#!/usr/bin/env bash
set -Eeuo pipefail
umask 077
BASE="${ROUTER_OPS_BASE:-/opt/router-ops}"
ROOT="${BUNDLE_ROOT:?}"
RUN_DIR="${ROUTER_DETACHED_RUN_DIR:?}"
CHILD_RESULT="${ROUTER_DETACHED_CHILD_RESULT:?}"
INCOMING="${ROUTER_STEP_INCOMING:-/home/ops/incoming}"
SELFTEST="${ROUTER_EXACT_WORKER_SELFTEST:-false}"
CASE=pass
if [[ "$SELFTEST" == true ]]; then
  case "${ROUTER_PUBLIC_ROOT:-}" in
    */fail-source/public) CASE=fail-source ;;
    */fail-runtime/public) CASE=fail-runtime ;;
  esac
fi

STEP=STEP_050M07P23D_R01_VM121_CREDENTIAL_KEY_BOUNDARY_PREFLIGHT
BASE_COMMIT=ae3248d60c77b588918f1d330cc53b8f32d886c8
BASE_TREE=4083cc0983b9ecf3549ad334fa939b0559467d56
BASE_COUNT=45
CURRENT="$RUN_DIR/workflow-current.txt"; EVENTS="$RUN_DIR/workflow-events.tsv"; EVIDENCE="$RUN_DIR/evidence"; REPORT="$RUN_DIR/report"; PAYLOAD="$RUN_DIR/public-payload"; FINAL_ENV="$RUN_DIR/final-publication.env"; TARGET_DIR="$RUN_DIR/target"
mkdir -p "$EVIDENCE" "$REPORT" "$PAYLOAD" "$TARGET_DIR" "$INCOMING"
chmod 700 "$EVIDENCE" "$REPORT" "$PAYLOAD" "$TARGET_DIR"
source "$BASE/lib/router-step-workflow.sh"
source <("$BASE/bin/router-release-contract" env --root "$ROOT")
router_step_workflow_init "$CURRENT" "$EVENTS" preflight runtime_discovery report_publish archive

CORE_CHANGE_COMPLETE=false
CORE_CHANGE_REPEATED=false
SOURCE_CHANGED=false
STOP_DETAIL=unknown
STOP_HANDLED=false
STEP_REPORT_URL=unknown
LATEST_ARCHIVE=not_created
LATEST_ARCHIVE_SHA256=unknown

ENV_FILE_PRESENT=unknown
ENV_FILE_MODE=unknown
BACKEND_CONFIG_USER=unknown
BACKEND_EFFECTIVE_UID=unknown
BACKEND_EFFECTIVE_GID=unknown
BACKEND_APP_MOUNT_SOURCE=unknown
BACKEND_APP_MOUNT_RW=unknown
ROUTER_OPS_BACKUPS_PRESENT=unknown
ROUTER_OPS_BACKUPS_MODE=unknown
ETC_WG_ACCESS_PRESENT=unknown
VAR_LIB_WG_ACCESS_PRESENT=unknown
DOCKER_COMPOSE_AVAILABLE=unknown
OPENSSL_AVAILABLE=unknown
COMPOSE_TOPLEVEL_SECRETS_DECLARED=unknown
KEYRING_ENV_NAME_COUNT=unknown
SECRET_NAMED_DIR_COUNT=unknown
PRODUCTION_KEY_LOADER_WIRED=unknown

last_field(){ local k="$1" f="$2"; awk -F= -v k="$k" '$1==k{v=substr($0,index($0,"=")+1)} END{print v}' "$f"; }

write_child(){
  local result="$1" rc="$2" tmp="${CHILD_RESULT}.tmp.$$"
  {
    echo "RESULT=$result"; echo "WORKER_RC=$rc"
    echo "CORE_CHANGE_COMPLETE=$CORE_CHANGE_COMPLETE"; echo "CORE_CHANGE_REPEATED=$CORE_CHANGE_REPEATED"; echo "SOURCE_CHANGED=$SOURCE_CHANGED"
