#!/usr/bin/env bash
set -Eeuo pipefail
umask 077
export PATH='/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
export PYTHONDONTWRITEBYTECODE=1

STEP_ID='STEP_050M07R20QUA1_R07_VM130_SHARED_WORKFLOW_HARDENING'
REVISION='R07'
TARGET_PACKAGE_SHA256='d25b97195ad4d627b36677e53825d579077b97adf593ec5b00b2e37b8e33d22d'
BUNDLE_ROOT="${BUNDLE_ROOT:?BUNDLE_ROOT required}"
BASE="${ROUTER_OPS_BASE:-/opt/router-ops}"
TS="$(date -u +%Y%m%d-%H%M%S)"
RUN_DIR="${ROUTER_DETACHED_RUN_DIR:?ROUTER_DETACHED_RUN_DIR required}"
EVIDENCE="$RUN_DIR/evidence"
REPORT="$RUN_DIR/report"
PUBLIC_PAYLOAD="$RUN_DIR/public-payload"
CURRENT="$RUN_DIR/workflow-current.txt"
EVENTS="$RUN_DIR/workflow-events.tsv"
FINAL_ENV="$RUN_DIR/final-result.env"
SOURCE_ENV="$RUN_DIR/vm130-source.env"
PROJECT_ENV="$RUN_DIR/project-source.env"
FINAL_EXTRACT="$RUN_DIR/independent-final-extract"
FINAL_ROOT="$FINAL_EXTRACT/$STEP_ID"
HELPER_STAGE="$RUN_DIR/helper-stage"
APPLY_LOG="$EVIDENCE/apply.log"
MANDATORY_LOG="$EVIDENCE/mandatory-tests.log"
FULL_SELFTEST_LOG="$EVIDENCE/full-shared-selftest.log"
CHILD_RESULT="${ROUTER_DETACHED_CHILD_RESULT:-$RUN_DIR/child-result.env}"
CURRENT_PHASE=bootstrap
CORE_CHANGE_COMPLETE=false
BACKUP_READY=false
ROLLBACK_STATUS=not_needed
FAILURE_HANDLED=false
LATEST_ARCHIVE=not_created
LATEST_ARCHIVE_SHA256=unknown
STOP_REPORT_URL=not_published

mkdir -p "$EVIDENCE" "$REPORT" "$PUBLIC_PAYLOAD" "$HELPER_STAGE"
chmod 700 "$EVIDENCE" "$REPORT" "$PUBLIC_PAYLOAD" "$HELPER_STAGE"
tar -xzf "$BUNDLE_ROOT/payload/vm130-workflow-target-package.tar.gz" -C "$HELPER_STAGE" \
  lib/router-step-workflow.sh lib/router-core-boundary.sh
# shellcheck source=/dev/null
source "$HELPER_STAGE/lib/router-step-workflow.sh"
# shellcheck source=/dev/null
source "$HELPER_STAGE/lib/router-core-boundary.sh"
router_step_workflow_init "$CURRENT" "$EVENTS" \
  preflight previous_failure_evidence independent_extract mandatory_tests full_shared_selftest \
  apply source_publication project_source report_build report_publish archive

write_child_result() {
    local result="$1" rc="$2" tmp="${CHILD_RESULT}.tmp.$$"
    {
        echo "RUNNER_STEP_RESULT=$([[ "$rc" -eq 0 ]] && echo PASS || echo STOP)"
        echo "RESULT=$result"
        echo "REVISION=$REVISION"
        echo "RUN_DIR=$RUN_DIR"
        echo "STEP_REPORT_URL=$STOP_REPORT_URL"
        echo "LATEST_ARCHIVE=$LATEST_ARCHIVE"
        echo "LATEST_ARCHIVE_SHA256=$LATEST_ARCHIVE_SHA256"
        echo "CORE_CHANGE_COMPLETE=$CORE_CHANGE_COMPLETE"
        echo "ROLLBACK_STATUS=$ROLLBACK_STATUS"
        echo "CHILD_RC=$rc"
    } > "$tmp"
    chmod 600 "$tmp"
    mv -f "$tmp" "$CHILD_RESULT"
}

