
    *_jd                       d Z ddlmZ ddlZddlZddlZddlZddlZddlZddl	Z	ddl
Z
ddlZddlZddlZddlZddlZddlmZ ddlmZ ddlmZmZ dZdZd	Zd
ZdZdZdZdZdZdZ dZ! e"h d      Z#dZ$dZ%dZ&e	jN                   e(e	dd      z  Z) ee*      jW                         jX                  Z-e-j\                  d   Z/e/dz  dez   z  dz  Z0e/dz  Z1e/dz  Z2e/dz  Z3e-dz  Z4 G d d e5      Z6d>d!Z7d?d"Z8d@d#Z9dAd$Z:d%d&dBd'Z;d%d&dCd(Z<dDd)Z=dEd*Z>dFd+Z?dGd,Z@dHd-ZAdId.ZBdd/dJd0ZC G d1 d2      ZDdKd3ZEdLd4ZFdMd5ZGdMd6ZHdMd7ZIdMd8ZJdNd9ZKdMd:ZLdOd;ZMdPd<ZNeOd=k(  r eP eN             y)Qa>  Permission-sealed preparation/observation for one Task26 logical invite.

This tool has no Telegram, provider, service, archive, Git, or JSON-mutation path.
The sole profile writers it can call are the shipped candidate store's atomic
prepare and expire APIs. Receipts are redacted; only the handoff contains a token.
    )annotationsN)Path)Any)parse_qsurlparse@2e0894eac92bc396cc4723bf1f18ebc653b95018dd41574df435941c235da925@af4a9d0a1ffffb6eb7551c1d6dc2b32853ca6d024332a4f8f5702bbf992f141b@7ace03c6dad33d2fc3ef223621cbca68a150fde8429932138e252fb8498ac582@1f55b8f967c6564113574d41bf1c15ce977d35c38b5687f1623ba37f235a7bdb@f4f2d2347b4b68a080b9c437a813accbef8c4bcc471cbf21d67ffff31e56f89b
8527916639
8693203710dual_coach_pilot_test_bot@23845bda574c085e16b6d316e5e84e54b3bc6db3a8803c6b3b93ed7c4b86b049z0gateway/platforms/telegram_customer_bootstrap.py@145515d5e110dcebb94fcaa554bcee29544b3a75dcfe058fae944ea3b70042b2>   ACTIVEFAILEDEXPIRED	CANCELLED         
O_NOFOLLOW   z.omo/evidence/task26z"task26-repaired-archive-successor-z.artifacts/hermes_agent-0.17.0-py3-none-any.whlz,.omo/plans/dualcoach-production-readiness.mdz^.omo/evidence/task26/task26-runbook-rebind-2e0894ea-st_01a0054e/task26-golden-path-2e0894ea.mdzc.omo/evidence/task26/task26-runbook-rebind-2e0894ea-st_01a0054e/task26-recovery-runbook-2e0894ea.mdzapproval-receipt.jsonc                      e Zd Zy)HarnessErrorN)__name__
