
    ǂj6                       d Z ddlmZ ddlZddlZddlZddlZddlZddlZddl	Z	ddl
Z
ddlZddlmZ ddlmZ ej                    eedd      z  Zej&                  ej(                  z  ez  ZdZdZ ee      j2                  j2                  d	z  Zd
ZdZdZdZdZdZ dZ!dZ"e! de" Z# G d de$      Z%d@dZ&dAdZ'dBdZ(dCdZ)dDdEdZ*dFdGdZ+dHdZ,dIdZ-dddJdZ.dKd Z/dLd!Z0dMd"Z1dNd#Z2dOd$Z3dPd%Z4dQd&Z5dRd'Z6dSd(Z7dTd)Z8 ed*      dd+	 	 	 	 	 	 	 	 	 dUd,Z9 ed*      d-dVd.Z:dWd/Z;dXd0Z<dYd1Z=dZd2Z>ddd3d[d4Z?d\d5Z@d\d6ZAd]d7ZBd^d8ZCd_d9ZDd`d:ZEdad;ZFdad<ZGdbd=ZHdcd>ZIeJd?k(  r eK eI             y)dzCVerification-only v5 successor for sealed Task26 lifecycle cleanup.    )annotationsN)Path)Any
O_NOFOLLOW   $hermes-gateway-dualcoachtest.servicez5task26-post-lifecycle-cleanup-v4-4a6c7ee5-st_01a00e68@188e9e630b53e9329ae185fc8c007aecb7988c16d174d325d68e8e004edb38e9)zgateway_start_observer.pyzlifecycle_observer.pyzobserver_v2.pyzobserver_v3.pyzobserver_v4.pyzobserver_v5.pyzobserver_v6.pyzobserver_v61.pyzobserver_v62.pyzobserver_v63.pyzobserver_v64.py%task26_live_2e_r2_20260815_8527916639
8527916639
8693203710 005959f8d90c5a57f664d8022a9d5049e7d63548ceecf2fd@58f2cda7abd532c0d6e145bbb3f3216609b004374adab8bfae2ee28dc5d7d660:c                      e Zd Zy)CleanupErrorN)__name__
__module____qualname__     `.omo/evidence/task26/task26-post-lifecycle-cleanup-v5-4a6c7ee5-st_01a00ed7/cleanup_controller.pyr   r   .   s    r   r   c                T    t        j                  | dd      dz   j                         S )NT),r   )	sort_keys
separators
)jsondumpsencodevalues    r   canonr#   2   s#    JJuDtKSSUUr   c                H    t        j                  |       j                         S N)hashlibsha256	hexdigest)raws    r   digestr*   6   s    >>#((**r   c                4    t        | j                               S r%   )r*   
read_bytes)paths    r   file_digestr.   :   s    $//#$$r   c                    t        |      }|ra	 t        j                  | |      }t	        |t
              s#t	        |t              r|dk  s|t        |      kD  rt        d|      ||d }|r`yy# t        $ r Y ow xY w)zEWrite every byte or fail before the caller can publish the temp file.r   zinvalid write count: N)	
memoryviewoswriteInterruptedError
isinstanceboolintlenr   )fdr)   	remainingwrittens       r   	write_allr;   >   s    3I
	hhr9-G gt$Jw,DSTX_befobpXp!6wkBCCgh'	    		s   A0 0	A<;A<c                v   | j                   j                  ddd       t        j                  d| j                         \  }}	 	 t	        j
                  ||       t        ||       t	        j                  |       	 |dk\  rt	        j                  |       d}t	        j                  ||        t	        j                  | j                   t        j                  t        j                  z  t        z        }	 t	        j                  |       t	        j                  |       	 	 t	        j                  |       y # d}w xY w# 	 |dk\  rt	        j                  |       d}w # d}w xY wxY w# t	        j                  |       w xY w# t        $ r Y y w xY w# 	 t	        j                  |       w # t        $ r Y w w xY wxY w)NT  parentsexist_okmodez.task26-cleanup-)prefixdirr   )parentmkdirtempfilemkstempr1   fchmodr;   fsyncclosereplaceopenO_RDONLYO_DIRECTORYFLAGSunlinkFileNotFoundError)r-   r)   rA   r8   tmpdfds         r   atomicrU   K   sL   KKdT>&8dkkJGB		IIb$b#HHRL7HHRL


3ggdkk2;;#?%#GH	HHSMHHSM	IIcN 	7HHRLR HHSM ! 			IIcN  		s   7D? =D8 AF 6E( F "F 8D<<F ?E%EE%E""E%%F (E??F 	FFF8F)(F8)	F52F84F55F8c                   t        j                  | t         j                  t        z        }	 t        j                  |      }|xs h d}t        j                  |j                        rQ|j                  t        j                         k7  s0|j                  dk7  s!t        j                  |j                        |vrt        d|        g }t        j                  |d      x}r*|j                  |       t        j                  |d      x}r*t        j                  |      }|j                  |j                   |j"                  |j$                  |j&                  f|j                  |j                   |j"                  |j$                  |j&                  fk7  rt        d|        dj)                  |      t        j*                  |       S # t        j*                  |       w xY w)N>   @               r=      zunsafe file: r   zconcurrent file mutation: r   )r1   rM   rN   rP   fstatstatS_ISREGst_modest_uidgetuidst_nlinkS_IMODEr   readappendst_devst_inost_sizest_mtime_nsst_ctime_nsjoinrK   )r-   modesr8   beforeallowedchunkschunkafters           r   	safe_readru   f   se   	r{{U*	+B"SSV^^,}}		+!#||FNN+7:tf566 wwr;//e/MM%  wwr;//e/MM6==&..&:L:LfN`N`aLL%,,u7H7H%J[J[f
 
