#!/usr/bin/env bash
set -Eeuo pipefail
umask 077
BASE="${ROUTER_OPS_BASE:-/opt/router-ops}"
ROOT="${BUNDLE_ROOT:?}"
RUN_DIR="${ROUTER_DETACHED_RUN_DIR:?}"
CHILD_RESULT="${ROUTER_DETACHED_CHILD_RESULT:?}"
INCOMING="${ROUTER_STEP_INCOMING:-/home/ops/incoming}"
SELFTEST="${ROUTER_EXACT_WORKER_SELFTEST:-false}"
CASE=pass
if [[ "$SELFTEST" == true ]]; then
  case "${ROUTER_PUBLIC_ROOT:-}" in
    */fail-pre/public) CASE=fail-pre ;;
    */fail-post/public) CASE=fail-post ;;
  esac
fi

STEP=STEP_050M07P23C_R08_VM121_DOMAIN_V2_SERVICE_LAYER_AND_CREDENTIAL_FOUNDATION_CONTINUATION
R07_STEP=STEP_050M07P23C_R07_VM121_DOMAIN_V2_SERVICE_LAYER_AND_CREDENTIAL_FOUNDATION
R07_RUN_ID=20260810-174405-909695-7938
R07_RUN="/opt/router-ops/state/detached-step-runs/$R07_STEP/runs/$R07_RUN_ID"
VM121_BASE_COMMIT=e9bfa90773a8cd3c25e0e8d734c4232121272f43
VM121_ACCEPTED_TREE=a76d4084e1300c5e26a489696fb02b52e4b50fa2
VM121_ACCEPTED_COUNT=45
NEW_ADMIN_SHA=9f9dc7dd49613c9a45c27d1895eeb91a19a372a2c9cc8aad96fc755445754f1d
DOMAIN_SHA=79109ed792d0c34794a9e693d95914065515af0e23527ce90e2557ebdbbaf753
CREDENTIAL_SHA=d92bdf6746409fdb9b2fc368597273f7eb7318322bac72f56541e793c07fd35e

CURRENT="$RUN_DIR/workflow-current.txt"; EVENTS="$RUN_DIR/workflow-events.tsv"; EVIDENCE="$RUN_DIR/evidence"; REPORT="$RUN_DIR/report"; PAYLOAD="$RUN_DIR/public-payload"; FINAL_ENV="$RUN_DIR/final-publication.env"; TARGET_DIR="$RUN_DIR/target"
mkdir -p "$EVIDENCE" "$REPORT" "$PAYLOAD" "$TARGET_DIR" "$INCOMING"
chmod 700 "$EVIDENCE" "$REPORT" "$PAYLOAD" "$TARGET_DIR"
source "$BASE/lib/router-step-workflow.sh"
source <("$BASE/bin/router-release-contract" env --root "$ROOT")
router_step_workflow_init "$CURRENT" "$EVENTS" preflight retained_core live_verify machine_close postcheck report_publish archive

CORE_CHANGE_COMPLETE=true
CORE_CHANGE_REPEATED=false
SOURCE_CHANGED=true
SOURCE_CHANGE_REPEATED=false
SOURCE_ROLLBACK_STATUS=not_required
BACKEND_RECOVERY_STATUS=PASS
STOP_DETAIL=unknown
STOP_HANDLED=false
STEP_REPORT_URL=unknown
LATEST_ARCHIVE=not_created
LATEST_ARCHIVE_SHA256=unknown
VM121_NEW_COMMIT=unknown
VM121_NEW_TREE=unknown
VM121_NEW_FILE_COUNT=unknown
VM121_NEW_PUBLIC_URL=unknown

field(){ local k="$1" f="$2"; awk -F= -v k="$k" '$1==k{print substr($0,index($0,"=")+1); exit}' "$f"; }

