#!/usr/bin/bash
set -euo pipefail
export PATH=/usr/bin:/bin
umask 077
shopt -s lastpipe

CURRENT_EVIDENCE_ID=''
DOCUMENT_VERIFICATION_STATE=UNAVAILABLE
EVIDENCE_REVIEW_STATE=UNAVAILABLE
EVIDENCE_REVIEW_RUNTIME=UNAVAILABLE

observe_runtime_capability() {
    if [ ! -x /opt/ev424/bin/ev424_dependency_preflight.sh ]
    then
        /usr/bin/printf '%s\n' 'DEPENDENCY_PREFLIGHT=FAIL_STOP'
        return 1
    fi

    DOCUMENT_VERIFICATION_STATE=UNAVAILABLE
    EVIDENCE_REVIEW_STATE=UNAVAILABLE
EVIDENCE_REVIEW_RUNTIME=UNAVAILABLE

    while IFS= read -r PREFLIGHT_LINE
    do
        case "$PREFLIGHT_LINE" in
            COMMON_RUNTIME_FINAL_STATE=PASS)
                ;;
            COMMON_RUNTIME_FINAL_STATE=FAIL_STOP|DEPENDENCY_PREFLIGHT=FAIL_STOP)
                return 1
                ;;
            DOCUMENT_VERIFICATION_FINAL_STATE=AVAILABLE)
                DOCUMENT_VERIFICATION_STATE=AVAILABLE
                ;;
            DOCUMENT_VERIFICATION_FINAL_STATE=UNAVAILABLE)
                DOCUMENT_VERIFICATION_STATE=UNAVAILABLE
                ;;
            EVIDENCE_REVIEW_RUNTIME_PATH=/usr/bin/python3)
                EVIDENCE_REVIEW_RUNTIME=/usr/bin/python3
                ;;
            EVIDENCE_REVIEW_RUNTIME_PATH=/usr/bin/python3.14)
                EVIDENCE_REVIEW_RUNTIME=/usr/bin/python3.14
                ;;
            EVIDENCE_REVIEW_RUNTIME_PATH=UNAVAILABLE)
                EVIDENCE_REVIEW_RUNTIME=UNAVAILABLE
                ;;
            EVIDENCE_REVIEW_RUNTIME_PATH=*)
                return 1
                ;;
            EVIDENCE_REVIEW_FINAL_STATE=AVAILABLE)
                EVIDENCE_REVIEW_STATE=AVAILABLE
                ;;
            EVIDENCE_REVIEW_FINAL_STATE=UNAVAILABLE)
                EVIDENCE_REVIEW_STATE=UNAVAILABLE
EVIDENCE_REVIEW_RUNTIME=UNAVAILABLE
                ;;
        esac
    done < <(/opt/ev424/bin/ev424_dependency_preflight.sh)

    return 0
}

capture_current_evidence_candidate() {
    CANDIDATE_EVIDENCE_ID=''
    CANDIDATE_EVIDENCE_ID_COUNT=0
    CANDIDATE_REQUEST_TERMINAL_COUNT=0

    while IFS= read -r CONSUMER_LINE
    do
        /usr/bin/printf '%s\n' "$CONSUMER_LINE"
        case "$CONSUMER_LINE" in
            EVIDENCE_ID=*)
                CANDIDATE_EVIDENCE_ID_COUNT=$((CANDIDATE_EVIDENCE_ID_COUNT + 1))
                CANDIDATE_EVIDENCE_ID=${CONSUMER_LINE#EVIDENCE_ID=}
                ;;
            REQUEST_TERMINAL=*)
                CANDIDATE_REQUEST_TERMINAL_COUNT=$((CANDIDATE_REQUEST_TERMINAL_COUNT + 1))
                ;;
        esac
    done
}

promote_current_evidence_candidate() {
    if [ "$CANDIDATE_EVIDENCE_ID_COUNT" -ne 1 ]
    then
        return 1
    fi

    if [[ ! "$CANDIDATE_EVIDENCE_ID" =~ ^[0-9]{8}T[0-9]{12}\+0900_REQUESTED_SOURCE$ ]]
    then
        return 1
    fi

    if [ "$CANDIDATE_REQUEST_TERMINAL_COUNT" -gt 1 ]
    then
        return 1
    fi

    if [ "$CANDIDATE_REQUEST_TERMINAL_COUNT" -eq 1 ]
    then
        return 0
    fi