 !;D6BCCxx
s   CG B&G Gc                    	 t        j                  t        |             S # t         j                  $ r}t	        d|        |d }~ww xY w)Nzinvalid JSON: )r   loadsru   JSONDecodeErrorr   )r-   excs     r   	load_jsonrz      sD    =zz)D/** =^D623<=s     AAAc                   | j                  d      }t        j                  |j                        r!|j                  t	        j
                         k7  rt        d|        | j                         }| j                  d      }|j                  |j                  |j                  |j                  |j                  f|j                  |j                  |j                  |j                  |j                  fk7  rt        d|        |S )zFRead unrelated-profile content stably; Git object hardlinks are valid.F)follow_symlinkszunsafe unrelated-profile file: z'concurrent unrelated-profile mutation: )r`   ra   rb   rc   r1   rd   r   r,   ri   rj   rk   rl   rm   )r-   rp   r)   rt   s       r   stable_tree_readr}      s    YYuY-F<<'6==BIIK+G<TFCDD
//
CIIeI,Ev}}fnnf6H6H&J\J\]bgbnbnpup|p|  D  L  L  NS  N_  N_  af  ar  ar  bs  sDTFKLLJr   r   )excludec                  g }t        j                  | d      D ]  \  }}}|j                          |j                          t        |      j	                  |       |D cg c]  t        fd|D              r c}|d d  t        |      D ]  }t        |      |z  }|j	                  |       j                         |j                         }	t        j                  |	j                        rZ|j                  dt        j                  |      t        j                  |	j                        dd       |j                  |       t        j                   |	j                        r6|j                  dt        j                  |	j                        dd       t#        d	|        |D ]=  }t        |      |z  }|j	                  |       j                         t        fd
|D              rF|j                         }	t        j                  |	j                        rI|j                  dt        j                  |      t        j                  |	j                        dd       t        j$                  |	j                        st#        d|       t'        |      }
|j                  dt)        |
      t+        |
      t        j                  |	j                        dd       @  |S c c}w )NFfollowlinksc              3  b   K   | ]&  }z  j                         j                  |       ( y wr%   )as_posix
startswith).0xdrelbases     r   	<genexpr>z!tree_inventory.<locals>.<genexpr>   s.     -f^eYZw{.D.D.F.Q.QRS.T^es   ,/L04o)r-   typetargetrA   Dr-   r   rA   z%unsupported unrelated-profile entry: c              3  @   K   | ]  }j                  |        y wr%   r   )r   r   rels     r   r   z!tree_inventory.<locals>.<genexpr>   s     6g3>>!$gs   zunsupported tree entry: F)r-   r   sizer'   rA   )r1   walksortr   relative_toanylistr   lstatr`   S_ISLNKrb   rh   readlinkrf   removeS_ISDIRr   ra   r}   r7   r*   )rootr~   rowsbasedirsfilesr   namer-   str)   r   r   s         `    @@r   tree_inventoryr      si   !#DWWTu==dE		

t*((."gd#-f^e-f*f1dgQJD:$D""4(113CB||BJJ'S#TAR_c_k_klnlvlv_wx{^|~D!bjj)S#$,,rzzBZ[^A_ab"%J4&#QRR  D:$D""4(113C6g66B||BJJ'S#TAR_c_k_klnlvlv_wx{^|~<<

+"%=dV#DEE"4(CKKc3s8vVY{gkgsgstvt~t~g  AD  gE  G  H ! >: K3 hs   $K:?K:c                *    t        t        |             S r%   )r*   r#   )r   s    r   inventory_digestr      s    %+r   c           
     R   g }t        j                  | d      D ]w  \  }}}|j                          |j                          |D ]  }t        |      |z  }|j	                         }t        j                  |j                        st        d|       |j                  |j                  |       j                         dt        j                  |j                        dd        |D ]  }t        |      |z  }|j	                         }t        j                  |j                        st        d|       |j                  |j                  |       j                         dt        j                  |j                        dt        |      d	        z t        t!        |            S )
NFr   z!unsafe sealed archive directory: r   r   r   zunsafe sealed archive entry: r   )r-   r   rA   r'   )r1   r   r   r   r   r`   r   rb   r   rh   r   r   rf   ra   r.   r*   r#   )r   r   r   r   r   r   r-   r   s           r   sealed_tree_digestr      sr   !#DWWTu==dE		

D:$DB<<

+"%Ftf#MNNKK!1!1$!7!@!@!BC\`\h\hikisis\tux[y{|  D:$DB<<

+"%B4&#IJJKK!1!1$!7!@!@!BC\`\h\hikisis\tux[y  GR  SW  GX  Y  Z  > %+r   c                Z   g }|d   D ]'  | z  j                         s|j                         ) | dz  }t        |d         }|j                         rt        |j	                               D ]k  dj
                   j
                  |v s|v r%j
                  |d   v st        fd|d   D              r|j                         _t        d        g }t        t        |      d	 
      D ](  t        fd|D              r|j                         * t        |      S )Nclear_scopesdataprotected_data_rootszdata/allowed_dynamic_data_rootsc              3  T   K   | ]  }j                   j                  |       ! y wr%   )r   r   )r   rB   childs     r   r   z"authority_paths.<locals>.<genexpr>   s&      K<e&

%%f-<e   %(allowed_dynamic_data_prefixeszunknown data authority root: c                (    | j                  d      | fS )N/)countr!   s    r   <lambda>z!authority_paths.<locals>.<lambda>   s    U[[5Eu4Mr   keyc              3  T   K   | ]  }|k(  xs j                  |d z          ! yw)r   Nr   )r   rE   r   s     r   r   z"authority_paths.<locals>.<genexpr>   s+     UuV3&=@CNN6C<$@@ur   )existsrh   setsortediterdirr   r   r   )profilecontractpathsr   	protectedouterr   r   s         @@r   authority_pathsr      s&   E'cM!!#LL ( VDH345I{{}DLLN+E%**&CzzY&#,zzX&BCCs K<DEd<eK H S!"%B3%#HII , Ec%j&MNUuUULL O %=r   c           
     0   g }|D ]  }| |z  }|j                         rat        |      }|j                  |t        |      t	        |      t        j                  |j                         j                        dd       z|j                         rlt        |      D ]]  }|j                  d      dk(  r|j                  d      dk7  rt        d| d|d          | d|d    |d<   |j                  |       _ t        d	|        t        |d
       S )Nr   r-   r   r'   rA   r   r   r   zsymlink in active authority: r   r-   zunsupported authority scope: c                    | d   S )Nr-   r   rows    r   r   zscoped_rows.<locals>.<lambda>   s    Fr   r   )is_fileru   rh   r7   r*   r`   rf   rb   is_dirr   getr   r   )r   scopesr   r   r-   r)   r   s          r   scoped_rowsr      s   !#D}<<>D/CKKc#h&+Z^ZfZfgkgpgpgrgzgzZ{|  ZA  C  D[[]%d+776?c)776?c)&)Fse1SQW[M'Z[[!$Qs6{m4FC  , !>seDEE  $344r   c                p   t        j                  ddd| dgddd      }|j                  dk7  r&t        d	|j                  j                                t        d
 |j                  j                         D              }t        |      h dk7  rt        d      |d   |d   |d   |d   |d   |d   |d   dS )N/usr/bin/systemctl--usershowzY--property=ActiveState,SubState,MainPID,ControlPID,ExecMainPID,FragmentPath,UnitFileStateTF)textcapture_outputcheckr   zsystemctl show failed: c              3  J   K   | ]  }d |v s|j                  d d        yw)=r^   N)splitr   lines     r   r   zservice_show.<locals>.<genexpr>  s%     [1KsVZ{$**S!$1Ks   	##>   MainPIDSubState
ControlPIDActiveStateExecMainPIDFragmentPathUnitFileStatez%unexpected systemctl authority outputr   r   r   r   r   r   r   )activesubpidcontrol_pidexec_main_pidfragmentunit_file_state)

