#!/usr/bin/env bash
set -euo pipefail

# Read-only verifier for the 110 controlled AWOOOI CD lane. It only prints
# metadata needed to decide whether the awoooi-host queue can be served safely.
# It never reads or prints runner registration contents.

TARGET_HOST_IP="${TARGET_HOST_IP:-192.168.0.110}"
CD_LANE_DRAIN_DIR="${CD_LANE_DRAIN_DIR:-/home/wooo/awoooi-cd-lane-drain}"
CD_LANE_DRAIN_SERVICE="${CD_LANE_DRAIN_SERVICE:-awoooi-cd-lane-drain.service}"
CD_LANE_DRAIN_USER="${CD_LANE_DRAIN_USER:-wooo}"
CD_LANE_DRAIN_BINARY="${CD_LANE_DRAIN_BINARY:-${CD_LANE_DRAIN_DIR}/awoooi_cd_lane_controlled}"
CD_LANE_DRAIN_CONFIG="${CD_LANE_DRAIN_CONFIG:-${CD_LANE_DRAIN_DIR}/config.yaml}"
CD_LANE_DRAIN_REGISTRATION_PATHS="${CD_LANE_DRAIN_REGISTRATION_PATHS:-${CD_LANE_DRAIN_DIR}/data/.runner ${CD_LANE_DRAIN_DIR}/.runner}"
PRIMARY_CD_LANE_SERVICE="${PRIMARY_CD_LANE_SERVICE:-awoooi-cd-lane.service}"
ROOT_RESTORE_PARENT="${ROOT_RESTORE_PARENT:-/root}"
MAX_CAPACITY="${MAX_CAPACITY:-1}"
MAX_HEAVY_PROCESS_COUNT="${MAX_HEAVY_PROCESS_COUNT:-0}"
MAX_ACTIVE_ACTION_CONTAINERS="${MAX_ACTIVE_ACTION_CONTAINERS:-0}"
MAX_LOAD_PER_CORE="${MAX_LOAD_PER_CORE:-1.25}"
REQUIRE_ACTIVE_SERVICE="${REQUIRE_ACTIVE_SERVICE:-1}"
REQUIRE_PRIMARY_LANE_FAILCLOSED="${REQUIRE_PRIMARY_LANE_FAILCLOSED:-1}"
LEGACY_RUNNER_SERVICE_NAMES="${LEGACY_RUNNER_SERVICE_NAMES:-awoooi-direct-runner-open.service awoooi-direct-runner.service gitea-act-runner-host.service gitea-act-runner-awoooi-controlled.service gitea-awoooi-controlled-runner.service gitea-act-runner-awoooi-open.service}"
LEGACY_RUNNER_BINARY_PATHS="${LEGACY_RUNNER_BINARY_PATHS:-/home/wooo/act-runner/act_runner /home/wooo/act-runner/act_runner.real-20260628-runner-pressure-guard /home/wooo/act-runner-controlled/act_runner /home/wooo/awoooi-controlled-runner/awoooi_controlled_runner}"
FORBIDDEN_LABEL_RE="${FORBIDDEN_LABEL_RE:-^(ubuntu-latest|ubuntu-[0-9].*|self-hosted|stockplatform.*|stock-platform.*|headless.*|playwright.*)$}"

BLOCKERS=()
WARNINGS=()
CONFIG_READY=0
BINARY_READY=0
REGISTRATION_READY=0
SERVICE_READY=0
SERVICE_GUARDRAILS_READY=0
LEGACY_FAILCLOSED=0
PRIMARY_LANE_FAILCLOSED=0
ROOT_RESTORE_LEFT="unknown"

section() {
  printf '\n== %s ==\n' "$1"
}

blocker() {
  BLOCKERS+=("$1")
  printf 'BLOCKER %s\n' "$1"
}

warning() {
  WARNINGS+=("$1")
  printf 'WARNING %s\n' "$1"
}

command_exists() {
  command -v "$1" >/dev/null 2>&1
}

service_user_test() {
  local flag="$1"
  local path="$2"
  if [ -z "$CD_LANE_DRAIN_USER" ] || [ "$CD_LANE_DRAIN_USER" = "$(id -un 2>/dev/null || true)" ]; then
    test "$flag" "$path"
    return $?
  fi
  if [ "$(id -u 2>/dev/null || echo 1)" = "0" ]; then
    if command_exists sudo; then
      sudo -n -u "$CD_LANE_DRAIN_USER" test "$flag" "$path" 2>/dev/null
      return $?
    fi
    if command_exists runuser; then
      runuser -u "$CD_LANE_DRAIN_USER" -- test "$flag" "$path" 2>/dev/null
      return $?
    fi
  fi
  test "$flag" "$path"
}