__module____qualname__     H.omo/evidence/task26/task26-invite-harness-st_01a0056a/invite_harness.pyr   r   6   s    r!   r   c                H    t        j                  |       j                         S N)hashlibsha256	hexdigest)raws    r"   	sha_bytesr)   :   s    >>#((**r!   c                .    t        t        | d            S )NFprivate)r)   read_regular)paths    r"   sha_filer/   >   s    \$677r!   c                V    t        j                  | ddd      dz   j                         S )NT,:)	sort_keys
separatorsensure_ascii
)jsondumpsencode)values    r"   	canonicalr<   B   s'    JJuRVWZ^^ffhhr!   c                    | j                   | j                  | j                  | j                  | j                  | j
                  | j                  | j                  fS r$   )st_devst_inost_modest_nlinkst_uidst_sizest_mtime_nsst_ctime_ns)infos    r"   stablerG   F   sB    KKdllDMM4;;LL$**D,<,<> >r!   Tr+   c                  t        j                  | t         j                  t        z        }	 t        j                  |      }t        j                  |j                        r0|j                  dk7  s!|j                  t        j                         k7  rt        d|        |r/t        j                  |j                        dvrt        d|        g }t        j                  |d      x}r*|j                  |       t        j                  |d      x}r*t        |      t        t        j                  |            k7  rt        d|        dj!                  |      t        j"                  |       S # t        j"                  |       w xY w)N   zunsafe regular file: >   @  r       zfile is not private: i   zfile changed during read: r!   )osopenO_RDONLYO_FLAGSfstatstatS_ISREGr@   rA   rB   getuidr   S_IMODEreadappendrG   joinclose)r.   r,   fdbeforechunkschunks         r"   r-   r-   K   s)   	r{{W,	-B"||FNN+v!/Cv}}XZXaXaXcGc!6tf=>>t||FNN3;WW!6tf=>> wwr;//e/MM%  wwr;//e/&>VBHHRL11!;D6BCCxx
s   C&E2 AE2 2F	c                   	 t        j                  t        | |            }t        |t              st        d|        |S # t        t         j                  f$ r}t        d|        |d }~ww xY w)Nr+   zinvalid JSON: zJSON root is not an object: )r8   loadsr-   UnicodeDecodeErrorJSONDecodeErrorr   
isinstancedict)r.   r,   r;   excs       r"   	read_jsonre   ]   sq    =