    echo "STOP_DETAIL=$STOP_DETAIL"
    echo "LIVE_DATABASE_WRITTEN=false"; echo "DATABASE_SCHEMA_CHANGED=false"; echo "RUNTIME_PROVISIONING_ACTIVE=false"; echo "EXTERNAL_ONBOARDING_ACTIVE=false"
    echo "PRODUCTION_MASTER_KEY_CREATED=false"; echo "PRODUCTION_SECRET_PATH_SELECTED=false"
    echo "ENV_FILE_PRESENT=$ENV_FILE_PRESENT"; echo "ENV_FILE_MODE=$ENV_FILE_MODE"
    echo "BACKEND_CONFIG_USER=$BACKEND_CONFIG_USER"; echo "BACKEND_EFFECTIVE_UID=$BACKEND_EFFECTIVE_UID"; echo "BACKEND_EFFECTIVE_GID=$BACKEND_EFFECTIVE_GID"
    echo "BACKEND_APP_MOUNT_SOURCE=$BACKEND_APP_MOUNT_SOURCE"; echo "BACKEND_APP_MOUNT_RW=$BACKEND_APP_MOUNT_RW"
    echo "ROUTER_OPS_BACKUPS_PRESENT=$ROUTER_OPS_BACKUPS_PRESENT"; echo "ROUTER_OPS_BACKUPS_MODE=$ROUTER_OPS_BACKUPS_MODE"
    echo "ETC_WG_ACCESS_PRESENT=$ETC_WG_ACCESS_PRESENT"; echo "VAR_LIB_WG_ACCESS_PRESENT=$VAR_LIB_WG_ACCESS_PRESENT"
    echo "DOCKER_COMPOSE_AVAILABLE=$DOCKER_COMPOSE_AVAILABLE"; echo "OPENSSL_AVAILABLE=$OPENSSL_AVAILABLE"
    echo "COMPOSE_TOPLEVEL_SECRETS_DECLARED=$COMPOSE_TOPLEVEL_SECRETS_DECLARED"; echo "KEYRING_ENV_NAME_COUNT=$KEYRING_ENV_NAME_COUNT"; echo "SECRET_NAMED_DIR_COUNT=$SECRET_NAMED_DIR_COUNT"; echo "PRODUCTION_KEY_LOADER_WIRED=$PRODUCTION_KEY_LOADER_WIRED"
    echo "VM121_COMMIT=$BASE_COMMIT"; echo "VM121_TREE=$BASE_TREE"; echo "VM121_FILE_COUNT=$BASE_COUNT"
    echo "STEP_REPORT_URL=$STEP_REPORT_URL"; echo "LATEST_ARCHIVE=$LATEST_ARCHIVE"; echo "LATEST_ARCHIVE_SHA256=$LATEST_ARCHIVE_SHA256"
  } > "$tmp"
  chmod 600 "$tmp"; mv "$tmp" "$CHILD_RESULT"
}
archive_latest(){
  local log="$EVIDENCE/archive.log"
  router_step_archive_latest_python "$BASE" "$INCOMING" "$(date -u +%Y%m%d-%H%M%S)" | tee "$log"
  LATEST_ARCHIVE="$(last_field LATEST_ARCHIVE "$log")"; LATEST_ARCHIVE_SHA256="$(last_field LATEST_ARCHIVE_SHA256 "$log")"
}
write_stop_report(){
  local rc="$1" line="$2" cmd="$3"
  cat > "$REPORT/report.txt" <<EOF2
RESULT=STOP_P23D_R01_VM121_CREDENTIAL_KEY_BOUNDARY_PREFLIGHT
REVISION=R01
STOP_RC=$rc
STOP_LINE=$line
STOP_DETAIL=$STOP_DETAIL
CORE_CHANGE_COMPLETE=false
CORE_CHANGE_REPEATED=false
SOURCE_CHANGED=false
LIVE_DATABASE_WRITTEN=false
DATABASE_SCHEMA_CHANGED=false
RUNTIME_PROVISIONING_ACTIVE=false