rollback_now() {
    [ "$BACKUP_READY" = true ] || return 0
    [[ -f "$RUN_DIR/backup/live-pre-change.tar.gz" ]] || return 0
    [[ "$CORE_CHANGE_COMPLETE" != true ]] || return 0
    set +e
    BUNDLE_ROOT="$FINAL_ROOT" "$FINAL_ROOT/scripts/rollback-vm130-workflow.sh" "$RUN_DIR" \
      > "$EVIDENCE/rollback.log" 2>&1
    local rc=$?
    set -e
    if [[ "$rc" -eq 0 ]]; then ROLLBACK_STATUS=completed; else ROLLBACK_STATUS="failed_rc_$rc"; fi
}

archive_latest_best_effort() {
    set +e
    router_step_archive_latest_python "$BASE" /home/ops/incoming "$TS" > "$EVIDENCE/latest-archive.log" 2>&1
    local rc=$?
    set -e
    cat "$EVIDENCE/latest-archive.log" || true
    if [[ "$rc" -eq 0 ]]; then
        LATEST_ARCHIVE="$(awk -F= '$1=="LATEST_ARCHIVE"{print substr($0,index($0,"=")+1)}' "$EVIDENCE/latest-archive.log" | tail -n1)"
        LATEST_ARCHIVE_SHA256="$(awk -F= '$1=="LATEST_ARCHIVE_SHA256"{print $2}' "$EVIDENCE/latest-archive.log" | tail -n1)"
    fi
}

publish_stop_report_best_effort() {
    local phase="$1" line="$2" rc="$3" command="$4"
    set +e
    local source_root="$FINAL_ROOT"
    [[ -f "$source_root/scripts/build-stop-report.py" ]] || source_root="$BUNDLE_ROOT"
    python3 "$source_root/scripts/build-stop-report.py" \
      --step-id "$STEP_ID" --revision "$REVISION" --phase "$phase" --line "$line" --rc "$rc" \
      --command "$command" --core-complete "$CORE_CHANGE_COMPLETE" --rollback "$ROLLBACK_STATUS" \
      --run-dir "$RUN_DIR" --output "$REPORT"
    local build_rc=$?
    if [[ "$build_rc" -eq 0 ]]; then
        cp "$source_root/scripts/run-step.sh" "$REPORT/executed-step.sh" 2>/dev/null || true
        cp "$source_root/release-info.json" "$REPORT/release-info.json" 2>/dev/null || true
        cp "$source_root/installer.sha256" "$REPORT/installer.sha256" 2>/dev/null || true
        cp "$source_root/manifest.sha256" "$REPORT/bundle-manifest.sha256" 2>/dev/null || true
        cp "$CURRENT" "$REPORT/workflow-current.txt" 2>/dev/null || true
        cp "$EVENTS" "$REPORT/workflow-events.tsv" 2>/dev/null || true
        for f in "$EVIDENCE"/*.log "$EVIDENCE"/*.txt; do
            [[ -f "$f" ]] || continue
            cp "$f" "$REPORT/$(basename "$f")" 2>/dev/null || true
        done
        args=(
          "$REPORT/report.txt" report.txt
          "$REPORT/facts.json" facts.json
          "$REPORT/facts-public.html" facts-public.html
          "$REPORT/verify-public.html" verify-public.html
          "$REPORT/rollback-public.html" rollback-public.html
          "$REPORT/executed-step.sh" executed-step.sh
          "$REPORT/release-info.json" release-info.json
          "$REPORT/installer.sha256" installer.sha256
          "$REPORT/bundle-manifest.sha256" bundle-manifest.sha256
          "$REPORT/workflow-current.txt" workflow-current.txt
          "$REPORT/workflow-events.tsv" workflow-events.tsv
        )
        for f in "$REPORT"/*.log "$REPORT"/*.txt; do
            [[ -f "$f" ]] || continue
            case "$(basename "$f")" in report.txt|workflow-current.txt) continue;; esac
            args+=("$f" "$(basename "$f")")
        done
        router_step_publish_payload \
          step050m07r20qua1_r07_vm130_shared_workflow_hardening_continuation \
          "$REPORT" "$PUBLIC_PAYLOAD" "$CURRENT" "$EVENTS" "$FINAL_ENV" "${args[@]}" \
          > "$EVIDENCE/stop-publication.log" 2>&1
        local pub_rc=$?
        cat "$EVIDENCE/stop-publication.log" || true
        if [[ -f "$FINAL_ENV" ]]; then
            STOP_REPORT_URL="$(awk -F= '$1=="PUBLIC_URL"{print substr($0,index($0,"=")+1)}' "$FINAL_ENV" | tail -n1)"
        elif [[ -f "${FINAL_ENV}.publish" ]]; then
            STOP_REPORT_URL="$(awk -F= '$1=="PUBLIC_URL"{print substr($0,index($0,"=")+1)}' "${FINAL_ENV}.publish" | tail -n1)"
        fi
        [[ -n "$STOP_REPORT_URL" ]] || STOP_REPORT_URL=not_published
        set -e
        return "$pub_rc"
    fi
    set -e
    return "$build_rc"
}

