#!/usr/bin/env bash
set -Eeuo pipefail
umask 077
BASE="${ROUTER_OPS_BASE:-/opt/router-ops}"; ROOT="${BUNDLE_ROOT:?}"; RUN_DIR="${ROUTER_DETACHED_RUN_DIR:?}"; CHILD_RESULT="${ROUTER_DETACHED_CHILD_RESULT:?}"; INCOMING="${ROUTER_STEP_INCOMING:-/home/ops/incoming}"; SELFTEST="${ROUTER_EXACT_WORKER_SELFTEST:-false}"
CASE=pass; if [[ "$SELFTEST" == true ]]; then case "${ROUTER_PUBLIC_ROOT:-}" in */fail-source/public) CASE=fail-source;; */fail-apply/public) CASE=fail-apply;; esac; fi
STEP=STEP_050M07P23D_R02_VM121_PRODUCTION_CREDENTIAL_KEY_BOUNDARY
BASE_COMMIT=ae3248d60c77b588918f1d330cc53b8f32d886c8; BASE_TREE=4083cc0983b9ecf3549ad334fa939b0559467d56; BASE_COUNT=45; EXPECTED_TREE=86e95cd2009466266a338a548cea5e3b6122a2bd; EXPECTED_COUNT=46
CURRENT="$RUN_DIR/workflow-current.txt"; EVENTS="$RUN_DIR/workflow-events.tsv"; EVIDENCE="$RUN_DIR/evidence"; REPORT="$RUN_DIR/report"; PAYLOAD="$RUN_DIR/public-payload"; FINAL_ENV="$RUN_DIR/final-publication.env"; TARGET_DIR="$RUN_DIR/target"
mkdir -p "$EVIDENCE" "$REPORT" "$PAYLOAD" "$TARGET_DIR" "$INCOMING"; chmod 700 "$EVIDENCE" "$REPORT" "$PAYLOAD" "$TARGET_DIR"
source "$BASE/lib/router-step-workflow.sh"; source <("$BASE/bin/router-release-contract" env --root "$ROOT"); router_step_workflow_init "$CURRENT" "$EVENTS" preflight apply machine_close postcheck report_publish archive
CORE_CHANGE_COMPLETE=false; CORE_CHANGE_REPEATED=false; SOURCE_CHANGED=false; SOURCE_ROLLBACK_STATUS=not_required; BACKEND_RECOVERY_STATUS=not_required; PRODUCTION_MASTER_KEY_CREATED=false; PRODUCTION_SECRET_PATH_SELECTED=false; STOP_DETAIL=unknown; STOP_HANDLED=false; STEP_REPORT_URL=unknown; LATEST_ARCHIVE=not_created; LATEST_ARCHIVE_SHA256=unknown; VM121_NEW_COMMIT=unknown; VM121_NEW_TREE=unknown; VM121_NEW_FILE_COUNT=unknown; VM121_NEW_PUBLIC_URL=unknown; REMOTE_STAGE=unknown; REMOTE_PKG=unknown
last_field(){ local k="$1" f="$2"; awk -F= -v k="$k" '$1==k{v=substr($0,index($0,"=")+1)} END{print v}' "$f"; }
write_child(){ local result="$1" rc="$2" tmp="${CHILD_RESULT}.tmp.$$"; { echo RESULT="$result"; echo WORKER_RC="$rc"; echo CORE_CHANGE_COMPLETE="$CORE_CHANGE_COMPLETE"; echo CORE_CHANGE_REPEATED="$CORE_CHANGE_REPEATED"; echo SOURCE_CHANGED="$SOURCE_CHANGED"; echo SOURCE_ROLLBACK_STATUS="$SOURCE_ROLLBACK_STATUS"; echo BACKEND_RECOVERY_STATUS="$BACKEND_RECOVERY_STATUS"; echo PRODUCTION_MASTER_KEY_CREATED="$PRODUCTION_MASTER_KEY_CREATED"; echo PRODUCTION_SECRET_PATH_SELECTED="$PRODUCTION_SECRET_PATH_SELECTED"; echo STOP_DETAIL="$STOP_DETAIL"; echo LIVE_DATABASE_WRITTEN=false; echo DATABASE_SCHEMA_CHANGED=false; echo RUNTIME_PROVISIONING_ACTIVE=false; echo