write_child(){
  local result="$1" rc="$2" tmp="${CHILD_RESULT}.tmp.$$"
  {
    echo "RESULT=$result"
    echo "WORKER_RC=$rc"
    echo "CORE_CHANGE_COMPLETE=true"
    echo "CORE_CHANGE_REPEATED=false"
    echo "SOURCE_CHANGED=true"
    echo "SOURCE_CHANGE_REPEATED=false"
    echo "SOURCE_ROLLBACK_STATUS=not_required"
    echo "BACKEND_RECOVERY_STATUS=PASS"
    echo "STOP_DETAIL=$STOP_DETAIL"
    echo "LIVE_DATABASE_WRITTEN=false"
    echo "DATABASE_SCHEMA_CHANGED=false"
    echo "RUNTIME_PROVISIONING_ACTIVE=false"
    echo "EXTERNAL_ONBOARDING_ACTIVE=false"
    echo "VM121_NEW_COMMIT=$VM121_NEW_COMMIT"
    echo "VM121_NEW_TREE=$VM121_NEW_TREE"
    echo "VM121_NEW_FILE_COUNT=$VM121_NEW_FILE_COUNT"
    echo "VM121_NEW_PUBLIC_URL=$VM121_NEW_PUBLIC_URL"
    echo "STEP_REPORT_URL=$STEP_REPORT_URL"
    echo "LATEST_ARCHIVE=$LATEST_ARCHIVE"
    echo "LATEST_ARCHIVE_SHA256=$LATEST_ARCHIVE_SHA256"
  } > "$tmp"
  chmod 600 "$tmp"; mv "$tmp" "$CHILD_RESULT"
}

archive_latest(){
  local log="$EVIDENCE/archive.log"
  router_step_archive_latest_python "$BASE" "$INCOMING" "$(date -u +%Y%m%d-%H%M%S)" | tee "$log"
  LATEST_ARCHIVE="$(field LATEST_ARCHIVE "$log")"
  LATEST_ARCHIVE_SHA256="$(field LATEST_ARCHIVE_SHA256 "$log")"
}

write_stop_report(){
  local rc="$1" line="$2" cmd="$3"
  cat > "$REPORT/report.txt" <<REPORT_EOF
RESULT=STOP_P23C_VM121_DOMAIN_V2_SERVICE_LAYER_AND_CREDENTIAL_FOUNDATION_CONTINUATION
REVISION=R08
STOP_RC=$rc
STOP_LINE=$line
STOP_DETAIL=$STOP_DETAIL
CORE_CHANGE_COMPLETE=true
CORE_CHANGE_REPEATED=false
SOURCE_CHANGED=true
SOURCE_CHANGE_REPEATED=false
SOURCE_ROLLBACK_STATUS=not_required
BACKEND_RECOVERY_STATUS=PASS
LIVE_DATABASE_WRITTEN=false
DATABASE_SCHEMA_CHANGED=false
RUNTIME_PROVISIONING_ACTIVE=false
EXTERNAL_ONBOARDING_ACTIVE=false
R07_RUN_ID=$R07_RUN_ID
R07_ACCEPTED_TREE=$VM121_ACCEPTED_TREE
REPORT_EOF
  printf 'STOP_COMMAND=%q\n' "$cmd" >> "$REPORT/report.txt"
  cp "$REPORT/report.txt" "$REPORT/verify.txt"
  cp "$ROOT/scripts/run-step.sh" "$REPORT/executed-step.sh"
  cp "$ROOT/release-info.json" "$REPORT/release-info.json"
  cp "$ROOT/rollback/README.md" "$REPORT/rollback.txt"
}