<g>? eT"9$@AAL	  4 45 =^D623<=s    A A/A**A/c                ~   | j                   j                  ddd       | j                   j                         rt        d      t	        |      }t        j                  | t
        j                  t
        j                  z  t
        j                  z  t        z  d      }	 t        j                  |d       d}|t        |      k  r+|t        j                  |||d        z  }|t        |      k  r+t        j                  |       t        j                  |       t        j                  | j                   t
        j                   t
        j"                  z  t        z        }	 t        j                  |       t        j                  |       y # t        j                  |       w xY w# t        j                  |       w xY w)NrL   T)modeparentsexist_okz"receipt parent cannot be a symlinkrK   r   )parentmkdir
is_symlinkr   r<   rM   rN   O_WRONLYO_CREATO_EXCLrP   fchmodlenwritefsyncrY   rO   O_DIRECTORY)r.   r;   r(   rZ   offset	directorys         r"   exclusive_writerw   g   s2   KK5$>{{?@@
E
C	r{{RZZ/"));gEu	MB
		"es3xbhhr3vw<00F s3x

R[[2>>%AG%KLI

 	
 	s   AF /F  F% F"%F<c                   t        |       }dt        t        t        t        t
        t        t        t        t        t        t              t        t        t              j                               d}|j                         D ]'  \  }}|j!                  |      |k7  st#        d|        |j!                  d      }t%        |t&              r||vrt#        d|       |S )Nz(task26-invite-harness-permission-seal-v1)schemacandidate_digestwheel_sha256plan_sha256golden_runbook_sha256recovery_runbook_sha256actor_idowner_idbot_usernameapproval_event_sha256approval_receipt_sha256harness_sha256zpermission seal mismatch: allowed_modeszmode is not permission sealed: )re   	CANDIDATEWHEEL_SHA256PLAN_SHA256GOLDEN_SHA256RECOVERY_SHA256ACTOR_IDOWNER_IDBOT_USERNAMEAPPROVAL_EVENT_SHA256r/   APPROVAL_RECEIPTr   __file__resolveitemsgetr   rb   list)r.   rg   sealexpectedkeywantedalloweds          r"   verify_sealr   |   s    T?D<%$"!.#2$!6#+,<#="4>#9#9#;<H  ~~'V88C=F"!;C5ABB ( hh'Ggt$G(;<TFCDDKr!   c                 ^   t         t        ft        t        ft        t
        ft        t        ff} | D ]+  \  }}t        |      |k7  st        d|j                          t        j                  t               5 }|j                  t              }d d d        t              t         k7  rt        d      t"        j$                  j'                  d      }|1|j(                  %t        t+        |j(                              t         k7  rt        d      t        t         t         ddS # 1 sw Y   xY w)Nzbound evidence hash mismatch: z$wheel bootstrap member hash mismatch-gateway.platforms.telegram_customer_bootstrapzAloaded bootstrap module bytes are not the shipped candidate bytesPASS)r{   wheel_module_sha256loaded_module_sha256loaded_byte_match)WHEELr   PLANr   GOLDENr   RECOVERYr   r/   r   namezipfileZipFilerV   MODULE_MEMBERr)   MODULE_SHA256	importlibutil	find_specoriginr   )pinsr.   r   archiver(   specs         r"   loaded_byte_proofr      s    L!D+#68O')DfD>V#!?		{KLL  
	7ll=) 
 ~&ABB>>##$STD|t{{*htDKK7H.I].Z^__$, -#	  
 	s   8D##D,c                    | dz  S )Nz:data/onboarding/telegram-customer-bootstrap-v1/ledger.jsonr    )profiles    r"   bootstrap_pathr      s    QQQr!   c                D   t        |       }t        |      h dk7  s|j                  d      dk7  rt        d      |j                  d      }t	        |t
              st        d      |d   |d}t        j                  |dd	d
d      j                  d      }|j                  d      t        |      k7  rt        d      g }g }|D ]  }t	        |t              st        d      |j                  d      }|j                  d      }	t	        |t              rt	        |	t              st        d      |j                  |       |j                  |	        t        t        |            t        |      k7  s t        t        |            t        |      k7  rt        d      |S )N>   digestry   sessionsry   telegram-customer-bootstrap-v1z/customer bootstrap ledger shape/schema mismatchr   z'customer bootstrap sessions are invalid)ry   r   FTr1   )r6   r4   r5   	allow_nanutf-8r   z)customer bootstrap ledger digest mismatchz%customer bootstrap session is invalid
session_idsid_hashz&customer bootstrap identity is invalidz+duplicate bootstrap session/token authority)re   setr   r   rb   r   r8   r9   r:   r)   rc   strrW   rq   )
r.   r;   r   payloadcandidate_bytesidshashesitemsidr   s
             r"   validate_ledger_documentr      sh   dOE
5z5589LPp9pLMMyy$Hh%DEExh?Gjjet
V[fWo  yyi88FGGCF$%FGGhh|$88J'#s#:h+DGHH