EXTERNAL_ONBOARDING_ACTIVE=false; echo VM121_COMMIT="$VM121_NEW_COMMIT"; echo VM121_TREE="$VM121_NEW_TREE"; echo VM121_FILE_COUNT="$VM121_NEW_FILE_COUNT"; echo VM121_PUBLIC_URL="$VM121_NEW_PUBLIC_URL"; echo STEP_REPORT_URL="$STEP_REPORT_URL"; echo LATEST_ARCHIVE="$LATEST_ARCHIVE"; echo LATEST_ARCHIVE_SHA256="$LATEST_ARCHIVE_SHA256"; } > "$tmp"; chmod 600 "$tmp"; mv "$tmp" "$CHILD_RESULT"; }
archive_latest(){ local log="$EVIDENCE/archive.log"; router_step_archive_latest_python "$BASE" "$INCOMING" "$(date -u +%Y%m%d-%H%M%S)" | tee "$log"; LATEST_ARCHIVE="$(last_field LATEST_ARCHIVE "$log")"; LATEST_ARCHIVE_SHA256="$(last_field LATEST_ARCHIVE_SHA256 "$log")"; }
cleanup_remote(){ [[ "$SELFTEST" == false && "$REMOTE_STAGE" != unknown ]] || return 0; set +e; ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 "rm -rf '$REMOTE_STAGE' '$REMOTE_PKG'" >/dev/null 2>&1; set -e; }
write_stop_report(){ local rc="$1" line="$2" cmd="$3"; cat > "$REPORT/report.txt" <<EOF
RESULT=STOP_P23D_R02_VM121_PRODUCTION_CREDENTIAL_KEY_BOUNDARY
REVISION=R02
STOP_RC=$rc
STOP_LINE=$line
STOP_DETAIL=$STOP_DETAIL
CORE_CHANGE_COMPLETE=$CORE_CHANGE_COMPLETE
CORE_CHANGE_REPEATED=false
SOURCE_CHANGED=$SOURCE_CHANGED
SOURCE_ROLLBACK_STATUS=$SOURCE_ROLLBACK_STATUS
BACKEND_RECOVERY_STATUS=$BACKEND_RECOVERY_STATUS
PRODUCTION_MASTER_KEY_CREATED=$PRODUCTION_MASTER_KEY_CREATED
PRODUCTION_SECRET_PATH_SELECTED=$PRODUCTION_SECRET_PATH_SELECTED
LIVE_DATABASE_WRITTEN=false
DATABASE_SCHEMA_CHANGED=false
RUNTIME_PROVISIONING_ACTIVE=false
EXTERNAL_ONBOARDING_ACTIVE=false
VM121_BASE_COMMIT=$BASE_COMMIT
VM121_BASE_TREE=$BASE_TREE
EOF
printf 'STOP_COMMAND=%q\n' "$cmd" >> "$REPORT/report.txt"; cp "$REPORT/report.txt" "$REPORT/verify.txt"; cp "$ROOT/scripts/run-step.sh" "$REPORT/executed-step.sh"; cp "$ROOT/release-info.json" "$REPORT/release-info.json"; cp "$ROOT/rollback/README.md" "$REPORT/rollback.txt"; [[ ! -f "$EVIDENCE/key-boundary.txt" ]] || cp "$EVIDENCE/key-boundary.txt" "$REPORT/key-boundary.txt"; }
stop_handler(){ local rc="$1" line="$2" cmd="$3"; trap - ERR; [[ "$STOP_HANDLED" == false ]] || return "$rc"; STOP_HANDLED=true; cleanup_remote; write_stop_report "$rc" "$line" "$cmd"; set +e; if [[ "$SELFTEST" == true ]]; then DEST="${ROUTER_PUBLIC_ROOT:?}/latest/p23d-r02-$CASE-selftest"; rm -rf "$DEST"; mkdir -p "$DEST"; cp -a "$REPORT"/. "$DEST"/; STEP_REPORT_URL="selftest://p23d-r02-$CASE/"; archive_latest >/dev/null 2>&1; else args=(); while IFS= read -r f; do args+=("$f" "$(basename "$f")"); done < <(find "$REPORT" -maxdepth 1 -type f -print | LC_ALL=C sort); router_step_publish_payload step050m07p23d_r02_vm121_production_credential_key_boundary_stop "$REPORT" "$PAYLOAD" "$CURRENT" "$EVENTS" "$FINAL_ENV" "${args[@]}" >/dev/null 2>&1 || true; [[ -f "$FINAL_ENV" ]] && STEP_REPORT_URL="$(last_field PUBLIC_URL "$FINAL_ENV")"; archive_latest >/dev/null 2>&1; fi; set -e; write_child STOP_P23D_R02_VM121_PRODUCTION_CREDENTIAL_KEY_BOUNDARY "$rc"; return "$rc"; }
