#!/usr/bin/env bash
set -Eeuo pipefail
umask 077

LABEL=REDIS01_Q131_IDENTITY_CHRONOLOGY
EXPECTED_HOST=sqjcredis01
EXPECTED_IP=10.2.203.112
Q073_RUN_ID=q073-20260727T181115+0800
Q073_EVIDENCE="/var/backups/zhct-q073/${Q073_RUN_ID}"
RUN_ID="q131-identity-chronology-$(date +%Y%m%dT%H%M%S%z)"
AUDIT_DIR="/var/backups/zhct-manual-preflight/${RUN_ID}"
AUDIT_LOG="${AUDIT_DIR}/operator.log"

finish() {
    rc=$?
    trap - EXIT
    printf 'END|%s|RC=%s|AUDIT_LOG=%s\n' \
        "$LABEL" "$rc" "${AUDIT_LOG:-NOT_CREATED}"
    exit "$rc"
}
trap finish EXIT

printf 'BEGIN|%s|%s\n' "$LABEL" "$(date --iso-8601=seconds)"
actual_host=$(hostname -s)
printf 'IDENTITY|hostname=%s|expected=%s\n' "$actual_host" "$EXPECTED_HOST"
test "$actual_host" = "$EXPECTED_HOST"
ip -o -4 addr show scope global |
    awk '{split($4,a,"/"); print a[1]}' |
    grep -Fxq "$EXPECTED_IP"

install -d -o root -g root -m 0700 "$AUDIT_DIR"
exec > >(tee -a "$AUDIT_LOG") 2>&1
printf 'AUDIT_BEGIN|%s|%s\n' "$LABEL" "$(date --iso-8601=seconds)"

printf '%s\n' '=== Q073 SEALED RECEIPT ==='
test -d "$Q073_EVIDENCE"
result_file="$Q073_EVIDENCE/result.env"
identity_file="$Q073_EVIDENCE/clone-identity-after.env"
test -r "$result_file"
test -r "$identity_file"
stat -c 'Q073_FILE|%y|%s|%A|%U:%G|%n' "$result_file" "$identity_file"
grep -E \
    '^(run_id|completed_at|live_seal|clone_identity_removed|machine_id_bytes|ssh_host_key_file_count|post_clone_execution|template_state|q073)=' \
    "$result_file"
cat "$identity_file"

printf '%s\n' '=== CURRENT MACHINE ID METADATA ==='
for file in /etc/machine-id /var/lib/dbus/machine-id; do
    if test -e "$file" || test -L "$file"; then
        stat -c 'MACHINE_ID_FILE|%w|%y|%z|%s|%A|%U:%G|%F|%n' "$file"
    else
        printf 'MACHINE_ID_FILE|ABSENT|%s\n' "$file"
    fi
done

printf '%s\n' '=== CURRENT SSH HOST KEY METADATA ==='
key_count=$(find /etc/ssh -maxdepth 1 -type f -name 'ssh_host_*' |
    awk 'END {print NR+0}')
printf 'SSH_HOST_KEY_FILE_COUNT=%s\n' "$key_count"
find /etc/ssh -maxdepth 1 -type f -name 'ssh_host_*' -print0 |
    sort -z |
    xargs -0 -r stat -c \
        'SSH_HOST_KEY_FILE|%w|%y|%z|%s|%A|%U:%G|%n'

printf '%s\n' '=== BOOT AND SSHD TIMELINE ==='
printf 'UPTIME_SINCE=%s\n' "$(uptime -s)"
who -b || true
systemctl show sshd.service \
    -p LoadState -p ActiveState -p UnitFileState \
    -p ActiveEnterTimestamp -p ExecMainStartTimestamp --no-pager

printf '%s\n' '=== RELEVANT JOURNAL SINCE Q073 ==='
journalctl \
    --since '2026-07-27 18:10:00 +0800' \
    -u sshd.service \
    -u sshd-keygen.service \
    -u 'sshd-keygen@*.service' \
    --no-pager -n 160 2>&1 |
    grep -Ei 'started|starting|host key|ssh-keygen|server listening|failed|error' ||
    echo 'NO_MATCHING_SSHD_KEYGEN_JOURNAL_LINES'

printf '%s\n' '=== CURRENT SAFE IDENTITY SUMMARY ==='
machine_ready=0
test -s /etc/machine-id && machine_ready=1
private_key_count=$(find /etc/ssh -maxdepth 1 -type f -name 'ssh_host_*_key' |
    awk 'END {print NR+0}')
keys_ready=0
test "$private_key_count" -eq 3 && keys_ready=1
env_ready=0
if test -r /etc/zhct/node.env &&
   grep -Fxq 'ROLE=redis' /etc/zhct/node.env &&
   grep -Fxq 'NODE_KEY=redis01' /etc/zhct/node.env &&
   grep -Fxq 'NODE_IP=10.2.203.112' /etc/zhct/node.env
then
    env_ready=1
fi
printf 'IDENTITY_COMPONENTS|machine=%s|keys=%s|env=%s\n' \
    "$machine_ready" "$keys_ready" "$env_ready"
echo 'DIAGNOSTIC_ONLY=PASS_NO_IDENTITY_OR_SERVICE_MUTATION'