#!/usr/bin/env bash
# ===== YEFFAI_PULL_WORKER_FIRST_INSTALLATION_CONTRACT_GATE_PERSISTENCE_V3_BEGIN =====
yeffai_first_install_contract_gate_persistence_v3() {
  python3 <<'PERSIST_V3_PY'
import json, pathlib, datetime

ROOT = pathlib.Path("/home/yeff/public_html/devon")
STATE = ROOT / "canon/execution/state"

PLAN = STATE / "execution_server_integration_plan.json"
PULL = STATE / "yeffai_target_pull_worker_latest.json"
SCAN = STATE / "yeffai_target_operational_scan.json"
GAP_QUEUE = STATE / "execution_contract_gap_queue.json"

CURRENT_ACTION = "YEFFAI_FIRST_INSTALLATION_STEP_CONTRACT_GATE"

def load(path):
    try:
        return json.loads(path.read_text(encoding="utf-8"))
    except Exception:
        return {}

def dump(path, data):
    path.write_text(json.dumps(data, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")

def norm(v):
    return str(v or "").strip().upper()

plan = load(PLAN)
gap = load(GAP_QUEUE)

if (
    norm(plan.get("next_required_action")) == CURRENT_ACTION
    and norm(plan.get("installation_started")) == "NO"
    and norm(plan.get("installation_command_executed")) == "NO"
    and norm(plan.get("remote_mutation_executed")) == "NO"
    and norm(gap.get("status")) == "PASS"
    and int(gap.get("open_gap_count", -1)) == 0
):
    now = datetime.datetime.now(datetime.timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")

    pull = load(PULL)
    if not isinstance(pull, dict):
        pull = {}
    pull["worker_id"] = pull.get("worker_id") or "yeffai_target_pull_worker"
    pull["status"] = "PASS"
    pull["updated_at"] = now
    pull["next_required_action"] = CURRENT_ACTION
    pull["next_required_action_source"] = "worker_persistence_v3_first_install_contract_gate"
    pull["contract_gap_status"] = "PASS"
    pull["contract_gap_open_count"] = 0
    pull["remote_yeffai_mutation"] = "NO"
    pull["reboot_executed"] = "NO_BY_DEVON"
    pull["installation_started"] = "NO"
    pull["installation_command_executed"] = "NO"
    pull["remote_mutation_executed"] = "NO"
    dump(PULL, pull)

    scan = load(SCAN)
    if not isinstance(scan, dict):
        scan = {}
    scan["scan_id"] = scan.get("scan_id") or "yeffai_target_operational_scan"
    scan["status"] = "PASS"
    scan["updated_at"] = now
    scan["next_required_action"] = CURRENT_ACTION
    scan["next_required_action_source"] = "worker_persistence_v3_first_install_contract_gate"
    scan["contract_gap_status"] = "PASS"
    scan["contract_gap_open_count"] = 0
    scan["remote_yeffai_mutation"] = "NO"
    scan["reboot_executed"] = False
    scan["installation_started"] = False
    scan["installation_command_executed"] = False
    scan["remote_mutation_executed"] = False
    dump(SCAN, scan)
PERSIST_V3_PY
}
trap yeffai_first_install_contract_gate_persistence_v3 RETURN
# ===== YEFFAI_PULL_WORKER_FIRST_INSTALLATION_CONTRACT_GATE_PERSISTENCE_V3_END =====
set +e
set +u
set +H 2>/dev/null

ROOT="/home/yeff/public_html/devon"
CANON="$ROOT/canon/execution"
STATE="$CANON/state"
BACKUP="$ROOT/_backup"
TS="$(date +%Y%m%d_%H%M%S)"

PROBE="$STATE/yeffai_target_probe_latest.json"
LIVE="$STATE/yeffai_target_live_runtime.json"
SCAN="$STATE/yeffai_target_operational_scan.json"
LEDGER="$STATE/execution_ledger.json"
LEDGER_JSONL="$STATE/execution_ledger.jsonl"
LATEST="$STATE/yeffai_target_pull_worker_latest.json"
LOCK="$STATE/yeffai_target_pull_worker.lock"

