
    *!j                       U d Z ddlmZ ddlZddlZddlZddlZddlZddlZddl	Z	ddl
Z
ddlZddlZddlZddlZddlZddlZddlZddlZddlmZmZmZmZ ddlmZ ddlmZmZ  ed      Zedz  Z ed	      Z ed
      Zedz  Z edz  Z!dZ"edz  Z#dZ$dZ%dZ&dZ'dZ(dZ)dZ*dZ+dZ,dZ-dZ.dZ/e
j`                   e1e
dd      z  Z2ddddd d!d"Z3g Z4d#e5d$<    G d% d&e6      Z7dLd'Z8dMd(Z9dNd)Z:dOd*Z;dPd+Z<dQd,Z=dPd-Z>dRd.Z?dPd/Z@dPd0ZAdSd1ZBdTd2ZCdUd3ZDd4d5dVd6ZEdWd7ZFdXd8ZGdYd9ZHdPd:ZIdPd;ZJdZd<ZKd[d=ZLd\d>ZMd]d?ZNd^d@ZOd_dAZPd`dBZQdadCZRdbdDZSdcdEZTdddFZUdedGZV G dH dI      ZWdfdJZXeYdKk(  r eZ eX             y)gz7One-use, fail-closed Task26 strict-A launch controller.    )annotationsN)UTCdatedatetimetime)Path)AnyCallablez)/home/cube/projects/richard/traning coachzK.omo/evidence/task26/task26-strict-final-candidate-successor-v3-st_01a00f35z)/home/cube/.hermes/profiles/dualcoachtestz(/home/cube/projects/richard/hermes-agentz.venv/bin/pythonz".venv/lib/python3.12/site-packagesz$hermes-gateway-dualcoachtest.servicezC.omo/evidence/task26/task26-strict-launch-controller-v5-st_01a00f53@04611ded095935757c829f1e2785e3b671489178b6b0052c97931f0b1d727c44@ba8226e9e7cc036560070d43e2d90a4c7bd56345fc0dc2148ea1a69ba986b1f9@b6d78bc1e68ead7340d92b534fe3a6d0257c8aa2b02cd3d58e43215fbd8a3443@ad8e48118992b80861fcc86cbe624a75a9cfbf922777e7e8ee8f4fca58e450a1@ee787fb63fd8ce61d35eb2d7a43c11d7e7adef268c1d09a0a40c1d881b8ea742@fb48a1931828ee60ab3812faf795550bf4e672a54c56f78cd10dcf674c45560d@e24e3392c6348fb3ccaf3ccba1292b71b07e292f8b8093bd273ce5f1d58cbf22@7e279202be7d04547032488c0b91ce5d6e80f279a6330bf9fcb0bc4556ec7f0b
8527916639
8693203710dual_coach_pilot_test_bot)verifiedbaselineprepareddeployedstarted
subscribed
membershipproviderreadyinvite_intentinvite_result
O_NOFOLLOWzgateway/platforms/telegram.pyz0gateway/platforms/telegram_customer_bootstrap.pyz3gateway/platforms/telegram_staff_membership_gate.pyz$gateway/platforms/dualcoach_admin.pyzcheckin_cli/__init__.pyzcheckin_cli/customer_admin.py)zgateway.platforms.telegram-gateway.platforms.telegram_customer_bootstrap0gateway.platforms.telegram_staff_membership_gate!gateway.platforms.dualcoach_admincheckin_clicheckin_cli.customer_adminzlist[subprocess.Popen[Any]]CHILDRENc                      e Zd Zy)BlockedN)__name__
__module____qualname__     launch_controller_v7.pyr)   r)   8   s    r.   r)   c                V    t        j                  | ddd      dz   j                         S )NT),:)	sort_keys
separatorsensure_ascii
)jsondumpsencode)values    r/   canonr;   :   s'    JJuRVWX\\ddffr.   c                H    t        j                  |       j                         S N)hashlibsha256	hexdigest)raws    r/   	sha_bytesrB   =   s    )<)F)F)H"Hr.   c                4    t        | j                               S r=   )rB   
read_bytes)paths    r/   sharF   >   s    9T__->#??r.   c                
   | j                  d      t        t              k7  rt        d      | j                  d      t        t        dz        k7  rt        d      | j                  d      t        t
        dz        k7  rt        d      | j                  d	      t        t              k7  rt        d
      | j                  d      t        t        dz        k7  rt        d      | j                  d      t        t              k7  rt        d      | j                  di       }t        j                         D ]H  \  }}|j                  |i       }|j                  d      |j                  d      k7  s<t        d|        | j                  d      t        k7  s| j                  d      t        k7  rt        d      | j                  d      t        k7  rt        d      | j                  d      t        k7  rt        d      y )N