subprocessrun
returncoder   stderrstripdictstdout
splitlinesr   )serviceresultvaluess      r   service_showr      s    ^^	x  ;V  	W	F A4V]]5H5H5J4KLMM[1I1I1K[[F
6{zzBCC'j!i l+.>*!/2 r   c                   t        j                  |t         j                  t        z  |       }	 g }d}	 t        j                  |t        dt        dz   |z
              }|sn7|j                  |       |t        |      z  }|t        kD  rt        d|       ddj                  |      t        j                  |       S # t        j                  |       w xY w)z=Read one proc pseudo-file through a pinned process directory.)dir_fdr   i   r^   zoversized /proc entry: r   )r1   rM   rN   rP   rg   minPROC_READ_LIMITrh   r7   r   rn   rK   )proc_fdr   r8   rr   totalrs   s         r   _read_proc_filer     s    	r{{U*7	;B GGBE?Q+>+F GHEMM% SZE&"%<TF#CDD  xx
s   A9B> >Cc                   	 | j                  d      j                         }|j                  dd      \  }}|j                  dd      \  }}|j                         }t	        |      |k7  st        |      dk  rt        t	        |d         t	        |d         t	        |d         dS # t        t        f$ r}t        d	| d
      |d }~ww xY w)Nasciiz) r^   z (         )ppid
session_idstart_time_ticksmalformed /proc/z/stat)	decoder   rsplitr   r6   r7   
ValueErrorUnicodeDecodeErrorr   )	r)   expected_pidr   rB   fields_textpid_text_commfieldsry   s	            r   _parse_proc_statr  #  s    Lzz'"((*"kk$2 ,,tQ/%""$x=L(CK",< q	NfQi. #F2J
 	

 
+ L-l^5ABKLs   B$B' 'C6CCc                    | sg S | j                  d      st        d| d      | d d j                  d      D cg c]  }|j                  dd       c}S c c}w )N    r  z/cmdlinerD   zutf-8surrogateescape)endswithr   r   r  )r)   r   parts      r   _decode_cmdliner  5  s`    	<<-cU(;<<@CCRu@UV@UDKK!23@UVVVs   Ac                |    | dd  D ]4  }|dk(  s,|j                  d      s|j                  d      r,d|dd  v s4 y y)Nr^   z--follow-z--fTFr   )argvargs     r   _follow_optionr  =  sJ    ABx*!4S^^D=QVY]`abac]dVd  r   c                   | sg S dj                  |       j                         t        | d         j                  j                         }t	        |j                               }|v xs |v xs
 dv xs dv }g }|v r|j                  d       |v r|j                  d       t        fdt        D              sdv rd	v r|j                  d
       |dk(  r|r|j                  d       |dk(  rt        |       r|r|j                  d       dv r%t        fddD              r|j                  d       t        t        |            S )N r   dualcoachtesttask26target_service_referenceexact_profile_path_referencec              3  &   K   | ]  }|v  
 y wr%   r   )r   r   joineds     r   r   z#_process_reasons.<locals>.<genexpr>Q  s     
9&8d46>&8   zlive-vz-events.jsonlobserver_script_or_eventinotifywaittarget_inotify_watcher
journalctltarget_journal_followerc              3  &   K   | ]  }|v  
 y wr%   r   )r   tokenlowers     r   r   z#_process_reasons.<locals>.<genexpr>Y  s      h=gE%=gr#  )monitorwatchfollowobservertask_owned_monitor)rn   r+  r   r   strresolverh   r   OBSERVER_ARTIFACTSr  r   r   )	r  r   r   
executableprofile_texttarget_contextreasonsr"  r+  s	          @@r   _process_reasonsr8  D  s<   	YYt_FLLNEd1g##))+Jw()L&q,&*@qOW\D\q`hlq`qNG&12v56

