#!/usr/bin/env bash
set -Eeuo pipefail

STEP_ID="STEP_050M07R15B1_GENERATION_SCHEMA_VALIDATOR_R07_PUBLICATION_CONTINUATION_R01_VERIFIED"
EXPECTED_COMMIT="66a24ee69f186d27cab4ae73169fab6fab636d56"
EXPECTED_TREE="6b16f8192262116a7a1ff77c333184e548446be7"
EXPECTED_COUNT="32"
EXPECTED_SOURCE_URL="https://reports.secret-studio.ru/latest/20260716-152607_vm101_git_source_66a24ee69f18/"
EXPECTED_CONF_SHA="d9013d65e3b2538c0cfddc98d0585d71616bd847b89e68ef776ac9ac3780c254"
EXPECTED_LIB_SHA="cfdb352742aa83f35303b87cfc367991892f82f71fc34e841a8aafaa3e84440d"
EXPECTED_VALIDATOR_SHA="69c8215bb6dc54f8730afe6b6e7f8bb6e8a28a753faa741d371292b8b8d5dddf"
EXPECTED_PUBLISHER_SHA="e78430b57afbd0ae27fc575fc4de78bb267c76caf04ec935b01e9b2f89840e32"

PUBLISHER="/opt/router-ops/bin/router-publish-report"
REPOSITORY="https://github.com/DChuvelev/wg-paid-vm101.git"
PERMANENT_ROOT="https://reports.secret-studio.ru"
RESOLVE="reports.secret-studio.ru:443:10.71.100.84"

PREVIOUS_R05_STOP_URL="https://reports.secret-studio.ru/latest/20260716-152607_step050m07r15b1_generation_schema_validator_r05_stop/"
GLOBAL_PROJECT_PLAN_URL="https://reports.secret-studio.ru/latest/20260711-123348_global_project_plan_wg_paid/"
ACCESS_MAP_URL="https://reports.secret-studio.ru/latest/20260715-210236_access_map_canonical_current/"
VM100_PUBLIC_URL="https://reports.secret-studio.ru/latest/20260715-190653_vm100_git_source_1958200ccc1b/"
VM101_PUBLIC_URL="$EXPECTED_SOURCE_URL"
VM121_PUBLIC_URL="https://reports.secret-studio.ru/latest/20260713-182700_vm121_git_source_93e0e5a31f09/"
VM130_SOURCE_URL="https://reports.secret-studio.ru/latest/20260716-064558_vm130_router_ops_source_snapshot_r14b2/"
LATEST_ROOT_URL="https://reports.secret-studio.ru/latest/"
OLD_ROOT_URL="https://reports.secret-studio.ru/old/"

BUNDLE_ROOT="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
BUNDLE_ZIP="${BUNDLE_ZIP:?BUNDLE_ZIP required}"
EXPECTED_BUNDLE_SHA256="${EXPECTED_BUNDLE_SHA256:?EXPECTED_BUNDLE_SHA256 required}"
EXPECTED_INSTALLER_SHA256="${EXPECTED_INSTALLER_SHA256:?EXPECTED_INSTALLER_SHA256 required}"

STAMP="$(date -u +%Y%m%d-%H%M%S)"
STEP_DIR="/opt/router-ops/steps/${STAMP}_${STEP_ID}"
mkdir -p "$STEP_DIR"
LOG="$STEP_DIR/main.log"
exec > >(tee -a "$LOG") 2>&1

RESULT="STOP_R15B1_R06_UNHANDLED_ERROR"
PHASE=initialization
COPY_VERIFY=PASS
RUNTIME_IMPACT=false
CORE_CHANGE_REPEATED=false
TARGET_INSTALLER_RERUN=false
ROUTER_MACHINE_CLOSE_RERUN=false
PUBLISHER_APPROVED=false
FINALIZED=false

STEP_REPORT_URL=""
LOCAL_M07_PLAN_URL="https://reports.secret-studio.ru/latest/20260716-141707_local_architecture_plan_vm101_autonomous_hmn_recovery_r15a_full_spec_pinned/"
VM101_MODEL_URL="https://reports.secret-studio.ru/latest/20260716-133906_vm101_model_legacy_freeze_clean_foundation_r15a/"
VM101_METHODS_URL="https://reports.secret-studio.ru/latest/20260716-133906_vm101_methods_legacy_freeze_clean_foundation_r15a/"
FACTS_URL=""
VERIFY_URL=""
ROLLBACK_URL=""
PUBLIC_OBJECT_KIND=""
PREVIOUS_MOVED_COUNT=""

progress() {
    printf '>>> [%s] %s\n' "$(date -u +%H:%M:%S)" "$*"
}

value() {
    local key="$1" file="$2"
    awk -F= -v k="$key" '$1==k {v=substr($0,index($0,"=")+1)} END{print v}' "$file"
}