host_ips() {
  if command_exists ip; then
    ip -o -4 addr show 2>/dev/null | awk '{print $4}' | sed 's#/.*##' | sort -u
    return 0
  fi
  hostname -I 2>/dev/null | tr ' ' '\n' | awk 'NF' | sort -u || true
}

host_has_ip() {
  local ip="$1"
  host_ips | grep -qx "$ip"
}

systemd_cat() {
  local unit="$1"
  if systemctl cat "$unit" >/dev/null 2>&1; then
    systemctl cat "$unit" 2>/dev/null
    return 0
  fi
  return 1
}

systemd_show() {
  local unit="$1"
  systemctl show "$unit" \
    -p LoadState \
    -p ActiveState \
    -p UnitFileState \
    -p MainPID \
    --no-pager 2>/dev/null || true
}

systemd_value() {
  local unit="$1"
  local key="$2"
  systemd_show "$unit" | awk -F= -v k="$key" '$1 == k {print $2; found=1} END {if (!found) print ""}'
}

unit_failclosed_or_absent() {
  local unit="$1"
  local state load unitfile active mainpid
  state="$(systemd_show "$unit" | tr '\n' ' ')"
  load="$(printf '%s\n' "$state" | tr ' ' '\n' | awk -F= '$1 == "LoadState" {print $2; exit}')"
  unitfile="$(printf '%s\n' "$state" | tr ' ' '\n' | awk -F= '$1 == "UnitFileState" {print $2; exit}')"
  active="$(printf '%s\n' "$state" | tr ' ' '\n' | awk -F= '$1 == "ActiveState" {print $2; exit}')"
  mainpid="$(printf '%s\n' "$state" | tr ' ' '\n' | awk -F= '$1 == "MainPID" {print $2; exit}')"
  printf 'FAILCLOSED_UNIT unit=%s load=%s unitfile=%s active=%s mainpid=%s\n' \
    "$unit" "${load:-unknown}" "${unitfile:-unknown}" "${active:-unknown}" "${mainpid:-unknown}"
  if [ "${load:-}" = "not-found" ]; then
    return 0
  fi
  if [ "${load:-}" = "masked" ] && [ "${unitfile:-}" = "masked" ] && [ "${active:-}" != "active" ] && [ "${mainpid:-0}" = "0" ]; then
    return 0
  fi
  return 1
}

extract_runner_capacity() {
  local config_path="$1"
  awk '
    /^runner:[[:space:]]*$/ {
      in_runner=1
      next
    }
    in_runner && /^[^[:space:]]/ && $0 !~ /^runner:[[:space:]]*$/ {
      in_runner=0
    }
    in_runner && /^[[:space:]]*capacity:[[:space:]]*/ {
      line=$0
      sub(/^[[:space:]]*capacity:[[:space:]]*/, "", line)
      gsub(/["'\'']/, "", line)
      print line
      exit
    }
  ' "$config_path"
}

extract_runner_labels() {
  local config_path="$1"
  awk '
    /^[[:space:]]*labels:[[:space:]]*$/ {
      in_labels=1
      next
    }
    in_labels && /^[[:space:]]*-[[:space:]]*/ {
      line=$0
      sub(/^[[:space:]]*-[[:space:]]*"/, "", line)
      sub(/^[[:space:]]*-[[:space:]]*/, "", line)
      sub(/"[[:space:]]*$/, "", line)
      print line
      next
    }
    in_labels && /^[^[:space:]]/ {
      in_labels=0
    }
  ' "$config_path"
}

label_name() {
  printf '%s' "${1%%:*}"
}

active_action_container_count() {
  if ! command_exists docker; then
    echo 0
    return 0
  fi
  docker ps --format '{{.Names}}' 2>/dev/null | grep -Ec '^GITEA-ACTIONS-TASK-' || true
}

heavy_process_count() {
  {
    pgrep -f '(^|/)(chrome|chromium|chromium-browser)( |$)' 2>/dev/null || true
    pgrep -f 'playwright|stockplatform.*smoke|next build|turbo build|vite build' 2>/dev/null || true
  } | sort -u | wc -l | tr -d ' '
}