3h  3s8}C CF$4F$CHIILr!   c                    t        |       }|j                  |      g i fvr*t        d| j                  | j                  d                y )Nzexisting customer authority:    )re   r   r   relative_torh   )r.   fieldr;   s      r"   
empty_listr      sM    dOEyyBx':4;K;KDLLYZO;\:]^__ (r!   customer_keyc               j   | j                         s?| j                         r/| j                         j                  t	        j
                         k7  rt        d      t        |       }t        |      }|d   }t        d |D              rt        d      t        d |D              rt        d      t        fd|D              rt        d      t        | d	z  d
       t        | dz  d       t        | dz  d       t        | dz  d       t        | dz  d       | dz  j                         D ch c]  }|j                   }}h d}||k7  rt        d      | dz  }|j                         r$t        |j                               rt        d      t        | dz        }	|	j                  d      }
t!        |
t"              rt!        |
j                  d      t"              st        d      |
d   }|	j                  d      dk7  s|j                  d      dk7  rt        d      | dz  j                         rt        d       t$        t&        k(  rt        d!      t)               }|i d"d#d$t*        d%t$        d&t&        d'd(d)d(d*t-        |      d+d(d,d-d.d-d/d-d0d-d1d(d2d-d3|d4g d5fS c c}w )6Nzunsafe profile rootr   c              3  J   K   | ]  }|j                  d       t        v  ywstateNr   TERMINAL.0r   s     r"   	<genexpr>zpreflight.<locals>.<genexpr>   s     
B488GH,   !#z#nonterminal prior bootstrap sessionc              3  d   K   | ](  }|j                  d       xs |j                  d       * yw)role_claimsrecovery_attemptsN)r   r   s     r"   r   zpreflight.<locals>.<genexpr>   s.     
YPX488M"Cdhh/B&CCPXs   .0z8open claim/recovery authority in prior bootstrap sessionc              3     K   | ]<  }t        |j                  d       t              xr |d    j                  d      k(   > yw)customer_draftr   N)rb   r   rc   )r   r   r   s     r"   r   zpreflight.<locals>.<genexpr>   sQ      ( D 	488,-t4 	G!"&&~6,F	Gs   AAzcustomer key is not newzcustomers/registry.json	customersz6data/onboarding/telegram-room-bootstrap-v1/ledger.jsonz.data/owner-actions/customer-service-state.jsonstatesz:data/onboarding/telegram-publication-outbox-v1/ledger.jsonrecordsz=data/onboarding/telegram-publication-outbox-v1/emergency.jsonzdata/onboarding>   telegram-room-bootstrap-v1telegram-publication-outbox-v1r   z1existing or unknown onboarding customer authorityzdata/customersz!existing data/customers authorityzgateway_state.json	platformstelegramz!gateway state topology is invalidgateway_statestoppedr   disconnectedz1gateway must be stopped and Telegram disconnectedzgateway.lockzgateway.lock must be absentz&private-DM actor cannot be owner/staffstatusr   rz   r   r   actor_not_owner_staffTprivate_dm_requiredprior_session_countall_prior_sessions_terminal&existing_registry_customer_authoritiesr   "existing_room_customer_authorities%existing_service_customer_authorities(existing_onboarding_customer_authorities%gateway_stopped_telegram_disconnectedopen_recovery_authoritiesr   prohibited_operations)networkzTelegram/getUpdateszdrop updateszcursor editszarchive restore/prepopulationzdirect JSON mutationreplayzforced publicationzservice actionzprovider actionGit)rl   is_dirrR   rB   rM   rT   r   r   r   anyr   iterdirr   existsre   r   rb   rc   r   r   r   r   rq   )r   r   ledger_pathledgerr   r   onboarding_entriesexpected_entriescustomer_rootgatewayr   r   proofs    `           r"   	preflightr      s   7>>#3w||~7L7LPRPYPYP[7[011 )K%k2Fj!H

B
BB@AA

YPX
YYUVVC ( ( %
 455w22K@wQQS]^wII8TwUUW`awXXZcd18;L1L0U0U0WX0W$))0WX
 --NOO..M#m&;&;&=">>??"667GK(Ii&jz9RTX.Y>??$H{{?#y0HLL4I^4[NOO. ((*8998CDDE &I 	H 	H	
 	  	t 	s8} 	&t 	1! 	-a 	0 	3A 	0 	$Q 	U  	  "
!  / Ys   2J0c                  $    e Zd ZddZddZddZy)Inotifyc                   t        j                  d d      }|| _        |j                  t        j
                        | _        | j                  dk  rt        t        j                         d      |j                  | j                  t	        j                  |      t        t        z  t        z        | _        | j                  dk  rBt        j                         }t	        j                  | j                         t        |d|       y )NT)	use_errnor   inotify_init1zinotify_add_watch:)ctypesCDLL_libcr  rM   	O_CLOEXECrZ   OSError	get_errnoinotify_add_watchfsencodeIN_CLOSE_WRITEIN_MOVED_TO	IN_CREATEwatchrY   )selfrv   libcerrors       r"   __init__zInotify.__init__  s    {{440
$$R\\277Q;&**,o>>++GGR[[+^k-II-U