executablezwrong interpreterprefixz.venvzwrong virtual environmenttelegram_originztelegram/__init__.pyztelegram missing or path driftexecstart_pythonz#service ExecStart interpreter driftservice_virtual_envzservice environment driftworking_directoryzservice working-directory driftmodulesloaded_sha256wheel_sha256zimport byte drift: hermes_wheel_sha256profile_wheel_sha256zinstalled wheel driftv5_controller_seal_sha256zv5 controller seal driftv5_clean_run_seal_sha256zv5 clean run seal drift)getstrPYTHONr)   HERMESSITE_PACKAGESPROFILEMODULE_MEMBERSitems
HERMES_SHAPROFILE_SHAV5_CONTROLLER_SEAL_SHAV5_CLEAN_RUN_SEAL_SHA)recordrN   namememberrows        r/   validate_interpreter_recordre   @   s   zz,3v;.g>Q6R0Rzz(s6'>22'B]:^4^zz#$M:P,P(QQY`  bB  ZC  TCzz$%V4GDi<j6jzz'(Cw,??wOjGkAkzz%&#g,6gFg>h8hJJy$G%++-VKKR 77?#sww~'>>gPcdhciNjFk@k . zz'(J6&**E[:\`k:ksz  |S  tT  nTzz-.2HHPWXrPsJszz,-1FFgVoNpHpFr.   c                    t         j                  t        t              k7  rt	        dt         j                         	 t        j                  d      } t        dz  t        dz  d}i }|j                         D ci c]  \  }}|t        j                  |       }}}	 t        j                         D ]  \  }}t        j                  |      }	t        |	dd       }
t        |
t              st	        d|       t        |
      j!                         }||j#                  d	      rd	nd
   }|j%                  |      }dt        |      v rt'        |      n
t)        |      }t        |      |t'        |      d||<    	 |j+                         D ]  }|j-                           	 t/        dddt0        ddddddg
      j2                  }t5        d |j7                         D              }|j9                  dd      }|j9                  dd      }t        | dd       }t        |t              st	        d      ddt         j                  t         j:                  t        t        |      j!                               d|v r(|j=                  dd      d   j=                  dd      d   nd t?        d |j=                         D        d       |j9                  d      |t)        |d	         t)        |d
         t)        t@        dz        t)        t@        dz        d }tC        |       |S # t        $ r}t	        d      |d }~ww xY wc c}}w # |j+                         D ]  }|j-                           w xY w)!Nzwrong interpreter: telegramz,telegram unavailable in required interpreter.artifacts/hermes_agent-0.17.0-py3-none-any.whl5artifacts/physique_checkin_cli-0.1.0-py3-none-any.whl)gatewayr%   __file__zimport has no file: rj   r%   .whl/)originrO   rP   /usr/bin/systemctl--usershow-p	ExecStartEnvironmentWorkingDirectoryc              3  J   K   | ]  }d |v s|j                  d d        yw=   Nsplit.0xs     r/   	<genexpr>z$interpreter_proof.<locals>.<genexpr>k   s#     F(91SAXA(9   	## ztelegram import has no fileztask26-v7-interpreter-proof-v1Tzpath=rx    r   c              3  j   K   | ]+  }|j                  d       s|j                  dd      d    - yw)zVIRTUAL_ENV=rw   rx   N)
