#!/usr/bin/env bash
set -Eeuo pipefail
umask 077

BASE="${ROUTER_OPS_BASE:-/opt/router-ops}"
ROOT="${BUNDLE_ROOT:?}"
RUN_DIR="${ROUTER_DETACHED_RUN_DIR:?}"
CHILD_RESULT="${ROUTER_DETACHED_CHILD_RESULT:?}"
INCOMING="${ROUTER_STEP_INCOMING:-/home/ops/incoming}"
SELFTEST="${ROUTER_EXACT_WORKER_SELFTEST:-false}"

CASE=pass
if [[ "$SELFTEST" == true ]]; then
  case "${ROUTER_PUBLIC_ROOT:-}" in
    */fail-source/public) CASE=fail-source ;;
    */fail-apply/public) CASE=fail-apply ;;
  esac
fi

STEP=STEP_050M07P23E_R01_VM121_PRODUCTION_CREDENTIAL_SERVICE_WIRING
BASE_COMMIT=3744f66c3c1a3b3c1d711a6af74bc7daecf69920
BASE_TREE=86e95cd2009466266a338a548cea5e3b6122a2bd
BASE_COUNT=46
EXPECTED_TREE=7ace7d88b02a457f91469394c6f1f8bdf0c528b5
EXPECTED_COUNT=47

CURRENT="$RUN_DIR/workflow-current.txt"
EVENTS="$RUN_DIR/workflow-events.tsv"
EVIDENCE="$RUN_DIR/evidence"
REPORT="$RUN_DIR/report"
PAYLOAD="$RUN_DIR/public-payload"
FINAL_ENV="$RUN_DIR/final-publication.env"
TARGET_DIR="$RUN_DIR/target"

mkdir -p "$EVIDENCE" "$REPORT" "$PAYLOAD" "$TARGET_DIR" "$INCOMING"
chmod 700 "$EVIDENCE" "$REPORT" "$PAYLOAD" "$TARGET_DIR"

source "$BASE/lib/router-step-workflow.sh"
source <("$BASE/bin/router-release-contract" env --root "$ROOT")
router_step_workflow_init "$CURRENT" "$EVENTS" preflight apply machine_close postcheck report_publish archive

CORE_CHANGE_COMPLETE=false
CORE_CHANGE_REPEATED=false
SOURCE_CHANGED=false
SOURCE_ROLLBACK_STATUS=not_required
BACKEND_RECOVERY_STATUS=not_required
PRODUCTION_MASTER_KEY_PRESENT=true
STOP_DETAIL=unknown
STOP_HANDLED=false
STEP_REPORT_URL=unknown
LATEST_ARCHIVE=not_created
LATEST_ARCHIVE_SHA256=unknown
VM121_NEW_COMMIT=unknown
VM121_NEW_TREE=unknown
VM121_NEW_FILE_COUNT=unknown
VM121_NEW_PUBLIC_URL=unknown
REMOTE_STAGE=unknown
REMOTE_PKG=unknown

last_field(){
  local k="$1" f="$2"
  awk -F= -v k="$k" '$1==k{v=substr($0,index($0,"=")+1)} END{print v}' "$f"
}

write_child(){
  local result="$1" rc="$2" tmp="${CHILD_RESULT}.tmp.$$"
  {
    echo RESULT="$result"
    echo WORKER_RC="$rc"
    echo CORE_CHANGE_COMPLETE="$CORE_CHANGE_COMPLETE"
    echo CORE_CHANGE_REPEATED="$CORE_CHANGE_REPEATED"
    echo SOURCE_CHANGED="$SOURCE_CHANGED"
    echo SOURCE_ROLLBACK_STATUS="$SOURCE_ROLLBACK_STATUS"
    echo BACKEND_RECOVERY_STATUS="$BACKEND_RECOVERY_STATUS"
    echo PRODUCTION_MASTER_KEY_PRESENT="$PRODUCTION_MASTER_KEY_PRESENT"
    echo STOP_DETAIL="$STOP_DETAIL"
    echo LIVE_DATABASE_WRITTEN=false
    echo DATABASE_SCHEMA_CHANGED=false
    echo RUNTIME_PROVISIONING_ACTIVE=false
    echo EXTERNAL_ONBOARDING_ACTIVE=false
    echo VM121_COMMIT="$VM121_NEW_COMMIT"
    echo VM121_TREE="$VM121_NEW_TREE"
    echo VM121_FILE_COUNT="$VM121_NEW_FILE_COUNT"
    echo VM121_PUBLIC_URL="$VM121_NEW_PUBLIC_URL"
    echo STEP_REPORT_URL="$STEP_REPORT_URL"
    echo LATEST_ARCHIVE="$LATEST_ARCHIVE"
    echo LATEST_ARCHIVE_SHA256="$LATEST_ARCHIVE_SHA256"
  } > "$tmp"
  chmod 600 "$tmp"
  mv "$tmp" "$CHILD_RESULT"
}