 ::>$$&EHHTWW%#5i[!ABB r!   c                B    t        j                  | j                         y r$   )rM   rY   rZ   )r  s    r"   rY   zInotify.close$  s    
r!   c                
   t        j                         |z   }	 |t        j                         z
  }|dk  rt        d      t        j                  | j                  gg g |      \  }}}|st        d      t        j                  | j                  d      }d}|dz   t        |      k  r]t        j                  d||      \  }	}
}}||dz   |dz   |z    j                  dd      d   }|d|z   z  }||k(  ry |dz   t        |      k  r])Nr   z bounded filesystem event timeouti      iIII    rI   )time	monotonicr   selectrZ   rM   rV   rq   structunpack_fromsplit)r  r   timeoutdeadline	remainingreadable_r   ru   _watch_mask_cookielengthobserveds                 r"   
await_namezInotify.await_name'  s   >>#g- 4>>#33IA~"#EFF#]]DGG9b"iHNHa"#EFFggdggu-GF2+W-171C1CFGU[1\.w"6B;v{V/CDJJ5RSTUVW"v+%t# 2+W- r!   N)rv   r   returnNone)r,  r-  )r   bytesr!  floatr,  r-  )r   r   r   r  rY   r+  r    r!   r"   r  r    s    Cr!   r  c                 r    t        j                  d      } | j                  | j                  | j                  fS )Nr   )r   import_moduleRoomBootstrapStoreload_customer_draftroom_bootstrap_state_dir)modules    r"   
import_apir6  :  s8    $$%TUF!!""'' r!   c                n    d|  d| t         t        t        t        t        t        t              t        dd
S )Nztask26-invite-harness-z-receipt-v1zCredacted; no raw token, link, Telegram content, or customer answers)
ry   rg   rz   r{   r|   r}   r~   r   r   privacy)r   r   r   r   r   r/   r   r   )rg   s    r"   base_receiptr9  C  s9    *4&<%$"!.#2#+,<#=!6X r!   c                    	 t        | j                        \  }}i t        d      |ddd}t        | j                  |       |S # t        $ r'}i t        d      dddt	        |      d}Y d }~Cd }~ww xY w)Ndry-runr   T)	mutationsready_for_one_inviteFAILFr   r<  r=  blocker)r   r   r9  r   r   rw   receipt)args_ledgerresultrA  rd   s        r"   dry_runrE  R  s    G#DLL11\), 1 1Q+/1
 DLL'*N	  GG\), GQ+0SXGGs   ,A 	A6A11A6c                F   	 t        | j                        \  }}i t        d      |t        t	        | j                              t        |d         ddd}t        | j                  |       |S # t        $ r'}i t        d      dddt        |      d}Y d }~Cd }~ww xY w)	Nverifyr   r   T)ledger_sha256ledger_session_countr<  r=  r>  Fr?  )
r   r   r9  r/   r   rq   r   r   rw   rA  )rB  r   rD  rA  rd   s        r"   rG  rG  ^  s    G"4<<01\(+ 1v 1$,^DLL-I$J+.vj/A+BQR+/1 DLL'*N	  GG\(+ GvA+0SXGGs   AA0 0	B 9BB c                	   | j                   j                         s| j                  j                         rt        d      t	               \  }}} || j
                        }t        | j                  |j                        \  }} || j                        }|j                         st        d      t        |      }	  ||      }	|	j                  |t        t              }
|j                  dd       |j                          t!        t#        |