9&8
99Eo612]"~/0\!nT&:~015S h=g hh+,#g,r   z/proc)	proc_rootself_pidc               j   |t        j                         n|}g }g }g }	 t        d t        j                  |      D        t              }|D ])  }
t	        |
      }	 t        j                  ||
z  t              }	 t        j                  |      j                  }|t        j                         k7  r	 t        j                   |       {	 t#        t%        |d	      |      }t'        t%        |d
      |      }t#        t%        |d	      |      }|d   |d   k7  r3|j                  |d|d   |d   d       	 t        j                   |       |j                  d|i|d
|i       t        j                   |       , |D ci c]  }|d   |
 }}t+               }|}||v r&||vr"|j-                  |       ||   d   }||v r||vr"g }t/        t0              j2                  |D ]  }|d   }||v xr t5        fd|d
   D              }||k(  s|r$||k(  rdnd|d<   |j                  ||d   d       Pt7        |d
   | |      }|rdnd|d<   |sl||d<   |j                  |        |||||dS # t
        $ r}	t        d|       |	d}	~	ww xY w# t        $ r |j                  |dd       Y _t        $ r Y jt
        $ r<}	|	j                  dv r|j                  |dd       Y d}	~	t        d|       |	d}	~	ww xY w# t        t(        f$ r- |j                  |dd       Y t        j                   |       t
        $ rQ}	|	j                  dv r/|j                  |dd       Y d}	~	t        j                   |       1t        d|       |	d}	~	ww xY w# t        j                   |       w xY wc c}w )zFCapture a stable same-UID process snapshot and target classifications.Nc              3  B   K   | ]  }|j                         s|  y wr%   )	isdecimal)r   r   s     r   r   z&enumerate_processes.<locals>.<genexpr>k  s     S)>$..BR)>s   r   zcannot enumerate disappeared_before_open)r   race)   r   zcannot open /proc/r`   cmdlinedisappeared_during_readzcannot inspect same-uid /proc/r  pid_reused_during_read)r   r?  start_time_ticks_beforestart_time_ticks_afterr   r  c              3  &   K   | ]  }|v  
 y wr%   r   )r   r  controller_names     r   r   z&enumerate_processes.<locals>.<genexpr>  s     4fWePS_5KWer#  self_excludedverifier_command_excludedclassificationr   r  target_owned	unrelatedr7  )same_uid_processesprocess_races
violationsr:  excluded_verifier_identities)r1   getpidr   listdirr6   OSErrorr   rM   	DIR_FLAGSrR   rh   PermissionErrorerrnor_   rc   rd   rK   r  r   r  ProcessLookupErrorr   addr   __file__r   r   r8  )r   r   r9  r:  excluded_pidevidenceracesrP  namesry   r   r   r   ownerrp   rA  rt   r   by_pid	ancestorscursorexcluded_identitiesverifier_ancestorr7  rG  s                           @r   enumerate_processesre  ^  s    #+"2299;L%'H"$E')JESI)>SY\] $i	Dggi$.	:G	HHW%,,E		#$ HHW#T)/'6*JCP)/'9*MsS(&)I3O ()U3E-FFS2Jgm  oA  hB  ^c  dv  ^w  x  y HHW OOUCE5E)WEFHHWG H *22#c%j#oF2%IF
F
vY6f' F
vY6 138n))O%j9,f4fWZ[dWe4f1f,"37:l7JOPkC !&&sL^H_'`a"3y>7GD29{$C	Nc"  '  (; u  E.yk:;DE ! 	LL.GHI 	 	DyyF"S2KLM!3C59:C		D &'9: S2KLM HHW  T99&LL6O!PQ HHW #%CC5#IJPSS	T HHW2s   +I- J<6N
AK?'N
N?N0-	J
6JJ
K<-K<8K< "K7(K77K<?#N"N:N"N$N?NNNN-r9  c                  t        | ||      }t        | ||      }|d   |d   z   }|r-|D cg c]  }|d   |d   |d   |d   f }}t        d|       |d   D ch c]  }|d   |d   f }}|d   D ch c]  }|d   |d   f }	}d	d
dg ||t        |	|z
  D 
cg c]
  \  }
}|
|d c}}
d       t        ||	z
  D 
cg c]
  \  }
}|
|d c}}
d       dS c c}w c c}w c c}w c c}}
w c c}}
w )zHUse two stable snapshots so births, exits, and PID reuse are observable.rf  rP  r   r  rA  r7  z+session-owned background processes remain: rN  z#task26-session-process-poststate-v1PASSr@  rK  c                    | d   S Nr   r   r   s    r   r   z#process_poststate.<locals>.<lambda>  s      MP  QV  MWr   r   c                    | d   S rj  r   r   s    r   r   z#process_poststate.<locals>.<lambda>  s      LO  PU  LVr   )schemastatuspassestarget_processesfirst_snapshotsecond_snapshotidentity_birthsidentity_exits)re  r   r   )r   r   r9  firstsecondrP  r   detailsstable_firststable_secondr   starts               r   process_poststaterz    si   IFE 'YGF|$vl';;Jdnodn]`CJ$6 7YYXdnoH	RSSEJK_E`aE`cSZ%7!89E`LaFLMaFbcFbsc%j#&8"9:FbMc7!!]jmy]y"z]yzsTY3E#J]y"z  AW  X \hkx\x!y\xjcSX#5"I\x!y  @V  W	 		 pac #{!ys   C C%8C*C/C5c                .  
 t        | j                  dh      }t        | j                        }t	        j
                  |      }i ddddd| j                  d| j                  d| j                  d	| j                  d
| j                  d| j                  dt        dt        dt        t        t                     dt#        |      ddd| j$                  d|d   d   d|d   d   dt&        }||k7  rt)        d      |j+                  di       j+                  d      t&        k7  st        t,        dz        t&        k7  rt)        d      |j+                  di       
| j                  | j                  | j                  | j                  | j                  | j                  d}|j+                  d      dk7  s"t/        
fd|j1                         D              rt)        d      |j+                  di       }|j+                  d       d!k7  sC|j+                  d      d"k7  s/|j+                  d      d#k7  st        | j2                        |d   k7  rt)        d$      |d%   j1                         D ]*  \  }}t        t        |            |k7  st)        d&|        |d'   }	t        t        d(            |	d)   k7  rt)        d*      t        t        |	d+               |	d,   k7  rt)        d-      t        | j4                        |d.   k7  rt)        d/      |S )0Nr\   rl  z+task26-post-lifecycle-cleanup-permission-v5approval*TASK26_COMPLETED_CLEANUP_VERIFICATION_ONLYcandidate_digesthermes_wheel_sha256profile_wheel_sha256plan_sha256lifecycle_root_sha256lifecycle_seal_sha256actor_idcustomer_keycontroller_sha256contract_sha256execute_allowed_onceFrun_idv3_seal_sha256completed_cleanuparchive_root_sha256v4_seal_sha256z*verification-only permission pins mismatchpredecessorz	SEAL.jsonzv4 predecessor seal mismatchbindings)r~  r  r  r  r  r  z)task26-post-lifecycle-cleanup-contract-v5c              3  L   K   | ]  \  }}j                  |      |k7    y wr%   )r   )r   kvpinss      r   r   z$validate_bindings.<locals>.<genexpr>  s:       TC  rBimijlmTXT\T\]^T_cdTd  rBs   !$zcontract binding mismatchrm  %PASS_VERIFIED_DISABLED_ARCHIVED_CLEAN@84d937ef67c1517bfdbca4cabce9fb4bfbe39aa1165458bb3aedd14decc4bff0@9f5d72840b4cc1fcb57720a61ebc53529fa00202d9201615e4ebdbb3e047a635z"completed cleanup binding mismatchsource_authoritieszsource authority drift: r   r   systemctl_sha256zsystemctl authority driftfragment_pathfragment_sha256zservice unit authority driftapply_patch_sha256zapply_patch authority drift)ru   r   rz   
permissionr   rw   	candidatehermes_wheelprofile_wheelr  r  r  ACTORCUSTOMERr.   r   rZ  r*   r  V4_SEAL_SHA256r   r   V4_ROOTr   itemsv3_sealapply_patch)argscontract_rawr  r   expected_permissionrequired	completedr-   expectedr   r  s             @r   validate_bindingsr    sh   T]]UG4L4??+Jzz,'H?@ 	DNN 	t00	
 	 2 2 	t'' 	 !;!; 	 !;!; 	E 	 	[h8 	6,/ 	 	$++ 	(#678HI  	x(;<=RS!" 	.#& ((GHH]B'++,<=Ow,-?9::<<
B'D NN#00 $ 2 2''!%!;!;!%!;!;H ||H!LLPS  TCqyqq  rB  TC  QC6770"5Ih#JJ==)*.pp==./3uut||$	2B(CC?@@"#78>>@htDz"h.!9$@AA A y!G4,-.':L2MM6774012g>O6PP9::4##$1E(FF899Or   c               ~   t        | dz        |d   d   k7  rt        d      t        j                  | dz  j                         j                        dk7  rt        d      |d   j                         D ]$  \  }}t        | |z        |k7  st        d|        t        | d	z        }|j                  d