trap 'rc=$?; stop_handler "$rc" "$LINENO" "$BASH_COMMAND"; exit "$rc"' ERR
self_source(){ local head="$1" tree="$2" count="$3" staged="$4"; cat <<EOF
MODE=--check
MACHINE_ID=vm121
LOCAL_HEAD=$head
REMOTE_HEAD=$head
STAGED_CHANGE_COUNT=$staged
SIMULATED_TREE_SHA=$tree
SIMULATED_TREE_FILE_COUNT=$count
RESULT=PASS_VM121_GIT_PUBLISH_CHECK
GIT_COMMIT=$head
GIT_TREE=$tree
GIT_FILE_COUNT=$count
COMMIT_CREATED=false
PUSH_PERFORMED=false
EOF
}
self_apply(){ cat <<'EOF'
ALEMBIC_VERSION=0003_domain_v2_schema
FAILED_STAGE=none
BUSINESS_ROWS_BEFORE=0
BUSINESS_ROWS_AFTER=0
PEER_CREDENTIAL_ROWS=0
KEYRING_PATH=/opt/wg-access/runtime/credential-keyring.json
KEYRING_SCHEMA=wg-paid-credential-keyring-v1
KEYRING_ACTIVE_VERSION=1
KEYRING_VERSION_COUNT=1
KEYRING_MODE=600
KEYRING_UID=0
KEYRING_GID=0
KEYRING_BACKEND_BIND_READ_ONLY=true
KEY_BACKUP_ROOT=/root/router-ops-backups/p23d-credential-keyring
KEY_BACKUP_MODE=600
KEY_BACKUP_ROOT_MODE=700
KEY_BACKUP_CREATED=true
RESTORE_PROOF=PASS
PRODUCTION_LOADER_ENCRYPT_DECRYPT=PASS
ROTATION_OLD_KEY_DECRYPT=PASS
ROTATION_NEW_KEY_ENCRYPT_DECRYPT=PASS
ROTATION_KEY_VERSION_COUNT=2
ROTATION_ACTIVE_VERSION=2
SECRET_VALUES_EMITTED=false
KEY_ABSENT_FROM_MACHINE_GIT=true
KEY_ABSENT_FROM_DATABASE=true
KEY_ABSENT_FROM_IMAGE=true
BACKEND_GENERATION_CHANGED=true
BACKEND_STARTED_AT_BEFORE=before
BACKEND_STARTED_AT_AFTER=after
BACKEND_PID_BEFORE=100
BACKEND_PID_AFTER=200
CORE_SOURCE_CHANGE_COMPLETE=true
SOURCE_CHANGED=true
SOURCE_ROLLBACK_STATUS=not_required
BACKEND_RECOVERY_STATUS=PASS
PRODUCTION_MASTER_KEY_CREATED=true
PRODUCTION_SECRET_PATH_SELECTED=true
LIVE_DATABASE_WRITTEN=false
DATABASE_SCHEMA_CHANGED=false
RUNTIME_PROVISIONING_ACTIVE=false
EXTERNAL_ONBOARDING_ACTIVE=false
RESULT=PASS_P23D_R02_VM121_PRODUCTION_CREDENTIAL_KEY_BOUNDARY
EOF
}
self_close(){ cat <<EOF
RESULT=PASS_VM121_GIT_PUBLISH
MACHINE=vm121
COMMIT=1111111111111111111111111111111111111111
TREE=$EXPECTED_TREE
GIT_FILE_COUNT=$EXPECTED_COUNT
VM121_PUBLIC_URL=https://reports.example/latest/vm121/
RESULT=PASS_ROUTER_MACHINE_CLOSE
EOF
}
router_step_phase_begin preflight