load_per_core_ok() {
  if [ ! -r /proc/loadavg ] || ! command_exists awk; then
    warning "loadavg_unavailable"
    return 0
  fi
  local cores load1 ratio
  cores="$(getconf _NPROCESSORS_ONLN 2>/dev/null || echo 1)"
  load1="$(awk '{print $1}' /proc/loadavg)"
  ratio="$(awk -v load_value="$load1" -v cores="${cores:-1}" 'BEGIN { if (cores < 1) cores=1; printf "%.6f", load_value / cores }')"
  printf 'LOAD_READBACK load1=%s cores=%s load_per_core=%s max=%s\n' "$load1" "$cores" "$ratio" "$MAX_LOAD_PER_CORE"
  awk -v ratio="$ratio" -v max="$MAX_LOAD_PER_CORE" 'BEGIN { exit !(ratio <= max) }'
}

check_host_selector() {
  section "host selector"
  printf 'target_host_ip=%s\n' "$TARGET_HOST_IP"
  printf 'host_ips=%s\n' "$(host_ips | paste -sd, -)"
  if [ -n "$TARGET_HOST_IP" ] && ! host_has_ip "$TARGET_HOST_IP"; then
    blocker "target_host_ip_not_present_${TARGET_HOST_IP}"
  fi
}

check_config() {
  section "controlled lane config"
  local capacity labels label name has_host=0 has_ubuntu=0 forbidden=0 service_user_readable=0
  if [ ! -r "$CD_LANE_DRAIN_CONFIG" ]; then
    printf 'CD_LANE_CONFIG path=%s readable=0\n' "$CD_LANE_DRAIN_CONFIG"
    blocker "controlled_cd_lane_config_missing"
    return 0
  fi
  if service_user_test -r "$CD_LANE_DRAIN_CONFIG"; then
    service_user_readable=1
  else
    blocker "controlled_cd_lane_config_not_readable_by_service_user:${CD_LANE_DRAIN_USER}"
  fi
  capacity="$(extract_runner_capacity "$CD_LANE_DRAIN_CONFIG" | head -1)"
  printf 'CD_LANE_CONFIG path=%s readable=1 service_user=%s service_user_readable=%s capacity=%s max_capacity=%s\n' \
    "$CD_LANE_DRAIN_CONFIG" "$CD_LANE_DRAIN_USER" "$service_user_readable" "${capacity:-missing}" "$MAX_CAPACITY"
  if ! printf '%s' "${capacity:-}" | grep -Eq '^[0-9]+$'; then
    blocker "controlled_cd_lane_capacity_missing"
  elif [ "$capacity" -gt "$MAX_CAPACITY" ]; then
    blocker "controlled_cd_lane_capacity_too_high:${capacity}"
  fi

  labels="$(extract_runner_labels "$CD_LANE_DRAIN_CONFIG" || true)"
  if [ -z "$labels" ]; then
    blocker "controlled_cd_lane_labels_missing"
  fi
  while IFS= read -r label; do
    [ -n "$label" ] || continue
    name="$(label_name "$label")"
    printf 'CD_LANE_LABEL label=%s name=%s\n' "$label" "$name"
    if [ "$label" = "awoooi-host:host" ]; then
      has_host=1
    fi
    case "$label" in
      awoooi-ubuntu:docker://192.168.0.110:5000/awoooi/ci-runner:act-22.04)
        has_ubuntu=1
        ;;
    esac
    if printf '%s' "$name" | grep -Eq "$FORBIDDEN_LABEL_RE"; then
      forbidden=1
      blocker "controlled_cd_lane_forbidden_label:${name}"
    fi
    if [ "$name" != "awoooi-host" ] && [ "$name" != "awoooi-ubuntu" ]; then
      forbidden=1
      blocker "controlled_cd_lane_unexpected_label:${name}"
    fi
  done <<<"$labels"