RUN_DIR="$BACKUP/yeffai_target_pull_worker_run_$TS"
RAW="$RUN_DIR/remote_probe_raw_$TS.txt"
OUT="$RUN_DIR/worker_output_$TS.txt"

mkdir -p "$RUN_DIR"

{
  echo "===== YEFF AI TARGET PULL WORKER RUN ====="
  echo "DATE=$(date)"
  echo "SERVER=WARESITES"
  echo "LOCAL_HOSTNAME=$(hostname 2>/dev/null)"
  echo "LOCAL_WHOAMI=$(whoami 2>/dev/null)"
  echo "ROOT=$ROOT"
  echo "STATE=$STATE"
  echo "RAW=$RAW"
  echo "OUT=$OUT"
  echo
  echo "POLICY=READ_ONLY_PULL_FROM_YEFFAI"
  echo "REMOTE_YEFFAI_MUTATION=NO"
  echo "YEFFAI_INSTALLATION_COMMAND_EXECUTED=NO"
  echo "INSTALLATION_STARTED=NO"
  echo

  if [ -f "$LOCK" ]; then
    LOCK_AGE="$(( $(date +%s) - $(stat -c %Y "$LOCK" 2>/dev/null || echo 0) ))"
    if [ "$LOCK_AGE" -lt 240 ]; then
      echo "LOCK_STATUS=ACTIVE"
      echo "STATUS=MISSING"
      echo "CAUSE=Worker lock is active; skipping overlapping run."
      exit 0
    fi
  fi

  echo "$$" > "$LOCK"

  finish() {
    rm -f "$LOCK" 2>/dev/null || true
  }
  trap finish EXIT

  if ! command -v ssh >/dev/null 2>&1; then
    echo "SSH_STATUS=FAIL"
    echo "STATUS=FAIL"
    echo "CAUSE=ssh missing."
    exit 0
  fi

  if ! command -v python3 >/dev/null 2>&1; then
    echo "PYTHON3_STATUS=FAIL"
    echo "STATUS=FAIL"
    echo "CAUSE=python3 missing."
    exit 0
  fi

  for f in "$PROBE" "$LIVE" "$SCAN" "$LEDGER" "$LEDGER_JSONL"; do
    if [ ! -f "$f" ]; then
      echo "REQUIRED_FILE_MISSING=$f"
      echo "STATUS=FAIL"
      echo "CAUSE=Required canonical state file missing."
      exit 0
    fi
  done

  echo "PRECHECK_STATUS=PASS"
  echo

  echo "===== REMOTE READONLY PULL ====="
  ssh YEFFAI 'set +e
set +u
set +H 2>/dev/null

LATEST_TXT="$(ls -1t /root/yeffai_target_probe_local_readonly_before_installation_*.txt 2>/dev/null | head -n 1)"
LATEST_JSON="$(ls -1t /root/yeffai_target_probe_local_readonly_before_installation_*.json 2>/dev/null | head -n 1)"

echo "REMOTE_READ_STARTED_AT=$(date -Iseconds 2>/dev/null || date)"
echo "REMOTE_WHOAMI=$(whoami 2>/dev/null)"
echo "REMOTE_HOSTNAME=$(hostname 2>/dev/null)"
echo "REMOTE_LATEST_TXT=${LATEST_TXT:-MISSING}"
echo "REMOTE_LATEST_JSON=${LATEST_JSON:-MISSING}"

if [ -n "$LATEST_TXT" ] && [ -f "$LATEST_TXT" ]; then
  echo "REMOTE_LATEST_TXT_SHA256=$(sha256sum "$LATEST_TXT" 2>/dev/null | awk "{print \$1}")"
  echo "REMOTE_LATEST_TXT_SIZE=$(wc -c < "$LATEST_TXT" 2>/dev/null)"
else
  echo "REMOTE_LATEST_TXT_STATUS=MISSING"
fi