      }t        |t              rt        |      dk7  rt        d      |d   }|j                  d      t        k7  s|j                  d      durt        d      t        |j                  di       j                  d            t        k7  s1t        |j                  di       j                  d            t        k7  rt        d      t        | dz        }|j                  dg       D 	cg c]*  }	t        |	t              s|	j                  d      dk(  s)|	, }
}	t        |
      dk7  s+|
d   j                  di       j                  d      t        k7  rt        d      t        | dz        }t        |      t         gk7  rt        d      |t            }|j                  d      dk7  s5t        |j                  d             d!k7  s|j                  d      t        k7  rt        d"      | d#z  }|j#                         r(t        |      j                  d$      g k7  rt        d%      t        | d&z        }|j                  d'      g k7  rt        d(      t        | d)z        }t%        d*      j'                         j)                         }|j                  d+      |k7  s|j                  d,      d-k7  rt        d.      t+        |d/   d0         }|r7|d1   |d2   |d3   fd1d-t        |j                  d3            fk7  rt        d4      |rA|d3   |d/   d5   k7  s(|j                  d+      |d/   d6   k7  s|d7   |d/   d8   k7  rt        d9      t        t        t        t,        t.        t0        d!|t        |d3         d:	S c c}	w );Nconfig.yamlr  config_sha256zcurrent config hash mismatchr]   zcurrent config mode mismatchsealed_live_file_sha256zsealed lifecycle drift: customers/registry.json	customersr^   zrequires exactly one customerr   r  enabledTz'target customer is not uniquely enabledtelegramuser_idr_  zcustomer/actor/owner mismatchz:data/onboarding/telegram-customer-bootstrap-v1/ledger.jsonsessionsstateACTIVEcustomer_draftz+requires exactly one bound ACTIVE lifecycle(data/owner-actions/draft-deliveries.jsonz/delivery authority is not exactly one bound rowrm  sent_audited
message_id232zaudited delivery mismatchcron/jobs.jsonjobszfuture jobs remainz=data/onboarding/telegram-publication-outbox-v1/emergency.jsonrecordszemergency publications remaingateway_state.jsonz/proc/sys/kernel/random/boot_idboot_idgateway_staterunningz"gateway runtime authority mismatchr   r   r   r   r   z'service is not the bound active gatewayinitial_main_pidinitial_boot_idr   r  zservice/runtime pin mismatch)	r  r  owner_idr  draft_idrevisionr  r  main_pid)r.   r   r`   rf   rb   r  rz   r   r4   r   r7   r  r1  r  OWNERr   DELIVERY_KEYr   r   	read_textr   r   SESSIONDRAFTREVISION)r   r   require_runningr   r  registryr  customer	bootstrapr   r   delivery_docdeliveryr  	emergencyr  r  r   s                     r   validate_lifecycler    s@   7]*+x
/CO/TT9::||W},224<<=F9::!";<BBDXw}%1!9#?@@ E #<<=H[)Ii&#i.A*=:;;|H||N#x/8<<	3JRV3VDEE
8<<
B'++I675@CU\^`HaHeHefoHpDquzDz:;;'$``aI&]]:r:u:cjd>SX[X_X_`gXhltXtc:Fu
6{a6!9==)92>BB>RV^^HIIW'QQRLLl^+LMML)H||H/3x||L7Q3RV[3[_g_k_klz_{  @H  `H677%%D{{}4,,V4:/00'$ccdI}}Y2%:;;g 445E45??AGGIGyyw&%))O*D	*Q?@@8I.v67GGH-wu~wu~NS[]fhklqluluv{l|h}R~~DEE(9-.@AA99Y8I#67H#II:(9"5o"FF9::$%UZaot  CK  [`  mt  BE  FK  LQ  FR  BS  T  T9 vs   -P:P:P:c                b    i }| d   D ]$  }t        |      }t        t        |            ||<   & |S )Nunrelated_profiles)r   r   r   )r   r   r   r-   s       r   baseline_other_profilesr  4  s:    F-.Dz't(<=t / Mr   c                   | j                   | j                  z  }| j                   d| j                   z  }|j                         s|j                         rt        d      |j	                  dd       |dz  }|j	                  d       	 |D ]Q  }	t        | j                  |	d   z        }
t        |
      |	d	   k7  rt        d
|	d          t        ||	d   z  |
       S t        | j                  dz  dh      }t        |dz  |       t        |d   d         }t        |dz  t        |             d| j                  |d   |||dt        |      t        |      ddt        |dz        |ddd}t        t        |            |d<   t        |dz  t        |             t        j                  ||       |S # t        $ r' |j                         rt!        j"                  |        w xY w)Nz	.pending-zone-use archive already existsTr=   )r?   rA   payloadrA   r-   r'   zarchive source drift: r  r]   r   r   zservice-prestate.json(task26-post-lifecycle-cleanup-archive-v3r  0664r   )rl  r  r  active_lifecycler   entriesconfig_entryservice_prestate_sha256unrelated_profiles_pre_sha256'archive_committed_before_first_mutation%active_and_audited_history_byte_exactevidence_digestmanifest.json)archive_rootr  r   r   rF   ru   r   r*   rU   r   r#   r7   r.   r1   rename	Exceptionshutilrmtree)r  r   r   r   idsrM  finalpendingr  r   r)   
config_rawr   manifests                 r   archive_prestater  <  s   +EIdkk]";;G||~);<<MM$UM+	!GMMuMCDLL3v;67Cc{c(m+"%;CK=#IJJ7S[(#.	 
 t||m;eWE
w&
3x	26:;w00%.A@kk , #%2C
OW]^hWisyz'27=T3T'U-67;59
 '-U8_&="#w(%/:
		'5! >>MM'"s   D,F9 90G)cwdenvc                  t        j                  | ||ddd      }| |rt        |      nd |j                  |j                  |j
                  d}|j                  dk7  r)t        d| d|j
                  j                                |S )NTF)r  r  r   r   r   )commandr  	exit_coder   r   r   zcommand failed: z: )r   r   r1  r   r   r   r   r   )r  r  r  r   receipts        r   run_checkedr  e  s    ^^G#DQU]bcF!c#c(tRXRcRcouo|o|  IO  IV  IV  WGA-g[6==;N;N;P:QRSSNr   c           	        t        | j                        dddt        | j                  dz        dt        g}t	        t
        j                        }t        | j                        |d<   t        || j                  |      }t        | j                  dz        }|d   d	   j                  d
      durt        d      |j                  ddt        t        | j                  dz        d       t        |dz  t        |             |S )N-mzcheckin_cli.customer_adminz
--registryr  disable
PYTHONPATHr  r  r   r  Fz!canonical disable did not persistz#task26-canonical-disable-receipt-v1rh  )rl  rm  r  registry_sha256disable-receipt.json)r1  pythonr   r  r   r1   environcustomer_admin_rootr  rz   r   r   updater.   rU   r#   )r  archiver  r  r  r  s         r   disable_customerr	  m  s   4;;'C\SVW[WcWcfW  TA  CL  NV  WG
rzz
CD445C't'?'?SIG(AABHQ##I.e;>??NNCvgo  EP  QU  Q]  Q]  `y  Qy  Ez  {  |
7++U7^<Nr   c           	        d}t        j                  t        | j                        g| j                  |ddd      }|j
                  dk7  r&t        d|j                  j                                t        | j                  dz  dh      }|j                         d	}t        fd
|D              s=t        j                  | j                  dz  j                         j                        dk7  rt        d      ddt        | j                        t        |j!                               t        |      d|j"                  |j                  d}t%        |dz  t'        |             |S )Nz*** Begin Patch
*** Update File: config.yaml
@@
-        delivery_enabled: true
+        delivery_enabled: false
*** End Patch
TF)r  inputr   r   r   r   z apply_patch config edit failed: r  r]   )z        enabled: truez        delivery_enabled: falsez        activation: falsez        delivery: falsec              3  &   K   | ]  }|v 
 y wr%   r   )r   r*  r   s     r   r   z&patch_delivery_gate.<locals>.<genexpr>  s     
3(5(r#  z&delivery config postcondition mismatchz'task26-delivery-gate-disable-receipt-v1rh  r  )rl  rm  toolpatch_sha256r  rA   r   r   config-disable-receipt.json)r   r   r1  r  r   r   r   r   r   ru   r  r   r`   rf   rb   r*   r    r   rU   r#   )r  r  patchr   r)   r  r  r   s          @r   patch_delivery_gater  z  s}    TE^^S!1!123UY]nrz  AFA=fmm>Q>Q>S=TUVV
DLL=05'
:C::<D DH