url_from_log() {
    local key="$1" file="$2" url rel dir
    url="$(value "$key" "$file")"
    [[ -n "$url" ]] || url="$(value PUBLIC_URL "$file")"
    if [[ -z "$url" ]]; then
        rel="$(value PUBLISHED_RELATIVE_PATH "$file")"
        [[ -n "$rel" ]] && url="${PERMANENT_ROOT}/${rel}/"
    fi
    if [[ -z "$url" ]]; then
        dir="$(value PUBLISHED_DIR "$file")"
        [[ -n "$dir" ]] && url="${PERMANENT_ROOT}/latest/$(basename "$dir")/"
    fi
    printf '%s\n' "$url"
}

publish_files() {
    local label="$1" log="$2"
    shift 2
    "$PUBLISHER" "$label" "$@" >"$log" 2>&1
}

http_fetch() {
    curl --fail --silent --show-error --location         --resolve "$RESOLVE"         --connect-timeout 5 --max-time 30         "$1" -o "$2"
}

step_sha() {
    sha256sum "$STEP_DIR/step-code.sh" | awk '{print $1}'
}

finish() {
    printf '%s\n'         "RESULT=$RESULT"         "STEP_REPORT_URL=$STEP_REPORT_URL"         "LOCAL_M07_PLAN_URL=$LOCAL_M07_PLAN_URL"         "GLOBAL_PROJECT_PLAN_URL=$GLOBAL_PROJECT_PLAN_URL"         "ACCESS_MAP_URL=$ACCESS_MAP_URL"         "VM100_PUBLIC_URL=$VM100_PUBLIC_URL"         "VM101_PUBLIC_URL=$VM101_PUBLIC_URL"         "VM121_PUBLIC_URL=$VM121_PUBLIC_URL"         "VM101_MODEL_URL=$VM101_MODEL_URL"         "VM101_METHODS_URL=$VM101_METHODS_URL"         "VM130_SOURCE_URL=$VM130_SOURCE_URL"         "LATEST_ROOT_URL=$LATEST_ROOT_URL"         "OLD_ROOT_URL=$OLD_ROOT_URL"         "FACTS_URL=$FACTS_URL"         "VERIFY_URL=$VERIFY_URL"         "ROLLBACK_URL=$ROLLBACK_URL"         "PUBLIC_OBJECT_KIND=$PUBLIC_OBJECT_KIND"         "PREVIOUS_MOVED_COUNT=$PREVIOUS_MOVED_COUNT"         "COPY_VERIFY=$COPY_VERIFY"         "STEP_SHA256=$(step_sha)"         "RUNTIME_IMPACT=$RUNTIME_IMPACT"
}

write_stop_artifacts() {
    local rc="$1" line="$2"
    cat >"$STEP_DIR/report.txt" <<EOF
STEP_ID=$STEP_ID
RESULT=$RESULT
PHASE=$PHASE
ERROR_RC=$rc
ERROR_LINE=$line
MACHINE_GIT_COMPLETE=true
ROUTER_MACHINE_CLOSE_RERUN=false
CORE_CHANGE_REPEATED=false
TARGET_INSTALLER_RERUN=false
RUNTIME_IMPACT=false
COPY_VERIFY=$COPY_VERIFY
STEP_SHA256=$(step_sha)
EOF

    cat >"$STEP_DIR/verify.txt" <<EOF
RESULT=$RESULT
PHASE=$PHASE
MACHINE_GIT_COMPLETE=true
ROUTER_MACHINE_CLOSE_RERUN=false
COPY_VERIFY=$COPY_VERIFY
STEP_SHA256=$(step_sha)
RUNTIME_IMPACT=false
EOF

    python3 - "$STEP_DIR/facts.json" "$rc" "$line" <<PY
import json, sys
json.dump({
  "step_id": "$STEP_ID",
  "result": "$RESULT",
  "phase": "$PHASE",
  "error_rc": sys.argv[2],
  "error_line": sys.argv[3],
  "machine_git_complete": True,
  "router_machine_close_rerun": False,
  "core_change_repeated": False,
  "runtime_impact": False
}, open(sys.argv[1], "w"), indent=2)
open(sys.argv[1], "a").write("\n")
PY

    cat >"$STEP_DIR/rollback.sh" <<'EOF'
#!/usr/bin/env bash
set -Eeuo pipefail
echo "RESULT=STOP_NO_RUNTIME_CHANGE_TO_ROLL_BACK"
echo "RUNTIME_IMPACT=false"
exit 1
EOF
    chmod 700 "$STEP_DIR/rollback.sh"
}

publish_stop_if_possible() {
    [[ "$PUBLISHER_APPROVED" == true ]] || return 0
    publish_files         "step050m07r15b1_generation_schema_validator_r06_stop"         "$STEP_DIR/publish-stop.log"         "$STEP_DIR/step-code.sh"         "$STEP_DIR/report.txt"         "$STEP_DIR/facts.json"         "$STEP_DIR/verify.txt"         "$STEP_DIR/rollback.sh"         "$STEP_DIR/r05-classification.txt"         "$STEP_DIR/r06-classification.txt"         "$STEP_DIR/r07-count-authority-fixture.txt"         "$STEP_DIR/transfer-verify.txt"         "$STEP_DIR/main.log" || return 0