stop_handler(){
  local rc="$1" line="$2" cmd="$3"
  trap - ERR
  [[ "$STOP_HANDLED" == false ]] || return "$rc"
  STOP_HANDLED=true
  write_stop_report "$rc" "$line" "$cmd"
  set +e
  if [[ "$SELFTEST" == true ]]; then
    DEST="${ROUTER_PUBLIC_ROOT:?}/latest/p23c-r08-$CASE-selftest"
    rm -rf "$DEST"; mkdir -p "$DEST"; cp -a "$REPORT"/. "$DEST"/
    STEP_REPORT_URL="selftest://p23c-r08-$CASE/"
    archive_latest >/dev/null 2>&1
  else
    args=()
    while IFS= read -r f; do args+=("$f" "$(basename "$f")"); done < <(find "$REPORT" -maxdepth 1 -type f -print | LC_ALL=C sort)
    router_step_publish_payload step050m07p23c_r08_vm121_domain_v2_service_layer_and_credential_foundation_continuation_stop "$REPORT" "$PAYLOAD" "$CURRENT" "$EVENTS" "$FINAL_ENV" "${args[@]}" >/dev/null 2>&1 || true
    [[ -f "$FINAL_ENV" ]] && STEP_REPORT_URL="$(field PUBLIC_URL "$FINAL_ENV")"
    archive_latest >/dev/null 2>&1
  fi
  set -e
  write_child STOP_P23C_VM121_DOMAIN_V2_SERVICE_LAYER_AND_CREDENTIAL_FOUNDATION_CONTINUATION "$rc"
  return "$rc"
}
trap 'rc=$?; stop_handler "$rc" "$LINENO" "$BASH_COMMAND"; exit "$rc"' ERR

write_selftest_retained(){
  cat > "$EVIDENCE/r07-service-foundation.txt" <<'EOR'
RESULT=PASS_P23C_CANDIDATE_COMPILE
EMAIL_NORMALIZATION=PASS
RESULT=PASS_P23C_DOMAIN_V2_SERVICE_LAYER_FIXTURE
ALEMBIC_VERSION=0003_domain_v2_schema
BUSINESS_ROWS_BEFORE=0
BUSINESS_ROWS_AFTER=0
EGRESS_TARGET_COUNT=5
EGRESS_ALLOCATOR_COUNT=14
ADMIN_SHA256=9f9dc7dd49613c9a45c27d1895eeb91a19a372a2c9cc8aad96fc755445754f1d
DOMAIN_V2_SERVICE_SHA256=79109ed792d0c34794a9e693d95914065515af0e23527ce90e2557ebdbbaf753
CREDENTIAL_CRYPTO_SHA256=d92bdf6746409fdb9b2fc368597273f7eb7318322bac72f56541e793c07fd35e
LEGACY_ADMIN_WRITERS_FENCED=true
LEGACY_ADMIN_WRITER_FENCE_VERIFICATION=non_mutating_runtime_introspection
MUTATING_HTTP_FENCE_PROBES=false
BACKEND_GENERATION_CHANGED=true
BACKEND_STARTED_AT_BEFORE=2026-08-10T17:44:10Z
BACKEND_STARTED_AT_AFTER=2026-08-10T17:44:20Z
BACKEND_PID_BEFORE=100
BACKEND_PID_AFTER=200
DOMAIN_V2_SERVICE_FIXTURE=PASS
CORE_SOURCE_CHANGE_COMPLETE=true
SOURCE_CHANGED=true
SOURCE_ROLLBACK_STATUS=not_required
BACKEND_RECOVERY_STATUS=PASS
LIVE_DATABASE_WRITTEN=false
DATABASE_SCHEMA_CHANGED=false
RUNTIME_PROVISIONING_ACTIVE=false
EXTERNAL_ONBOARDING_ACTIVE=false
RESULT=PASS_P23C_VM121_DOMAIN_V2_SERVICE_LAYER_AND_CREDENTIAL_FOUNDATION
EOR
  cat > "$EVIDENCE/r07-result.env" <<'EOR'
RESULT=STOP_P23C_VM121_DOMAIN_V2_SERVICE_LAYER_AND_CREDENTIAL_FOUNDATION
WORKER_RC=1
CORE_CHANGE_COMPLETE=true
CORE_CHANGE_REPEATED=false
SOURCE_CHANGED=true
SOURCE_ROLLBACK_STATUS=not_required
BACKEND_RECOVERY_STATUS=PASS
STOP_DETAIL=service_foundation_semantics
LIVE_DATABASE_WRITTEN=false
DATABASE_SCHEMA_CHANGED=false
RUNTIME_PROVISIONING_ACTIVE=false
EXTERNAL_ONBOARDING_ACTIVE=false
EOR
  if [[ "$CASE" == fail-pre ]]; then
    sed -i 's/RESULT=PASS_P23C_VM121_DOMAIN_V2_SERVICE_LAYER_AND_CREDENTIAL_FOUNDATION$/RESULT=STOP_BROKEN_RETAINED/' "$EVIDENCE/r07-service-foundation.txt"
  fi
}