    CURRENT_EVIDENCE_ID=$CANDIDATE_EVIDENCE_ID
    return 0
}

print_help() {
    /usr/bin/printf "%s\n" \
    "" \
    "EV424 Verification Kernel — Help" \
    "" \
    "[1] Document Verification" \
    "    Verify an official public PDF source." \
    "    Paste the direct official PDF URL beginning with http:// or https://." \
    "    Use the official source, not a search result or third-party mirror." \
    "    AVAILABLE means all required host dependencies were directly observed." \
    "    UNAVAILABLE means verification is blocked; it is not a PASS." \
    "" \
    "    At the URL prompt:" \
    "      [H] Help" \
    "      Paste URL" \
    "" \
    "    At the confirmation prompt:" \
    "      [Enter] Verify" \
    "      [B] Back" \
    "      [H] Help" \
    "" \
    "[2] Evidence Review" \
    "    Review evidence from a completed verification run." \
    "    The current Evidence ID is used when available." \
    "    Otherwise, enter the exact Evidence ID." \
    "" \
    "[I] Build Identity" \
    "    Show the installed public executable identity" \
    "    and the bound request-runner identity." \
    "" \
    "[H] Help" \
    "    Show this help at the main, URL, and confirmation prompts." \
    "" \
    "[Q] Exit" \
    "    Exit the EV424 Verification Kernel." \
    "" \
    "Important" \
    "    EV424 verifies reproducible byte-level integrity" \
    "    from an official public source." \
    "    PASS is limited to the predicates directly verified." \
    "    HOLD is not PASS." \
    "    Evidence Review PASS means the evidence is readable;" \
    "    it does not turn a failed verification into PASS." \
    "    EV424 does not determine truth, safety, legality," \
    "    authenticity, endorsement, or document meaning." \
    ""
}

print_main() {
    /usr/bin/printf '%b\n' \
    '──────── \033[34m●\033[0m ────────    EV424  Verification Kernel'

    /usr/bin/printf '%s\n' \
    '' \
    'AVAILABLE KERNEL  DOCUMENT' \
    'BUILD IDENTITY    BOUND' \
    '' \
    "[1] Document Verification — $DOCUMENT_VERIFICATION_STATE" \
    "[2] Evidence Review — $EVIDENCE_REVIEW_STATE" \
    '[H] Help' \
    '[I] Build Identity' \
    '[Q] Exit' \
    '' \
    '─────────────────────────────' \
    'Quick Start' \
    'Paste official PDF URL' \
    '─────────────────────────────'
}

if ! observe_runtime_capability
then
    /usr/bin/printf '%s\n' 'EV424_RUNTIME_PREFLIGHT_FAIL_STOP'
    exit 78
fi

print_main

while /usr/bin/true
do
    /usr/bin/printf '\nEV424 > '

    if IFS= read -r INPUT
    then
        /usr/bin/true
    else
        exit 0
    fi

    case "$INPUT" in
        Q|q)
            exit 0
            ;;

        http://*|https://*)
            if [ "$DOCUMENT_VERIFICATION_STATE" != "AVAILABLE" ]
            then
                /usr/bin/printf '%s\n' 'DOCUMENT_VERIFICATION_UNAVAILABLE'
                continue
            fi

            if {
                /usr/bin/strace \
                -qq \
                -yy \
                -s 488 \
                -e write,exit_group \
                -o /dev/fd/3 \
                /opt/ev424/bin/새문서요청검증.PUBLIC_V7_EXECUTABLE_BINDING_SUCCESSOR_V1 \
                --requested-source-url "$INPUT" \
                --requested-source-name "EV424_PUBLIC_${BASHPID}_${EPOCHREALTIME/./}" \
                --verification-scope 'Official PDF source access, transport preflight, five-stage document verification pipeline, fail-stop at each stage, final receipt completeness, and raw-content disposal confirmation' \
                --publication-requested NO \
                --publication-family '' \
                --raw-content-retention NO \
                --public-executable-path /usr/local/bin/ev424 \
                3>&1 \
                1>/dev/null ||
                /usr/bin/true
            } |
            /usr/bin/grep \
            -E \
            -e 'EXECUTION_EVENT_LEDGER\.tsv>' \
            -e '^exit_group\(' |
            /usr/bin/gawk \
            -f \
              '/opt/ev424/bin/EV424_PUBLIC_V7_SINGLE_GAWK_CONSUMER_EVIDENCE_ID_TRANSPORT_HARD_CAP_REMOVAL_SUCCESSOR_V1_20260814T1756+0900.awk' |
              capture_current_evidence_candidate
              then
                  if promote_current_evidence_candidate
                  then
                      continue
                  else
                      exit 79
                  fi
              else
                  exit 79
              fi
            ;;

        1)
            if [ "$DOCUMENT_VERIFICATION_STATE" != "AVAILABLE" ]
            then
                /usr/bin/printf '%s\n' 'DOCUMENT_VERIFICATION_UNAVAILABLE'
                continue
            fi

            /usr/bin/printf '%s\n' \
            '' \
            'Document Verification' \
            '' \
            'Paste official PDF URL' \
            ''