    STEP_REPORT_URL="$(url_from_log STEP_REPORT_URL "$STEP_DIR/publish-stop.log" || true)"
    PUBLIC_OBJECT_KIND="$(value PUBLIC_OBJECT_KIND "$STEP_DIR/publish-stop.log")"
    PREVIOUS_MOVED_COUNT="$(value PREVIOUS_MOVED_COUNT "$STEP_DIR/publish-stop.log")"
    if [[ -n "$STEP_REPORT_URL" ]]; then
        FACTS_URL="${STEP_REPORT_URL}facts.json"
        VERIFY_URL="${STEP_REPORT_URL}verify.txt"
        ROLLBACK_URL="${STEP_REPORT_URL}rollback.sh"
    fi
}

on_error() {
    local rc=$? line="${BASH_LINENO[0]:-unknown}"
    set +e
    trap - ERR
    [[ "$FINALIZED" == true ]] && exit "$rc"
    FINALIZED=true
    RESULT="STOP_R15B1_R06_CONTINUATION_ERROR"
    write_stop_artifacts "$rc" "$line"
    publish_stop_if_possible
    finish
    exit "$rc"
}
trap on_error ERR

PHASE=bundle_verification
progress "verify exact continuation bundle and approved publisher"

cp "$0" "$STEP_DIR/step-code.sh"
cp "$BUNDLE_ZIP" "$STEP_DIR/"
cp "$BUNDLE_ROOT/manifest.sha256" "$STEP_DIR/bundle-manifest.sha256"
cp "$BUNDLE_ROOT/r05-classification.txt" "$STEP_DIR/"
cp "$BUNDLE_ROOT/r06-classification.txt" "$STEP_DIR/"
cp "$BUNDLE_ROOT/release-info.json" "$STEP_DIR/"
cp "$BUNDLE_ROOT/tests/test-r07-count-authority.sh" "$STEP_DIR/"
cp "$BUNDLE_ROOT/local-build-count-authority-fixture.txt" "$STEP_DIR/"
cp "$BUNDLE_ROOT/vm101-transport.sh" "$STEP_DIR/"
cp "$BUNDLE_ROOT/vm101-verify-post-machine-git.sh" "$STEP_DIR/"
cp "$BUNDLE_ROOT/vm101-export-artifacts.sh" "$STEP_DIR/"
cp "$BUNDLE_ROOT/vm101-export-run-log.sh" "$STEP_DIR/"

ACTUAL_BUNDLE_SHA="$(sha256sum "$BUNDLE_ZIP" | awk '{print $1}')"
ACTUAL_INSTALLER_SHA="$(sha256sum "$BUNDLE_ROOT/install.sh" | awk '{print $1}')"

cat >"$STEP_DIR/transfer-verify.txt" <<EOF
EXPECTED_BUNDLE_SHA256=$EXPECTED_BUNDLE_SHA256
ACTUAL_BUNDLE_SHA256=$ACTUAL_BUNDLE_SHA
EXPECTED_INSTALLER_SHA256=$EXPECTED_INSTALLER_SHA256
ACTUAL_INSTALLER_SHA256=$ACTUAL_INSTALLER_SHA
EOF

[[ "$ACTUAL_BUNDLE_SHA" == "$EXPECTED_BUNDLE_SHA256" ]]
[[ "$ACTUAL_INSTALLER_SHA" == "$EXPECTED_INSTALLER_SHA256" ]]
(
    cd "$BUNDLE_ROOT"
    sha256sum -c manifest.sha256
) >>"$STEP_DIR/transfer-verify.txt" 2>&1

bash -n "$STEP_DIR/step-code.sh"
bash -n "$BUNDLE_ROOT/tests/test-r07-count-authority.sh"
bash -n "$BUNDLE_ROOT/vm101-transport.sh"
sh -n "$BUNDLE_ROOT/vm101-verify-post-machine-git.sh"
sh -n "$BUNDLE_ROOT/vm101-export-artifacts.sh"
sh -n "$BUNDLE_ROOT/vm101-export-run-log.sh"

[[ "$(sha256sum "$PUBLISHER" | awk '{print $1}')" == "$EXPECTED_PUBLISHER_SHA" ]]
PUBLISHER_APPROVED=true

echo "COPY_VERIFY=PASS" >>"$STEP_DIR/transfer-verify.txt"
echo "STEP_SHA256=$(step_sha)" >>"$STEP_DIR/transfer-verify.txt"
: >"$STEP_DIR/r07-count-authority-fixture.txt"

bash "$BUNDLE_ROOT/tests/test-r07-count-authority.sh" >"$STEP_DIR/r07-count-authority-fixture.txt"
grep -q '^RESULT=PASS_R07_COUNT_AUTHORITY_FIXTURE$' "$STEP_DIR/r07-count-authority-fixture.txt"

# shellcheck disable=SC1090
source "$BUNDLE_ROOT/vm101-transport.sh"

PHASE=previous_machine_git_proof
progress "verify completed Machine Git from R05 without rerunning it"