startswithrz   r{   s     r/   r~   z$interpreter_proof.<locals>.<genexpr>o   s}       ~N  Zm  UV  qr  q}  q}  ~L  qM  @  F  F  GJ  KL  M  NO  P  Zms   33zSEAL-v5.jsonz)run-20260817-strict-a-v5/RUN-SEAL-v5.json)schemainstalled_candidate_requiredrH   rI   rJ   rK   rL   rM   rN   rQ   rR   rS   rT   )"sysrH   rV   rW   r)   	importlibimport_moduleImportError	CANDIDATEr\   zipfileZipFiler[   getattr
isinstancer   resolver   readrB   rF   valuescloserunSERVICEstdoutdict
splitlinesrU   rI   rz   nextPREDECESSORre   )rg   excwheelsrN   keyrE   archivesrb   rc   modulemodule_filerm   archivewheel_bytesrO   rp   fields	execstartenvironmenttelegram_filera   s                        r/   interpreter_proofr   O   s%   
~~V$G6I#..IY4Z,[&[O((4 MM !XXF G8>GHCc'//$''HG:)//1KD**40FgfZX\>]+k#.g@TUYTZ>[6\0\$,,.F$//)*DY-XGV,K c&k) +&[ 
 %(K]fgr]stGDM 2  (G'--/(	"8F74DQ^_cdvw	x		DF(9FFFjjR(Ifjjr6R+(:d3MmC(8U0V*V5UYgjgugu  @C  @J  @J  ]`  ae  fs  at  a|  a|  a~  ]  DK  OX  DX  S\  Sb  Sb  cj  kl  Sm  no  Sp  Sv  Sv  wz  {|  S}  ~  S@  ^b  y}  ~N  Ze  Zk  Zk  Zm  ~N  OS  yT  io  is  is  tF  iG  RY  ps  tz  {D  tE  pF  ^a  bh  iv  bw  ^x  U	X	  Y	d	  e	s	  Y	s	  U	t	  P
S
  T
_
  `
K  T
K  P
L  MF';  ODE3NO H  (G'--/(s*   L ; L9CL? 	L6%L11L6?'M&c                   t        j                  | j                               dt        t	        t
                    t        t              ddddd}t        fd|j                         D              rt        d      S )	NAUTHORIZED_ONE_USE_V7@bb191678ac5a3d5d27db30709385e66e57f949539c74a048e3dadb7cc503450e@6ff6f8fc3ea6b1c139b7ccee559e4797dd62f595e8abf5cb79200b8692ea75d0@b2df5bb3a8c553bb785247b86fa7b96e0633025c598123458d19684b3bafa564@c7a5d14dd1cffed19374a0546ce2f7ca4d19bb0edb46bca8a52e1bce9a7a7d1d)statuscontroller_sha256required_interpreterv6_candidate_seal_sha256v6_permission_sha256v6_incident_binding_sha256config_authority_seal_sha256c              3  L   K   | ]  \  }}j                  |      |k7    y wr=   rU   )r|   kvr:   s      r/   r~   z$verify_permission.<locals>.<genexpr>u   s$     
7&6sq599Q<?&6   !$zv5 permission mismatch)r7   loads	read_textrF   r   rk   rV   rW   anyr\   r)   )rE   expectedr:   s     @r/   verify_permissionr   r   sx    
**T^^%
&E.3tH~CVnqrxny  VX  pr  PR  rt  uH

7hnn&6
77wG_?`9`Lr.   c                    t        j                  t        dz  j                               } t        dz  }| j                  d      dk7  sa| j                  d      t        |      k7  sD| j                  d      dk7  s0t        j                  |j                         j                        dk7  rt        d	      d
d l}|j                  t        dz  j                               }|j                  di       j                  di       }t        |t              rd|v rt        d      t        j                   d      }t#        |dd       }t#        |dd       }t        |t$              rt'        |      st        d      t)        |      j+                         }dt%        |      v r@t-        j.                  t        dz        5 }	t1        |	j3                  d            }
d d d        nt        |      }
ddddd
dS # 1 sw Y   xY w)NzCONFIG-AUTHORITY-SEAL-v3.jsonconfig.yamlr   AUTHORIZED_METADATA_HARDENEDr?   