stop() {
    local rc="$1" line="$2" command="$3" phase="${CURRENT_PHASE:-unknown}"
    trap - ERR
    [[ "$FAILURE_HANDLED" == false ]] || exit "$rc"
    FAILURE_HANDLED=true
    set +e
    router_step_phase_fail "$phase" "line=$line rc=$rc" >/dev/null 2>&1 || true
    [[ -f "$RUN_DIR/apply-state.env" ]] && source "$RUN_DIR/apply-state.env"
    [[ -f "$RUN_DIR/backup/live-pre-change.tar.gz" ]] && BACKUP_READY=true
    rollback_now
    publish_stop_report_best_effort "$phase" "$line" "$rc" "$command" || true
    archive_latest_best_effort
    write_child_result STOP_R20QUA1_R07_VM130_SHARED_WORKFLOW_HARDENING "$rc"
    echo RESULT=STOP_R20QUA1_R07_VM130_SHARED_WORKFLOW_HARDENING
    echo "REVISION=$REVISION"
    echo "STOP_PHASE=$phase"
    echo "STOP_LINE=$line"
    echo "STOP_RC=$rc"
    echo STOP_MACHINE_OWNER=VM130
    printf 'STOP_COMMAND=%q\n' "$command"
    echo "CORE_CHANGE_COMPLETE=$CORE_CHANGE_COMPLETE"
    echo "ROLLBACK_STATUS=$ROLLBACK_STATUS"
    echo "STOP_REPORT_URL=$STOP_REPORT_URL"
    echo "LATEST_ARCHIVE=$LATEST_ARCHIVE"
    echo "LATEST_ARCHIVE_SHA256=$LATEST_ARCHIVE_SHA256"
    echo "RUN_DIR=$RUN_DIR"
    echo "NEXT_DIAGNOSTIC_ACTION=$RUN_DIR/controlled_by_parent_runner"
    exit "$rc"
}
trap 'rc=$?; stop "$rc" "$LINENO" "$BASH_COMMAND"' ERR

CURRENT_PHASE=preflight
router_step_phase_begin preflight
[[ "$(hostname)" == router-ops ]]
[[ "$(id -u)" -ne 0 ]]
[[ -f "${BUNDLE_ZIP:?BUNDLE_ZIP required}" ]]
[[ "$(sha256sum "$BUNDLE_ROOT/payload/vm130-workflow-target-package.tar.gz" | awk '{print $1}')" == "$TARGET_PACKAGE_SHA256" ]]
router_step_phase_complete preflight detached_worker_and_target_package_verified