if [ -n "$LATEST_JSON" ] && [ -f "$LATEST_JSON" ]; then
  echo "REMOTE_LATEST_JSON_SHA256=$(sha256sum "$LATEST_JSON" 2>/dev/null | awk "{print \$1}")"
  echo "REMOTE_LATEST_JSON_SIZE=$(wc -c < "$LATEST_JSON" 2>/dev/null)"
else
  echo "REMOTE_LATEST_JSON_STATUS=MISSING"
fi

echo "REMOTE_MUTATION_EXECUTED=NO"
echo "INSTALLATION_COMMAND_EXECUTED=NO"
echo "REMOTE_READ_FINISHED_AT=$(date -Iseconds 2>/dev/null || date)"

echo "===== REMOTE_JSON_BEGIN ====="
if [ -n "$LATEST_JSON" ] && [ -f "$LATEST_JSON" ]; then
  cat "$LATEST_JSON" 2>/dev/null
else
  echo "{}"
fi
echo "===== REMOTE_JSON_END ====="

echo "===== REMOTE_TXT_TAIL_BEGIN ====="
if [ -n "$LATEST_TXT" ] && [ -f "$LATEST_TXT" ]; then
  tail -n 260 "$LATEST_TXT" 2>/dev/null
fi
echo "===== REMOTE_TXT_TAIL_END ====="
' > "$RAW" 2>&1

  SSH_STATUS="$?"
  echo "SSH_EXIT_CODE=$SSH_STATUS"
  echo "RAW=$RAW"

  if [ "$SSH_STATUS" -ne 0 ]; then
    python3 - "$LATEST" "$RAW" <<'PY'
import json, sys, datetime
latest, raw = sys.argv[1:]
now=datetime.datetime.now(datetime.timezone.utc).replace(microsecond=0).isoformat().replace("+00:00","Z")
data={
  "worker_id":"yeffai_target_pull_worker",
  "status":"FAIL",
  "updated_at":now,
  "remote_yeffai_mutation":"NO",
  "installation_command_executed":"NO",
  "raw_output":raw,
  "cause":"ssh YEFFAI pull failed"
}
open(latest,"w",encoding="utf-8").write(json.dumps(data,indent=2,ensure_ascii=False)+"\n")
PY
    echo "STATUS=FAIL"
    echo "CAUSE=ssh YEFFAI pull failed."
    exit 0
  fi

  echo "REMOTE_READ_STATUS=PASS"
  echo

  echo "===== UPDATE CANONICAL STATE ====="
  python3 - "$RAW" "$PROBE" "$LIVE" "$SCAN" "$LEDGER" "$LEDGER_JSONL" "$LATEST" "$TS" <<'PY'
import json, sys, re, datetime, pathlib

raw_path, probe_path, live_path, scan_path, ledger_path, ledger_jsonl_path, latest_path, ts = sys.argv[1:]
raw = pathlib.Path(raw_path).read_text(encoding="utf-8", errors="replace")

def val(key, default="MISSING"):
    m = re.search(r"^" + re.escape(key) + r"=(.*)$", raw, re.M)
    return m.group(1).strip() if m else default

def section(start, end):
    a = raw.find(start)
    b = raw.find(end)
    if a < 0 or b < 0 or b <= a:
        return ""
    return raw[a + len(start):b].strip()

remote_json_text = section("===== REMOTE_JSON_BEGIN =====", "===== REMOTE_JSON_END =====")
tail = section("===== REMOTE_TXT_TAIL_BEGIN =====", "===== REMOTE_TXT_TAIL_END =====")

try:
    remote_json = json.loads(remote_json_text) if remote_json_text else {}
except Exception:
    remote_json = {"json_parse_status": "FAIL", "raw_excerpt": remote_json_text[:500]}

def tail_val(key, default="MISSING"):
    m = re.search(r"^" + re.escape(key) + r"=(.*)$", tail, re.M)
    return m.group(1).strip() if m else default

now = datetime.datetime.now(datetime.timezone.utc).replace(microsecond=0).isoformat().replace("+00:00","Z")

try:
    ledger = json.loads(pathlib.Path(ledger_path).read_text(encoding="utf-8"))
except Exception:
    ledger = {}

events_count = int(ledger.get("events_count", 0) or 0) + 1
event_id = f"yeffai_target_pull_worker_{ts}_{events_count}"

