"""Single-attempt T03 owner procedure; native PEP checks precede every action."""
import argparse,base64,copy,contextlib,io,json,os,stat,subprocess,sys,tempfile
from pathlib import Path
from datetime import datetime,timezone
from dataclasses import replace
import yaml
ROOT=Path('/home/worsch/secrets-engine')
sys.path.insert(0,str(ROOT/'src'))
sys.path.insert(0,'/home/worsch/railiance-clock/src')
from secrets_engine.config import Config
from secrets_engine.catalog import get_entry
from secrets_engine.authorization import build_action_request,digest_material
from secrets_engine.approval_consume import authorize_action
from secrets_engine.cli import build_parser
from secrets_engine.decisions import resolve_decision,require_approved
from secrets_engine.openbao import OpenBaoClient
from secrets_engine.exec_owner import validate_delivery_target
from secrets_engine.plan import build_plan
RECEIPT=ROOT/'docs/evidence/2026-09-15-t03-native-execution.json'
KUBE=['kubectl','--kubeconfig','/home/worsch/.kube/config-railiance01']
ROLE='se-prod-openrouter-llm-connect'; LANE='openrouter-llm-connect'
IDS={'apply':'9935335c-8e9a-566e-a48e-6a5b5f4882eb','verify':'273d6882-6253-5dc9-ac54-544f92ef5e56','exec':'7ba0c13b-68cd-5b3e-9481-42ba9e385e68'}

def require(value,code):
 if not value:raise ValueError(code)
def private(p,directory=False):
 s=p.lstat();require(s.st_uid==os.getuid() and stat.S_IMODE(s.st_mode)==(0o700 if directory else 0o600) and (stat.S_ISDIR(s.st_mode) if directory else stat.S_ISREG(s.st_mode)),'private_path_required')
def run(*args):
 p=subprocess.run(args,capture_output=True,text=True,timeout=30);require(p.returncode==0,'metadata_command_failed');return p.stdout
def bao(*args):return json.loads(run('bao',*args))
def save(receipt):RECEIPT.write_text(json.dumps(receipt,indent=2)+'\n')
def prepare(directory):
 source=yaml.safe_load((ROOT/'docs/proposals/openrouter-key-check.yaml').read_text())
 configs={};entries={}
 for action,approval in IDS.items():
  folder=directory/action;folder.mkdir();doc=copy.deepcopy(source);doc['approval']['authorization_id']=approval
  (folder/(LANE+'.yaml')).write_text(yaml.safe_dump(doc,sort_keys=False))
  cfg=replace(Config.load(),catalog_dir=folder,bao_addr='http://127.0.0.1:18200',approval_url='http://127.0.0.1:18281',approval_token_file=None,approval_client_secret_file=directory/'client-secret',keycape_token_url='https://kc.coulomb.social/token',keycape_issuer='https://kc.coulomb.social',keycape_client_secret_file=None,openbao_jwt_login_file=None,authorization_subject_id='secrets-engine',authorization_subject_type='service',authorization_policy_package='secrets-engine.catalog-lane.lifecycle',authorization_policy_version='v2',authorization_min_approvals=1,pdp_url='http://127.0.0.1:18282',pdp_token_file=directory/'pdp-caller')
  entry=get_entry(folder,LANE);fields=() if action=='apply' else tuple(entry.fields)
  actual=build_action_request(entry,action,subject_id='secrets-engine',subject_type='service',purpose=entry.approval['purpose'],fields=fields,policy_targets=(entry.policy_name,),auth_targets=(entry.role_name,))
  expected=json.loads((ROOT/f'docs/evidence/2026-09-14-openrouter-final-{action}-request.json').read_text())
  require(digest_material(actual)==digest_material(expected),'frozen_action_request_drift')
  configs[action]=cfg;entries[action]=entry
 command=source['delivery_config']['exec_owner']['command']
 validate_delivery_target(entries['exec'],entries['exec'].fields[0],command,'exec-env')
 plan=build_plan(entries['apply'],'prod');require(plan.policy_name==ROLE and plan.role_name==ROLE,'plan_target_drift')
 return configs,entries,command

def health():
 # Metadata only: never request Kubernetes Secret payloads.
 result={}
 for kind in ('deployment','externalsecret'):
  items=json.loads(run(*KUBE,'get',kind,'-A','-o','json'))['items']
  rows=[]
  for obj in items:
   if 'llm-connect' not in obj['metadata']['name']:continue
   if kind=='deployment':
    require(obj.get('status',{}).get('readyReplicas',0)>=1,'llm_connect_not_ready')
    rows.append({'namespace':obj['metadata']['namespace'],'name':obj['metadata']['name'],'ready':obj['status']['readyReplicas']})
   else:
    require(any(c['type']=='Ready' and c['status']=='True' for c in obj.get('status',{}).get('conditions',[])),'llm_connect_eso_not_ready')
    rows.append({'namespace':obj['metadata']['namespace'],'name':obj['metadata']['name'],'ready':True})
  require(rows,'llm_connect_health_target_missing');result[kind]=rows
 return result