archive_latest(){
  local log="$EVIDENCE/archive.log"
  router_step_archive_latest_python "$BASE" "$INCOMING" "$(date -u +%Y%m%d-%H%M%S)" | tee "$log"
  LATEST_ARCHIVE="$(last_field LATEST_ARCHIVE "$log")"
  LATEST_ARCHIVE_SHA256="$(last_field LATEST_ARCHIVE_SHA256 "$log")"
}

cleanup_remote(){
  [[ "$SELFTEST" == false && "$REMOTE_STAGE" != unknown ]] || return 0
  set +e
  ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 "rm -rf '$REMOTE_STAGE' '$REMOTE_PKG'" >/dev/null 2>&1
  set -e
}

write_stop_report(){
  local rc="$1" line="$2" cmd="$3"
  cat > "$REPORT/report.txt" <<EOF
RESULT=STOP_P23E_R01_VM121_PRODUCTION_CREDENTIAL_SERVICE_WIRING
REVISION=R01
STOP_RC=$rc
STOP_LINE=$line
STOP_DETAIL=$STOP_DETAIL
CORE_CHANGE_COMPLETE=$CORE_CHANGE_COMPLETE
CORE_CHANGE_REPEATED=false
SOURCE_CHANGED=$SOURCE_CHANGED
SOURCE_ROLLBACK_STATUS=$SOURCE_ROLLBACK_STATUS
BACKEND_RECOVERY_STATUS=$BACKEND_RECOVERY_STATUS
PRODUCTION_MASTER_KEY_PRESENT=true
LIVE_DATABASE_WRITTEN=false
DATABASE_SCHEMA_CHANGED=false
RUNTIME_PROVISIONING_ACTIVE=false
EXTERNAL_ONBOARDING_ACTIVE=false
VM121_BASE_COMMIT=$BASE_COMMIT
VM121_BASE_TREE=$BASE_TREE
EOF
  printf 'STOP_COMMAND=%q\n' "$cmd" >> "$REPORT/report.txt"
  cp "$REPORT/report.txt" "$REPORT/verify.txt"
  cp "$ROOT/scripts/run-step.sh" "$REPORT/executed-step.sh"
  cp "$ROOT/release-info.json" "$REPORT/release-info.json"
  cp "$ROOT/rollback/README.md" "$REPORT/rollback.txt"
  [[ ! -f "$EVIDENCE/service-wiring.txt" ]] || cp "$EVIDENCE/service-wiring.txt" "$REPORT/service-wiring.txt"
}