CURRENT_PHASE=previous_failure_evidence
router_step_phase_begin previous_failure_evidence
# This phase is diagnostic only. It must never block apply.
if [[ -f "$BUNDLE_ROOT/reference/r04-live-source-diff.txt" ]]; then
    cp "$BUNDLE_ROOT/reference/r04-live-source-diff.txt" "$EVIDENCE/r04-live-source-diff.txt" || true
else
    echo R04_BUNDLED_LIVE_SOURCE_DIFF_PRESENT=false > "$EVIDENCE/r04-live-source-diff-missing.txt"
fi
for previous_step in \
    STEP_050M07R20QUA1_R05_VM130_SHARED_WORKFLOW_HARDENING \
    STEP_050M07R20QUA1_R04_VM130_SHARED_WORKFLOW_HARDENING
do
    previous_tag="${previous_step#STEP_050M07R20QUA1_}"
    previous_tag="${previous_tag%%_*}"
    previous_tag="${previous_tag,,}"
    prev_root="$BASE/state/detached-step-runs/$previous_step/runs"
    if [[ -d "$prev_root" ]]; then
        find "$prev_root" -maxdepth 4 -type f -printf '%TY-%Tm-%TdT%TH:%TM:%TSZ\t%p\n' 2>/dev/null \
          | LC_ALL=C sort > "$EVIDENCE/${previous_tag}-retained-files.txt" || true
        latest_prev="$(find "$prev_root" -mindepth 1 -maxdepth 1 -type d -printf '%T@ %p\n' 2>/dev/null \
          | sort -n | tail -n1 | cut -d' ' -f2-)"
        if [[ -n "$latest_prev" ]]; then
            find "$latest_prev" -maxdepth 3 -type f -printf '%p\n' 2>/dev/null \
              | sort > "$EVIDENCE/${previous_tag}-latest-run-files.txt" || true
            [[ -f "$latest_prev/workflow-current.txt" ]] \
              && cp "$latest_prev/workflow-current.txt" "$EVIDENCE/${previous_tag}-workflow-current.txt" || true
            [[ -f "$latest_prev/child-result.env" ]] \
              && cp "$latest_prev/child-result.env" "$EVIDENCE/${previous_tag}-child-result.txt" || true
        fi
    else
        echo "${previous_step}_RETAINED_RUN_PRESENT=false" > "$EVIDENCE/${previous_tag}-retained-files.txt"
    fi
done
router_step_phase_complete previous_failure_evidence bundled_r04_diff_and_previous_stop_evidence_captured_non_blocking

CURRENT_PHASE=independent_extract
router_step_phase_begin independent_extract
rm -rf "$FINAL_EXTRACT"; mkdir -p "$FINAL_EXTRACT"
python3 - "$BUNDLE_ZIP" "$FINAL_EXTRACT" "$STEP_ID" <<'PY'
import os
import stat
import sys
import zipfile
from pathlib import Path

archive = Path(sys.argv[1])
destination = Path(sys.argv[2]).resolve()
expected = sys.argv[3]