def verify_session_cleanup(client):
 # Keep the explicit scoped token in memory: close() clears session.client.token,
 # which otherwise makes a subsequent CLI call use the attended admin helper.
 from urllib.request import Request,build_opener,ProxyHandler,HTTPRedirectHandler
 from urllib.error import HTTPError
 class NoRedirect(HTTPRedirectHandler):
  def redirect_request(self,*a,**k):return None
 with client.approle_session(ROLE) as session:
  probe_token=session.client.token
  probes=['platform/data/workloads/secrets-engine/approval-client','platform/metadata/workloads/activity-core']
  require(all(session.client.token_capabilities(p,token=probe_token)==['deny'] for p in probes),'unrelated_path_authority')
 try:
  require(session.revocation_succeeded,'session_revocation_failed')
  req=Request(client.addr+'/v1/auth/token/lookup-self',headers={'X-Vault-Token':probe_token})
  try:
   with build_opener(ProxyHandler({}),NoRedirect()).open(req,timeout=20) as response:
    raise ValueError('revoked_token_still_usable')
  except HTTPError as error:
   require(error.code==403,'revocation_probe_not_definitive')
 finally:
  del probe_token
 return {'unrelated_path_denied':True,'session_revocation_verified':True,'revoked_token_lookup_status':403}

def resume_receipt():
 prior=json.loads((ROOT/'docs/evidence/2026-09-15-t03-native-execution.json').read_text())
 require(prior.get('phase')=='verify_attempt_started' and prior.get('failure_code')=='revoked_token_still_usable','unexpected_prior_failure')
 require(prior.get('actions')==[{'action':'apply','approval_id':IDS['apply'],'exit_code':0,'limits':{'token_ttl':900,'token_max_ttl':1800,'secret_id_ttl':900,'secret_id_num_uses':1,'token_num_uses':8}}],'prior_apply_not_verified')
 return prior