3(
33t||T\\TaEaDgDgDiDqDq7rv{7{CDDBf^abfbrbr^s  FL  MR  MY  MY  M[  F\  ou  vy  oz  DJ  V\  Vc  Vc  ou  o|  o|  }G
722E'NCNr   c                   |d   d   }t        ddd|dddd	d
dg
      }t        d |d   j                         D        d       }|st        d      |j	                  dd      d   j                         }t        |      }	|	d   |	d   fdk7  rt        d      t        | j                  dz        |k7  rt        d      t        |      |k7  rt        d      t        t        | j                        ddddddg| j                        }
t        |      }|d   |d   |d   fd k7  rt        d!      t        ddd|d"|d	d
dg	      }|d   j                         D cg c]"  t        v st        fd#d$D              s!$ }}|rt        d%      d&d'd(d)|d*d)d)|
d+   |t        |d   j!                               d,}t#        |d-z  t%        |             t#        |d.z  |d   j!                                |S c c}w )/Nr   r   z/usr/bin/journalctlr   z-uz-n0z--show-cursorz
--no-pagerz-ocatc              3  D   K   | ]  }|j                  d       s|  yw)z
-- cursor:Nr   r   s     r   r   zqa_and_stop.<locals>.<genexpr>  s"     o)MQUQ`Q`amQn)Ms     r   zcould not arm journal cursorr   r^   r   r   )r   r  z+gateway did not remain active after disabler  z(delivery authority changed after disablez+unrelated profile changed during disable QAr  hermes_cli.main	--profiler  gatewaystopr  r   )inactivedeadr  z+gateway did not stop inactive/dead MainPID0z--after-cursorc              3  B   K   | ]  }|j                         v   y wr%   )r+  )r   r*  r   s     r   r   zqa_and_stop.<locals>.<genexpr>  s1       ^d  Bcx}^cgkgqgqgs^s  Bcs   )senddeliverr  z(customer delivery observed after disablez"task26-restart-after-disable-qa-v1rh  FTr   r  )rl  rm  restart_required&gateway_remained_running_after_disablejournal_cursor&customer_delivery_events_after_disabledelivery_authority_unchangedunrelated_profiles_unchangedstop_commandservice_post_stopjournal_sha256restart-after-disable-qa.jsonzjournal-after-disable.txt)r  nextr   r   r   r   r   r.   r   r  r1  hermes_pythonhermes_sourcer  r   r*   r    rU   r#   )r  r   r  delivery_beforerM  r   cursor_resultcursor_linerb  active_after_disabler  stoppedjournalr   
suspiciousr  s                `  r   qa_and_stopr4    s   y!&)G!6$QUWZ\kmy{  BG  !H  IMox)@)K)K)MoquvK9::sA&q)//1F'0X&(<U(CDH]]HII4<<"LLMQ``EFFx(I5HIID../7H+Wfhqsyz  AE  AS  AS  TD7#G75>75>:>WWHII0(D'K[]ceqswy~  AG#*8#4#?#?#A  e#A4XQUEUZ]  ^d  Bc  ^d  [d$#AJ  eEFF=ej  W[  ou  ab  DH  jn  @D  EN  @O  fm  AG  HO  PX  HY  H`  H`  Hb  Ac  dG
744eGnE
700'(2C2J2J2LMN es   G2%G2:G2c                     |dz  }|j                  d       g }	 |D ]b  } |z  }|j                         s||z  }|j                  j                  ddd       t        j                  ||       |j                  |       d t         fd|D              rt        d      |S # t        $ rP t        |      D ]@  }||z  } |z  }|j                  j                  ddd       t        j                  ||       B  w xY w)Ncleared-originalsr=   r  Tr>   c              3  D   K   | ]  }|z  j                           y wr%   )r   )r   r   r   s     r   r   zmove_scopes.<locals>.<genexpr>  s     :6C#%%'6s    zreset scope remains live)
rF   r   rE   r1   r  rh   r   r   r  reversed)r   r  r   destmovedr   sourcer   s   `       r   move_scopesr<    s    ((DJJEJECs]F==?CZFMMt%HIIff%LL  :6::9:: E?CCZFs]FMMt%HIIff%	 #
 	s   BB$ $AC=c           	     Z   |dz  }t        |      D ]  }||z  }|j                         s| j                  |z  j                         r7| j                  |z  j                  j	                  ddd       t        j                  || j                  |z          dD ]I  }|dz  |z  }|j                         s|dk(  rdnd	}t        | j                  |z  t        |d	h      |       K |rDt        d
      d   dk7  r2t        t        | j                        ddddddg| j                         y y y )Nr6  Tr=   r>   )r  r  r  r  r]   r\   r   r   r  r  r  r  r  ry  r  )r8  r   r   rE   rF   r1   r  rU   ru   r   r  r1  r+  r,  )r  r  r:  was_runningclearedr   r;  rA   s           r   restore_prestater@    s+   ++G3==?DLL3$6#>#>#@\\C''--dTPU-VIIfdllS01	 
 :9$s*==?=05eD4<<#%y%'A4H	 :
 |$JKHUYaaS++,d4E{Tcenpwx  C  Q  Q  	R b{r   c           	     d   t        |d   d         }g d}|D cg c]"  }| j                  |z  j                         s!|$ }}|rt        d|       | j                  dz  }|j                         r(t	        |      j                  d      g k7  rt        d      |d   |d	   |d
   |d   fdk7  rt        d      t        | j                  |d   d         }	t        | j                  dz  dh      }
d|
vsd|
vsd|
vsd|
vrt        d      t        |      }||k7  rt        d      |d   D ci c]  }|t        t        |             }}||d   k7  rt        d      g }| j                  dz  | j                  dz  | j                  dz  | j                  dz  fD ]:  }|j                         s|j                  d |j                  d      D               < |rt        d      i dd d!d"d#d$d%d&d'd&d(d$d|d)g d*|	d+d$d,g d-t        |
      d.d/d0|d1|d2t        |      S c c}w c c}w )3Nr   r   )