EXTERNAL_ONBOARDING_ACTIVE=false
PRODUCTION_MASTER_KEY_CREATED=false
PRODUCTION_SECRET_PATH_SELECTED=false
VM121_COMMIT=$BASE_COMMIT
VM121_TREE=$BASE_TREE
VM121_FILE_COUNT=$BASE_COUNT
EOF2
  printf 'STOP_COMMAND=%q\n' "$cmd" >> "$REPORT/report.txt"
  cp "$REPORT/report.txt" "$REPORT/verify.txt"; cp "$ROOT/scripts/run-step.sh" "$REPORT/executed-step.sh"; cp "$ROOT/release-info.json" "$REPORT/release-info.json"; cp "$ROOT/rollback/README.md" "$REPORT/rollback.txt"
  [[ ! -f "$EVIDENCE/runtime-preflight.txt" ]] || cp "$EVIDENCE/runtime-preflight.txt" "$REPORT/runtime-preflight.txt"
}
stop_handler(){
  local rc="$1" line="$2" cmd="$3"
  trap - ERR
  [[ "$STOP_HANDLED" == false ]] || return "$rc"
  STOP_HANDLED=true; write_stop_report "$rc" "$line" "$cmd"
  set +e
  if [[ "$SELFTEST" == true ]]; then
    DEST="${ROUTER_PUBLIC_ROOT:?}/latest/p23d-r01-$CASE-selftest"; rm -rf "$DEST"; mkdir -p "$DEST"; cp -a "$REPORT"/. "$DEST"/
    STEP_REPORT_URL="selftest://p23d-r01-$CASE/"; archive_latest >/dev/null 2>&1
  else
    args=(); while IFS= read -r f; do args+=("$f" "$(basename "$f")"); done < <(find "$REPORT" -maxdepth 1 -type f -print | LC_ALL=C sort)
    router_step_publish_payload step050m07p23d_r01_vm121_credential_key_boundary_preflight_stop "$REPORT" "$PAYLOAD" "$CURRENT" "$EVENTS" "$FINAL_ENV" "${args[@]}" >/dev/null 2>&1 || true
    [[ -f "$FINAL_ENV" ]] && STEP_REPORT_URL="$(last_field PUBLIC_URL "$FINAL_ENV")"
    archive_latest >/dev/null 2>&1
  fi
  set -e; write_child STOP_P23D_R01_VM121_CREDENTIAL_KEY_BOUNDARY_PREFLIGHT "$rc"; return "$rc"
}
trap 'rc=$?; stop_handler "$rc" "$LINENO" "$BASH_COMMAND"; exit "$rc"' ERR

self_source(){
cat <<EOF2
MODE=--check
MACHINE_ID=vm121
LOCAL_HEAD=$BASE_COMMIT
REMOTE_HEAD=$BASE_COMMIT
STAGED_CHANGE_COUNT=0
SIMULATED_TREE_SHA=$BASE_TREE
SIMULATED_TREE_FILE_COUNT=$BASE_COUNT
RESULT=PASS_VM121_GIT_PUBLISH_CHECK
GIT_COMMIT=$BASE_COMMIT
GIT_TREE=$BASE_TREE
GIT_FILE_COUNT=$BASE_COUNT
COMMIT_CREATED=false
PUSH_PERFORMED=false
EOF2
}
self_runtime(){
cat <<'EOF2'
RUNTIME_PROBE_SCHEMA=p23d-r01-v1
COMPOSE_SHA256=24e9c9ae78c61081da843b99382c36c6b2dcb2dc2a74ddc2ef4c79610c6cb207
COMPOSE_OVERRIDE_SHA256=c4d36ae430dba7234a784c8bd50c1d6144ab77210a3aa67de63ef08849caca02
ENV_EXAMPLE_SHA256=92fcc654e7eef6417c8d86dbc44f92818e007c7a75fd91d81f2f5d1a75048e17