def admin(directory,negative,resume=False):
 require(not RECEIPT.exists(),'existing_execution_receipt_requires_reconciliation')
 receipt={'status':'failed','phase':'preflight','observed_at':datetime.now(timezone.utc).isoformat(),'actions':[]}
 forwards=[]
 try:
  require(Path.home().parent.name=='.warden-attended-login' and not os.getenv('BAO_TOKEN') and not os.getenv('VAULT_TOKEN'),'attended_envelope_required')
  private(directory,True);private(directory/'client-secret');private(negative)
  identity=bao('token','lookup','-format=json')['data'];policies=set(identity['policies'])|set(identity.get('identity_policies',[]))
  require('platform-admin' in policies and 'root' not in policies and identity.get('entity_id') and 0<identity['ttl']<=3600,'attended_operator_required')
  require(bao('read','-format=json','sys/auth')['data'].get('approle/') is not None,'existing_approle_mount_required')
  configs,entries,command=prepare(directory)
  from secrets_engine.application_time import read_window
  require(all(cfg.clock_trust_file for cfg in configs.values()),'admitted_railiance_clock_required')
  for cfg in configs.values():read_window(cfg)
  receipt['health_before']=health()
  for ns,label,image,port in [('approval-engine','approval-engine','251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49',18281),('flex-auth','flex-auth-secrets-engine','05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd',18282)]:
   pods=json.loads(run(*KUBE,'-n',ns,'get','pods','-l','app.kubernetes.io/name='+label,'-o','json'))['items']
   require(len(pods)==1,'single_owner_pod_required');pod=pods[0]
   require(any(c.get('ready') and c.get('imageID','').endswith('@sha256:'+image) for c in pod.get('status',{}).get('containerStatuses',[])),'native_image_pin_drift')
   p=subprocess.Popen(KUBE+['-n',ns,'port-forward','pod/'+pod['metadata']['name'],str(port)+':8080','--address=127.0.0.1'],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL);forwards.append(p)
  import socket,time
  for port in (18281,18282):
   for attempt in range(50):
    try:
     with socket.create_connection(('127.0.0.1',port),timeout=.2):break
    except OSError:time.sleep(.1)
   else:raise ValueError('owner_forward_not_ready')
  fd=os.open(directory/'pdp-caller',os.O_WRONLY|os.O_CREAT|os.O_EXCL,0o600)
  with os.fdopen(fd,'w') as out:out.write(run(*KUBE,'-n','secrets-engine','create','token','secrets-engine','--audience=flex-auth','--duration=10m').strip())
  # Validate real claims and exact current decisions before any consumption.
  actions=('exec',) if resume else tuple(IDS)
  for action in actions:
   auth=authorize_action(configs[action],entries[action],action,fields=() if action=='apply' else tuple(entries[action].fields),policy_targets=(ROLE,),auth_targets=(ROLE,))
   require(auth is not None,'native_authorization_missing')
  receipt['phase']='all_claims_and_pdp_checks_passed';save(receipt)
  client=OpenBaoClient.resolve('http://127.0.0.1:18200')
  existing=client.read_policy(ROLE)
  if resume:
   prior=resume_receipt()
   plan=build_plan(entries['apply'],'prod')
   require(existing is not None and existing.strip()==plan.policy_hcl.strip(),'applied_policy_drift')
   role=bao('read','-format=json','auth/approle/role/'+ROLE)['data']
   require(all(role.get(k)==v for k,v in prior['actions'][0]['limits'].items()) and role.get('token_policies')==[ROLE],'applied_role_drift')
   code="import json;from approval_engine.store import Engine;e=Engine('/data/approvals.sqlite');print(json.dumps({k:e.claim(v) for k,v in "+repr(IDS)+".items()}))"
   claims=json.loads(run(*KUBE,'-n','approval-engine','exec','statefulset/approval-engine','--','python','-c',code))
   require(all(claims[a]['consumed'] and claims[a]['approval_id']==IDS[a] for a in ('apply','verify')) and claims['exec']['valid_now'] and not claims['exec']['consumed'],'resume_approval_state_mismatch')
   receipt['prior_receipt']='2026-09-15-t03-native-execution.json'
   receipt['completed_actions_not_replayed']=['apply','verify']
   receipt['supplemental_cleanup']=verify_session_cleanup(client);save(receipt)
  else:
   require(existing is None and not client.approle_exists(ROLE),'existing_native_objects_require_reconciliation')
  for action in actions:
   receipt['phase']=action+'_attempt_started';save(receipt)
   if action=='apply':argv=['apply',LANE,'--stage','prod','--auth','env']
   elif action=='verify':argv=['verify',LANE,'--auth','env','--negative-token-file',str(negative)]
   else:argv=['exec','--catalog',LANE,'--auth','env','--mode','exec-env','--',*command]
   args=build_parser().parse_args(argv)
   if action=='exec':args.command=args.command[1:]
   output=io.StringIO()
   with contextlib.redirect_stdout(output),contextlib.redirect_stderr(io.StringIO()):rc=args.func(configs[action],args)
   require(rc==0,'native_action_failed')
   row={'action':action,'approval_id':IDS[action],'exit_code':rc}
   if action=='apply':
    role=bao('read','-format=json','auth/approle/role/'+ROLE)['data']
    limits={'token_ttl':900,'token_max_ttl':1800,'secret_id_ttl':900,'secret_id_num_uses':1,'token_num_uses':8}
    require(all(role.get(k)==v for k,v in limits.items()) and role.get('token_policies')==[ROLE],'role_limits_mismatch');row['limits']=limits
   elif action=='verify':
    row.update(verify_session_cleanup(client))
   else:
    result=json.loads(output.getvalue());require(result=={'result':'authenticated','http_status':200},'key_check_result_invalid');row['key_check']=result
   receipt['actions'].append(row);receipt['phase']=action+'_completed';save(receipt)
  receipt['health_after']=health();receipt['status']='passed';receipt['phase']='all_actions_completed'
 except Exception as exc:
  receipt['failure_type']=type(exc).__name__
  import traceback
  frame=traceback.extract_tb(exc.__traceback__)[-1]
  receipt['failure_location']=frame.filename+':'+str(frame.lineno)
  # Only explicit local codes are eligible; no backend exception text is exported.
  if type(exc) is ValueError and str(exc).replace('_','').isalnum():receipt['failure_code']=str(exc)
  raise
 finally:
  for p in forwards:
   p.terminate()
   try:p.wait(timeout=5)
   except subprocess.TimeoutExpired:p.kill();p.wait()
  receipt['owner_forwards_closed']=True;save(receipt)

if __name__=='__main__':
 p=argparse.ArgumentParser();p.add_argument('mode',choices=['preflight','admin','resume-exec']);p.add_argument('--directory',type=Path);p.add_argument('--negative-token-file',type=Path);a=p.parse_args()
 try:
  if a.mode=='preflight':
   with tempfile.TemporaryDirectory() as t:prepare(Path(t))
   print('Three frozen requests and pinned recipient passed; native claims checked at execution.')
  else:
   if a.mode=='resume-exec':
    resume_receipt()
    RECEIPT=ROOT/'docs/evidence/2026-09-16-t03-resume-exec.json'
   admin(a.directory,a.negative_token_file,resume=a.mode=='resume-exec')
 except Exception:
  if a.mode=='preflight':raise
  raise SystemExit(1) from None