM101_METHODS_FRESH=true "$EVIDENCE_DIR/model-methods.txt"; router_step_phase_complete model_methods fresh_timestamped_vm101_model_and_methods_published
CURRENT_PHASE=project_source; router_step_phase_begin project_source
if [[ -n "${ROUTER_R20QL_PROJECT_PHASE_FIXTURE:-}" ]]; then cat "$ROUTER_R20QL_PROJECT_PHASE_FIXTURE"; else "$BUNDLE_ROOT/scripts/publish-project-source.sh" "$EVIDENCE_DIR/audit.txt" "$EVIDENCE_DIR/source-publish.txt" "$EVIDENCE_DIR/model-methods.txt" "$RUN_DIR/project-source"; fi | tee "$EVIDENCE_DIR/project-source.txt"; grep -Fqx RESULT=PASS_R20QL_PROJECT_SOURCE_PUBLISH "$EVIDENCE_DIR/project-source.txt"; router_step_phase_complete project_source zero_healthy_design_and_proof_boundary_published
CURRENT_PHASE=report_build; router_step_phase_begin report_build
python3 "$BUNDLE_ROOT/scripts/build_report.py" --preflight "$EVIDENCE_DIR/preflight.txt" --audit "$EVIDENCE_DIR/audit.txt" --postcheck "$EVIDENCE_DIR/postcheck.txt" --source-verify "$EVIDENCE_DIR/source-publish.txt" --model-methods "$EVIDENCE_DIR/model-methods.txt" --project-source "$EVIDENCE_DIR/project-source.txt" --output "$REPORT_DIR" --release-info "$BUNDLE_ROOT/release-info.json" --installer-sha "$BUNDLE_ROOT/installer.sha256" --bundle-manifest "$BUNDLE_ROOT/manifest.sha256"
cp "$BUNDLE_ROOT/install.sh" "$REPORT_DIR/executed-step.sh"; for f in preflight audit postcheck source-publish model-methods project-source; do cp "$EVIDENCE_DIR/$f.txt" "$REPORT_DIR/$f.txt"; done; cp "$EVIDENCE_DIR/audit-source.json" "$REPORT_DIR/audit-source.json"; cp "$EVIDENCE_DIR/audit-source-excerpts.txt" "$REPORT_DIR/audit-source-excerpts.txt"
args=("$REPORT_DIR/report.txt" report.txt "$REPORT_DIR/facts.json" facts.json "$REPORT_DIR/facts-public.html" facts-public.html "$REPORT_DIR/verify-public.html" verify-public.html "$REPORT_DIR/rollback-public.html" rollback-public.html "$REPORT_DIR/release-info.json" release-info.json "$REPORT_DIR/installer.sha256" installer.sha256 "$REPORT_DIR/bundle-manifest.sha256" bundle-manifest.sha256 "$REPORT_DIR/executed-step.sh" executed-step.sh); for f in preflight audit postcheck source-publish model-methods project-source; do args+=("$REPORT_DIR/$f.txt" "$f.txt"); done; args+=("$REPORT_DIR/audit-source.json" audit-source.json "$REPORT_DIR/audit-source-excerpts.txt" audit-source-excerpts.txt)
ROUTER_PUBLICATION_POLICY_LIB="$POLICY_LIB" "$SAFE_PAYLOAD" "$PUBLIC_PAYLOAD" "${args[@]}"; "$FINALIZER" --label step050m07r20ql_zero_healthy_direct_bootstrap_design --payload-dir "$PUBLIC_PAYLOAD" --workflow-current "$CURRENT_FILE" --workflow-events "$EVENTS_FILE" --output-env "$FINAL_ENV" --expect-kind step-report; router_step_workflow_mark_complete || true; router_step_phase_complete report_build final_pass_report_with_fresh_model_methods_published
trap - ERR; archive_latest; cat "$FINAL_ENV"; cat "$REPORT_DIR/report.txt"; echo BOOTSTRAP_INSTALLER_RC=0