#!/usr/bin/env bash
set -Eeuo pipefail
umask 077
export PATH='/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
STEP_ID='STEP_050M07R20QS_CONTROLLED_LIVE_ZERO_HEALTHY_END_TO_END'
TARGET_PACKAGE_SHA='c448415ce46bbe1d09037781af20db1be8d8617fc499312d5d81372aaa4907b8'
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"; BUNDLE_ROOT="${BUNDLE_ROOT:-$SCRIPT_DIR}"; export BUNDLE_ROOT
BASE="${ROUTER_OPS_BASE:-/opt/router-ops}"; CONTRACT_ROOT="${ROUTER_CONTRACT_ROOT:-/opt/router-ops}"; WORKFLOW_LIB="$CONTRACT_ROOT/lib/router-step-workflow.sh"; FINALIZER="$CONTRACT_ROOT/bin/router-step-finalize"; SAFE_PAYLOAD="$CONTRACT_ROOT/bin/router-public-safe-payload"; POLICY_LIB="$CONTRACT_ROOT/lib/router-publication-policy.sh"
RUN_ID="$(date -u +%Y%m%d-%H%M%S)-$$"; RUN_DIR="${ROUTER_STEP_RUN_DIR:-$BASE/state/step-runs/$STEP_ID/$RUN_ID}"; CURRENT_FILE="$RUN_DIR/workflow-current.txt"; EVENTS_FILE="$RUN_DIR/workflow-events.tsv"; EVIDENCE_DIR="$RUN_DIR/evidence"; REPORT_DIR="$RUN_DIR/report"; PUBLIC_PAYLOAD="$RUN_DIR/public-payload"; FINAL_ENV="$RUN_DIR/finalize.txt"; LOCK_FILE="$BASE/state/locks/${STEP_ID}.lock"
CURRENT_PHASE=bootstrap; BACKUP_READY=false; CORE_CHANGE_COMPLETE=false; VM100_BACKUP_DIR=''; VM101_BACKUP_DIR=''
archive_latest(){ "$BUNDLE_ROOT/scripts/archive-latest.sh"; }
source "$WORKFLOW_LIB"
rollback_now(){ [ "$BACKUP_READY" = true ] || return 0; [ "$CORE_CHANGE_COMPLETE" = false ] || return 0; export VM100_BACKUP_DIR VM101_BACKUP_DIR; "$BUNDLE_ROOT/rollback/rollback.sh"; }
publish_stop_report(){ local phase="$1" line="$2" rc="$3"; python3 "$BUNDLE_ROOT/scripts/build_stop_report.py" --step-id "$STEP_ID" --phase "$phase" --line "$line" --rc "$rc" --core-complete "$CORE_CHANGE_COMPLETE" --output "$REPORT_DIR" --release-info "$BUNDLE_ROOT/release-info.json" --installer-sha "$BUNDLE_ROOT/installer.sha256" --bundle-manifest "$BUNDLE_ROOT/manifest.sha256" || return 1; cp "$BUNDLE_ROOT/install.sh" "$REPORT_DIR/executed-step.sh"; local args=("$REPORT_DIR/report.txt" report.txt "$REPORT_DIR/facts.json" facts.json "$REPORT_DIR/facts-public.html" facts-public.html "$REPORT_DIR/verify-public.html" verify-public.html "$REPORT_DIR/rollback-public.html" rollback-public.html "$REPORT_DIR/release-info.json" release-info.json "$REPORT_DIR/installer.sha256" installer.sha256 "$REPORT_DIR/bundle-manifest.sha256" bundle-manifest.sha256 "$REPORT_DIR/executed-step.sh" executed-step.sh); for f in preflight-main preflight pve-preflight vm100-preflight vm101-preflight snapshot backup apply postcheck source project-source rollback; do [[ ! -f "$EVIDENCE_DIR/$f.txt" ]] || { cp "$EVIDENCE_DIR/$f.txt" "$REPORT_DIR/$f.txt"; args+=("$REPORT_DIR/$f.txt" "$f.txt"); }; done; ROUTER_PUBLICATION_POLICY_LIB="$POLICY_LIB" "$SAFE_PAYLOAD" "$PUBLIC_PAYLOAD" "${args[@]}" || return 1; "$FINALIZER" --label step050m07r20qs_controlled_live_zero_healthy_end_to_end --payload-dir "$PUBLIC_PAYLOAD" --workflow-current "$CURRENT_FILE" --workflow-events "$EVENTS_FILE" --output-env "$FINAL_ENV" --expect-kind step-report; }