R05_DIR="$(
    find /opt/router-ops/steps -maxdepth 1 -type d         -name '*STEP_050M07R15B1_GENERATION_SCHEMA_VALIDATOR_R02S_PUBLICATION_SALVAGE_R05_VERIFIED' |
    sort | tail -n1
)"
[[ -n "$R05_DIR" ]]
[[ -f "$R05_DIR/router-machine-close.log" ]]
cp "$R05_DIR/router-machine-close.log" "$STEP_DIR/router-machine-close-r05.log"

grep -q '^STOP=ROUTER_MACHINE_CLOSE_BACKEND_FAILED$' "$STEP_DIR/router-machine-close-r05.log"
grep -q '^RESULT=PASS_vm101_GIT_PUBLISH$' "$STEP_DIR/router-machine-close-r05.log"
grep -q "^GIT_COMMIT=$EXPECTED_COMMIT$" "$STEP_DIR/router-machine-close-r05.log"
grep -q "^GIT_TREE=$EXPECTED_TREE$" "$STEP_DIR/router-machine-close-r05.log"
grep -q "^GIT_FILE_COUNT=$EXPECTED_COUNT$" "$STEP_DIR/router-machine-close-r05.log"
grep -q "^VM130_COMMIT=$EXPECTED_COMMIT$" "$STEP_DIR/router-machine-close-r05.log"
grep -q "^VM130_TREE=$EXPECTED_TREE$" "$STEP_DIR/router-machine-close-r05.log"
grep -q "^VM130_FILE_COUNT=$EXPECTED_COUNT$" "$STEP_DIR/router-machine-close-r05.log"
grep -q '^VM130_STATUS=CLEAN$' "$STEP_DIR/router-machine-close-r05.log"
grep -q "^VM101_PUBLIC_URL=$EXPECTED_SOURCE_URL$" "$STEP_DIR/router-machine-close-r05.log"

PHASE=vm101_post_machine_git_verify
progress "verify VM101 commit, tree, managed files and unchanged runtime"

vm101_run_script "$BUNDLE_ROOT/vm101-verify-post-machine-git.sh"     >"$STEP_DIR/vm101-post-machine-git.txt"

grep -q '^RESULT=PASS_VM101_POST_MACHINE_GIT_VERIFY$' "$STEP_DIR/vm101-post-machine-git.txt"
[[ "$(value HEAD_COMMIT "$STEP_DIR/vm101-post-machine-git.txt")" == "$EXPECTED_COMMIT" ]]
[[ "$(value HEAD_TREE "$STEP_DIR/vm101-post-machine-git.txt")" == "$EXPECTED_TREE" ]]
[[ "$(value MANAGED_PATH_COUNT "$STEP_DIR/vm101-post-machine-git.txt")" == "$EXPECTED_COUNT" ]]
[[ "$(value CONF_SHA "$STEP_DIR/vm101-post-machine-git.txt")" == "$EXPECTED_CONF_SHA" ]]
[[ "$(value LIB_SHA "$STEP_DIR/vm101-post-machine-git.txt")" == "$EXPECTED_LIB_SHA" ]]
[[ "$(value VALIDATOR_SHA "$STEP_DIR/vm101-post-machine-git.txt")" == "$EXPECTED_VALIDATOR_SHA" ]]

awk '/TRACKED_DIFF_BEGIN/{f=1;next}/TRACKED_DIFF_END/{f=0}f'     "$STEP_DIR/vm101-post-machine-git.txt" | sed '/^$/d' >"$STEP_DIR/tracked-diff.txt"
test ! -s "$STEP_DIR/tracked-diff.txt"

awk '/TRACKED_STATUS_BEGIN/{f=1;next}/TRACKED_STATUS_END/{f=0}f'     "$STEP_DIR/vm101-post-machine-git.txt" | sed '/^$/d' >"$STEP_DIR/tracked-status.txt"
test ! -s "$STEP_DIR/tracked-status.txt"

awk '/LIVE_ENDPOINTS_BEGIN/{f=1;next}/LIVE_ENDPOINTS_END/{f=0}f'     "$STEP_DIR/vm101-post-machine-git.txt" >"$STEP_DIR/live-endpoints.tsv"
[[ "$(wc -l <"$STEP_DIR/live-endpoints.tsv" | tr -d ' ')" == 5 ]]

vm101_run_script "$BUNDLE_ROOT/vm101-export-artifacts.sh"     >"$STEP_DIR/target-artifacts.tar.gz"
gzip -t "$STEP_DIR/target-artifacts.tar.gz"
mkdir -p "$STEP_DIR/target-artifacts"
tar -xzf "$STEP_DIR/target-artifacts.tar.gz" -C "$STEP_DIR/target-artifacts"

vm101_run_script "$BUNDLE_ROOT/vm101-export-run-log.sh"     >"$STEP_DIR/target-run.log"

python3 - "$STEP_DIR/target-artifacts/target-facts.json" <<'PY'
import json, sys
f = json.load(open(sys.argv[1]))
assert f["result"] == "PASS_R15B1_GENERATION_SCHEMA_VALIDATOR_INSTALLED"
assert f["runtime_impact"] is False
assert f["active_slots_changed"] is False
assert f["active_generation_created"] is False
assert f["managed_path_count"] == 32
assert f["validator_selftest"] == "PASS"
PY

cmp     "$STEP_DIR/target-artifacts/state/endpoints-after.tsv"     "$STEP_DIR/live-endpoints.tsv"