stop_handler(){
  local rc="$1" line="$2" cmd="$3"
  trap - ERR
  [[ "$STOP_HANDLED" == false ]] || return "$rc"
  STOP_HANDLED=true
  cleanup_remote
  write_stop_report "$rc" "$line" "$cmd"
  set +e
  if [[ "$SELFTEST" == true ]]; then
    DEST="${ROUTER_PUBLIC_ROOT:?}/latest/p23e-r01-$CASE-selftest"
    rm -rf "$DEST"
    mkdir -p "$DEST"
    cp -a "$REPORT"/. "$DEST"/
    STEP_REPORT_URL="selftest://p23e-r01-$CASE/"
    archive_latest >/dev/null 2>&1
  else
    args=()
    while IFS= read -r f; do args+=("$f" "$(basename "$f")"); done < <(find "$REPORT" -maxdepth 1 -type f -print | LC_ALL=C sort)
    router_step_publish_payload step050m07p23e_r01_vm121_production_credential_service_wiring_stop "$REPORT" "$PAYLOAD" "$CURRENT" "$EVENTS" "$FINAL_ENV" "${args[@]}" >/dev/null 2>&1 || true
    [[ -f "$FINAL_ENV" ]] && STEP_REPORT_URL="$(last_field PUBLIC_URL "$FINAL_ENV")"
    archive_latest >/dev/null 2>&1
  fi
  set -e
  write_child STOP_P23E_R01_VM121_PRODUCTION_CREDENTIAL_SERVICE_WIRING "$rc"
  return "$rc"
}
trap 'rc=$?; stop_handler "$rc" "$LINENO" "$BASH_COMMAND"; exit "$rc"' ERR

self_source(){
  local head="$1" tree="$2" count="$3" staged="$4"
  cat <<EOF
MODE=--check
MACHINE_ID=vm121
LOCAL_HEAD=$head
REMOTE_HEAD=$head
STAGED_CHANGE_COUNT=$staged
SIMULATED_TREE_SHA=$tree
SIMULATED_TREE_FILE_COUNT=$count
RESULT=PASS_VM121_GIT_PUBLISH_CHECK
GIT_COMMIT=$head
GIT_TREE=$tree
GIT_FILE_COUNT=$count
COMMIT_CREATED=false
PUSH_PERFORMED=false
EOF
}

self_apply(){
  cat <<'EOF'
ALEMBIC_VERSION=0003_domain_v2_schema
FAILED_STAGE=none
BUSINESS_ROWS_BEFORE=0
BUSINESS_ROWS_AFTER=0
PEER_CREDENTIAL_ROWS_BEFORE=0
PEER_CREDENTIAL_ROWS_AFTER=0
CREDENTIAL_SERVICE_PATH=/opt/wg-access/backend/app/services/credential_service.py
PRODUCTION_KEYRING_LOADER_USED=true
CREDENTIAL_GENERATION_USED_EXISTING_WG_KEYPAIR=true
CREDENTIAL_PSK_USED_EXISTING_WG_PSK=true
CREDENTIAL_STORAGE_USED_EXISTING_STORE_REVISION=true
PRODUCTION_SERVICE_ENCRYPT_DECRYPT=PASS
ROTATION_OLD_VERSION_DECRYPT=PASS
ROTATION_NEW_VERSION_DECRYPT=PASS
SECRET_SAFE_FAILURE=PASS
PLAINTEXT_LOGGING_PRESENT=false
SECRET_VALUES_EMITTED=false
KEYRING_PATH=/opt/wg-access/runtime/credential-keyring.json
KEYRING_SCHEMA=wg-paid-credential-keyring-v1
KEYRING_ACTIVE_VERSION=1
KEYRING_VERSION_COUNT=1
KEYRING_BACKEND_BIND_READ_ONLY=true
PRODUCTION_MASTER_KEY_PRESENT=true
BACKEND_GENERATION_CHANGED=true
BACKEND_STARTED_AT_BEFORE=before
BACKEND_STARTED_AT_AFTER=after
BACKEND_PID_BEFORE=100
BACKEND_PID_AFTER=200
CORE_SOURCE_CHANGE_COMPLETE=true
SOURCE_CHANGED=true
SOURCE_ROLLBACK_STATUS=not_required
BACKEND_RECOVERY_STATUS=PASS
LIVE_DATABASE_WRITTEN=false
DATABASE_SCHEMA_CHANGED=false
RUNTIME_PROVISIONING_ACTIVE=false
EXTERNAL_ONBOARDING_ACTIVE=false
RESULT=PASS_P23E_R01_VM121_PRODUCTION_CREDENTIAL_SERVICE_WIRING
EOF
}