if [[ "$SELFTEST" == true ]]; then self_source "$BASE_COMMIT" "$BASE_TREE" "$BASE_COUNT" 0 > "$EVIDENCE/pre-source.txt"; [[ "$CASE" != fail-source ]] || sed -i 's/STAGED_CHANGE_COUNT=0/STAGED_CHANGE_COUNT=1/' "$EVIDENCE/pre-source.txt"; else ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 /usr/local/sbin/router-vm121-git-publish.sh --check > "$EVIDENCE/pre-source.txt" 2>&1; fi
"$ROOT/scripts/source-check-validate.sh" pre "$EVIDENCE/pre-source.txt" "$BASE_COMMIT" "$BASE_TREE" "$BASE_COUNT" 0 > "$EVIDENCE/pre-source-validation.txt" || { STOP_DETAIL=pre_vm121_source; false; }
PKG="$ROOT/$ROUTER_RELEASE_TARGET_PACKAGE_PATH"; "$ROOT/scripts/target-apply.sh" "$ROUTER_RELEASE_TARGET_PACKAGE_SHA256" "$PKG" "$TARGET_DIR" > "$EVIDENCE/target-extract.txt"; router_step_phase_complete preflight exact_source_and_target_verified
router_step_phase_begin apply
target_rc=0
if [[ "$SELFTEST" == true ]]; then
  if [[ "$CASE" == fail-apply ]]; then
    self_apply > "$EVIDENCE/key-boundary.txt"
    sed -i -e 's/FAILED_STAGE=none/FAILED_STAGE=restore_loader_proof/' -e 's/CORE_SOURCE_CHANGE_COMPLETE=true/CORE_SOURCE_CHANGE_COMPLETE=false/' -e 's/SOURCE_ROLLBACK_STATUS=not_required/SOURCE_ROLLBACK_STATUS=PASS/' -e 's/PRODUCTION_MASTER_KEY_CREATED=true/PRODUCTION_MASTER_KEY_CREATED=false/' -e 's/PRODUCTION_SECRET_PATH_SELECTED=true/PRODUCTION_SECRET_PATH_SELECTED=false/' -e 's/RESULT=PASS_P23D_R02_VM121_PRODUCTION_CREDENTIAL_KEY_BOUNDARY/RESULT=STOP_P23D_R02_VM121_PRODUCTION_CREDENTIAL_KEY_BOUNDARY/' "$EVIDENCE/key-boundary.txt"
    target_rc=1
  else
    self_apply > "$EVIDENCE/key-boundary.txt"
  fi
else
  token="$(basename "$RUN_DIR" | tr -cd 'A-Za-z0-9._-')"; REMOTE_STAGE="/root/router-step-p23d-r02-$token"; REMOTE_PKG="/root/router-step-p23d-r02-$token.tar.gz"
  ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 "umask 077; cat > '$REMOTE_PKG'" < "$PKG" || { STOP_DETAIL=remote_package_transfer; false; }
  ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 "rm -rf '$REMOTE_STAGE'; install -d -m 0700 '$REMOTE_STAGE'; tar -xzf '$REMOTE_PKG' -C '$REMOTE_STAGE'" > "$EVIDENCE/remote-stage.txt" 2>&1 || { STOP_DETAIL=remote_package_extract; false; }
  if ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 "/bin/bash '$REMOTE_STAGE/vm121-p23d-r02-key-boundary.sh' '$REMOTE_STAGE/candidate'" > "$EVIDENCE/key-boundary.txt" 2>&1; then target_rc=0; else target_rc=$?; fi
fi
remote_core="$(last_field CORE_SOURCE_CHANGE_COMPLETE "$EVIDENCE/key-boundary.txt")"; remote_changed="$(last_field SOURCE_CHANGED "$EVIDENCE/key-boundary.txt")"; remote_rb="$(last_field SOURCE_ROLLBACK_STATUS "$EVIDENCE/key-boundary.txt")"; remote_backend="$(last_field BACKEND_RECOVERY_STATUS "$EVIDENCE/key-boundary.txt")"; remote_key="$(last_field PRODUCTION_MASTER_KEY_CREATED "$EVIDENCE/key-boundary.txt")"; remote_path="$(last_field PRODUCTION_SECRET_PATH_SELECTED "$EVIDENCE/key-boundary.txt")"