PHASE=github_exact_clone
progress "verify GitHub main, exact commit, tree, file count and file SHA256"

REMOTE_MAIN="$(git ls-remote "$REPOSITORY" refs/heads/main | awk '{print $1}')"
[[ "$REMOTE_MAIN" == "$EXPECTED_COMMIT" ]]

CLONE="$STEP_DIR/github-exact-clone"
git clone --quiet "$REPOSITORY" "$CLONE" >"$STEP_DIR/git-clone.log" 2>&1
git -C "$CLONE" checkout --quiet --detach "$EXPECTED_COMMIT"

[[ "$(git -C "$CLONE" rev-parse HEAD)" == "$EXPECTED_COMMIT" ]]
[[ "$(git -C "$CLONE" rev-parse 'HEAD^{tree}')" == "$EXPECTED_TREE" ]]
[[ "$(git -C "$CLONE" ls-tree -r --name-only HEAD | wc -l | tr -d ' ')" == "$EXPECTED_COUNT" ]]

[[ "$(git -C "$CLONE" show HEAD:etc/router-egress-generation.conf | sha256sum | awk '{print $1}')" == "$EXPECTED_CONF_SHA" ]]
[[ "$(git -C "$CLONE" show HEAD:usr/local/lib/router-egress-generation.sh | sha256sum | awk '{print $1}')" == "$EXPECTED_LIB_SHA" ]]
[[ "$(git -C "$CLONE" show HEAD:usr/local/sbin/router-egress-generation-validate | sha256sum | awk '{print $1}')" == "$EXPECTED_VALIDATOR_SHA" ]]

PHASE=source_http_verify
progress "verify already published VM101 source over permanent HTTPS"

http_fetch "$VM101_PUBLIC_URL" "$STEP_DIR/http-source-index.html"
grep -q 'vm101' "$STEP_DIR/http-source-index.html"

TOKEN="$(cat /opt/router-ops/public/.router-public-token)"
LATEST_DIR="/opt/router-ops/public/r/$TOKEN/latest"
SOURCE_COUNT="$(find "$LATEST_DIR" -mindepth 1 -maxdepth 1 -type d -name '*_vm101_git_source_*' | wc -l | tr -d ' ')"
[[ "$SOURCE_COUNT" == 1 ]]
SOURCE_DIR="$(find "$LATEST_DIR" -mindepth 1 -maxdepth 1 -type d -name '*_vm101_git_source_*')"
[[ "$(basename "$SOURCE_DIR")" == "20260716-152607_vm101_git_source_66a24ee69f18" ]]

PHASE=model_methods_publication
progress "publish fresh VM101 model and methods"

cat >"$STEP_DIR/vm101-model.md" <<EOF
# VM101 model after R15B1

- Machine Git commit: $EXPECTED_COMMIT
- tree: $EXPECTED_TREE
- managed file count: $EXPECTED_COUNT
- VM101 source: $VM101_PUBLIC_URL
- generation schema: router-egress-generation-v1
- validator: /usr/local/sbin/router-egress-generation-validate
- validator selftests: PASS
- active generation: absent
- staging directory: empty
- active vpn1..vpn5 endpoints: unchanged
- tables 201..205: present
- recovery services: enabled and running
- activation capability: disabled
- service restarts: none
- runtime impact: false
EOF

cat >"$STEP_DIR/vm101-methods.md" <<'EOF'
# VM101 generation validation methods after R15B1

R15B1 installs only the generation schema, shared validation library and strict
read-only validator.

A valid generation must contain exactly five unique tested candidates mapped to:

- egress1 / vpn1 / table 201
- egress2 / vpn2 / table 202
- egress3 / vpn3 / table 203
- egress4 / vpn4 / table 204
- egress5 / vpn5 / table 205

The validator rejects duplicate endpoints and ranks, active endpoint reuse,
quarantine reuse, incomplete mappings, stale or future tests, malformed endpoints,
config-hash mismatch, endpoint mismatch and manifest tampering.

R15B1 has no builder, no active generation and no activation path.
EOF

publish_files     "vm101_model_generation_schema_validator_r15b1"     "$STEP_DIR/publish-model.log"     "$STEP_DIR/vm101-model.md"     "$STEP_DIR/vm101-post-machine-git.txt"     "$STEP_DIR/target-artifacts/target-facts.json"     "$STEP_DIR/target-artifacts/target-verify.txt"     "$STEP_DIR/live-endpoints.tsv"     "$STEP_DIR/router-machine-close-r05.log"

VM101_MODEL_URL="$(url_from_log VM101_MODEL_URL "$STEP_DIR/publish-model.log")"

publish_files     "vm101_methods_generation_schema_validator_r15b1"     "$STEP_DIR/publish-methods.log"     "$STEP_DIR/vm101-methods.md"     "$STEP_DIR/target-artifacts/state/validator-selftest.txt"     "$STEP_DIR/target-artifacts/state/validator-selftest-salvage.txt"     "$STEP_DIR/target-artifacts/rollback.sh"