  [ "$has_host" -eq 1 ] || blocker "controlled_cd_lane_awoooi_host_label_missing"
  [ "$has_ubuntu" -eq 1 ] || blocker "controlled_cd_lane_awoooi_ubuntu_label_missing"
  if [ "$has_host" -eq 1 ] && [ "$has_ubuntu" -eq 1 ] && [ "$forbidden" -eq 0 ] \
    && [ "$service_user_readable" -eq 1 ] \
    && printf '%s' "${capacity:-}" | grep -Eq '^[0-9]+$' && [ "$capacity" -le "$MAX_CAPACITY" ]; then
    CONFIG_READY=1
  fi
}

check_binary() {
  section "controlled lane binary"
  local kind service_user_executable=0
  kind="$(file -b "$CD_LANE_DRAIN_BINARY" 2>/dev/null || echo missing)"
  if service_user_test -x "$CD_LANE_DRAIN_BINARY"; then
    service_user_executable=1
  else
    blocker "controlled_cd_lane_binary_not_executable_by_service_user:${CD_LANE_DRAIN_USER}"
  fi
  printf 'CD_LANE_BINARY path=%s executable=%s service_user=%s service_user_executable=%s kind=%s\n' \
    "$CD_LANE_DRAIN_BINARY" "$([ -x "$CD_LANE_DRAIN_BINARY" ] && [ -f "$CD_LANE_DRAIN_BINARY" ] && echo 1 || echo 0)" \
    "$CD_LANE_DRAIN_USER" "$service_user_executable" "$kind"
  if [ -x "$CD_LANE_DRAIN_BINARY" ] && [ -f "$CD_LANE_DRAIN_BINARY" ] && [ "$service_user_executable" -eq 1 ] && grep -qi "ELF" <<<"$kind"; then
    BINARY_READY=1
  else
    blocker "controlled_cd_lane_binary_not_ready"
  fi
}

check_registration() {
  section "controlled lane registration metadata"
  local registration found=0 mode size service_user_readable=0
  for registration in $CD_LANE_DRAIN_REGISTRATION_PATHS; do
    if [ -f "$registration" ] && [ -s "$registration" ]; then
      service_user_readable=0
      if service_user_test -r "$registration"; then
        service_user_readable=1
      else
        blocker "controlled_cd_lane_registration_not_readable_by_service_user:${CD_LANE_DRAIN_USER}"
      fi
      mode="$(stat -c '%a' "$registration" 2>/dev/null || stat -f '%Lp' "$registration" 2>/dev/null || echo unknown)"
      size="$(stat -c '%s' "$registration" 2>/dev/null || stat -f '%z' "$registration" 2>/dev/null || echo unknown)"
      printf 'CD_LANE_REGISTRATION path=%s present=1 size_bytes=%s mode=%s service_user=%s service_user_readable=%s content_read=false\n' \
        "$registration" "$size" "$mode" "$CD_LANE_DRAIN_USER" "$service_user_readable"
      if [ "$service_user_readable" -eq 1 ]; then
        found=1
      fi
    else
      printf 'CD_LANE_REGISTRATION path=%s present=0 content_read=false\n' "$registration"
    fi
  done
  if [ "$found" -eq 1 ]; then
    REGISTRATION_READY=1
  else
    blocker "controlled_cd_lane_registration_missing"
  fi
}

unit_has_required_limits() {
  local text="$1"
  grep -Eq '^[[:space:]]*CPUAccounting=true' <<<"$text" || return 1
  grep -Eq '^[[:space:]]*CPUQuota=' <<<"$text" || return 1
  grep -Eq '^[[:space:]]*MemoryAccounting=true' <<<"$text" || return 1
  grep -Eq '^[[:space:]]*Memory(Max|High)=' <<<"$text" || return 1
  grep -Eq '^[[:space:]]*TasksAccounting=true' <<<"$text" || return 1
  grep -Eq '^[[:space:]]*TasksMax=' <<<"$text" || return 1
  grep -Eq '^[[:space:]]*NoNewPrivileges=true' <<<"$text" || return 1
  grep -Eq '^[[:space:]]*Restart=' <<<"$text" || return 1
  return 0
}

unit_has_target_match() {
  local text="$1"
  grep -Fq -- "$CD_LANE_DRAIN_BINARY" <<<"$text" || return 1
  grep -Fq -- "$CD_LANE_DRAIN_CONFIG" <<<"$text" || return 1
  return 0
}

unit_has_registration_condition() {
  local text="$1"
  local registration
  for registration in $CD_LANE_DRAIN_REGISTRATION_PATHS; do
    if grep -Eq "^[[:space:]]*ConditionPathExists=${registration//\//\\/}[[:space:]]*$" <<<"$text"; then
      return 0
    fi
  done
  return 1
}