self_close(){
  cat <<EOF
RESULT=PASS_VM121_GIT_PUBLISH
MACHINE=vm121
COMMIT=1111111111111111111111111111111111111111
TREE=$EXPECTED_TREE
GIT_FILE_COUNT=$EXPECTED_COUNT
VM121_PUBLIC_URL=https://reports.example/latest/vm121/
RESULT=PASS_ROUTER_MACHINE_CLOSE
EOF
}

router_step_phase_begin preflight
if [[ "$SELFTEST" == true ]]; then
  self_source "$BASE_COMMIT" "$BASE_TREE" "$BASE_COUNT" 0 > "$EVIDENCE/pre-source.txt"
  [[ "$CASE" != fail-source ]] || sed -i 's/STAGED_CHANGE_COUNT=0/STAGED_CHANGE_COUNT=1/' "$EVIDENCE/pre-source.txt"
else
  ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 /usr/local/sbin/router-vm121-git-publish.sh --check > "$EVIDENCE/pre-source.txt" 2>&1
fi
"$ROOT/scripts/source-check-validate.sh" pre "$EVIDENCE/pre-source.txt" "$BASE_COMMIT" "$BASE_TREE" "$BASE_COUNT" 0 > "$EVIDENCE/pre-source-validation.txt" || { STOP_DETAIL=pre_vm121_source; false; }

PKG="$ROOT/$ROUTER_RELEASE_TARGET_PACKAGE_PATH"
"$ROOT/scripts/target-apply.sh" "$ROUTER_RELEASE_TARGET_PACKAGE_SHA256" "$PKG" "$TARGET_DIR" > "$EVIDENCE/target-extract.txt"
router_step_phase_complete preflight exact_source_and_target_verified

router_step_phase_begin apply
target_rc=0
if [[ "$SELFTEST" == true ]]; then
  self_apply > "$EVIDENCE/service-wiring.txt"
  if [[ "$CASE" == fail-apply ]]; then
    sed -i \
      -e 's/FAILED_STAGE=none/FAILED_STAGE=production_service_proof/' \
      -e 's/CORE_SOURCE_CHANGE_COMPLETE=true/CORE_SOURCE_CHANGE_COMPLETE=false/' \
      -e 's/SOURCE_ROLLBACK_STATUS=not_required/SOURCE_ROLLBACK_STATUS=PASS/' \
      -e 's/RESULT=PASS_P23E_R01_VM121_PRODUCTION_CREDENTIAL_SERVICE_WIRING/RESULT=STOP_P23E_R01_VM121_PRODUCTION_CREDENTIAL_SERVICE_WIRING/' \
      "$EVIDENCE/service-wiring.txt"
    target_rc=1
  fi
else
  token="$(basename "$RUN_DIR" | tr -cd 'A-Za-z0-9._-')"
  REMOTE_STAGE="/root/router-step-p23e-r01-$token"
  REMOTE_PKG="/root/router-step-p23e-r01-$token.tar.gz"
  ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 "umask 077; cat > '$REMOTE_PKG'" < "$PKG" || { STOP_DETAIL=remote_package_transfer; false; }
  ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 "rm -rf '$REMOTE_STAGE'; install -d -m 0700 '$REMOTE_STAGE'; tar -xzf '$REMOTE_PKG' -C '$REMOTE_STAGE'" > "$EVIDENCE/remote-stage.txt" 2>&1 || { STOP_DETAIL=remote_package_extract; false; }
  if ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 "/bin/bash '$REMOTE_STAGE/vm121-p23e-r01-credential-service.sh' '$REMOTE_STAGE/candidate'" > "$EVIDENCE/service-wiring.txt" 2>&1; then
    target_rc=0
  else
    target_rc=$?
  fi
fi

remote_core="$(last_field CORE_SOURCE_CHANGE_COMPLETE "$EVIDENCE/service-wiring.txt")"
remote_changed="$(last_field SOURCE_CHANGED "$EVIDENCE/service-wiring.txt")"
remote_rb="$(last_field SOURCE_ROLLBACK_STATUS "$EVIDENCE/service-wiring.txt")"
remote_backend="$(last_field BACKEND_RECOVERY_STATUS "$EVIDENCE/service-wiring.txt")"
[[ "$remote_core" == true ]] && CORE_CHANGE_COMPLETE=true
[[ "$remote_changed" == true ]] && SOURCE_CHANGED=true
[[ -n "$remote_rb" ]] && SOURCE_ROLLBACK_STATUS="$remote_rb"
[[ -n "$remote_backend" ]] && BACKEND_RECOVERY_STATUS="$remote_backend"
cleanup_remote

if [[ "$target_rc" -ne 0 ]]; then
  STOP_DETAIL="credential_service_$(last_field FAILED_STAGE "$EVIDENCE/service-wiring.txt")"
  false
fi