[[ "$remote_core" == true ]] && CORE_CHANGE_COMPLETE=true
[[ "$remote_changed" == true ]] && SOURCE_CHANGED=true
[[ -n "$remote_rb" ]] && SOURCE_ROLLBACK_STATUS="$remote_rb"
[[ -n "$remote_backend" ]] && BACKEND_RECOVERY_STATUS="$remote_backend"
[[ "$remote_key" == true ]] && PRODUCTION_MASTER_KEY_CREATED=true
[[ "$remote_path" == true ]] && PRODUCTION_SECRET_PATH_SELECTED=true
cleanup_remote
if [[ "$target_rc" -ne 0 ]]; then STOP_DETAIL="key_boundary_$(last_field FAILED_STAGE "$EVIDENCE/key-boundary.txt")"; false; fi
"$ROOT/scripts/key-boundary-validate.sh" "$EVIDENCE/key-boundary.txt" > "$EVIDENCE/key-boundary-validation.txt" || { STOP_DETAIL=key_boundary_semantics; false; }
CORE_CHANGE_COMPLETE=true; SOURCE_CHANGED=true; SOURCE_ROLLBACK_STATUS=not_required; BACKEND_RECOVERY_STATUS=PASS; PRODUCTION_MASTER_KEY_CREATED=true; PRODUCTION_SECRET_PATH_SELECTED=true; router_step_phase_complete apply production_key_boundary_and_rotation_proof_complete
router_step_phase_begin machine_close
if [[ "$SELFTEST" == true ]]; then self_close > "$EVIDENCE/machine-close.txt"; else "$BASE/bin/router-machine-close-safe" vm121 "$STEP: production credential keyring loader, protected key boundary, backup/restore and isolated rotation proof" > "$EVIDENCE/machine-close.txt" 2>&1; fi
"$ROOT/scripts/machine-close-validate.sh" "$EVIDENCE/machine-close.txt" "$EXPECTED_TREE" "$EXPECTED_COUNT" > "$EVIDENCE/machine-close-validation.txt" || { STOP_DETAIL=machine_close_after_core; false; }
VM121_NEW_COMMIT="$(last_field VM121_NEW_COMMIT "$EVIDENCE/machine-close-validation.txt")"; VM121_NEW_TREE="$EXPECTED_TREE"; VM121_NEW_FILE_COUNT="$EXPECTED_COUNT"; VM121_NEW_PUBLIC_URL="$(last_field VM121_NEW_PUBLIC_URL "$EVIDENCE/machine-close-validation.txt")"; router_step_phase_complete machine_close vm121_source_closed_and_published
router_step_phase_begin postcheck
if [[ "$SELFTEST" == true ]]; then self_source "$VM121_NEW_COMMIT" "$EXPECTED_TREE" "$EXPECTED_COUNT" 0 > "$EVIDENCE/post-source.txt"; self_apply > "$EVIDENCE/post-live.txt"; else ssh -T vm121 /usr/local/sbin/router-vm121-git-publish.sh --check > "$EVIDENCE/post-source.txt" 2>&1; ssh -T vm121 /bin/bash -s > "$EVIDENCE/post-live.txt" 2>&1 <<'VM'
set -Eeuo pipefail
KEY=/opt/wg-access/runtime/credential-keyring.json
[[ "$(stat -c %a "$KEY")" == 600 && "$(stat -c %u "$KEY")" == 0 && "$(stat -c %g "$KEY")" == 0 ]]