check_service() {
  section "controlled lane service"
  local text state active mainpid limits_ok=0 target_ok=0 condition_ok=0
  if ! text="$(systemd_cat "$CD_LANE_DRAIN_SERVICE" 2>/dev/null)"; then
    printf 'CD_LANE_SERVICE unit=%s installed=0\n' "$CD_LANE_DRAIN_SERVICE"
    blocker "controlled_cd_lane_service_missing"
    return 0
  fi
  state="$(systemd_show "$CD_LANE_DRAIN_SERVICE" | tr '\n' ' ')"
  active="$(printf '%s\n' "$state" | tr ' ' '\n' | awk -F= '$1 == "ActiveState" {print $2; exit}')"
  mainpid="$(printf '%s\n' "$state" | tr ' ' '\n' | awk -F= '$1 == "MainPID" {print $2; exit}')"
  printf 'CD_LANE_SERVICE unit=%s installed=1 %s\n' "$CD_LANE_DRAIN_SERVICE" "$state"
  if unit_has_required_limits "$text"; then
    limits_ok=1
  else
    blocker "controlled_cd_lane_service_limits_missing"
  fi
  if unit_has_target_match "$text"; then
    target_ok=1
  else
    blocker "controlled_cd_lane_service_target_mismatch"
  fi
  if unit_has_registration_condition "$text"; then
    condition_ok=1
  else
    blocker "controlled_cd_lane_service_registration_condition_missing"
  fi
  printf 'CD_LANE_SERVICE_GUARDRAILS unit=%s active=%s main_pid=%s limits=%s target_match=%s registration_condition=%s\n' \
    "$CD_LANE_DRAIN_SERVICE" "${active:-unknown}" "${mainpid:-0}" "$limits_ok" "$target_ok" "$condition_ok"
  if [ "$limits_ok" -eq 1 ] && [ "$target_ok" -eq 1 ] && [ "$condition_ok" -eq 1 ]; then
    SERVICE_GUARDRAILS_READY=1
  fi
  if [ "$REQUIRE_ACTIVE_SERVICE" = "1" ]; then
    if [ "${active:-}" != "active" ] || ! printf '%s' "${mainpid:-0}" | grep -Eq '^[1-9][0-9]*$'; then
      blocker "controlled_cd_lane_service_not_active"
    fi
  fi
  if [ "$limits_ok" -eq 1 ] && [ "$target_ok" -eq 1 ] && [ "$condition_ok" -eq 1 ]; then
    if [ "$REQUIRE_ACTIVE_SERVICE" != "1" ] || { [ "${active:-}" = "active" ] && printf '%s' "${mainpid:-0}" | grep -Eq '^[1-9][0-9]*$'; }; then
      SERVICE_READY=1
    fi
  fi
}

check_failclosed_boundaries() {
  section "legacy fail-closed boundary"
  local unit legacy_blockers=0 path kind
  if [ "$REQUIRE_PRIMARY_LANE_FAILCLOSED" = "1" ]; then
    if unit_failclosed_or_absent "$PRIMARY_CD_LANE_SERVICE"; then
      PRIMARY_LANE_FAILCLOSED=1
    else
      legacy_blockers=$((legacy_blockers + 1))
      blocker "primary_cd_lane_not_failclosed:${PRIMARY_CD_LANE_SERVICE}"
    fi
  else
    PRIMARY_LANE_FAILCLOSED=1
  fi

  for unit in $LEGACY_RUNNER_SERVICE_NAMES; do
    if ! unit_failclosed_or_absent "$unit"; then
      legacy_blockers=$((legacy_blockers + 1))
      blocker "legacy_runner_unit_not_failclosed:${unit}"
    fi
  done
  for path in $LEGACY_RUNNER_BINARY_PATHS; do
    kind="$(file -b "$path" 2>/dev/null || echo missing)"
    printf 'FAILCLOSED_BINARY path=%s kind=%s\n' "$path" "$kind"
    if grep -qi "ELF" <<<"$kind"; then
      legacy_blockers=$((legacy_blockers + 1))
      blocker "legacy_runner_binary_restored:${path}"
    fi
  done
  if [ "$legacy_blockers" -eq 0 ]; then
    LEGACY_FAILCLOSED=1
  fi
}

check_pressure() {
  section "pressure readback"
  local containers heavy
  containers="$(active_action_container_count)"
  heavy="$(heavy_process_count)"
  printf 'ACTIVE_ACTION_CONTAINERS=%s max=%s\n' "$containers" "$MAX_ACTIVE_ACTION_CONTAINERS"
  printf 'HEAVY_PROCESS_COUNT=%s max=%s\n' "$heavy" "$MAX_HEAVY_PROCESS_COUNT"
  [ "$containers" -le "$MAX_ACTIVE_ACTION_CONTAINERS" ] || blocker "active_action_containers_present:${containers}"
  [ "$heavy" -le "$MAX_HEAVY_PROCESS_COUNT" ] || blocker "heavy_processes_present:${heavy}"
  load_per_core_ok || blocker "host_load_per_core_too_high"
}