            /usr/bin/printf 'URL > '

            if IFS= read -r URL_INPUT
            then
                /usr/bin/true
            else
                exit 0
            fi

            case "$URL_INPUT" in
                H|h)
                    print_help
                    continue
                    ;;
                http://*|https://*)
                    ;;

                *)
                    /usr/bin/printf '%s\n' \
                    'PUBLIC_URL_INPUT_INVALID'
                    continue
                    ;;
            esac

            /usr/bin/printf '%s\n' \
            '' \
            'Verify this source?' \
            '' \
            "$URL_INPUT" \
            '' \
            '[Enter] Verify' \
            '[B] Back' \
            '[H] Help' \
            ''

            if IFS= read -r CONFIRM_INPUT
            then
                /usr/bin/true
            else
                exit 0
            fi

            case "$CONFIRM_INPUT" in
                H|h)
                    print_help
                    continue
                    ;;
                '')
                    if {
                        /usr/bin/strace \
                        -qq \
                        -yy \
                        -s 488 \
                        -e write,exit_group \
                        -o /dev/fd/3 \
                        /opt/ev424/bin/새문서요청검증.PUBLIC_V7_EXECUTABLE_BINDING_SUCCESSOR_V1 \
                        --requested-source-url "$URL_INPUT" \
                        --requested-source-name "EV424_PUBLIC_${BASHPID}_${EPOCHREALTIME/./}" \
                        --verification-scope 'Official PDF source access, transport preflight, five-stage document verification pipeline, fail-stop at each stage, final receipt completeness, and raw-content disposal confirmation' \
                        --publication-requested NO \
                        --publication-family '' \
                        --raw-content-retention NO \
                --public-executable-path /usr/local/bin/ev424 \
                        3>&1 \
                        1>/dev/null ||
                        /usr/bin/true
                    } |
                    /usr/bin/grep \
                    -E \
                    -e 'EXECUTION_EVENT_LEDGER\.tsv>' \
                    -e '^exit_group\(' |
                    /usr/bin/gawk \
                    -f \
                      '/opt/ev424/bin/EV424_PUBLIC_V7_SINGLE_GAWK_CONSUMER_EVIDENCE_ID_TRANSPORT_HARD_CAP_REMOVAL_SUCCESSOR_V1_20260814T1756+0900.awk' |
                      capture_current_evidence_candidate
                      then
                          if promote_current_evidence_candidate
                          then
                              continue
                          else
                              exit 79
                          fi
                      else
                          exit 79
                      fi
                    ;;

                B|b)
                    /usr/bin/printf '%s\n' \
                    'PUBLIC_BACK_REQUESTED'
                    continue
                    ;;

                *)
                    /usr/bin/printf '%s\n' \
                    'PUBLIC_CONFIRMATION_UNRECOGNIZED'
                    continue
                    ;;
            esac
            ;;

        2)
            if [ "$EVIDENCE_REVIEW_STATE" != "AVAILABLE" ]
            then
                /usr/bin/printf '%s\n' 'EVIDENCE_REVIEW_UNAVAILABLE'
                continue
            fi

            /usr/bin/printf '%s\n' \
            '' \
            'Evidence Review' \
            ''

            if [ -n "$CURRENT_EVIDENCE_ID" ]
            then
                EVIDENCE_ID=$CURRENT_EVIDENCE_ID
            else
                /usr/bin/printf '%s\n' \
                'Enter exact Evidence ID' \
                ''

                /usr/bin/printf 'EVIDENCE ID > '

                if IFS= read -r EVIDENCE_ID
                then
                    /usr/bin/true
                else
                    exit 0
                fi
            fi

            if "$EVIDENCE_REVIEW_RUNTIME" \
                /opt/ev424/bin/ev424.PUBLIC_V7_EVIDENCE_REVIEW_9ITEM_READ_ONLY_SUCCESSOR_V1 \
                "$EVIDENCE_ID"
            then
                continue
            else
                exit 79
            fi
            ;;

        H|h)
            print_help
            continue
            ;;

        I|i)
            /usr/bin/printf '%s\n' \
            'BUILD_IDENTITY_STATE=BOUND' \
            'PUBLIC_EXECUTABLE_PATH=/usr/local/bin/ev424'
            /usr/bin/sha256sum -- /usr/local/bin/ev424
            /usr/bin/printf '%s\n' \
            'REQUEST_RUNNER_PATH=/opt/ev424/bin/새문서요청검증.PUBLIC_V7_EXECUTABLE_BINDING_SUCCESSOR_V1'
            /usr/bin/sha256sum -- /opt/ev424/bin/새문서요청검증.PUBLIC_V7_EXECUTABLE_BINDING_SUCCESSOR_V1
            continue
            ;;

        *)
            /usr/bin/printf '%s\n' \
            'PUBLIC_INPUT_UNRECOGNIZED'
            continue
            ;;
    esac
done