validate_r07_result_env(){
  local f="$1"
  [[ "$(field RESULT "$f")" == STOP_P23C_VM121_DOMAIN_V2_SERVICE_LAYER_AND_CREDENTIAL_FOUNDATION ]]
  [[ "$(field CORE_CHANGE_COMPLETE "$f")" == true ]]
  [[ "$(field CORE_CHANGE_REPEATED "$f")" == false ]]
  [[ "$(field SOURCE_CHANGED "$f")" == true ]]
  [[ "$(field SOURCE_ROLLBACK_STATUS "$f")" == not_required ]]
  [[ "$(field BACKEND_RECOVERY_STATUS "$f")" == PASS ]]
  [[ "$(field STOP_DETAIL "$f")" == service_foundation_semantics ]]
  [[ "$(field LIVE_DATABASE_WRITTEN "$f")" == false ]]
  [[ "$(field DATABASE_SCHEMA_CHANGED "$f")" == false ]]
  echo RESULT=PASS_P23C_R08_RETAINED_R07_STOP_CLASSIFICATION
}

write_selftest_source_pre(){
cat <<SRC_EOF
MODE=--check
MACHINE_ID=vm121
LOCAL_HEAD=$VM121_BASE_COMMIT
REMOTE_HEAD=$VM121_BASE_COMMIT
STAGED_CHANGE_COUNT=3
SIMULATED_TREE_SHA=$VM121_ACCEPTED_TREE
SIMULATED_TREE_FILE_COUNT=$VM121_ACCEPTED_COUNT
RESULT=PASS_VM121_GIT_PUBLISH_CHECK
MACHINE_ID=vm121
GIT_COMMIT=$VM121_BASE_COMMIT
GIT_TREE=$VM121_ACCEPTED_TREE
GIT_FILE_COUNT=$VM121_ACCEPTED_COUNT
COMMIT_CREATED=false
PUSH_PERFORMED=false
SRC_EOF
}

collect_source_pre(){
  if [[ "$SELFTEST" == true ]]; then
    write_selftest_source_pre > "$EVIDENCE/pre-vm121-source.txt"
  else
    ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 /bin/bash -s > "$EVIDENCE/pre-vm121-source.txt" 2>&1 <<'VM121'
set -euo pipefail
/usr/local/sbin/router-vm121-git-publish.sh --check
VM121
  fi
  "$ROOT/scripts/source-check-validate.sh" vm121 "$EVIDENCE/pre-vm121-source.txt" "$VM121_BASE_COMMIT" "$VM121_ACCEPTED_TREE" "$VM121_ACCEPTED_COUNT" 3 > "$EVIDENCE/pre-vm121-source-validation.txt"
}

write_selftest_live(){
cat <<LIVE_EOF
ALEMBIC_VERSION=0003_domain_v2_schema
BUSINESS_ROWS=0
EGRESS_TARGET_COUNT=5
EGRESS_ALLOCATOR_COUNT=14
ADMIN_SHA256=$NEW_ADMIN_SHA
DOMAIN_V2_SERVICE_SHA256=$DOMAIN_SHA
CREDENTIAL_CRYPTO_SHA256=$CREDENTIAL_SHA
BACKEND_HEALTH=PASS
LEGACY_ADMIN_WRITER_FENCE_SOURCE=true
LEGACY_ADMIN_WRITER_FENCE_RUNTIME=true
MUTATING_HTTP_FENCE_PROBES=false
RUNTIME_PROVISIONING_ACTIVE=false
EXTERNAL_ONBOARDING_ACTIVE=false
LIVE_EOF
}