j$                        j&                  d      }|j)                  d	      }t+        |t,              r"t/        |      d
k7  s|d   j1                  d      st        d      |d   }|dd  }|
j2                  t5        t7        | j                              }t/        |d         t/        |d         d
z   k7  rt        d      j8                  t;        |j=                  d            k7  rt        d      t?        fd|d   D              d
k7  rt        d      dj@                  ||
j$                  |
jB                  jE                         tF        dd}tI        | j                   |       i tK        d      |i dddd
dddddj@                  d t;        j@                  j=                  d            d!j8                  d"t;        |j=                  d            d#t;        |j                  j=                  d$            d%jL                  jN                  d&jP                  d'|
jB                  jE                         d(tS        t7        | j                              d)tS        | j                         d*d+d,tU        | j                         gd-d.}tI        | j                  |       | jV                  g }tY        jZ                  | jV                  d/0      D ]  \  }}}|j]                          |j]                          |D ]r  }t_        |      |z  }|ja                         s|jc                         s2	 te        |d1      }|j=                  d      |v sT|ji                  |jk                                t  || j                   jk                         gk7  rt        d2      |S # |j                          w xY w# t        tf        f$ r Y w xY w)3Nz+one-use handoff/receipt path already existsr   z;current-layout bootstrap state directory must already exist)r   r      ledger.jsong      @T)strict_parsingstartrI   r   rc1_z-candidate returned an invalid private handoff   r   z*prepare did not create exactly one sessionasciiz$candidate SID hash relation mismatchc              3  Z   K   | ]"  }|j                  d       j                  k(   $ yw)r   N)r   r   )r   r   sessions     r"   r   zprepare.<locals>.<genexpr>  s(     
VDUD488L!W%7%77DUs   (+z%prepared session cardinality mismatchz task26-private-invite-handoff-v1z>Private DM only: actor opens this link and presses Start once.)ry   r   start_tokencustomer_link
expires_atr   instructionpreparer   PASS_PREPAREDprepare_invocations!event_subscription_before_preparefilesystem_eventIN_MOVED_TO:ledger.jsonr   session_id_sha256r   start_token_sha256customer_key_sha256r   r   
generationrU  rH  handoff_sha256handoff_mode0600raw_token_locationsrollbackz;prohibited after handoff publication; canonical expiry onlyF)followlinksr+   z5raw token escaped the single private handoff artifact)6handoffr   rA  r   r6  draftr   r   r   r   r  !prepare_rehearsal_customer_inviter   r   r+  rY   r   r   rT  queryr   rb   r   rq   
startswithrR  r   r   r   r)   r:   sumr   rU  	isoformatr   rw   r9  r   r;   r`  r/   r   evidence_rootrM   walksortr   rl   is_filer-   PermissionErrorrW   r   )rB  r2  r3  r4  rh  r[   rD  	state_dirr  storepreparedrj  tokenstokenr   afterrg  rA  occurrencesrootdirsfilesr   r.   r(   rR  s                            @r"   rW  rW  l  s   || 3 3 5HIIHRE+-E