CONFIG_SHA256=84a9b75921eeaf5785ac2fcd7d2c82b3efa64208a9b6ef18891aeec2a7cf546a
CREDENTIAL_CRYPTO_SHA256=d92bdf6746409fdb9b2fc368597273f7eb7318322bac72f56541e793c07fd35e
MACHINE_GIT_PROFILE_SHA256=119996c097d5302e4911488ac542dd0b5105ea64c4775f476181bafa21eab60a
WG_ACCESS_ROOT_MODE=755
WG_ACCESS_ROOT_UID=0
WG_ACCESS_ROOT_GID=0
ENV_FILE_PRESENT=true
ENV_FILE_MODE=600
ENV_FILE_UID=0
ENV_FILE_GID=0
RUNTIME_DIR_PRESENT=true
RUNTIME_DIR_MODE=755
RUNTIME_DIR_UID=0
RUNTIME_DIR_GID=0
ETC_WG_ACCESS_PRESENT=false
VAR_LIB_WG_ACCESS_PRESENT=false
ROUTER_OPS_BACKUPS_PRESENT=true
ROUTER_OPS_BACKUPS_MODE=700
ROUTER_OPS_BACKUPS_UID=0
ROUTER_OPS_BACKUPS_GID=0
VAR_BACKUPS_PRESENT=true
VAR_BACKUPS_MODE=755
VAR_BACKUPS_UID=0
VAR_BACKUPS_GID=0
APP_SECRET_NAME_PRESENT=true
AGENT_TOKEN_NAME_PRESENT=true
DATABASE_URL_NAME_PRESENT=true
KEYRING_ENV_NAME_COUNT=0
ENV_FILE_MACHINE_GIT_TRACKED=false
MACHINE_GIT_FORBIDS_SECRETS_PATH=true
DOCKER_COMPOSE_AVAILABLE=true
OPENSSL_AVAILABLE=true
PYTHON3_AVAILABLE=true
BASE64_AVAILABLE=true
INSTALL_AVAILABLE=true
COMPOSE_ENV_FILE_DECLARED=true
COMPOSE_BACKEND_BIND_SOURCE_DECLARED=true
COMPOSE_TOPLEVEL_SECRETS_DECLARED=false
COMPOSE_BACKEND_USER_DECLARED=false
BACKEND_CONFIG_USER=default
BACKEND_EFFECTIVE_UID=0
BACKEND_EFFECTIVE_GID=0
BACKEND_MOUNT_COUNT=2
BACKEND_APP_MOUNT_SOURCE=/opt/wg-access/backend
BACKEND_APP_MOUNT_RW=true
BACKEND_HEALTH=PASS
CRYPTOGRAPHY_IMPORT=PASS
CREDENTIAL_CIPHER_CALLER_SUPPLIED_KEYS=true
CREDENTIAL_ACTIVE_VERSION_REQUIRED=true
PRODUCTION_KEY_LOADER_WIRED=false
SECRET_NAMED_DIR_COUNT=0
ALEMBIC_VERSION=0003_domain_v2_schema
BUSINESS_ROWS=0
EGRESS_TARGET_COUNT=5
EGRESS_ALLOCATOR_COUNT=14
PEER_CREDENTIAL_ROWS=0
PRODUCTION_MASTER_KEY_CREATED=false
LIVE_DATABASE_WRITTEN=false
DATABASE_SCHEMA_CHANGED=false
RUNTIME_PROVISIONING_ACTIVE=false
EXTERNAL_ONBOARDING_ACTIVE=false
NO_SECRET_VALUES_EMITTED=true
RESULT=PASS_P23D_R01_VM121_RUNTIME_PREFLIGHT
EOF2
}

router_step_phase_begin preflight
if [[ "$SELFTEST" == true ]]; then
  self_source > "$EVIDENCE/pre-vm121-source.txt"
  [[ "$CASE" != fail-source ]] || sed -i 's/STAGED_CHANGE_COUNT=0/STAGED_CHANGE_COUNT=1/' "$EVIDENCE/pre-vm121-source.txt"
else
  ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 /usr/local/sbin/router-vm121-git-publish.sh --check > "$EVIDENCE/pre-vm121-source.txt" 2>&1