with zipfile.ZipFile(archive) as z:
    members = z.infolist()
    roots = set()
    safe = []
    for member in members:
        name = member.filename.replace('\\', '/')
        parts = Path(name).parts
        if not parts:
            continue
        if any(c in name for c in ('\x00', '\n', '\r', '\t')) or name.startswith('/') or '..' in parts or ':' in parts[0]:
            raise SystemExit(f'unsafe ZIP member: {member.filename!r}')
        roots.add(parts[0])
        target = (destination / name).resolve()
        if target != destination and destination not in target.parents:
            raise SystemExit(f'ZIP escape: {member.filename}')
        unix_mode = (member.external_attr >> 16) & 0xFFFF
        if unix_mode and stat.S_ISLNK(unix_mode):
            raise SystemExit(f'ZIP symlink not allowed: {member.filename}')
        if unix_mode and stat.S_IMODE(unix_mode) & 0o7000:
            raise SystemExit(f'ZIP special permission bits not allowed: {member.filename}')
        safe.append((member, target, unix_mode))
    if roots != {expected}:
        raise SystemExit(f'unexpected ZIP roots: {sorted(roots)}')
    z.extractall(destination)
    for member, target, unix_mode in safe:
        if not target.exists():
            raise SystemExit(f'extracted member missing: {member.filename}')
        if unix_mode:
            os.chmod(target, stat.S_IMODE(unix_mode))
PY
(cd "$FINAL_ROOT" && sha256sum -c manifest.sha256) | tee "$EVIDENCE/final-zip-manifest.log"
! find "$FINAL_ROOT" \( -type d -name __pycache__ -o -type f \( -name '*.pyc' -o -name '*.pyo' \) \) -print -quit | grep -q .
{
    for required in       bootstrap.sh install.sh       scripts/apply-vm130-workflow.sh scripts/build-report.py scripts/build-stop-report.py       scripts/publish-project-source.sh scripts/publish-vm130-source.sh       scripts/remote-target-syntax-proof.sh scripts/rollback-vm130-workflow.sh scripts/run-step.sh; do
        [[ -x "$FINAL_ROOT/$required" ]]
        stat -c '%a %n' "$FINAL_ROOT/$required"
    done
    while IFS= read -r test_name; do
        [[ -n "$test_name" && "$test_name" != \#* ]] || continue
        [[ -x "$FINAL_ROOT/tests/$test_name" ]]
        stat -c '%a %n' "$FINAL_ROOT/tests/$test_name"
    done < "$FINAL_ROOT/tests/mandatory.list"
} | tee "$EVIDENCE/independent-extract-modes.log"
router_step_phase_complete independent_extract final_zip_hashes_and_executable_modes_verified

CURRENT_PHASE=mandatory_tests
router_step_phase_begin mandatory_tests
: > "$MANDATORY_LOG"
while IFS= read -r test_name; do
    [[ -n "$test_name" && "$test_name" != \#* ]] || continue
    echo ">>> mandatory $test_name" | tee -a "$MANDATORY_LOG"
    set +e
    BUNDLE_ROOT="$FINAL_ROOT" bash "$FINAL_ROOT/tests/$test_name" >> "$MANDATORY_LOG" 2>&1
    test_rc=$?
    set -e
    tail -n 20 "$MANDATORY_LOG"
    [[ "$test_rc" -eq 0 ]] || { echo "MANDATORY_TEST=$test_name"; return_rc="$test_rc"; false; }
done < "$FINAL_ROOT/tests/mandatory.list"
router_step_phase_complete mandatory_tests outer_safe_matrix_repeated_with_explicit_bash

CURRENT_PHASE=full_shared_selftest
router_step_phase_begin full_shared_selftest
rm -rf "$RUN_DIR/full-selftest-stage"; mkdir -p "$RUN_DIR/full-selftest-stage"
tar -xzf "$FINAL_ROOT/payload/vm130-workflow-target-package.tar.gz" -C "$RUN_DIR/full-selftest-stage"
ROUTER_OPS_BASE="$RUN_DIR/full-selftest-stage" \
  "$RUN_DIR/full-selftest-stage/bin/router-workflow-r20qu-selftest" "$RUN_DIR/full-selftest" \
  | tee "$FULL_SELFTEST_LOG"
grep -Fqx RESULT=PASS_ROUTER_WORKFLOW_R20QU_SELFTEST "$FULL_SELFTEST_LOG"
ROUTER_R20QU_SELFTEST_SKIP_NESTED_DETACHED=true \
  "$RUN_DIR/full-selftest-stage/libexec/router-bundle-gate-r17" "$FINAL_ROOT" \
  | tee "$EVIDENCE/staged-new-gate.log"
"$RUN_DIR/full-selftest-stage/bin/router-bundle-policy-r19" "$FINAL_ROOT" \
  | tee "$EVIDENCE/staged-new-policy.log"
router_step_phase_complete full_shared_selftest actual_worker_pid_tracking_nested_detach_failure_archive_and_new_gate_proven