check_restore_sources() {
  section "restore-source readback"
  if [ -d "$ROOT_RESTORE_PARENT" ]; then
    ROOT_RESTORE_LEFT="$(find "$ROOT_RESTORE_PARENT" -maxdepth 1 -type d \( -name 'awoooi-cd-lane-disabled-*' -o -name 'awoooi-cd-lane-drain-disabled-*' \) -print 2>/dev/null | wc -l | tr -d ' ')"
  else
    ROOT_RESTORE_LEFT=0
  fi
  printf 'CD_LANE_ROOT_RESTORE_SOURCES parent=%s left=%s\n' "$ROOT_RESTORE_PARENT" "$ROOT_RESTORE_LEFT"
  [ "$ROOT_RESTORE_LEFT" = "0" ] || blocker "cd_lane_root_restore_sources_left:${ROOT_RESTORE_LEFT}"
}

print_verdict() {
  section "verdict"
  printf 'CONFIG_READY=%s\n' "$CONFIG_READY"
  printf 'BINARY_READY=%s\n' "$BINARY_READY"
  printf 'REGISTRATION_READY=%s\n' "$REGISTRATION_READY"
  printf 'SERVICE_READY=%s\n' "$SERVICE_READY"
  printf 'SERVICE_GUARDRAILS_READY=%s\n' "$SERVICE_GUARDRAILS_READY"
  printf 'LEGACY_FAILCLOSED=%s\n' "$LEGACY_FAILCLOSED"
  printf 'PRIMARY_LANE_FAILCLOSED=%s\n' "$PRIMARY_LANE_FAILCLOSED"
  printf 'WARNING_COUNT=%s\n' "${#WARNINGS[@]}"
  printf 'BLOCKER_COUNT=%s\n' "${#BLOCKERS[@]}"
  if [ "${#BLOCKERS[@]}" -eq 0 ]; then
    printf 'AWOOOI_110_CONTROLLED_CD_LANE_READY=1\n'
    printf 'safe_next_step=rerun_harbor_110_local_repair_queue_readback_and_non110_cd_closure_verifier\n'
    return 0
  fi
  printf 'AWOOOI_110_CONTROLLED_CD_LANE_READY=0\n'
  if [ "$CONFIG_READY" -eq 0 ] || [ "$BINARY_READY" -eq 0 ] || [ "$SERVICE_GUARDRAILS_READY" -eq 0 ]; then
    printf 'safe_next_step=restore_awoooi_cd_lane_drain_staging_artifacts_then_rerun_this_verifier\n'
  elif [ "$REGISTRATION_READY" -eq 0 ]; then
    printf 'safe_next_step=restore_or_register_awoooi_cd_lane_drain_registration_without_printing_token_then_rerun_this_verifier\n'
  elif [ "$ROOT_RESTORE_LEFT" != "0" ]; then
    printf 'safe_next_step=quarantine_cd_lane_root_restore_sources_then_rerun_this_verifier\n'
  elif [ "$SERVICE_READY" -eq 0 ] && [ "$CONFIG_READY" -eq 1 ] && [ "$BINARY_READY" -eq 1 ]; then
    printf 'safe_next_step=start_awoooi_cd_lane_drain_service_after_apply_window_then_rerun_this_verifier\n'
  else
    printf 'safe_next_step=fix_controlled_cd_lane_guardrail_blockers_then_rerun_this_verifier\n'
  fi
  return 1
}

main() {
  section "audit metadata"
  printf 'read_only=true\n'
  printf 'secret_values_collected=false\n'
  printf 'runner_token_read=false\n'
  printf 'raw_runner_registration_read=false\n'
  printf 'timestamp=%s\n' "$(date -Is 2>/dev/null || date)"
  printf 'host=%s\n' "$(hostname 2>/dev/null || echo unknown)"
  printf 'user=%s\n' "$(id -un 2>/dev/null || echo unknown)"

  check_host_selector
  check_config
  check_binary
  check_registration
  check_service
  check_failclosed_boundaries
  check_restore_sources
  check_pressure
  print_verdict
}

main "$@"