stop(){ local line="$1" rc="$2"; trap - ERR; set +e; mkdir -p "$RUN_DIR" "$EVIDENCE_DIR" "$REPORT_DIR" "$PUBLIC_PAYLOAD"; local phase="${CURRENT_PHASE:-unknown}"; rollback_now >"$EVIDENCE_DIR/rollback.txt" 2>&1 || true; publish_stop_report "$phase" "$line" "$rc" || true; archive_latest; [[ ! -f "$FINAL_ENV" ]] || cat "$FINAL_ENV"; echo RESULT=STOP_R20QS_CONTROLLED_LIVE_ZERO_HEALTHY_END_TO_END; echo STOP_PHASE="$phase"; echo STOP_LINE="$line"; echo STOP_RC="$rc"; echo CORE_CHANGE_COMPLETE="$CORE_CHANGE_COMPLETE"; exit "$rc"; }
trap 'stop "$LINENO" "$?"' ERR
mkdir -p "$RUN_DIR" "$EVIDENCE_DIR" "$REPORT_DIR" "$PUBLIC_PAYLOAD" "$(dirname "$LOCK_FILE")"; exec 9>"$LOCK_FILE"; flock -n 9
router_step_workflow_init "$CURRENT_FILE" "$EVENTS_FILE" preflight snapshot backup apply postcheck source project_source report_build
CURRENT_PHASE=preflight; router_step_phase_begin preflight; "$BUNDLE_ROOT/scripts/preflight.sh" "$EVIDENCE_DIR" | tee "$EVIDENCE_DIR/preflight-main.txt"; grep -Fqx RESULT=PASS_R20QS_PREFLIGHT "$EVIDENCE_DIR/preflight-main.txt"; cp "$EVIDENCE_DIR/preflight-main.txt" "$EVIDENCE_DIR/preflight.txt"; router_step_phase_complete preflight exact_clean_five_slot_baseline_and_live_safety_ready
CURRENT_PHASE=snapshot; router_step_phase_begin snapshot; "$BUNDLE_ROOT/scripts/snapshot.sh" | tee "$EVIDENCE_DIR/snapshot.txt"; grep -Fqx RESULT=PASS_R20QS_SNAPSHOT "$EVIDENCE_DIR/snapshot.txt"; router_step_phase_complete snapshot both_vm_pretest_snapshots_ready
CURRENT_PHASE=backup
router_step_phase_begin backup
"$BUNDLE_ROOT/scripts/backup-run.sh" "$RUN_ID" | tee "$EVIDENCE_DIR/backup.txt"
grep -Fqx RESULT=PASS_R20QS_BACKUP "$EVIDENCE_DIR/backup.txt"
echo BACKUP_RESULT_MARKER_VERIFIED=true
VM100_BACKUP_DIR="$(awk -F= '$1=="VM100_BACKUP_DIR"{print substr($0,index($0,"=")+1)}' "$EVIDENCE_DIR/backup.txt" | tail -n 1)"
[[ -n "$VM100_BACKUP_DIR" ]]
echo BACKUP_PATH_EXTRACT_VM100=true
VM101_BACKUP_DIR="$(awk -F= '$1=="VM101_BACKUP_DIR"{print substr($0,index($0,"=")+1)}' "$EVIDENCE_DIR/backup.txt" | tail -n 1)"
[[ -n "$VM101_BACKUP_DIR" ]]
echo BACKUP_PATH_EXTRACT_VM101=true
BACKUP_READY=true
router_step_phase_complete backup both_vm_runtime_provider_network_and_state_backups_ready
CURRENT_PHASE=apply; router_step_phase_begin apply; "$BUNDLE_ROOT/scripts/apply-runtime.sh" "$TARGET_PACKAGE_SHA" "$VM100_BACKUP_DIR" "$VM101_BACKUP_DIR" | tee "$EVIDENCE_DIR/apply.txt"; grep -Fqx RESULT=PASS_R20QS_APPLY "$EVIDENCE_DIR/apply.txt"; grep -Fqx RESULT=PASS_R20QS_LIVE_END_TO_END "$EVIDENCE_DIR/apply.txt"; grep -Fqx LIVE_ZERO_HEALTHY_SIMULATED=true "$EVIDENCE_DIR/apply.txt"; grep -Fqx CACHED_BOOTSTRAP_USED=true "$EVIDENCE_DIR/apply.txt"; grep -Fqx PROVIDER_ACQUISITION_USED=false "$EVIDENCE_DIR/apply.txt"; grep -Fqx HMN_DOWNLOAD_TRANSPORT=vpn "$EVIDENCE_DIR/apply.txt"; grep -Fqx HEAVY_REFRESH_EXECUTED=true "$EVIDENCE_DIR/apply.txt"; router_step_phase_complete apply live_zero_healthy_direct_cached_bootstrap_vpn_download_full_refresh_and_reconciliation_passed