"$ROOT/scripts/service-wiring-validate.sh" "$EVIDENCE/service-wiring.txt" > "$EVIDENCE/service-wiring-validation.txt" || { STOP_DETAIL=service_wiring_semantics; false; }
CORE_CHANGE_COMPLETE=true
SOURCE_CHANGED=true
SOURCE_ROLLBACK_STATUS=not_required
BACKEND_RECOVERY_STATUS=PASS
router_step_phase_complete apply credential_service_wiring_and_isolated_proof_complete

router_step_phase_begin machine_close
if [[ "$SELFTEST" == true ]]; then
  self_close > "$EVIDENCE/machine-close.txt"
else
  "$BASE/bin/router-machine-close-safe" vm121 "$STEP: wire existing production keyring loader to credential generation/storage service; no onboarding or provisioning" > "$EVIDENCE/machine-close.txt" 2>&1
fi
"$ROOT/scripts/machine-close-validate.sh" "$EVIDENCE/machine-close.txt" "$EXPECTED_TREE" "$EXPECTED_COUNT" > "$EVIDENCE/machine-close-validation.txt" || { STOP_DETAIL=machine_close_after_core; false; }
VM121_NEW_COMMIT="$(last_field VM121_NEW_COMMIT "$EVIDENCE/machine-close-validation.txt")"
VM121_NEW_TREE="$EXPECTED_TREE"
VM121_NEW_FILE_COUNT="$EXPECTED_COUNT"
VM121_NEW_PUBLIC_URL="$(last_field VM121_NEW_PUBLIC_URL "$EVIDENCE/machine-close-validation.txt")"
router_step_phase_complete machine_close vm121_source_closed_and_published

router_step_phase_begin postcheck
if [[ "$SELFTEST" == true ]]; then
  self_source "$VM121_NEW_COMMIT" "$EXPECTED_TREE" "$EXPECTED_COUNT" 0 > "$EVIDENCE/post-source.txt"
  self_apply > "$EVIDENCE/post-live.txt"
else
  ssh -T vm121 /usr/local/sbin/router-vm121-git-publish.sh --check > "$EVIDENCE/post-source.txt" 2>&1
  ssh -T vm121 /bin/bash -s > "$EVIDENCE/post-live.txt" 2>&1 <<'VM'
set -Eeuo pipefail
SERVICE=/opt/wg-access/backend/app/services/credential_service.py
KEY=/opt/wg-access/runtime/credential-keyring.json
[[ -f "$SERVICE" ]]
[[ "$(sha256sum "$SERVICE" | awk '{print $1}')" == 3bdeff1eae368d82ed28f9d8a4b924bf76a372eba531a4549b5c2ec41f5892e7 ]]
[[ "$(stat -c %a "$KEY")" == 600 && "$(stat -c %u "$KEY")" == 0 && "$(stat -c %g "$KEY")" == 0 ]]
docker inspect wgaccess-backend --format '{{range .Mounts}}{{println .Type .Source .Destination .RW}}{{end}}' |
  awk '$1=="bind" && $2=="/opt/wg-access/runtime/credential-keyring.json" && $3=="/opt/wg-access/runtime/credential-keyring.json" && $4=="false"{ok=1} END{exit(ok?0:1)}'
curl -fsS --max-time 5 http://127.0.0.1:18080/health >/dev/null
curl -fsS --max-time 5 http://127.0.0.1:18080/health/db >/dev/null