fi
"$ROOT/scripts/source-check-validate.sh" pre "$EVIDENCE/pre-vm121-source.txt" "$BASE_COMMIT" "$BASE_TREE" "$BASE_COUNT" 0 > "$EVIDENCE/pre-vm121-source-validation.txt" || { STOP_DETAIL=pre_vm121_source; false; }
PKG="$ROOT/$ROUTER_RELEASE_TARGET_PACKAGE_PATH"
"$ROOT/scripts/target-apply.sh" "$ROUTER_RELEASE_TARGET_PACKAGE_SHA256" "$PKG" "$TARGET_DIR" > "$EVIDENCE/target-extract.txt"
router_step_phase_complete preflight exact_source_and_readonly_probe_verified

router_step_phase_begin runtime_discovery
if [[ "$SELFTEST" == true ]]; then
  self_runtime > "$EVIDENCE/runtime-preflight.txt"
  [[ "$CASE" != fail-runtime ]] || sed -i 's/BUSINESS_ROWS=0/BUSINESS_ROWS=1/' "$EVIDENCE/runtime-preflight.txt"
else
  ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 /bin/bash -s < "$TARGET_DIR/vm121-p23d-r01-runtime-preflight.sh" > "$EVIDENCE/runtime-preflight.txt" 2>&1
fi
"$ROOT/scripts/runtime-preflight-validate.sh" "$EVIDENCE/runtime-preflight.txt" > "$EVIDENCE/runtime-preflight-validation.txt" || { STOP_DETAIL=runtime_preflight_semantics; false; }
for k in ENV_FILE_PRESENT ENV_FILE_MODE BACKEND_CONFIG_USER BACKEND_EFFECTIVE_UID BACKEND_EFFECTIVE_GID BACKEND_APP_MOUNT_SOURCE BACKEND_APP_MOUNT_RW ROUTER_OPS_BACKUPS_PRESENT ROUTER_OPS_BACKUPS_MODE ETC_WG_ACCESS_PRESENT VAR_LIB_WG_ACCESS_PRESENT DOCKER_COMPOSE_AVAILABLE OPENSSL_AVAILABLE COMPOSE_TOPLEVEL_SECRETS_DECLARED KEYRING_ENV_NAME_COUNT SECRET_NAMED_DIR_COUNT PRODUCTION_KEY_LOADER_WIRED; do printf -v "$k" '%s' "$(last_field "$k" "$EVIDENCE/runtime-preflight.txt")"; done
router_step_phase_complete runtime_discovery secret_safe_live_facts_retained

router_step_phase_begin report_publish
cat > "$REPORT/report.txt" <<EOF2
RESULT=PASS_P23D_R01_VM121_CREDENTIAL_KEY_BOUNDARY_PREFLIGHT
REVISION=R01
CORE_CHANGE_COMPLETE=false
CORE_CHANGE_REPEATED=false
SOURCE_CHANGED=false
LIVE_DATABASE_WRITTEN=false
DATABASE_SCHEMA_CHANGED=false
RUNTIME_PROVISIONING_ACTIVE=false
EXTERNAL_ONBOARDING_ACTIVE=false
PRODUCTION_MASTER_KEY_CREATED=false
PRODUCTION_SECRET_PATH_SELECTED=false
ALEMBIC_VERSION=0003_domain_v2_schema
BUSINESS_ROWS=0
EGRESS_TARGET_COUNT=5
EGRESS_ALLOCATOR_COUNT=14
PEER_CREDENTIAL_ROWS=0
VM121_COMMIT=$BASE_COMMIT
VM121_TREE=$BASE_TREE
VM121_FILE_COUNT=$BASE_COUNT