collect_live(){
  local out="$1"
  if [[ "$SELFTEST" == true ]]; then
    write_selftest_live > "$out"
  else
    ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 /bin/bash -s > "$out" 2>&1 <<'VM121LIVE'
set -euo pipefail
PG=wgaccess-postgres
PGUSER="$(docker exec "$PG" sh -lc 'printf %s "$POSTGRES_USER"')"
PGDB="$(docker exec "$PG" sh -lc 'printf %s "$POSTGRES_DB"')"
q(){ docker exec "$PG" psql -v ON_ERROR_STOP=1 -U "$PGUSER" -d "$PGDB" -Atqc "$1"; }
echo "ALEMBIC_VERSION=$(q 'SELECT version_num FROM alembic_version')"
echo "BUSINESS_ROWS=$(q "SELECT
 (SELECT count(*) FROM users)+
 (SELECT count(*) FROM plans)+
 (SELECT count(*) FROM access_grants)+
 (SELECT count(*) FROM access_grant_protocol_limits)+
 (SELECT count(*) FROM invites)+
 (SELECT count(*) FROM invite_redemptions)+
 (SELECT count(*) FROM magic_link_tokens)+
 (SELECT count(*) FROM auth_sessions)+
 (SELECT count(*) FROM connection_profiles)+
 (SELECT count(*) FROM peer_credentials)+
 (SELECT count(*) FROM audit_events)+
 (SELECT count(*) FROM invite_codes)+
 (SELECT count(*) FROM orders)+
 (SELECT count(*) FROM subscriptions)+
 (SELECT count(*) FROM peers)+
 (SELECT count(*) FROM provisioning_jobs)+
 (SELECT count(*) FROM peer_egress_leases)")"
echo "EGRESS_TARGET_COUNT=$(q 'SELECT count(*) FROM egress_targets')"
echo "EGRESS_ALLOCATOR_COUNT=$(q 'SELECT count(*) FROM egress_allocator_settings')"
echo "ADMIN_SHA256=$(sha256sum /opt/wg-access/backend/app/api/admin.py | awk '{print $1}')"
echo "DOMAIN_V2_SERVICE_SHA256=$(sha256sum /opt/wg-access/backend/app/services/domain_v2.py | awk '{print $1}')"
echo "CREDENTIAL_CRYPTO_SHA256=$(sha256sum /opt/wg-access/backend/app/services/credential_crypto.py | awk '{print $1}')"
if curl -fsS --max-time 5 http://127.0.0.1:18080/health >/dev/null && curl -fsS --max-time 5 http://127.0.0.1:18080/health/db >/dev/null; then echo BACKEND_HEALTH=PASS; else echo BACKEND_HEALTH=FAIL; exit 1; fi
grep -Fq 'require_legacy_domain_v1_writer_retired' /opt/wg-access/backend/app/api/admin.py && echo LEGACY_ADMIN_WRITER_FENCE_SOURCE=true || { echo LEGACY_ADMIN_WRITER_FENCE_SOURCE=false; exit 1; }
docker exec -i wgaccess-backend python - <<'PY_FENCE'
from fastapi import HTTPException
from fastapi.routing import APIRoute
from app.main import app
from app.api.admin import require_legacy_domain_v1_writer_retired
try:
    require_legacy_domain_v1_writer_retired()
except HTTPException as exc:
    assert exc.status_code == 410
else:
    raise SystemExit(1)
targets={('POST','/admin/invites'),('POST','/admin/subscriptions'),('POST','/admin/subscriptions/{subscription_id}/cancel'),('POST','/admin/peers/{peer_id}/disable')}
def iter_effective_api_routes(routes):
    for route in routes:
        if isinstance(route, APIRoute):
            yield route
            continue
        original_router=getattr(route,'original_router',None)
        if original_router is not None:
            yield from iter_effective_api_routes(original_router.routes)
found=set()
for route in iter_effective_api_routes(app.router.routes):
    deps={getattr(dep.call,'__name__','') for dep in route.dependant.dependencies}
    for method in route.methods:
        key=(method,route.path)
        if key in targets:
            assert 'require_legacy_domain_v1_writer_retired' in deps
            found.add(key)
assert found == targets
print('LEGACY_ADMIN_WRITER_FENCE_RUNTIME=true')
PY_FENCE
echo MUTATING_HTTP_FENCE_PROBES=false
echo RUNTIME_PROVISIONING_ACTIVE=false
echo EXTERNAL_ONBOARDING_ACTIVE=false
VM121LIVE
  fi
  "$ROOT/scripts/live-semantics-validate.sh" "$out" > "${out%.txt}-validation.txt"
}