PG=wgaccess-postgres
U="$(docker exec "$PG" sh -lc 'printf %s "$POSTGRES_USER"')"
D="$(docker exec "$PG" sh -lc 'printf %s "$POSTGRES_DB"')"
Q(){ docker exec "$PG" psql -v ON_ERROR_STOP=1 -U "$U" -d "$D" -Atqc "$1"; }
business_rows(){
  Q "SELECT
    (SELECT count(*) FROM users)+
    (SELECT count(*) FROM plans)+
    (SELECT count(*) FROM access_grants)+
    (SELECT count(*) FROM access_grant_protocol_limits)+
    (SELECT count(*) FROM invites)+
    (SELECT count(*) FROM invite_redemptions)+
    (SELECT count(*) FROM magic_link_tokens)+
    (SELECT count(*) FROM auth_sessions)+
    (SELECT count(*) FROM connection_profiles)+
    (SELECT count(*) FROM peer_credentials)+
    (SELECT count(*) FROM audit_events)+
    (SELECT count(*) FROM invite_codes)+
    (SELECT count(*) FROM orders)+
    (SELECT count(*) FROM subscriptions)+
    (SELECT count(*) FROM peers)+
    (SELECT count(*) FROM provisioning_jobs)+
    (SELECT count(*) FROM peer_egress_leases)"
}
BUSINESS_ROWS_AFTER="$(business_rows)"
PEER_CREDENTIAL_ROWS_AFTER="$(Q 'SELECT count(*) FROM peer_credentials')"
[[ "$BUSINESS_ROWS_AFTER" == 0 && "$PEER_CREDENTIAL_ROWS_AFTER" == 0 ]]
[[ "$(Q 'SELECT count(*) FROM egress_targets')" == 5 ]]
[[ "$(Q 'SELECT count(*) FROM egress_allocator_settings')" == 14 ]]

docker exec -i wgaccess-backend python - <<'PY'
import base64, json, os, tempfile, uuid
from types import SimpleNamespace
import app.services.credential_service as service
from app.services.credential_crypto import CredentialCryptoError
from app.services.credential_keyring import load_credential_cipher

profile_id=uuid.uuid4()
captured={}
def fake_store(db, *, profile_id, public_key, secret_material, cipher, supersede_previous=True):
    env=cipher.encrypt_json(secret_material,profile_id=str(profile_id),revision=1)
    captured["secret"]=dict(secret_material)
    return SimpleNamespace(connection_profile_id=profile_id,revision=1,public_key=public_key,secret_ciphertext=env.ciphertext,key_version=env.key_version)

orig_store=service.store_credential_revision
service.store_credential_revision=fake_store
try:
    created=service.create_profile_credential_revision(None,profile_id=profile_id)
finally:
    service.store_credential_revision=orig_store
assert created.credential.key_version==1
assert service.decrypt_profile_credential(created.credential)==captured["secret"]

orig_loader=service.load_credential_cipher
sentinel="DO_NOT_EMIT_SECRET_SENTINEL"
service.load_credential_cipher=lambda: (_ for _ in ()).throw(CredentialCryptoError(sentinel))
try:
    try:
        service.create_profile_credential_revision(None,profile_id=uuid.uuid4())
        raise AssertionError("expected failure")
    except service.CredentialServiceError as exc:
        assert sentinel not in str(exc)
finally:
    service.load_credential_cipher=orig_loader

with open("/opt/wg-access/runtime/credential-keyring.json",encoding="utf-8") as f:
    d=json.load(f)
rot={"schema":d["schema"],"active_version":2,"keys":dict(d["keys"])}
rot["keys"]["2"]=base64.b64encode(os.urandom(32)).decode("ascii")
fd,tmp=tempfile.mkstemp(prefix="p23e-post-rotation-",suffix=".json")
os.fchmod(fd,0o600)
try:
    with os.fdopen(fd,"w",encoding="utf-8") as f:
        json.dump(rot,f,separators=(",",":")); f.write("\n")
    c2=load_credential_cipher(tmp)
    service.load_credential_cipher=lambda: c2
    assert service.decrypt_profile_credential(created.credential)==captured["secret"]
    payload2={"private_key":"isolated-v2","preshared_key":"isolated-v2-psk"}
    env2=c2.encrypt_json(payload2,profile_id=str(profile_id),revision=2)
    row2=SimpleNamespace(connection_profile_id=profile_id,revision=2,secret_ciphertext=env2.ciphertext,key_version=env2.key_version)
    assert env2.key_version==2 and service.decrypt_profile_credential(row2)==payload2
finally:
    service.load_credential_cipher=orig_loader
    try: os.unlink(tmp)
    except FileNotFoundError: pass
PY