VM101_METHODS_URL="$(url_from_log VM101_METHODS_URL "$STEP_DIR/publish-methods.log")"

PHASE=local_plan_publication
progress "publish complete local M07 plan with R15B1 marked complete"

cp "$BUNDLE_ROOT/canonical-m07-plan.md" "$STEP_DIR/"
cp "$BUNDLE_ROOT/canonical-plan.md" "$STEP_DIR/"
cp "$BUNDLE_ROOT/local-plan-contract.md" "$STEP_DIR/"
cp "$BUNDLE_ROOT/next-implementation-sequence.md" "$STEP_DIR/"

[[ "$(sha256sum "$STEP_DIR/canonical-plan.md" | awk '{print $1}')" == "d5127b5b617bc043c9a631f0853e750f8173166c619d02f51249a67d95976075" ]]

cat >>"$STEP_DIR/canonical-m07-plan.md" <<EOF

## R15B1 completion

- Result: PASS_R15B1_GENERATION_SCHEMA_VALIDATOR_ACTIVE
- VM101 commit: $EXPECTED_COMMIT
- VM101 tree: $EXPECTED_TREE
- managed file count: $EXPECTED_COUNT
- active generation created: false
- active slots changed: false
- runtime impact: false
- next implementation stage: R15B2 generation builder
EOF

publish_files     "local_architecture_plan_vm101_autonomous_hmn_recovery_r15b1"     "$STEP_DIR/publish-plan.log"     "$STEP_DIR/canonical-m07-plan.md"     "$STEP_DIR/canonical-plan.md"     "$STEP_DIR/local-plan-contract.md"     "$STEP_DIR/next-implementation-sequence.md"

LOCAL_M07_PLAN_URL="$(url_from_log LOCAL_M07_PLAN_URL "$STEP_DIR/publish-plan.log")"

PHASE=report_preparation
progress "prepare formal continuation report and independent verification"

cat >"$STEP_DIR/rollback.sh" <<EOF
#!/usr/bin/env bash
set -Eeuo pipefail

echo "RESULT=STOP_NO_RUNTIME_CHANGE_IN_R06"
echo "R06_SCOPE=publication continuation only"
echo "TARGET_RUNTIME_ROLLBACK=/root/router-steps/STEP_050M07R15B1_GENERATION_SCHEMA_VALIDATOR_R02_REBUILT/extracted/target-step/rollback.sh"
echo "VM101_SOURCE_COMMIT=$EXPECTED_COMMIT"
echo "PUBLICATION_ROLLBACK=restore prior model, methods and local-plan folders from old/ under a separately approved STEP"
echo "RUNTIME_IMPACT=false"
exit 1
EOF
chmod 700 "$STEP_DIR/rollback.sh"

RESULT="PASS_R15B1_GENERATION_SCHEMA_VALIDATOR_ACTIVE"

cat >"$STEP_DIR/facts.json" <<EOF
{
  "step_id": "$STEP_ID",
  "result": "$RESULT",
  "previous_r05_result": "STOP_R15B1_SALVAGE_ERROR",
  "machine_git_backend_result": "PASS_vm101_GIT_PUBLISH",
  "machine_git_complete": true,
  "router_machine_close_rerun": false,
  "commit": "$EXPECTED_COMMIT",
  "tree": "$EXPECTED_TREE",
  "file_count": $EXPECTED_COUNT,
  "vm101_source_url": "$VM101_PUBLIC_URL",
  "vm101_post_machine_git_verify": "PASS",
  "vm101_live_ls_tree_count_asserted": false,
  "authoritative_file_count_sources": ["machine_git_backend", "vm130_exact_clone", "github_exact_clone", "vm101_managed_path_count"],
  "github_main_verify": "PASS",
  "github_exact_clone": "PASS",
  "source_http_verify": "PASS",
  "active_slots_changed": false,
  "active_generation_created": false,
  "core_change_repeated": false,
  "target_installer_rerun": false,
  "service_restarts": [],
  "traffic_interruption": false,
  "runtime_impact": false
}
EOF