probe_status = "PASS" if tail_val("STATUS") == "PASS" and val("REMOTE_HOSTNAME") == "YeffAI" and val("REMOTE_WHOAMI") == "root" else "FAIL"

evidence = {
    "REMOTE_WHOAMI": val("REMOTE_WHOAMI"),
    "REMOTE_HOSTNAME": val("REMOTE_HOSTNAME"),
    "REMOTE_OS_PRETTY": tail_val("OS_PRETTY"),
    "REMOTE_KERNEL": tail_val("KERNEL"),
    "REMOTE_ARCH": tail_val("ARCH"),
    "REBOOT_REQUIRED": tail_val("REBOOT_REQUIRED"),
    "OPT_EXISTS": tail_val("OPT_EXISTS"),
    "OPT_YEFFAI_EXISTS": tail_val("OPT_YEFFAI_EXISTS"),
    "DOCKER_BIN": tail_val("DOCKER_BIN"),
    "DOCKER_COMPOSE_PLUGIN": tail_val("DOCKER_COMPOSE_PLUGIN"),
    "DOCKER_COMPOSE_LEGACY": tail_val("DOCKER_COMPOSE_LEGACY"),
    "NGINX_BIN": tail_val("NGINX_BIN"),
    "CADDY_BIN": tail_val("CADDY_BIN"),
    "TRAEFIK_BIN": tail_val("TRAEFIK_BIN"),
    "UFW_BIN": tail_val("UFW_BIN"),
    "AUTHORIZED_KEYS_STATUS": tail_val("AUTHORIZED_KEYS_STATUS"),
    "AUTHORIZED_KEYS_LINES": tail_val("AUTHORIZED_KEYS_LINES"),
    "AUTHORIZED_KEYS_SHA256": tail_val("AUTHORIZED_KEYS_SHA256"),
    "TARGET_PROBE_STATUS": tail_val("TARGET_PROBE_STATUS"),
    "MUTATION_EXECUTED": tail_val("MUTATION_EXECUTED"),
    "INSTALLATION_COMMAND_EXECUTED": tail_val("INSTALLATION_COMMAND_EXECUTED"),
    "CAUSE": tail_val("CAUSE")
}

probe = {
    "contract_id": "yeffai_target_probe_latest",
    "version": "v1",
    "source": "yeffai_target_pull_worker",
    "target_host_or_ip": "157.173.100.205",
    "target_ssh_alias": "YEFFAI",
    "pulled_at": now,
    "status": probe_status,
    "remote_probe": {
        "remote_latest_txt": val("REMOTE_LATEST_TXT"),
        "remote_latest_json": val("REMOTE_LATEST_JSON"),
        "remote_latest_txt_sha256": val("REMOTE_LATEST_TXT_SHA256"),
        "remote_latest_json_sha256": val("REMOTE_LATEST_JSON_SHA256"),
        "remote_latest_txt_size": val("REMOTE_LATEST_TXT_SIZE"),
        "remote_latest_json_size": val("REMOTE_LATEST_JSON_SIZE"),
        "remote_json": remote_json
    },
    "evidence": evidence,
    "raw_remote_capture": raw_path,
    "remote_mutation_executed": False,
    "installation_command_executed": False
}
pathlib.Path(probe_path).write_text(json.dumps(probe, indent=2, ensure_ascii=False)+"\n", encoding="utf-8")

live = {
    "contract_id": "yeffai_target_live_runtime",
    "version": "v1",
    "source": "yeffai_target_pull_worker",
    "target_host_or_ip": "157.173.100.205",
    "target_ssh_alias": "YEFFAI",
    "started_at": val("REMOTE_READ_STARTED_AT", now),
    "finished_at": val("REMOTE_READ_FINISHED_AT", now),
    "status": probe_status,
    "ssh_auth_status": "PASS",
    "remote_read_status": "PASS",
    "evidence": evidence,
    "error": None if probe_status == "PASS" else "Probe evidence did not resolve PASS.",
    "ssh_exit_code": 0,
    "ssh_stderr": ""
}
pathlib.Path(live_path).write_text(json.dumps(live, indent=4, ensure_ascii=False)+"\n", encoding="utf-8")