python3 - "$KEY" <<'PYKEY'
import base64,json,os,stat,sys
p=sys.argv[1]; x=json.load(open(p,encoding="utf-8")); s=os.stat(p)
assert stat.S_IMODE(s.st_mode)==0o600 and s.st_uid==0 and s.st_gid==0
assert x["schema"]=="wg-paid-credential-keyring-v1" and x["active_version"]==1 and set(x["keys"])=={"1"}
assert len(base64.b64decode(x["keys"]["1"],validate=True))==32
PYKEY

! grep -Eq '(^|[[:space:]])(print|logging\.|logger\.)' "$SERVICE"
echo "BUSINESS_ROWS_AFTER=$BUSINESS_ROWS_AFTER"
echo "PEER_CREDENTIAL_ROWS_AFTER=$PEER_CREDENTIAL_ROWS_AFTER"
echo CREDENTIAL_SERVICE_PATH=/opt/wg-access/backend/app/services/credential_service.py
echo PRODUCTION_KEYRING_LOADER_USED=true
echo CREDENTIAL_GENERATION_USED_EXISTING_WG_KEYPAIR=true
echo CREDENTIAL_PSK_USED_EXISTING_WG_PSK=true
echo CREDENTIAL_STORAGE_USED_EXISTING_STORE_REVISION=true
echo PRODUCTION_SERVICE_ENCRYPT_DECRYPT=PASS
echo ROTATION_OLD_VERSION_DECRYPT=PASS
echo ROTATION_NEW_VERSION_DECRYPT=PASS
echo SECRET_SAFE_FAILURE=PASS
echo PLAINTEXT_LOGGING_PRESENT=false
echo SECRET_VALUES_EMITTED=false
echo KEYRING_PATH=/opt/wg-access/runtime/credential-keyring.json
echo KEYRING_SCHEMA=wg-paid-credential-keyring-v1
echo KEYRING_ACTIVE_VERSION=1
echo KEYRING_VERSION_COUNT=1
echo KEYRING_BACKEND_BIND_READ_ONLY=true
echo PRODUCTION_MASTER_KEY_PRESENT=true
echo BACKEND_GENERATION_CHANGED=true
echo BACKEND_RECOVERY_STATUS=PASS
echo CORE_SOURCE_CHANGE_COMPLETE=true
echo SOURCE_CHANGED=true
echo SOURCE_ROLLBACK_STATUS=not_required
echo LIVE_DATABASE_WRITTEN=false
echo DATABASE_SCHEMA_CHANGED=false
echo RUNTIME_PROVISIONING_ACTIVE=false
echo EXTERNAL_ONBOARDING_ACTIVE=false
echo RESULT=PASS_P23E_R01_VM121_PRODUCTION_CREDENTIAL_SERVICE_WIRING
VM
fi

"$ROOT/scripts/source-check-validate.sh" post "$EVIDENCE/post-source.txt" "$VM121_NEW_COMMIT" "$EXPECTED_TREE" "$EXPECTED_COUNT" 0 > "$EVIDENCE/post-source-validation.txt" || { STOP_DETAIL=post_vm121_source; false; }
"$ROOT/scripts/service-wiring-validate.sh" "$EVIDENCE/post-live.txt" > "$EVIDENCE/post-live-validation.txt" || { STOP_DETAIL=post_live_semantics; false; }
router_step_phase_complete postcheck exact_tree_and_live_service_wiring_verified