+Et||%:L:LMNFF(6IXYYIE"9-::x ; 
 	-Xh445;;DQEYYwFfd#s6{a'7vay?S?STZ?[JKK1IE
)CG$^DLL%ABE
5VJ%7!81!<<GHH9SZZ%899ABB

VE*DU
VVZ[[BCC4((!//))335WG DLL'*
y
!%+-5q"Et 	5 	g((	
 	Yw'9'9'@'@'IJ 	G$$ 	iW(=> 	y););)B)B7)KL 	$$ '3G4F4F 	h))335 	.">? 	(4<<0 3A& 	DLL 12 	QG  DLL'*%!#););!OD$IIKJJLDzD(??$DLLN&tT:C <<(C/&&t||~6  "P 4<<//122VWWNy 	l %o6 s   >6R? S?SS&%S&c                   t        | j                  | j                  | j                        \  }}t	        | j                        j
                  }t        |      }i t        d      dt        | j                  j                  d            | j                  d| j                  d}t        | j                  |       | j                  ?t        j                  | j                  d       t        j                   | j                         	 |j#                  d| j                         |j!                          t%        t	        | j                              }|d   D cg c]#  }|j'                  d	      | j                  k(  s"|% }}t)        |      d
k7  rt+        d      |d   }|j'                  d      }	t-        |	t.              rt)        |	      d
k7  rt+        d      |	d   }
t-        |
t0              r,|
j'                  d      dk7  s|
j'                  d      t2        k7  rt+        d      |
j'                  d      t2        k7  s,|
j'                  d      dk7  s|j'                  d      t2        k(  rt+        d      |j'                  d      dvrt+        d      i t        d      ddd| j                  t        | j                  j                  d            | j                  t2        dd
|d   |j'                  d      t5        t	        | j                              dddd }t        | j6                  |       |S # |j!                          w xY wc c}w )!Nzobserve-readyREADYrP  T)r   r]  r   event_subscription_before_claimtimeout_seconds   1rK  r   r   rI   z.observed session identity cardinality mismatchr   r   z3accepted Start/claim cardinality is not exactly onerolecustomeruser_idzclaim actor/role mismatchchat_idtopic_id0r   z%claim is not an actor-only private DMr   >   r   REGISTERINGAWAITING_CONSENTAWAITING_ACTIVATIONz/claim did not enter an accepted canonical stateobservePASS_CLAIM_OBSERVEDr\  r`  F)r   r  r[  r   r]  r   r   
private_dmaccepted_start_claim_countr   r`  rH  raw_getUpdatesdrop_pending_updatescursor_edits)preflight_observer   r   r   r   rj   r  r9  r)   r:   r  rw   readyready_fdrM   rr   rY   r+  r   r   rq   r   rb   r   rc   r   r/   rA  )rB  r   _resultrs  r  r  rx  r   matchesclaimsclaimrA  s               r"   r  r    s   'doot}}UOFGt||,33IIE6|O, 6"+DOO,B,B7,K"L4 $ 4 46E DJJ&}} 
%
)=)=>$^DLL%ABE %j 1_ 1TXXl5Kt5^t 1G_
7|qKLL1:DXXm$Ffd#s6{a'7PQQ1IEeT"eii&7:&ES\I]aiIi677yyx'599Z+@C+G488T^K_ckKkBCCxx ddLMM
y
!-B+/E^ooIdooF\F\]dFe<fMMxt&'$w-hh|,xW[WcWcHd?ePUG DLL'*N5 	_s   L1 #M;M1Mc                   t                t        t        |             }|d   D cg c]  }|j                  d      |k(  s| }}t	        |      dk7  s|d   j                  d      |k7  rt        d      |d   }|j                  d      dk7  s"|j                  d	      s|j                  d
      rt        d      t        d |d   D              dk7  rt        d      ||fS c c}w )Nr   r   rI   r   r   z%prepared observation binding mismatchr   PREPAREDr   r   z/observation requires one clean PREPARED sessionc              3  J   K   | ]  }|j                  d       t        v  ywr   r   )r   ones     r"   r   z$preflight_observe.<locals>.<genexpr>  s!     
J7I37778+7Ir   z)duplicate/nonterminal bootstrap authority)r   r   r   r   rq   r   rl  )r   r   r   r   r   r  s         r"   r  r    s    %nW&=>F &z 2[ 2dhh|6LPZ6Zt 2G[
7|qGAJNN:6(BBCC1:DxxJ&$((=*ATXXNaEbLMM

