"""Prepared supervisor-only transport. NEVER run before founder exception approval.
No credentials leave the workload. Source/grant are delivered only on stdin.
"""
import argparse,base64,hashlib,json,os,stat,subprocess,sys
from pathlib import Path

def main():
 p=argparse.ArgumentParser(description=__doc__)
 p.add_argument('--executor',type=Path,required=True)
 p.add_argument('--executor-sha256',required=True)
 p.add_argument('--grant-file',type=Path,required=True)
 p.add_argument('--grant-sha256',required=True)
 p.add_argument('--expected-pod-uid',required=True)
 p.add_argument('--mode',choices=['dry-run','apply','rollback'],default='dry-run')
 a=p.parse_args()
 try:
  st=a.grant_file.lstat()
  if not stat.S_ISREG(st.st_mode) or st.st_uid!=os.getuid() or stat.S_IMODE(st.st_mode)!=0o600 or st.st_size>8192:raise ValueError('private grant required')
  source=a.executor.read_bytes();grant=json.loads(a.grant_file.read_text())
  sha=lambda b:hashlib.sha256(b).hexdigest()
  canonical=lambda x:json.dumps(x,sort_keys=True,separators=(',',':')).encode()
  if sha(source)!=a.executor_sha256 or sha(canonical(grant))!=a.grant_sha256:raise ValueError('source/grant mismatch')
  packet={'source':base64.b64encode(source).decode(),'executor_sha256':a.executor_sha256,'grant':grant,'grant_sha256':a.grant_sha256,'mode':a.mode}
  native="""
import base64,hashlib,json,os,sys
payload=json.loads(base64.b64decode('__PACKET__'))
saved=os.dup(1);null=os.open(os.devnull,os.O_WRONLY);os.dup2(null,1);os.dup2(null,2)
try:
 source=base64.b64decode(payload['source'])
 if hashlib.sha256(source).hexdigest()!=payload['executor_sha256']:raise ValueError('source differs')
 ns={'__name__':'supervised_catalogue_maintenance'};exec(compile(source,'<reviewed-maintenance-executor>','exec'),ns)
 import psycopg
 from user_engine.adapters.flex_auth import FlexAuthHTTPAdapter
 ordinary=FlexAuthHTTPAdapter(base_url=os.environ['USER_ENGINE_FLEX_AUTH_URL'],bearer_token_file=os.environ['USER_ENGINE_FLEX_AUTH_TOKEN_FILE'],timeout_seconds=3)
 with psycopg.connect(os.environ['USER_ENGINE_DATABASE_URL']) as conn:
  result=ns['execute'](conn,ordinary,payload['grant'],expected_grant_sha256=payload['grant_sha256'],actual_executor_sha256=payload['executor_sha256'],mode=payload['mode'])
except Exception:result={'result':'refused-or-rolled-back','raw_output_suppressed':True}
os.dup2(saved,1);os.close(saved);os.close(null);print(json.dumps(result,sort_keys=True))
""".replace('__PACKET__',base64.b64encode(canonical(packet)).decode())
  remote="""
import base64,json,subprocess,sys
r=subprocess.run(['kubectl','get','pods','-n','user-engine','-l','app.kubernetes.io/name=user-engine','-o','json'],capture_output=True,text=True)
try:
 pods=[p for p in json.loads(r.stdout)['items'] if p['metadata']['uid']=='__UID__' and p.get('status',{}).get('phase')=='Running' and any(c['type']=='Ready' and c['status']=='True' for c in p.get('status',{}).get('conditions',[]))]
 if r.returncode or len(pods)!=1:raise ValueError('fixed pod not ready')
 pod=pods[0];portal=[c for c in pod['spec']['containers'] if c['name']=='portal']
 if len(portal)!=1 or portal[0]['image']!='forgejo.coulomb.social/coulomb/user-engine@sha256:f239bbf332b8eb87320c86390fddca1dcb4f7c628a7af75e79dee8058d446a7b':raise ValueError('source runtime differs')
 r=subprocess.run(['kubectl','exec','-i','-n','user-engine',pod['metadata']['name'],'-c','portal','--','python3','-'],input=base64.b64decode('__NATIVE__'),capture_output=True)
 out=json.loads(r.stdout)
 if r.returncode:raise ValueError('exec failure')
except Exception:out={'result':'refused-or-rolled-back','raw_output_suppressed':True}
print(json.dumps(out,sort_keys=True))
""".replace('__UID__',a.expected_pod_uid).replace('__NATIVE__',base64.b64encode(native.encode()).decode())
  import uuid
  uuid.UUID(a.expected_pod_uid) # only UUID reaches the fixed remote literal
  r=subprocess.run(['ssh','railiance01','python3 -'],input=remote,text=True,capture_output=True)
  out=json.loads(r.stdout)
  if r.returncode:raise ValueError('transport failure')
 except Exception:out={'result':'refused-or-rolled-back','raw_output_suppressed':True}
 print(json.dumps(out,sort_keys=True))
 return 0 if out.get('result') in ('created','no-change','rolled-back') else 2
if __name__=='__main__':raise SystemExit(main())