router_step_phase_begin report_publish
cat > "$REPORT/report.txt" <<EOF
RESULT=PASS_P23E_VM121_PRODUCTION_CREDENTIAL_SERVICE_WIRING
REVISION=R01
CORE_CHANGE_COMPLETE=true
CORE_CHANGE_REPEATED=false
SOURCE_CHANGED=true
SOURCE_ROLLBACK_STATUS=not_required
BACKEND_RECOVERY_STATUS=PASS
BACKEND_GENERATION_CHANGED=true
LIVE_DATABASE_WRITTEN=false
DATABASE_SCHEMA_CHANGED=false
ALEMBIC_VERSION=0003_domain_v2_schema
BUSINESS_ROWS=0
PEER_CREDENTIAL_ROWS=0
PRODUCTION_MASTER_KEY_PRESENT=true
KEYRING_PATH=/opt/wg-access/runtime/credential-keyring.json
KEYRING_SCHEMA=wg-paid-credential-keyring-v1
KEYRING_ACTIVE_VERSION=1
KEYRING_VERSION_COUNT=1
KEYRING_BACKEND_BIND_READ_ONLY=true
CREDENTIAL_SERVICE_PATH=/opt/wg-access/backend/app/services/credential_service.py
PRODUCTION_KEYRING_LOADER_USED=true
CREDENTIAL_GENERATION_USED_EXISTING_WG_KEYPAIR=true
CREDENTIAL_PSK_USED_EXISTING_WG_PSK=true
CREDENTIAL_STORAGE_USED_EXISTING_STORE_REVISION=true
PRODUCTION_SERVICE_ENCRYPT_DECRYPT=PASS
ROTATION_OLD_VERSION_DECRYPT=PASS
ROTATION_NEW_VERSION_DECRYPT=PASS
SECRET_SAFE_FAILURE=PASS
PLAINTEXT_LOGGING_PRESENT=false
SECRET_VALUES_EMITTED=false
RUNTIME_PROVISIONING_ACTIVE=false
EXTERNAL_ONBOARDING_ACTIVE=false
VM121_BASE_COMMIT=$BASE_COMMIT
VM121_COMMIT=$VM121_NEW_COMMIT
VM121_TREE=$VM121_NEW_TREE
VM121_FILE_COUNT=$VM121_NEW_FILE_COUNT
VM121_PUBLIC_URL=$VM121_NEW_PUBLIC_URL
RUNTIME_IMPACT=true
COPY_VERIFY=PASS
NEXT_ACTION=P24 durable profile provisioning boundary: tunnel-IP allocation, durable profile identity, VM100 lifecycle adapter and reconcile contract
EOF

cp "$REPORT/report.txt" "$REPORT/verify.txt"
cp "$ROOT/scripts/run-step.sh" "$REPORT/executed-step.sh"
cp "$ROOT/release-info.json" "$REPORT/release-info.json"
cp "$ROOT/rollback/README.md" "$REPORT/rollback.txt"
cp "$EVIDENCE/service-wiring-validation.txt" "$REPORT/service-wiring-validation.txt"
cp "$EVIDENCE/post-source-validation.txt" "$REPORT/post-vm121-source-validation.txt"

if [[ "$SELFTEST" == true ]]; then
  DEST="${ROUTER_PUBLIC_ROOT:?}/latest/p23e-r01-pass-selftest"
  rm -rf "$DEST"
  mkdir -p "$DEST"
  cp -a "$REPORT"/. "$DEST"/
  STEP_REPORT_URL=selftest://p23e-r01-pass/
else
  args=()
  while IFS= read -r f; do args+=("$f" "$(basename "$f")"); done < <(find "$REPORT" -maxdepth 1 -type f -print | LC_ALL=C sort)
  router_step_publish_payload step050m07p23e_r01_vm121_production_credential_service_wiring "$REPORT" "$PAYLOAD" "$CURRENT" "$EVENTS" "$FINAL_ENV" "${args[@]}"
  STEP_REPORT_URL="$(last_field PUBLIC_URL "$FINAL_ENV")"
fi
router_step_phase_complete report_publish report_published

router_step_phase_begin archive
archive_latest
router_step_phase_complete archive latest_archived

STOP_DETAIL=none
write_child PASS_P23E_VM121_PRODUCTION_CREDENTIAL_SERVICE_WIRING 0
trap - ERR
exit 0