#!/usr/bin/env bash
set -euo pipefail
LAST="$HOME/.ev424_doc_last_run"
[ -s "$LAST" ] || { echo "ERROR: missing last-run pointer: $LAST"; exit 2; }
# shellcheck disable=SC1090
# BEGIN EV424 G06 DATA-ONLY POINTER PARSER
unset RUN_DIR SOURCE URL ISSUED_DATE
declare -A EV424_POINTER_SEEN=()
while IFS= read -r EV424_POINTER_LINE || [ -n "$EV424_POINTER_LINE" ]; do
  if [[ ! "$EV424_POINTER_LINE" =~ ^([A-Z][A-Z0-9_]*)=\"([^\"]*)\"$ ]]; then
    echo "ERROR: invalid last-run pointer line" >&2
    exit 2
  fi
  EV424_POINTER_KEY="${BASH_REMATCH[1]}"
  EV424_POINTER_VALUE="${BASH_REMATCH[2]}"
  case "$EV424_POINTER_KEY" in
    RUN_DIR|SOURCE|URL|ISSUED_DATE) ;;
    *) echo "ERROR: unexpected pointer key: $EV424_POINTER_KEY" >&2; exit 2 ;;
  esac
  if [ -n "${EV424_POINTER_SEEN[$EV424_POINTER_KEY]+x}" ]; then
    echo "ERROR: duplicate pointer key: $EV424_POINTER_KEY" >&2
    exit 2
  fi
  EV424_POINTER_SEEN["$EV424_POINTER_KEY"]=1
  case "$EV424_POINTER_VALUE" in
    *'$('*|*'`'*) echo "ERROR: shell command substitution signal in pointer value" >&2; exit 2 ;;
  esac
  printf -v "$EV424_POINTER_KEY" "%s" "$EV424_POINTER_VALUE"
done < "$LAST"
if [ -z "${RUN_DIR+x}" ] || [ -z "${RUN_DIR}" ]; then
  echo "ERROR: missing required pointer key: RUN_DIR" >&2
  exit 2
fi
EV424_RUN_ROOT="/var/lib/ev424/ev424_evidence"
EV424_RUN_ROOT_CANONICAL="$(readlink -f -- "$EV424_RUN_ROOT")" || { echo "ERROR: allowed run root cannot be resolved" >&2; exit 2; }
EV424_RUN_DIR_CANONICAL="$(readlink -f -- "$RUN_DIR")" || { echo "ERROR: RUN_DIR cannot be resolved" >&2; exit 2; }
if [ "$RUN_DIR" != "$EV424_RUN_DIR_CANONICAL" ]; then
  echo "ERROR: RUN_DIR is not canonical" >&2
  exit 2
fi
case "$EV424_RUN_DIR_CANONICAL" in
  "$EV424_RUN_ROOT_CANONICAL"/*) ;;
  *) echo "ERROR: RUN_DIR outside allowed root" >&2; exit 2 ;;
esac
if [ -n "${SOURCE+x}" ]; then
  if [ -z "$SOURCE" ] || [ "$SOURCE" != "$(basename -- "$SOURCE")" ] || [ "$SOURCE" = "." ] || [ "$SOURCE" = ".." ]; then
    echo "ERROR: SOURCE is not a valid basename" >&2
    exit 2
  fi
fi
unset EV424_POINTER_LINE EV424_POINTER_KEY EV424_POINTER_VALUE
unset EV424_RUN_ROOT EV424_RUN_ROOT_CANONICAL
unset EV424_RUN_DIR_CANONICAL EV424_POINTER_SEEN
# END EV424 G06 DATA-ONLY POINTER PARSER
: "${RUN_DIR:?}"
cd "$RUN_DIR"

# --- Pre-req gate (Annex A, FAIL-STOP) ---
REQ1="local.sha256"
REQ2="run_manifest.sha256"
REQ3="redownload.sha256"
REQ4="redownload.sha256.sha256"
MISSING=""
[ -f "$REQ1" ] || MISSING="${MISSING} ${REQ1}"
[ -f "$REQ2" ] || MISSING="${MISSING} ${REQ2}"
[ -f "$REQ3" ] || MISSING="${MISSING} ${REQ3}"
[ -f "$REQ4" ] || MISSING="${MISSING} ${REQ4}"
if [ -n "${MISSING}" ]; then
  echo "FAILURE_FACT_PACK"
  echo "FAILED_CHECK: MISSING_PREREQ_ARTIFACT"
  echo "OBSERVABLES: RUN_DIR=${RUN_DIR:-unknown} MISSING=${MISSING# }"
  exit 2
fi
# --- end gate ---

sha256sum -c local.sha256 >/dev/null
sha256sum -c run_manifest.sha256 >/dev/null
sha256sum -c redownload.sha256 >/dev/null
sha256sum -c redownload.sha256.sha256 >/dev/null


python3 - <<PY
import os, sys, subprocess

def g(k: str) -> str:
    with open("pick_record.txt","r",encoding="utf-8") as f:
        for line in f:
            line=line.strip()
            if line.startswith(k+"="):
                return line.split("=",1)[1]
    raise SystemExit(f"ERROR: missing {k} in pick_record.txt")

source = g("SOURCE")
url = g("URL")
issued = g("ISSUED_DATE")

def sha256_file(path: str) -> str:
    return subprocess.check_output(["sha256sum", path], text=True).split()[0]

fingerprint = sha256_file(source)
rep = sha256_file("run_manifest.sha256")

term = os.environ.get("TERM","")
use_color = sys.stdout.isatty() and term and term != "dumb"
BLUE  = "\033[34m" if use_color else ""
GREEN = "\033[32m" if use_color else ""
RESET = "\033[0m"  if use_color else ""

out=[]
out.append(f"{BLUE}==[EV424 FINAL RECEIPT]=={RESET}\n\n")
out.append(
"01)\nLEGEND\n"
"OK           SHA-256 verified (sha256sum -c PASS)\n"
"PASS         Printed only when all required checks are OK\n"
"MODE         REPRO\n"
"----------------------------------------\n\n"
)
out.append("02)\nIDENTITY\n")
out.append(f"SOURCE       {source}\nISSUED_DATE  {issued}\nFINGERPRINT  {fingerprint}\nURL          {url}\nREVERIFY     +7d -> CONSISTENCY+REDOWNLOAD\n")
out.append("----------------------------------------\n\n")
out.append("03)\nVERIFY\nSTATUS       [OK] LOCAL_SHA  [OK] SRC_RECORD  [OK] REDOWNLOAD  [OK] CHAIN\n----------------------------------------\n\n")
out.append("04)\nRESULT\n")
out.append(f"{GREEN}PASS{RESET} | sha256={rep}\n\n")
out.append(f"{GREEN}Accuracy(4)=Truth(2)=Life(4){RESET}\n")
sys.stdout.write("".join(out))
PY