Jvj7I
JJaOFGG4< \s   C# C#c                X   t               \  }}}t        | j                  | j                  | j                          | || j                              }|j                  | j                        }t        j                         |j                  j                         k  rt        d      |j                         }|D cg c]  }|j                  | j                  k(  s|  }}t        |      dk7  s|d   j                  j                  dk7  rt        d      i t        d      ddd| j                  t        | j                  j!                  d	            | j                  d|d   j"                  t%        t'        | j                              d
dd}	t)        | j*                  |	       |	S c c}w )Nz1canonical expiry is unavailable before expires_atrI   r   r   z&canonical expiry did not reach EXPIREDexpirePASS_EXPIREDz!RoomBootstrapStore.expire_unboundrP  FzRterminal receipt complete; archive-first profile cleanup remains separately sealed)r   expire_invocationscanonical_apir   r]  r   r   r`  rH  token_publication_rollbackcleanup)r6  r  r   r   r   r   r  rU  	timestampr   expire_unboundrq   r   r;   r9  r)   r:   r`  r/   r   rw   rA  )
rB  r2  _load_customer_draftr4  rt  r[   r   r   r  rA  s
             r"   r  r    sa   ISF,.FdllDOOT]]C7EFEYYt'Fyy{V&&0022NOO##%H (ODOOt,NtGO
7|qGAJ,,22i?CDD
x
 ,:RS<ooIdooF\F\]dFe<fMMIWQZEZEZ!.">?_dgG DLL'*N Ps   ;F'F'c                    t        j                  t              } | j                  dd      }dD ]  }|j	                  |      }|j                  dt        d       |j                  dt        d       |j                  d	t        d       |d
k(  rG|j                  dt        d       |j                  dt        d       |j                  dt               |dv r&|j                  dd       |j                  dd       |dk(  s|j                  dt        d       |j                  dt        d       |j                  dt               " | S )N)descriptionrg   T)destrequiredr;  rG  rW  r  r  z	--profile)typer  z--permissionz	--receiptrW  z--draftz	--handoffz--evidence-root)r  >   r  r  z--session-id)r  z
--sid-hashr  z--readyz--timeout-secondsg      ^@)r  defaultz
--ready-fd)	argparseArgumentParser__doc__add_subparsers
add_parseradd_argumentr   r/  int)rD  subr   commands       r"   parserr    sA   $$9F


Vd

;CE..&[tdC^$F[tdC9   E  4$ G  !2 >((  $ ?   =9   E  !45% P  C 8 F  Mr!   c            	     J   t               j                         } 	 t        | j                  | j                         t
        t        t        t        t        d} || j                     |       }t        j                  j                  j                  t        | j                  |d   t        | j                         d             |d   dk(  rdS dS # t"        t$        t&        t(        t*        j,                  f$ r-}t        j.                  j                  d| d       Y d }~yd }~ww xY w)	Nr  r   )rg   r   rA  r>  r   r   zFAIL: r7   )r  
parse_argsr   
permissionrg   rE  rG  rW  r  r  sysstdoutbufferrr   r<   r   rA  r   r
  
ValueErrorKeyErrorr   
BadZipFilestderr)rB  handlersrD  rd   s       r"   mainr  $  s    8 DDOOTYY/&&W&&:$$))$T*

	499xHX585F+H !I 	J8$.q5A5':x9K9KL 

6#b)*s   B0C C (D"5#DD"__main__)r(   r.  r,  r   )r.   r   r,  r   )r;   r   r,  r.  )rF   zos.stat_resultr,  ztuple[int, ...])r.   r   r,   boolr,  r.  )r.   r   r,   r  r,  dict[str, Any])r.   r   r;   r  r,  r-  )r.   r   rg   r   r,  r  )r,  zdict[str, str])r   r   r,  r   )r.   r   r,  r  )r.   r   r   r   r,  r-  )r   r   r   z
str | Noner,  %tuple[dict[str, Any], dict[str, Any]])r,  ztuple[Any, Any, Any])rg   r   r,  r  )rB  zargparse.Namespacer,  r  )r   r   r   r   r   r   r,  r  )r,  zargparse.ArgumentParser)r,  r  )Qr  
__future__r   r  r  r%   r   importlib.utilr8   rM   r  rR   r  r  r  r   pathlibr   typingr   urllib.parser   r   r   r   r   r   r   r   r   r   r   r   r   	frozensetr   r  r  r  r	  getattrrP   r   r   rj   HERErh   ROOTr   r   r   r   r   RuntimeErrorr   r)   r/   r<   rG   r-   re   rw   r   r   r   r   r   r   r  r6  r9  rE  rG  rW  r  r  r  r  r  r   
SystemExitr    r!   r"   <module>r     s   #       	    
     +N	QPRT*Z BRAB	
,,\15
5H~&&||A%%(94	4	5 <<	p	pww11 	< 	+8i>
 15 $ .2 *2*R:` <@ AH" "J	Nb)X.,  z
TV
 r!   