CURRENT_PHASE=apply
router_step_phase_begin apply
apply_child() {
    BUNDLE_ROOT="$FINAL_ROOT" "$FINAL_ROOT/scripts/apply-vm130-workflow.sh" \
      "$TARGET_PACKAGE_SHA256" "$RUN_DIR"
}
set +e
router_core_boundary_run "$APPLY_LOG" -- apply_child
BOUNDARY_RC=$?
set -e
[[ -f "$RUN_DIR/apply-state.env" ]] && source "$RUN_DIR/apply-state.env"
[[ -f "$RUN_DIR/backup/live-pre-change.tar.gz" ]] && BACKUP_READY=true
CORE_CHANGE_COMPLETE="${ROUTER_CORE_CHANGE_COMPLETE:-${CORE_CHANGE_COMPLETE:-false}}"
if [[ "$BOUNDARY_RC" -ne 0 || "${ROUTER_CORE_CHILD_RC:-1}" -ne 0 ]]; then false; fi
[[ "$CORE_CHANGE_COMPLETE" == true ]]
ROLLBACK_STATUS=not_needed_core_complete
router_step_phase_complete apply shared_vm130_workflow_exact_target_state_and_selftests_passed

CURRENT_PHASE=source_publication
router_step_phase_begin source_publication
BUNDLE_ROOT="$FINAL_ROOT" "$FINAL_ROOT/scripts/publish-vm130-source.sh" "$RUN_DIR" "$SOURCE_ENV" | tee "$EVIDENCE/source-publication.log"
grep -Fqx RESULT=PASS_R20QUA1_R07_VM130_SOURCE_PUBLICATION "$SOURCE_ENV"
router_step_phase_complete source_publication fresh_complete_78_file_vm130_source_published

CURRENT_PHASE=project_source
router_step_phase_begin project_source
BUNDLE_ROOT="$FINAL_ROOT" "$FINAL_ROOT/scripts/publish-project-source.sh" "$RUN_DIR" "$SOURCE_ENV" "$PROJECT_ENV" | tee "$EVIDENCE/project-source-publication.log"
grep -Fqx RESULT=PASS_R20QUA1_R07_PROJECT_SOURCE_PUBLICATION "$PROJECT_ENV"
router_step_phase_complete project_source r20qua1_r07_project_sources_published

CURRENT_PHASE=report_build
router_step_phase_begin report_build
INSTALLER_SHA="$(cat "$FINAL_ROOT/installer.sha256")"
python3 "$FINAL_ROOT/scripts/build-report.py" "$RUN_DIR" "$REPORT" "$INSTALLER_SHA" "$SOURCE_ENV" "$PROJECT_ENV"
cp "$FINAL_ROOT/scripts/run-step.sh" "$REPORT/executed-step.sh"
cp "$FINAL_ROOT/release-info.json" "$REPORT/release-info.json"
cp "$FINAL_ROOT/installer.sha256" "$REPORT/installer.sha256"
cp "$FINAL_ROOT/manifest.sha256" "$REPORT/bundle-manifest.sha256"
cp "$FINAL_ROOT/scripts/rollback-vm130-workflow.sh" "$REPORT/rollback.sh"
cp "$CURRENT" "$REPORT/workflow-current.txt"
cp "$EVENTS" "$REPORT/workflow-events.tsv"
cp "$MANDATORY_LOG" "$REPORT/mandatory-tests.log"
cp "$FULL_SELFTEST_LOG" "$REPORT/full-shared-selftest.log"
cp "$EVIDENCE/staged-new-gate.log" "$REPORT/staged-new-gate.log"
cp "$EVIDENCE/staged-new-policy.log" "$REPORT/staged-new-policy.log"
cp "$EVIDENCE/independent-extract-modes.log" "$REPORT/independent-extract-modes.log"
cp "$APPLY_LOG" "$REPORT/apply.log"
cp "$FINAL_ROOT/reference/r04-live-source-diff.txt" "$REPORT/r04-live-source-diff.txt"
cp "$RUN_DIR/current-vm130-managed-source.sha256" "$REPORT/current-vm130-managed-source.sha256"
cp "$RUN_DIR/removed-bytecode.txt" "$REPORT/removed-bytecode.txt"
cp "$RUN_DIR/vm130-source-publication/vm130-source-manifest.sha256" "$REPORT/vm130-source-manifest.sha256"
router_step_phase_complete report_build final_pass_report_payload_built