r  data/customersdata/onboardingdata/owner-actionszgateway.lockzgateway.pidr  zstate.dbzstate.db-shmzstate.db-walzlive cleanup artifacts remain: r  r  zfuture jobs remain post-cleanupr   r   r   r   )r  r  r  r  zservice postcondition mismatchr  r]   s   delivery_enabled: falses           enabled: trues           activation: falses           delivery: falsezconfig postcondition mismatchzunrelated profile changedprotected_filesz token/provider authority changedr  rB  rC  rD  c              3  2   K   | ]  }t        |        y wr%   )r1  )r   r-   s     r   r   z!postconditions.<locals>.<genexpr>  s     "Q9P3t99Ps   z	*trainer*ztrainer authority remainsrl  z"task26-clean-baseline-poststate-v1rm  rh  r  absentfuture_jobsr   future_publicationsr  profile_processessession_process_proofcustomer_live_artifactstrainer_artifactsr  config_moder  unrelated_profiles_sha256protected_files_sha256r  )r   r   r   r   rz   r   rz  ru   r  r.   r   extendrglobr*   r1  )r  r   r  rM  r   	forbiddenr   presentr  	processesconfigunrelated_afterr-   r   trainer_matchesr   s                   r   postconditionsrY    sq   8I.v67G zI'IisDLL3,>+F+F+HsiGI<WIFGG<<**D{{}4,,V4:<==75>75>7=;QRVtt;<<!$,,0CF0KLIt||m3eW=F!/3KSY3Y]y  BH  ^H  Lf  nt  Lt:;;-h7O)#677;CDU;VW;V4{4:..;VIWH.//=>>!#O+T\\<L-Ldll]nNnptp|p|  @T  qT  U;;="""QK9P"QQ U 677 ^H:  ^Hf  ^jZb  ^dqst  ^  wL  NO  ^  Q`  bj  ^  lu  w~  ^  @S  UW  ^  Yp  r{  ^  }V  X`  ^  bu  wy  ^  {J  LR  SY  LZ  ^  \i  kq  ^  sN  P_  ^  ay  {D  ^  FO  QT  U\  Q]  ^  ^1 J Xs   "H(H(-H-c                   |j                  di       j                  d      dk(  rt        d      t        | j                  |d      }t	        |      }t        | j                  |      }t        | j                  |      }t        | |||||      }g }	 t        | j                  dz        }t        | |      }	t        | |      }
t        | ||||      }t        | j                  ||      }t        | |||      }t        |dz  t        |             d	d
d| j                   dt        |dz        t        |dz        t        |dz        t        |dz        |||	d   |
d   |d   d}t        |dz  t        |             |S # t"        $ rn}	 t%        | ||d       ddt'        |      dd}n0# t"        $ r$}ddt'        |      t'        |      dd}Y d }~nd }~ww xY wt        |dz  t        |              d }~ww xY w)Nr  rm  r  z5cleanup already completed; v4 forbids mutation replayT)r  r  zpoststate.jsonz(task26-post-lifecycle-cleanup-receipt-v3rh  executer  r  r)  r  r  r#  )rl  rm  rA   r  r   canonical_disable_receipt_sha256config_receipt_sha256qa_receipt_sha256poststate_sha256r  moved_scopesdisable_registry_sha256post_config_sha256!customer_deliveries_after_disablereceipt.jsonz(task26-post-lifecycle-cleanup-failure-v3FAIL_RESTORED_PRESTATE)rl  rm  errorarchive_retainedFAIL_RESTORE_ERROR)rl  rm  rf  restore_errorrg  zfailure-receipt.json)r   r   r  r   r  r   r   r  r.   r	  r  r4  r<  rY  rU   r#   r  r  r@  r1  )r  r   r  rM  r   r   r  r:  r-  r   rV  qapostr  ry   failurerestore_excs                    r   r[  r[    s   ||',00:>eeRSS
T\\8T
JC'1IT\\84Ft||V,DtXvtS)LGE%dll5_&_`"41$T73x/9MDLL'6:dHgyAw))5;7GSYclx|  yD  yD  qu  [f  gn  qG  gG  [H  cn  ov  yV  oV  cW  ny  zA  Dc  zc  nd  zE  FM  P`  F`  za  wz  LQ  nu  vG	  nH	  `	f	  g	v	  `	w	  ^
`
  a
I  ^
J  Kw'w8 	}T7E48!KWoz}  B  {C  Y]  ^G 	}!KWkvyz}v~  RU  Va  Rb  x|  }G	}w//w@s=   C)E< <	G3F%$G.%	G.GG.GG..G3c                f   | j                   | j                  z  }t        |dz  dh      }t        j                  |      }t        |dz        }|j                  d      dk7  s|j                  d      dk7  rt        d      |d	   }t        |      }|d	= |t        t        |            k7  rt        d
      |d   D ]K  }t        |dz  |d   z  dh      }	t        |	      |d   k7  st        |	      |d   k7  s<t        d|d           |d   }
t        |dz  dh      }	t        |	      |
d   k7  st        |	      |
d   k7  rt        d      t        |      }||d   d   k7  rt        d      t        | |||d         }ddt        |      t        |d         t        |      |d   d   |d   d   dd|d
S )Nr  r\   rd  rl  r  rm  rh  zarchive schema/status mismatchr  zarchive manifest seal mismatchr  r  r-   r   r'   zarchive payload mismatch: r  zpayload/config.yamlzarchived config mismatchr  r  zsealed archive root mismatchr  z-task26-post-lifecycle-cleanup-verification-v5r  T)
rl  rm  r  entry_countarchive_manifest_sha256r  r  delivery_history_preservedactive_lifecycle_preserved	poststate)r  r  ru   r   rw   rz   r   r   r   r*   r#   r7   r   rY  r1  )r  r   r  manifest_rawr  r  claimedr   r   r)   rV  r  rk  s                r   verify_archiverv  
  sL   $++-GW6@Lzz,'H.01G||H!KKw{{[cOdhnOn;<<()GNE &u&&;<<	")+c&k9E7Cs8s6{"fSkS]&B!;CK=IJJ # n%F
G33eW
=C
3x6&>!VC[F84D%D566,W5h':;<QRR9::$'8<[3\]DEQWdghodp  BE  FN  OX  FY  BZ  w}  ~J  wK  dl  m@  dA  BW  dX  lt  uH  lI  JZ  l[  {  _c  rv  w  wr   c                 l   t        j                         } | j                  dd       | j                  dt        d       | j                  dt        d       | j                  dt        d       | j                  d	t        d       | j                  d
d       | j                  dd       | j                  dd       | j                  dd       | j                  dd       | j                  dd       | j                  dd       | j                  dt        d       | j                  dt        t        t        j
                               | j                  dt        d       | j                  dt        d       | j                  dt        d       | j                  dt        d       | S )NrA   )dry-runverify)choicesr  T)r   r  z--archive-rootz
--contractz--permissionz--run-id)r  z--candidatez--hermes-wheelz--profile-wheelz--plan-sha256z--lifecycle-root-sha256z--lifecycle-seal-sha256z	--v3-sealz--python)r   defaultz--customer-admin-rootz--hermes-pythonz--hermes-sourcez--apply-patch)argparseArgumentParseradd_argumentr   sysr4  )ps    r   parserr  %  s[   !ANN6#8N9NN;TDN9NN#$N>NN<dTN:NN>tN<NN:N-NN=4N0NN#dN3NN$tN4NN?TN2NN,tN<NN,tN<NN;TDN9NN:D$s~~2FNGNN*NENN$4$N?NN$4$N?NN?N=Hr   c                    t               j                         } 	 t        |       }| j                  dk(  rt	        | |      }n"t	        | |      }ddddddd|d   |d	   |d
   d
}t
        j                  j                  j                  t        |             y# t        t        t        t        t        f$ r-}t
        j                  j                  d| d       Y d }~yd }~ww xY w)Nry  z(task26-post-lifecycle-cleanup-dry-run-v5rh  rx  r   FTr  r  rs  )
rl  rm  rA   	mutationsarchive_createdcleanup_replayedcompleted_archive_verifiedr  r  rs  zFAIL: r   r@  )r  
parse_argsr  rA   rv  r  r   bufferr2   r#   r   rT  r  KeyError	TypeErrorr   )r  r   r   verificationry   s        r   mainr  <  s   8 D$T*99 #D(3F)$9L JV\fo~  UZ  pu  UY  r~  T  rU  iu  vF  iG  Vb  cn  Vo  pF