docker inspect wgaccess-backend --format '{{range .Mounts}}{{println .Type .Source .Destination .RW}}{{end}}' | awk '$1=="bind" && $2=="/opt/wg-access/runtime/credential-keyring.json" && $3=="/opt/wg-access/runtime/credential-keyring.json" && $4=="false"{ok=1} END{exit(ok?0:1)}'
curl -fsS --max-time 5 http://127.0.0.1:18080/health >/dev/null; curl -fsS --max-time 5 http://127.0.0.1:18080/health/db >/dev/null
PG=wgaccess-postgres; U="$(docker exec "$PG" sh -lc 'printf %s "$POSTGRES_USER"')"; D="$(docker exec "$PG" sh -lc 'printf %s "$POSTGRES_DB"')"; Q(){ docker exec "$PG" psql -v ON_ERROR_STOP=1 -U "$U" -d "$D" -Atqc "$1"; }
business_rows(){ Q "SELECT (SELECT count(*) FROM users)+(SELECT count(*) FROM plans)+(SELECT count(*) FROM access_grants)+(SELECT count(*) FROM access_grant_protocol_limits)+(SELECT count(*) FROM invites)+(SELECT count(*) FROM invite_redemptions)+(SELECT count(*) FROM magic_link_tokens)+(SELECT count(*) FROM auth_sessions)+(SELECT count(*) FROM connection_profiles)+(SELECT count(*) FROM peer_credentials)+(SELECT count(*) FROM audit_events)+(SELECT count(*) FROM invite_codes)+(SELECT count(*) FROM orders)+(SELECT count(*) FROM subscriptions)+(SELECT count(*) FROM peers)+(SELECT count(*) FROM provisioning_jobs)+(SELECT count(*) FROM peer_egress_leases)"; }
BUSINESS_ROWS_AFTER="$(business_rows)"; PEER_CREDENTIAL_ROWS="$(Q 'SELECT count(*) FROM peer_credentials')"
[[ "$BUSINESS_ROWS_AFTER" == 0 && "$PEER_CREDENTIAL_ROWS" == 0 ]]
[[ "$(Q 'SELECT count(*) FROM egress_targets')" == 5 && "$(Q 'SELECT count(*) FROM egress_allocator_settings')" == 14 ]]
[[ "$(stat -c %a /root/router-ops-backups/p23d-credential-keyring)" == 700 ]]
shopt -s nullglob
key_backups=(/root/router-ops-backups/p23d-credential-keyring/credential-keyring-v1-*.json)
(( ${#key_backups[@]} >= 1 ))
for key_backup in "${key_backups[@]}"; do [[ "$(stat -c %a "$key_backup")" == 600 && "$(stat -c %u "$key_backup")" == 0 && "$(stat -c %g "$key_backup")" == 0 ]]; done
! git --git-dir=/root/.vm121-source.git --work-tree=/ ls-files --error-unmatch opt/wg-access/runtime/credential-keyring.json >/dev/null 2>&1
docker exec -i wgaccess-backend python - <<'PY'
import base64,json,os,tempfile
from app.services.credential_keyring import load_credential_cipher
path="/opt/wg-access/runtime/credential-keyring.json"
c1=load_credential_cipher(path)
assert c1.active_version==1
payload={"x":"isolated"}
e1=c1.encrypt_json(payload,profile_id="p23d-post",revision=1)
assert e1.key_version==1 and c1.decrypt_json(e1.ciphertext,key_version=1,profile_id="p23d-post",revision=1)==payload
with open(path,encoding="utf-8") as f: d=json.load(f)
d2={"schema":d["schema"],"active_version":2,"keys":dict(d["keys"])}