scan = {
    "contract_id": "yeffai_target_operational_scan",
    "version": "v1",
    "source": "yeffai_target_pull_worker",
    "target_host_or_ip": "157.173.100.205",
    "target_ssh_alias": "YEFFAI",
    "generated_at": now,
    "status": probe_status,
    "policy": "READ_ONLY_SCAN",
    "remote_mutation_executed": False,
    "installation_command_executed": False,
    "installation_started": False,
    "checks": {
        "ssh_auth": "PASS",
        "remote_read": "PASS",
        "target_hostname": "PASS" if evidence.get("REMOTE_HOSTNAME") == "YeffAI" else "FAIL",
        "target_user": "PASS" if evidence.get("REMOTE_WHOAMI") == "root" else "FAIL",
        "os_baseline": "PASS" if evidence.get("REMOTE_OS_PRETTY") != "MISSING" else "MISSING",
        "opt_exists": evidence.get("OPT_EXISTS", "MISSING"),
        "opt_yeffai_absent_before_installation": "PASS" if evidence.get("OPT_YEFFAI_EXISTS") == "NO" else "FAIL",
        "docker_before_installation": "MISSING" if evidence.get("DOCKER_BIN") == "MISSING" else "PASS",
        "web_server_before_installation": "MISSING" if evidence.get("NGINX_BIN") == "MISSING" and evidence.get("CADDY_BIN") == "MISSING" and evidence.get("TRAEFIK_BIN") == "MISSING" else "PASS",
        "reboot_required": evidence.get("REBOOT_REQUIRED", "MISSING")
    },
    "next_required_action": "FOLLOW_UI_NEXT_AUTHORIZED_JOB",
    "evidence_path": probe_path
}
pathlib.Path(scan_path).write_text(json.dumps(scan, indent=4, ensure_ascii=False)+"\n", encoding="utf-8")

event = {
    "event_id": event_id,
    "contract_id": "execution_ledger_event",
    "version": "v1.0",
    "action": "YEFFAI_TARGET_PULL_WORKER_REFRESH",
    "target": "157.173.100.205",
    "status": probe_status,
    "evidence_path": probe_path,
    "summary": "Automated Waresites pull worker refreshed YEFF AI target evidence read-only for UI state.",
    "created_at": now,
    "event_index": events_count,
    "remote_yeffai_mutation": "NO",
    "installation_command_executed": "NO"
}

with open(ledger_jsonl_path, "a", encoding="utf-8") as fh:
    fh.write(json.dumps(event, ensure_ascii=False)+"\n")

ledger["events_count"] = events_count
ledger["last_event"] = {
    "event": "yeffai_target_pull_worker_refresh",
    "status": probe_status,
    "target": "157.173.100.205",
    "ssh_auth_status": "PASS",
    "remote_read_status": "PASS",
    "error": None if probe_status == "PASS" else "Probe evidence did not resolve PASS.",
    "event_index": events_count,
    "recorded_at": now
}
# YEFFAI_PULL_WORKER_NEXT_ACTION_REGRESSION_GUARD_V1
advanced_next_action = "BEGIN_CONTROLLED_YEFFAI_INSTALL_STEPS_OR_PROVIDE_CATEGORY_RUNTIME_EVIDENCE"
precheck_next_action = "YEFFAI_CONTROLLED_INSTALLATION_PRECHECK"
precheck_review_next_action = "YEFFAI_CONTROLLED_INSTALLATION_PRECHECK_REVIEW"
controlled_reboot_exec_approval_action = "YEFFAI_CONTROLLED_REBOOT_READY_FOR_EXECUTION_APPROVAL"
post_reboot_review_action = "YEFFAI_POST_REBOOT_READINESS_REVIEW"
first_installation_contract_gate_action = "YEFFAI_FIRST_INSTALLATION_STEP_CONTRACT_GATE"
generic_next_action = "FOLLOW_UI_NEXT_AUTHORIZED_JOB"
# YEFFAI_PULL_WORKER_PRECHECK_NEXT_ACTION_GUARD_V1
# YEFFAI_PULL_WORKER_PRECHECK_REVIEW_NEXT_ACTION_GUARD_V1
# YEFFAI_PULL_WORKER_CONTROLLED_REBOOT_EXEC_APPROVAL_GUARD_V1
# YEFFAI_PULL_WORKER_POST_REBOOT_READINESS_REVIEW_GUARD_V1
preservable_next_actions = {advanced_next_action, precheck_next_action, precheck_review_next_action, controlled_reboot_exec_approval_action, post_reboot_review_action, first_installation_contract_gate_action}