cat >"$STEP_DIR/verify.txt" <<EOF
RESULT=$RESULT
COPY_VERIFY=PASS
STEP_SHA256=$(step_sha)
PREVIOUS_R05_RESULT=STOP_R15B1_SALVAGE_ERROR
MACHINE_GIT_BACKEND_RESULT=PASS_vm101_GIT_PUBLISH
MACHINE_GIT_COMPLETE=true
ROUTER_MACHINE_CLOSE_RERUN=false
VM101_COMMIT=$EXPECTED_COMMIT
VM101_TREE=$EXPECTED_TREE
VM101_FILE_COUNT=$EXPECTED_COUNT
VM101_POST_MACHINE_GIT_VERIFY=PASS
VM101_LIVE_LS_TREE_COUNT_ASSERTED=false
AUTHORITATIVE_FILE_COUNT_SOURCES=machine_git_backend,vm130_exact_clone,github_exact_clone,vm101_managed_path_count
VM101_TRACKED_DIFF_EMPTY=PASS
VM101_TRACKED_STATUS_CLEAN=PASS
VM101_MANAGED_PATH_COUNT=32
INSTALLED_FILE_SHA256=PASS
ACTIVE_GENERATION_CREATED=false
ACTIVE_SLOTS_CHANGED=false
ENDPOINTS_UNCHANGED=PASS
TABLES_201_205=PASS
RECOVERY_SERVICES=PASS
GITHUB_MAIN=PASS
GITHUB_EXACT_CLONE=PASS
SOURCE_HTTP_VERIFY=PASS
SOURCE_CURRENT_COUNT=1
FULL_CANONICAL_PLAN_RETAINED=PASS
CORE_CHANGE_REPEATED=false
TARGET_INSTALLER_RERUN=false
SERVICE_RESTARTS=none
TRAFFIC_INTERRUPTION=false
RUNTIME_IMPACT=false
EOF

cat >"$STEP_DIR/system-model.txt" <<EOF
GENERATION_SCHEMA=router-egress-generation-v1
GENERATION_VALIDATOR=/usr/local/sbin/router-egress-generation-validate
GENERATION_ACTIVE_LINK_PRESENT=false
GENERATION_STAGING_EMPTY=true
ACTIVE_SLOTS_CHANGED=false
ACTIVATION_ALLOWED=false
VM101_COMMIT=$EXPECTED_COMMIT
VM101_TREE=$EXPECTED_TREE
VM101_FILE_COUNT=$EXPECTED_COUNT
VM101_SOURCE_URL=$VM101_PUBLIC_URL
EOF

cat >"$STEP_DIR/methods-limitations.txt" <<'EOF'
METHOD=Publication continuation after independently proving completed Machine Git.
ROUTER_MACHINE_CLOSE_RERUN=false
CORE_CHANGE_REPEATED=false
TARGET_INSTALLER_RERUN=false
SERVICE_RESTARTS=none
INTERFACES_CHANGED=none
ROUTES_CHANGED=none
TRAFFIC_INTERRUPTION=none
LIMITATION=R15B1 validates staged generations but does not build or activate them.
RUNTIME_IMPACT=false
EOF

cat >"$STEP_DIR/access-routes.txt" <<'EOF'
ACCESS_MAP_CHANGED=false
VM101_ROUTE=ops@router-ops -> pve-mgts -> root@10.71.100.2
VM101_DIRECT_FROM_ROUTER_OPS=unsupported
EOF

cat >"$STEP_DIR/report.txt" <<EOF
STEP_ID=$STEP_ID
RESULT=$RESULT
PURPOSE=Complete R15B1 publication after late router-machine-close wrapper failure.
PREVIOUS_R05_RESULT=STOP_R15B1_SALVAGE_ERROR
MACHINE_GIT_BACKEND_RESULT=PASS_vm101_GIT_PUBLISH
MACHINE_GIT_COMPLETE=true
ROUTER_MACHINE_CLOSE_RERUN=false
VM101_COMMIT=$EXPECTED_COMMIT
VM101_TREE=$EXPECTED_TREE
VM101_FILE_COUNT=$EXPECTED_COUNT
VM101_SOURCE_URL=$VM101_PUBLIC_URL
VM101_POST_MACHINE_GIT_VERIFY=PASS
VM101_LIVE_LS_TREE_COUNT_ASSERTED=false
AUTHORITATIVE_FILE_COUNT_SOURCES=machine_git_backend,vm130_exact_clone,github_exact_clone,vm101_managed_path_count
GITHUB_MAIN_VERIFY=PASS
GITHUB_EXACT_CLONE=PASS
SOURCE_HTTP_VERIFY=PASS
ACTIVE_SLOTS_CHANGED=false
ACTIVE_GENERATION_CREATED=false
CORE_CHANGE_REPEATED=false
TARGET_INSTALLER_RERUN=false
SERVICE_RESTARTS=none
TRAFFIC_INTERRUPTION=false
RUNTIME_IMPACT=false
LOCAL_M07_PLAN_URL=$LOCAL_M07_PLAN_URL
GLOBAL_PROJECT_PLAN_URL=$GLOBAL_PROJECT_PLAN_URL
ACCESS_MAP_URL=$ACCESS_MAP_URL
VM100_PUBLIC_URL=$VM100_PUBLIC_URL
VM101_PUBLIC_URL=$VM101_PUBLIC_URL
VM121_PUBLIC_URL=$VM121_PUBLIC_URL
VM101_MODEL_URL=$VM101_MODEL_URL
VM101_METHODS_URL=$VM101_METHODS_URL
VM130_SOURCE_URL=$VM130_SOURCE_URL
COPY_VERIFY=PASS
STEP_SHA256=$(step_sha)
EOF