write_selftest_machine_close(){
  [[ "$CASE" != fail-post ]] || return 1
  cat <<CLOSE_EOF
RESULT=PASS_VM121_GIT_PUBLISH
MACHINE=vm121
COMMIT=1111111111111111111111111111111111111111
TREE=$VM121_ACCEPTED_TREE
GIT_FILE_COUNT=$VM121_ACCEPTED_COUNT
VM121_PUBLIC_URL=https://reports.example/latest/vm121/
RESULT=PASS_ROUTER_MACHINE_CLOSE
CLOSE_EOF
}

write_selftest_post_source(){
cat <<POST_EOF
MODE=--check
MACHINE_ID=vm121
LOCAL_HEAD=1111111111111111111111111111111111111111
REMOTE_HEAD=1111111111111111111111111111111111111111
STAGED_CHANGE_COUNT=0
SIMULATED_TREE_SHA=$VM121_ACCEPTED_TREE
SIMULATED_TREE_FILE_COUNT=$VM121_ACCEPTED_COUNT
RESULT=PASS_VM121_GIT_PUBLISH_CHECK
MACHINE_ID=vm121
GIT_COMMIT=1111111111111111111111111111111111111111
GIT_TREE=$VM121_ACCEPTED_TREE
GIT_FILE_COUNT=$VM121_ACCEPTED_COUNT
COMMIT_CREATED=false
PUSH_PERFORMED=false
POST_EOF
}

router_step_phase_begin preflight
PKG="$ROOT/$ROUTER_RELEASE_TARGET_PACKAGE_PATH"
[[ "$(sha256sum "$PKG" | awk '{print $1}')" == "$ROUTER_RELEASE_TARGET_PACKAGE_SHA256" ]] || { STOP_DETAIL=target_package_identity; false; }
if [[ "$SELFTEST" == true ]]; then
  write_selftest_retained
else
  [[ -f "$R07_RUN/evidence/service-foundation.txt" ]] || { STOP_DETAIL=r07_service_evidence_missing; false; }
  [[ -f "$R07_RUN/result.env" ]] || { STOP_DETAIL=r07_result_missing; false; }
  cp "$R07_RUN/evidence/service-foundation.txt" "$EVIDENCE/r07-service-foundation.txt"
  cp "$R07_RUN/result.env" "$EVIDENCE/r07-result.env"
fi
"$ROOT/scripts/service-foundation-validate.sh" "$EVIDENCE/r07-service-foundation.txt" > "$EVIDENCE/r07-service-foundation-validation.txt" || { STOP_DETAIL=r07_retained_service_semantics; false; }
validate_r07_result_env "$EVIDENCE/r07-result.env" > "$EVIDENCE/r07-result-validation.txt" || { STOP_DETAIL=r07_retained_stop_classification; false; }
collect_source_pre || { STOP_DETAIL=pre_vm121_accepted_tree; false; }
router_step_phase_complete preflight retained_r07_core_and_exact_unpublished_tree_verified

router_step_phase_begin retained_core
router_step_phase_complete retained_core r07_semantic_core_accepted_without_repetition

router_step_phase_begin live_verify
collect_live "$EVIDENCE/preclose-live.txt" || { STOP_DETAIL=preclose_live_semantics; false; }
router_step_phase_complete live_verify current_live_source_backend_db_and_fence_semantics_verified_readonly