f.':xC 

6#b)*s   A;B C!4#CC!__main__)r"   r   returnbytes)r)   r  r  r1  )r-   r   r  r1  )r8   r6   r)   r  r  None)r\   )r-   r   r)   r  rA   r6   r  r  r%   )r-   r   ro   zset[int] | Noner  r  )r-   r   r  r   )r-   r   r  r  )r   r   r~   ztuple[str, ...]r  list[dict[str, Any]])r   r  r  r1  )r   r   r  r1  )r   r   r   dict[str, Any]r  	list[str])r   r   r   r  r  r  )r   r1  r  dict[str, str])r   r6   r   r1  r  r  )r)   r  r	  r6   r  zdict[str, int])r)   r  r   r6   r  r  )r  r  r  r5   )r  r  r   r   r   r1  r  r  )
r   r   r   r1  r9  r   r:  z
int | Noner  r  )r   r   r   r1  r9  r   r  r  )r  argparse.Namespacer  r  )r   r   r   r  r  r5   r  r  )r   r  r  r  )r  r  r   r  r   r  r   r  r  r  rM  r  r  r   )r  r  r  zPath | Noner  zdict[str, str] | Noner  r  )r  r  r  r   r  r  )r  r  r   r  r  r   r-  r1  rM  r  r  r  )r   r   r  r   r   r  r  r  )
r  r  r  r   r:  r  r>  r5   r  r  )
r  r  r   r  r  r   rM  r  r  r  )r  r  r   r  r  r  )r  zargparse.ArgumentParser)r  r6   )L__doc__
__future__r   r|  r&   r   r1   r  r`   r   r  rG   pathlibr   typingr   	O_CLOEXECgetattrrP   rN   rO   rU  r   SERVICE_NAMErZ  rE   r  r  r3  r  r  r  r  r  r  r  RuntimeErrorr   r#   r*   r.   r;   rU   ru   rz   r}   r   r   r   r   r   r   r   r  r  r  r8  re  rz  r  r  r  r  r  r	  r  r4  r<  r@  rY  r[  rv  r  r  r   
SystemExitr   r   r   <module>r     s   I "    	    
   
wr<33KK"..(50	5
x.


&
&)`
`S  3
,M($	< 	V+%
(62=	 >@ D(25(.&L$W < 7mNNN 	N
 N Nb IMW ,;|.Tb&R ;?]a 
82R ^<<w6.  z
TV
 r   