CURRENT_PHASE=postcheck; router_step_phase_begin postcheck; "$BUNDLE_ROOT/scripts/postcheck-run.sh" "$VM100_BACKUP_DIR" "$VM101_BACKUP_DIR" | tee "$EVIDENCE_DIR/postcheck.txt"; grep -Fqx RESULT=PASS_R20QS_POSTCHECK "$EVIDENCE_DIR/postcheck.txt"; CORE_CHANGE_COMPLETE=true; router_step_phase_complete postcheck production_timing_and_source_trees_restored_and_final_runtime_healthy
CURRENT_PHASE=source; router_step_phase_begin source; "$BUNDLE_ROOT/scripts/source-publish.sh" | tee "$EVIDENCE_DIR/source.txt"; grep -Fqx RESULT=PASS_R20QS_SOURCE_CHECK "$EVIDENCE_DIR/source.txt"; router_step_phase_complete source machine_git_unchanged
CURRENT_PHASE=project_source; router_step_phase_begin project_source; "$BUNDLE_ROOT/scripts/publish-project-source.sh" "$EVIDENCE_DIR/apply.txt" "$EVIDENCE_DIR/source.txt" "$RUN_DIR/project-source" | tee "$EVIDENCE_DIR/project-source.txt"; grep -Fqx RESULT=PASS_R20QS_PROJECT_SOURCE_PUBLISH "$EVIDENCE_DIR/project-source.txt"; router_step_phase_complete project_source live_proof_published
CURRENT_PHASE=report_build; router_step_phase_begin report_build; python3 "$BUNDLE_ROOT/scripts/build_report.py" --apply "$EVIDENCE_DIR/apply.txt" --postcheck "$EVIDENCE_DIR/postcheck.txt" --source "$EVIDENCE_DIR/source.txt" --project-source "$EVIDENCE_DIR/project-source.txt" --output "$REPORT_DIR" --release-info "$BUNDLE_ROOT/release-info.json" --installer-sha "$BUNDLE_ROOT/installer.sha256" --bundle-manifest "$BUNDLE_ROOT/manifest.sha256"; cp "$BUNDLE_ROOT/install.sh" "$REPORT_DIR/executed-step.sh"; for f in preflight snapshot backup apply postcheck source project-source; do cp "$EVIDENCE_DIR/$f.txt" "$REPORT_DIR/$f.txt"; done; args=("$REPORT_DIR/report.txt" report.txt "$REPORT_DIR/facts.json" facts.json "$REPORT_DIR/facts-public.html" facts-public.html "$REPORT_DIR/verify-public.html" verify-public.html "$REPORT_DIR/rollback-public.html" rollback-public.html "$REPORT_DIR/release-info.json" release-info.json "$REPORT_DIR/installer.sha256" installer.sha256 "$REPORT_DIR/bundle-manifest.sha256" bundle-manifest.sha256 "$REPORT_DIR/executed-step.sh" executed-step.sh); for f in preflight snapshot backup apply postcheck source project-source; do args+=("$REPORT_DIR/$f.txt" "$f.txt"); done; ROUTER_PUBLICATION_POLICY_LIB="$POLICY_LIB" "$SAFE_PAYLOAD" "$PUBLIC_PAYLOAD" "${args[@]}"; "$FINALIZER" --label step050m07r20qs_controlled_live_zero_healthy_end_to_end --payload-dir "$PUBLIC_PAYLOAD" --workflow-current "$CURRENT_FILE" --workflow-events "$EVENTS_FILE" --output-env "$FINAL_ENV" --expect-kind step-report; router_step_workflow_mark_complete || true; router_step_phase_complete report_build pass_report_published; trap - ERR; archive_latest; cat "$FINAL_ENV"; cat "$REPORT_DIR/report.txt"; echo BOOTSTRAP_INSTALLER_RC=0