CURRENT_PHASE=report_publish
router_step_phase_begin report_publish
router_step_publish_payload \
  step050m07r20qua1_r07_vm130_shared_workflow_hardening_continuation \
  "$REPORT" "$PUBLIC_PAYLOAD" "$CURRENT" "$EVENTS" "$FINAL_ENV" \
  "$REPORT/report.txt" report.txt \
  "$REPORT/facts.json" facts.json \
  "$REPORT/facts-public.html" facts-public.html \
  "$REPORT/verify-public.html" verify-public.html \
  "$REPORT/rollback-public.html" rollback-public.html \
  "$REPORT/verify.txt" verify.txt \
  "$REPORT/executed-step.sh" executed-step.sh \
  "$REPORT/release-info.json" release-info.json \
  "$REPORT/installer.sha256" installer.sha256 \
  "$REPORT/bundle-manifest.sha256" bundle-manifest.sha256 \
  "$REPORT/rollback.sh" rollback.sh \
  "$REPORT/workflow-current.txt" workflow-current.txt \
  "$REPORT/workflow-events.tsv" workflow-events.tsv \
  "$REPORT/mandatory-tests.log" mandatory-tests.log \
  "$REPORT/full-shared-selftest.log" full-shared-selftest.log \
  "$REPORT/staged-new-gate.log" staged-new-gate.log \
  "$REPORT/staged-new-policy.log" staged-new-policy.log \
  "$REPORT/independent-extract-modes.log" independent-extract-modes.log \
  "$REPORT/apply.log" apply.log \
  "$REPORT/r04-live-source-diff.txt" r04-live-source-diff.txt \
  "$REPORT/current-vm130-managed-source.sha256" current-vm130-managed-source.sha256 \
  "$REPORT/removed-bytecode.txt" removed-bytecode.txt \
  "$REPORT/vm130-source-manifest.sha256" vm130-source-manifest.sha256
router_step_phase_complete report_publish pass_step_report_published_and_http_verified
STOP_REPORT_URL="$(awk -F= '$1=="PUBLIC_URL"{print substr($0,index($0,"=")+1)}' "$FINAL_ENV" | tail -n1)"

CURRENT_PHASE=archive
router_step_phase_begin archive
archive_latest_best_effort
[[ "$LATEST_ARCHIVE" != not_created && -f "$LATEST_ARCHIVE" ]]
router_step_phase_complete archive latest_python_zip_created
router_step_workflow_mark_complete
trap - ERR
source "$SOURCE_ENV"
source "$PROJECT_ENV"
write_child_result PASS_R20QUA1_VM130_SHARED_WORKFLOW_HARDENED 0
cat "$FINAL_ENV"
echo "STEP_REPORT_URL=$STOP_REPORT_URL"
cat "$REPORT/report.txt"
echo "LATEST_ARCHIVE=$LATEST_ARCHIVE"
echo "LATEST_ARCHIVE_SHA256=$LATEST_ARCHIVE_SHA256"
echo CORE_CHANGE_COMPLETE=true