current_ledger_next_action = str(ledger.get("required_next_action") or "")
current_pull_next_action = str(latest.get("next_required_action") or "") if isinstance(locals().get("latest"), dict) else ""

if current_ledger_next_action in preservable_next_actions:
    preserved_next_action = current_ledger_next_action
    preserved_next_source = "preserved_by_yeffai_target_pull_worker_precheck_regression_guard"
elif current_pull_next_action in preservable_next_actions:
    preserved_next_action = current_pull_next_action
    preserved_next_source = "preserved_by_yeffai_target_pull_worker_precheck_regression_guard"
else:
    preserved_next_action = generic_next_action
    preserved_next_source = "yeffai_target_pull_worker.latest"

ledger["required_next_action"] = preserved_next_action
ledger["required_next_action_source"] = preserved_next_source
ledger["required_next_action_updated_at"] = now
ledger["updated_at"] = now
ledger["status"] = "PASS" if probe_status == "PASS" else "FAIL"
pathlib.Path(ledger_path).write_text(json.dumps(ledger, indent=4, ensure_ascii=False)+"\n", encoding="utf-8")

latest = {
    "worker_id": "yeffai_target_pull_worker",
    "status": probe_status,
    "updated_at": now,
    "target": "157.173.100.205",
    "target_alias": "YEFFAI",
    "remote_read_status": "PASS",
    "ssh_auth_status": "PASS",
    "event_id": event_id,
    "event_index": events_count,
    "probe_latest": probe_path,
    "live_runtime": live_path,
    "operational_scan": scan_path,
    "raw_output": raw_path,
    "remote_yeffai_mutation": "NO",
    "installation_command_executed": "NO",
    "installation_started": "NO"
}
pathlib.Path(latest_path).write_text(json.dumps(latest, indent=2, ensure_ascii=False)+"\n", encoding="utf-8")

print("WORKER_BUILD_STATUS=" + probe_status)
print("EVENT_ID=" + event_id)
print("EVENT_INDEX=" + str(events_count))
PY

  for f in "$PROBE" "$LIVE" "$SCAN" "$LEDGER" "$LATEST"; do
    if python3 -m json.tool "$f" >/dev/null 2>&1; then
      echo "JSON_VALIDATION=PASS path=$f"
    else
      echo "JSON_VALIDATION=FAIL path=$f"
      echo "STATUS=FAIL"
      echo "CAUSE=JSON validation failed after worker state update."
      exit 0
    fi
  done

  if tail -n 1 "$LEDGER_JSONL" | python3 -c 'import sys,json; json.loads(sys.stdin.read()); print("LEDGER_JSONL_LAST_ROW_JSON=PASS")' 2>/dev/null; then
    echo "LEDGER_JSONL_VALIDATION=PASS"
  else
    echo "LEDGER_JSONL_VALIDATION=FAIL"
    echo "STATUS=FAIL"
    echo "CAUSE=Ledger JSONL last row validation failed."
    exit 0
  fi

  echo
  echo "STATUS=PASS"
  echo "CAUSE=Worker pulled YEFF AI evidence read-only and refreshed canonical UI state."
  echo "REMOTE_YEFFAI_MUTATION=NO"
  echo "YEFFAI_INSTALLATION_COMMAND_EXECUTED=NO"
  echo "INSTALLATION_STARTED=NO"
} | tee "$OUT"

if grep -q '^STATUS=PASS$' "$OUT"; then
  exit 0
else
  exit 0
fi

# YEFFAI_PULL_WORKER_FIRST_INSTALLATION_CONTRACT_GATE_GUARD_V1