router_step_phase_begin machine_close
close_rc=0
if [[ "$SELFTEST" == true ]]; then
  if write_selftest_machine_close > "$EVIDENCE/vm121-machine-close.txt"; then close_rc=0; else close_rc=$?; fi
else
  if "$BASE/bin/router-machine-close-safe" vm121 "$STEP: continuation after R07 semantic core; close accepted Domain V2 service/credential source" > "$EVIDENCE/vm121-machine-close.txt" 2>&1; then close_rc=0; else close_rc=$?; fi
fi
if [[ "$close_rc" -ne 0 ]]; then STOP_DETAIL=machine_close_after_retained_core; false; fi
"$ROOT/scripts/machine-close-validate.sh" "$EVIDENCE/vm121-machine-close.txt" "$VM121_ACCEPTED_TREE" "$VM121_ACCEPTED_COUNT" > "$EVIDENCE/vm121-machine-close-validation.txt" || { STOP_DETAIL=machine_close_semantics; false; }
VM121_NEW_COMMIT="$(field VM121_NEW_COMMIT "$EVIDENCE/vm121-machine-close-validation.txt")"
VM121_NEW_TREE="$(field VM121_NEW_TREE "$EVIDENCE/vm121-machine-close-validation.txt")"
VM121_NEW_FILE_COUNT="$(field VM121_NEW_FILE_COUNT "$EVIDENCE/vm121-machine-close-validation.txt")"
VM121_NEW_PUBLIC_URL="$(field VM121_NEW_PUBLIC_URL "$EVIDENCE/vm121-machine-close-validation.txt")"
router_step_phase_complete machine_close accepted_source_closed_and_published

router_step_phase_begin postcheck
if [[ "$SELFTEST" == true ]]; then
  write_selftest_post_source > "$EVIDENCE/post-vm121-source.txt"
else
  ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 /bin/bash -s > "$EVIDENCE/post-vm121-source.txt" 2>&1 <<'VM121POST'
set -euo pipefail
/usr/local/sbin/router-vm121-git-publish.sh --check
VM121POST
fi
"$ROOT/scripts/source-check-validate.sh" vm121 "$EVIDENCE/post-vm121-source.txt" "$VM121_NEW_COMMIT" "$VM121_ACCEPTED_TREE" "$VM121_ACCEPTED_COUNT" 0 > "$EVIDENCE/post-vm121-source-validation.txt" || { STOP_DETAIL=post_source; false; }
collect_live "$EVIDENCE/postclose-live.txt" || { STOP_DETAIL=post_live_semantics; false; }
router_step_phase_complete postcheck new_commit_exact_tree_clean_index_and_live_semantics_verified

cat > "$REPORT/report.txt" <<REPORT_EOF
RESULT=PASS_P23C_VM121_DOMAIN_V2_SERVICE_LAYER_AND_CREDENTIAL_FOUNDATION
REVISION=R08
CONTINUATION_ONLY=true
R07_RUN_ID=$R07_RUN_ID
R07_FALSE_STOP_CAUSE=service_foundation_validator_used_first_RESULT_from_composite_log
R07_RETAINED_FINAL_RESULT=PASS_P23C_VM121_DOMAIN_V2_SERVICE_LAYER_AND_CREDENTIAL_FOUNDATION
R07_RETAINED_CORE_SOURCE_CHANGE_COMPLETE=true
R07_RETAINED_SERVICE_FIXTURE=PASS
R07_RETAINED_BACKEND_GENERATION_CHANGED=true
CORE_CHANGE_COMPLETE=true
CORE_CHANGE_REPEATED=false
SOURCE_CHANGED=true
SOURCE_CHANGE_REPEATED=false
SOURCE_ROLLBACK_STATUS=not_required
BACKEND_RECOVERY_STATUS=PASS
LIVE_DATABASE_WRITTEN=false
DATABASE_SCHEMA_CHANGED=false
ALEMBIC_VERSION=0003_domain_v2_schema
BUSINESS_ROWS=0
EGRESS_TARGET_COUNT=5
EGRESS_ALLOCATOR_COUNT=14
LEGACY_ADMIN_WRITERS_FENCED=true
LEGACY_ADMIN_WRITER_FENCE_VERIFICATION=non_mutating_runtime_introspection
MUTATING_HTTP_FENCE_PROBES=false
DOMAIN_V2_SERVICE_FIXTURE=PASS
NORMALIZED_VERIFIED_IDENTITY_PRIMITIVE=true
ACCESS_GRANT_PROTOCOL_QUOTA_PRIMITIVE=true
QUOTA_RACE_SERIALIZATION_PROVED=true
PROVISIONING_JOB_IDEMPOTENCY_PRIMITIVE=true
AUDIT_PRIMITIVE=true
CREDENTIAL_AES256_GCM_VERSIONED_ENVELOPE=true
CREDENTIAL_REVISION_STORAGE_PRIMITIVE=true
RUNTIME_PROVISIONING_ACTIVE=false
EXTERNAL_ONBOARDING_ACTIVE=false
VM121_BASE_COMMIT=$VM121_BASE_COMMIT
VM121_COMMIT=$VM121_NEW_COMMIT
VM121_TREE=$VM121_NEW_TREE
VM121_FILE_COUNT=$VM121_NEW_FILE_COUNT
VM121_PUBLIC_URL=$VM121_NEW_PUBLIC_URL
PROJECT_SOURCES_CHECKPOINT=AFTER_P22B
RUNTIME_IMPACT=false
COPY_VERIFY=PASS
R04_CLEAN_BASELINE_RECOVERY=PASS
R08_COMPOSITE_RESULT_LAST_ORACLE=true
NEXT_ACTION=P23D production credential master-key deployment/backup/rotation foundation; no external onboarding
REPORT_EOF