d2["keys"]["2"]=base64.b64encode(os.urandom(32)).decode("ascii")
fd,tmp=tempfile.mkstemp(prefix="p23d-post-rotation-",suffix=".json")
os.fchmod(fd,0o600)
try:
    with os.fdopen(fd,"w",encoding="utf-8") as f: json.dump(d2,f,separators=(",",":")); f.write("\n")
    c2=load_credential_cipher(tmp)
    assert c2.active_version==2
    assert c2.decrypt_json(e1.ciphertext,key_version=1,profile_id="p23d-post",revision=1)==payload
    e2=c2.encrypt_json(payload,profile_id="p23d-post",revision=2)
    assert e2.key_version==2 and c2.decrypt_json(e2.ciphertext,key_version=2,profile_id="p23d-post",revision=2)==payload
finally:
    try: os.unlink(tmp)
    except FileNotFoundError: pass
PY
echo "BUSINESS_ROWS_AFTER=$BUSINESS_ROWS_AFTER"; echo "PEER_CREDENTIAL_ROWS=$PEER_CREDENTIAL_ROWS"; echo KEYRING_PATH=/opt/wg-access/runtime/credential-keyring.json; echo KEYRING_SCHEMA=wg-paid-credential-keyring-v1; echo KEYRING_ACTIVE_VERSION=1; echo KEYRING_VERSION_COUNT=1; echo KEYRING_MODE=600; echo KEYRING_UID=0; echo KEYRING_GID=0; echo KEYRING_BACKEND_BIND_READ_ONLY=true; echo KEY_BACKUP_ROOT_MODE=700; echo KEY_BACKUP_MODE=600; echo KEY_BACKUP_CREATED=true; echo RESTORE_PROOF=PASS; echo PRODUCTION_LOADER_ENCRYPT_DECRYPT=PASS; echo ROTATION_OLD_KEY_DECRYPT=PASS; echo ROTATION_NEW_KEY_ENCRYPT_DECRYPT=PASS; echo ROTATION_KEY_VERSION_COUNT=2; echo ROTATION_ACTIVE_VERSION=2; echo SECRET_VALUES_EMITTED=false; echo KEY_ABSENT_FROM_MACHINE_GIT=true; echo KEY_ABSENT_FROM_DATABASE=true; echo KEY_ABSENT_FROM_IMAGE=true; echo BACKEND_GENERATION_CHANGED=true; echo BACKEND_RECOVERY_STATUS=PASS; echo CORE_SOURCE_CHANGE_COMPLETE=true; echo SOURCE_CHANGED=true; echo PRODUCTION_MASTER_KEY_CREATED=true; echo PRODUCTION_SECRET_PATH_SELECTED=true; echo LIVE_DATABASE_WRITTEN=false; echo DATABASE_SCHEMA_CHANGED=false; echo RUNTIME_PROVISIONING_ACTIVE=false; echo EXTERNAL_ONBOARDING_ACTIVE=false; echo RESULT=PASS_P23D_R02_VM121_PRODUCTION_CREDENTIAL_KEY_BOUNDARY
VM
fi
"$ROOT/scripts/source-check-validate.sh" post "$EVIDENCE/post-source.txt" "$VM121_NEW_COMMIT" "$EXPECTED_TREE" "$EXPECTED_COUNT" 0 > "$EVIDENCE/post-source-validation.txt" || { STOP_DETAIL=post_vm121_source; false; }; "$ROOT/scripts/key-boundary-validate.sh" "$EVIDENCE/post-live.txt" > "$EVIDENCE/post-live-validation.txt" || { STOP_DETAIL=post_live_semantics; false; }; router_step_phase_complete postcheck exact_tree_and_live_key_boundary_verified
router_step_phase_begin report_publish
cat > "$REPORT/report.txt" <<EOF
RESULT=PASS_P23D_VM121_PRODUCTION_CREDENTIAL_MASTER_KEY_FOUNDATION
REVISION=R02
CORE_CHANGE_COMPLETE=true