ENV_FILE_PRESENT=$ENV_FILE_PRESENT
ENV_FILE_MODE=$ENV_FILE_MODE
BACKEND_CONFIG_USER=$BACKEND_CONFIG_USER
BACKEND_EFFECTIVE_UID=$BACKEND_EFFECTIVE_UID
BACKEND_EFFECTIVE_GID=$BACKEND_EFFECTIVE_GID
BACKEND_APP_MOUNT_SOURCE=$BACKEND_APP_MOUNT_SOURCE
BACKEND_APP_MOUNT_RW=$BACKEND_APP_MOUNT_RW
ROUTER_OPS_BACKUPS_PRESENT=$ROUTER_OPS_BACKUPS_PRESENT
ROUTER_OPS_BACKUPS_MODE=$ROUTER_OPS_BACKUPS_MODE
ETC_WG_ACCESS_PRESENT=$ETC_WG_ACCESS_PRESENT
VAR_LIB_WG_ACCESS_PRESENT=$VAR_LIB_WG_ACCESS_PRESENT
DOCKER_COMPOSE_AVAILABLE=$DOCKER_COMPOSE_AVAILABLE
OPENSSL_AVAILABLE=$OPENSSL_AVAILABLE
COMPOSE_TOPLEVEL_SECRETS_DECLARED=$COMPOSE_TOPLEVEL_SECRETS_DECLARED
KEYRING_ENV_NAME_COUNT=$KEYRING_ENV_NAME_COUNT
SECRET_NAMED_DIR_COUNT=$SECRET_NAMED_DIR_COUNT
PRODUCTION_KEY_LOADER_WIRED=$PRODUCTION_KEY_LOADER_WIRED
RUNTIME_IMPACT=false
COPY_VERIFY=PASS
NEXT_ACTION=build P23D apply revision only from these retained live facts; reuse existing VM121/VM130 conventions; no external onboarding or runtime provisioning
EOF2
cp "$REPORT/report.txt" "$REPORT/verify.txt"; cp "$ROOT/scripts/run-step.sh" "$REPORT/executed-step.sh"; cp "$ROOT/release-info.json" "$REPORT/release-info.json"; cp "$ROOT/rollback/README.md" "$REPORT/rollback.txt"; cp "$EVIDENCE/runtime-preflight.txt" "$REPORT/runtime-preflight.txt"; cp "$EVIDENCE/runtime-preflight-validation.txt" "$REPORT/runtime-preflight-validation.txt"; cp "$EVIDENCE/pre-vm121-source-validation.txt" "$REPORT/pre-vm121-source-validation.txt"
if [[ "$SELFTEST" == true ]]; then
  DEST="${ROUTER_PUBLIC_ROOT:?}/latest/p23d-r01-pass-selftest"; rm -rf "$DEST"; mkdir -p "$DEST"; cp -a "$REPORT"/. "$DEST"/; STEP_REPORT_URL=selftest://p23d-r01-pass/
else
  args=(); while IFS= read -r f; do args+=("$f" "$(basename "$f")"); done < <(find "$REPORT" -maxdepth 1 -type f -print | LC_ALL=C sort)
  router_step_publish_payload step050m07p23d_r01_vm121_credential_key_boundary_preflight "$REPORT" "$PAYLOAD" "$CURRENT" "$EVENTS" "$FINAL_ENV" "${args[@]}"
  STEP_REPORT_URL="$(last_field PUBLIC_URL "$FINAL_ENV")"
fi
router_step_phase_complete report_publish report_published

router_step_phase_begin archive
archive_latest
router_step_phase_complete archive latest_archived
STOP_DETAIL=none
write_child PASS_P23D_R01_VM121_CREDENTIAL_KEY_BOUNDARY_PREFLIGHT 0
trap - ERR
exit 0