cp "$REPORT/report.txt" "$REPORT/verify.txt"
cp "$ROOT/scripts/run-step.sh" "$REPORT/executed-step.sh"
cp "$ROOT/release-info.json" "$REPORT/release-info.json"
cp "$ROOT/manifest.sha256" "$REPORT/bundle-manifest.sha256"
cp "$ROOT/rollback/README.md" "$REPORT/rollback.txt"
cp "$EVIDENCE/r07-service-foundation-validation.txt" "$REPORT/"
cp "$EVIDENCE/r07-result-validation.txt" "$REPORT/"
cp "$EVIDENCE/pre-vm121-source-validation.txt" "$REPORT/"
cp "$EVIDENCE/preclose-live-validation.txt" "$REPORT/"
cp "$EVIDENCE/vm121-machine-close-validation.txt" "$REPORT/"
cp "$EVIDENCE/post-vm121-source-validation.txt" "$REPORT/"
cp "$EVIDENCE/postclose-live-validation.txt" "$REPORT/"

router_step_phase_begin report_publish
if [[ "$SELFTEST" == true ]]; then
  DEST="${ROUTER_PUBLIC_ROOT:?}/latest/p23c-r08-selftest"
  rm -rf "$DEST"; mkdir -p "$DEST"; cp -a "$REPORT"/. "$DEST"/
  STEP_REPORT_URL=selftest://p23c-r08/
else
  args=()
  while IFS= read -r f; do args+=("$f" "$(basename "$f")"); done < <(find "$REPORT" -maxdepth 1 -type f -print | LC_ALL=C sort)
  router_step_publish_payload step050m07p23c_r08_vm121_domain_v2_service_layer_and_credential_foundation_continuation "$REPORT" "$PAYLOAD" "$CURRENT" "$EVENTS" "$FINAL_ENV" "${args[@]}"
  STEP_REPORT_URL="$(field PUBLIC_URL "$FINAL_ENV")"
fi
router_step_phase_complete report_publish continuation_report_published

router_step_phase_begin archive
archive_latest
router_step_phase_complete archive latest_created
router_step_workflow_mark_complete
trap - ERR
STOP_DETAIL=none
write_child PASS_P23C_VM121_DOMAIN_V2_SERVICE_LAYER_AND_CREDENTIAL_FOUNDATION 0
cat "$REPORT/report.txt"
echo "STEP_REPORT_URL=$STEP_REPORT_URL"
echo "LATEST_ARCHIVE=$LATEST_ARCHIVE"
echo "LATEST_ARCHIVE_SHA256=$LATEST_ARCHIVE_SHA256"