PHASE=step_report_publication
progress "publish formal R15B1 continuation report"

publish_files     "step050m07r15b1_generation_schema_validator_r06_publication_continuation"     "$STEP_DIR/publish-step.log"     "$STEP_DIR/step-code.sh"     "$STEP_DIR/report.txt"     "$STEP_DIR/facts.json"     "$STEP_DIR/verify.txt"     "$STEP_DIR/rollback.sh"     "$STEP_DIR/system-model.txt"     "$STEP_DIR/methods-limitations.txt"     "$STEP_DIR/access-routes.txt"     "$STEP_DIR/transfer-verify.txt"     "$STEP_DIR/r05-classification.txt"     "$STEP_DIR/r06-classification.txt"     "$STEP_DIR/r07-count-authority-fixture.txt"     "$STEP_DIR/test-r07-count-authority.sh"     "$STEP_DIR/local-build-count-authority-fixture.txt"     "$STEP_DIR/release-info.json"     "$STEP_DIR/router-machine-close-r05.log"     "$STEP_DIR/vm101-post-machine-git.txt"     "$STEP_DIR/target-artifacts.tar.gz"     "$STEP_DIR/target-run.log"     "$STEP_DIR/live-endpoints.tsv"     "$STEP_DIR/tracked-diff.txt"     "$STEP_DIR/tracked-status.txt"     "$STEP_DIR/git-clone.log"     "$STEP_DIR/http-source-index.html"     "$STEP_DIR/publish-model.log"     "$STEP_DIR/publish-methods.log"     "$STEP_DIR/publish-plan.log"     "$STEP_DIR/canonical-m07-plan.md"     "$STEP_DIR/canonical-plan.md"     "$STEP_DIR/local-plan-contract.md"     "$STEP_DIR/next-implementation-sequence.md"     "$STEP_DIR/main.log"

STEP_REPORT_URL="$(url_from_log STEP_REPORT_URL "$STEP_DIR/publish-step.log")"
PUBLIC_OBJECT_KIND="$(value PUBLIC_OBJECT_KIND "$STEP_DIR/publish-step.log")"
PREVIOUS_MOVED_COUNT="$(value PREVIOUS_MOVED_COUNT "$STEP_DIR/publish-step.log")"
STEP_PUBLISHED_DIR="$(value PUBLISHED_DIR "$STEP_DIR/publish-step.log")"

FACTS_URL="${STEP_REPORT_URL}facts.json"
VERIFY_URL="${STEP_REPORT_URL}verify.txt"
ROLLBACK_URL="${STEP_REPORT_URL}rollback.sh"

cat >>"$STEP_DIR/report.txt" <<EOF
STEP_REPORT_URL=$STEP_REPORT_URL
FACTS_URL=$FACTS_URL
VERIFY_URL=$VERIFY_URL
ROLLBACK_URL=$ROLLBACK_URL
LATEST_ROOT_URL=$LATEST_ROOT_URL
OLD_ROOT_URL=$OLD_ROOT_URL
PUBLIC_OBJECT_KIND=$PUBLIC_OBJECT_KIND
PREVIOUS_MOVED_COUNT=$PREVIOUS_MOVED_COUNT
EOF

cp "$STEP_DIR/report.txt" "$STEP_PUBLISHED_DIR/report.txt"
(
    cd "$STEP_PUBLISHED_DIR"
    find . -type f ! -name manifest.sha256 -print0 |
        sort -z |
        xargs -0 sha256sum >manifest.sha256
)

PHASE=external_http_verification
progress "verify all current R15B1 artifacts over permanent HTTPS"

http_fetch "$FACTS_URL" "$STEP_DIR/http-facts.json"
http_fetch "$VERIFY_URL" "$STEP_DIR/http-verify.txt"
http_fetch "$ROLLBACK_URL" "$STEP_DIR/http-rollback.sh"
http_fetch "$VM101_PUBLIC_URL" "$STEP_DIR/http-source-index-final.html"
http_fetch "$VM101_MODEL_URL" "$STEP_DIR/http-model-index.html"
http_fetch "$VM101_METHODS_URL" "$STEP_DIR/http-methods-index.html"
http_fetch "${LOCAL_M07_PLAN_URL}canonical-m07-plan.md" "$STEP_DIR/http-canonical-m07-plan.md"
http_fetch "${LOCAL_M07_PLAN_URL}canonical-plan.md" "$STEP_DIR/http-canonical-plan.md"

cmp "$STEP_DIR/facts.json" "$STEP_DIR/http-facts.json"
cmp "$STEP_DIR/verify.txt" "$STEP_DIR/http-verify.txt"
cmp "$STEP_DIR/rollback.sh" "$STEP_DIR/http-rollback.sh"
cmp "$STEP_DIR/canonical-m07-plan.md" "$STEP_DIR/http-canonical-m07-plan.md"
cmp "$STEP_DIR/canonical-plan.md" "$STEP_DIR/http-canonical-plan.md"

for pattern in     '*_vm101_git_source_*'     '*_vm101_model_*'     '*_vm101_methods_*'     '*_local_architecture_plan_vm101_autonomous_hmn_recovery_*'
do
    count="$(find "$LATEST_DIR" -mindepth 1 -maxdepth 1 -type d -name "$pattern" | wc -l | tr -d ' ')"
    [[ "$count" == 1 ]]
done

FINALIZED=true
trap - ERR
finish