CORE_CHANGE_REPEATED=false
SOURCE_CHANGED=true
SOURCE_ROLLBACK_STATUS=not_required
BACKEND_RECOVERY_STATUS=PASS
BACKEND_GENERATION_CHANGED=true
LIVE_DATABASE_WRITTEN=false
DATABASE_SCHEMA_CHANGED=false
ALEMBIC_VERSION=0003_domain_v2_schema
BUSINESS_ROWS=0
PEER_CREDENTIAL_ROWS=0
PRODUCTION_MASTER_KEY_CREATED=true
PRODUCTION_SECRET_PATH_SELECTED=true
KEYRING_PATH=/opt/wg-access/runtime/credential-keyring.json
KEYRING_SCHEMA=wg-paid-credential-keyring-v1
KEYRING_ACTIVE_VERSION=1
KEYRING_VERSION_COUNT=1
KEYRING_MODE=600
KEYRING_BACKEND_BIND_READ_ONLY=true
KEY_BACKUP_ROOT=/root/router-ops-backups/p23d-credential-keyring
KEY_BACKUP_ROOT_MODE=700
KEY_BACKUP_MODE=600
RESTORE_PROOF=PASS
PRODUCTION_LOADER_ENCRYPT_DECRYPT=PASS
ROTATION_OLD_KEY_DECRYPT=PASS
ROTATION_NEW_KEY_ENCRYPT_DECRYPT=PASS
ROTATION_KEY_VERSION_COUNT=2
SECRET_VALUES_EMITTED=false
KEY_ABSENT_FROM_MACHINE_GIT=true
KEY_ABSENT_FROM_DATABASE=true
KEY_ABSENT_FROM_IMAGE=true
KEY_ABSENT_FROM_ZIP_REPORT_LATEST=true
RUNTIME_PROVISIONING_ACTIVE=false
EXTERNAL_ONBOARDING_ACTIVE=false
VM121_BASE_COMMIT=$BASE_COMMIT
VM121_COMMIT=$VM121_NEW_COMMIT
VM121_TREE=$VM121_NEW_TREE
VM121_FILE_COUNT=$VM121_NEW_FILE_COUNT
VM121_PUBLIC_URL=$VM121_NEW_PUBLIC_URL
RUNTIME_IMPACT=true
COPY_VERIFY=PASS
NEXT_ACTION=P23E production credential service wiring using the installed versioned keyring loader; still no public onboarding
EOF
cp "$REPORT/report.txt" "$REPORT/verify.txt"; cp "$ROOT/scripts/run-step.sh" "$REPORT/executed-step.sh"; cp "$ROOT/release-info.json" "$REPORT/release-info.json"; cp "$ROOT/rollback/README.md" "$REPORT/rollback.txt"; cp "$EVIDENCE/key-boundary-validation.txt" "$REPORT/key-boundary-validation.txt"; cp "$EVIDENCE/post-source-validation.txt" "$REPORT/post-vm121-source-validation.txt"
if [[ "$SELFTEST" == true ]]; then DEST="${ROUTER_PUBLIC_ROOT:?}/latest/p23d-r02-pass-selftest"; rm -rf "$DEST"; mkdir -p "$DEST"; cp -a "$REPORT"/. "$DEST"/; STEP_REPORT_URL=selftest://p23d-r02-pass/; else args=(); while IFS= read -r f; do args+=("$f" "$(basename "$f")"); done < <(find "$REPORT" -maxdepth 1 -type f -print | LC_ALL=C sort); router_step_publish_payload step050m07p23d_r02_vm121_production_credential_master_key_foundation "$REPORT" "$PAYLOAD" "$CURRENT" "$EVENTS" "$FINAL_ENV" "${args[@]}"; STEP_REPORT_URL="$(last_field PUBLIC_URL "$FINAL_ENV")"; fi
router_step_phase_complete report_publish report_published; router_step_phase_begin archive; archive_latest; router_step_phase_complete archive latest_archived; STOP_DETAIL=none; write_child PASS_P23D_VM121_PRODUCTION_CREDENTIAL_MASTER_KEY_FOUNDATION 0; trap - ERR; exit 0