mode0600  zconfig authority mismatchr   	platformsrg   tokenzliteral config token forbiddengateway.configrk   load_gateway_preflight_inputsz(read-only preflight resolver unavailablerl   rh   zgateway/config.pyztask26-v7-resolver-contract-v1Fz,gateway.config.load_gateway_preflight_inputs!read_only_zero_authority_mutation)r   literal_config_tokennetwork_usedresolver	bootstrapbootstrap_sha256)r7   r   r   r   rZ   rU   rF   statS_IMODEst_moder)   yaml	safe_loadr   r   r   r   r   rV   callabler   r   r   r   rB   r   )	authorityconfig_pathr   rA   telegram_cfggateway_configconfig_module_fileapiconfig_originr   r   s              r/   resolver_contractr   x   s   jj)$CCNNPQI%K}}X >>)--PXBY[^_j[kBkoxo|o|  ~D  pE  GM  pM  QU  Q]  Q]  ^i  ^n  ^n  ^p  ^x  ^x  Qy  {@  Q@  HO  Pk  Hl  Bl-88:;CR(,,Z;Ll4(G|,C7SsKtEt**+;<N~j>>tDC(-Xc]'R|J}D}+,446M#m$$__Y'WWX\c(6I)JK YX }-5Ubg  tb  oR  fv  w  w	 YXs   6G..G7c                    t               } 	 t        j                  d      }t        t              }|j                  t              }t        t              }||k7  rt        d      |j                  j                  }t        |t              r|j                         st        d      	 |i | dddt        |j                  j                        dfS # t        $ r  t        $ r}t        d      |d }~ww xY w)	Nr   z*read-only preflight mutated authority treeztelegram credential unavailablez&read-only credential resolution failedTFr   )credential_resolvedcredential_storedauthority_tree_mutationscredential_source_path)r   r   r   tree_snapshotrZ   r   r)   rg   secretr   rV   strip	Exceptionsource_path)contractr   beforeinputsafterr   r   s          r/   resolve_telegram_credentialr      s    H	^ ../?@W%;;GDG$U?'*V"WWoo$$%$EKKMIjAk;kM   jH  j4Emn  IL  MS  M\  M\  Mh  Mh  Ii  j  j  j E]7+S#TZ]]]s   BC C3"C..C3c                    t        j                  d      } t        dz  }t        dz  }t        t              }| j	                  t              }t        t              }||k7  rt        d      t        j                  |j                         j                        dk7  s0t        j                  |j                         j                        dk7  rt        d      |j                  j                  |k7  s|j                  j                  st        d      t        dz  j                         rt        d	      d
t        t              dddddddt        j                  t         j"                  j%                  d      dS )Nr   r   .envz.exact profile preflight mutated authority treer   zexact profile metadata mismatchz"exact profile secret path mismatchsessionsz%sessions created before customer prepPASS_READ_ONLYr   TFr   
PYTHONPATH)r   profileconfig_modeenv_moder   credential_outputcredential_source_namer   sessions_absentinterpreter
pythonpath)r   r   rZ   r   r   r)   r   r   r   rg   r   r   existsrV   r   rH   osenvironrU   )r   configenvr   r   r   s         r/   exact_profile_preflight_proofr      sq   **+;<N= Fgfn#!F77@F

 Eu}G$TUU||FKKM))*E1T\\#((*BTBT5UW\5\dk  mN  eO  _O""C'v/E/EWUyMzGz
""$G4[,\&\%G6]cz~  TY  sy  UV  im  |  |J  |J  XZ  Xb  Xb  Xf  Xf  gs  Xt  u  ur.   c            	     2   t        j                  d      } t        j                  d      5 }t	        |      }|j                  d       |dz  }|j                  d       |j                  d       |dz  }|j                  d	       |j                  d
       | j                  |       t        d      # t        $ rN}t        |      j                  dk7  st        |      dk7  rt        d      |dddddddcY d }~cd d d        S d }~ww xY w# 1 sw Y   y xY w)Nr   ztask26-v7-mode-fixture-)rI     r   z)platforms:
  telegram:
    enabled: true
i  r   z$TELEGRAM_BOT_TOKEN=fixture-not-live
r   GatewayPreflightErrorz$untrusted profile input: config.yamlz0664 fixture wrong failurePASS_FAIL_CLOSED0664#UNTRUSTED_PROFILE_INPUT_CONFIG_YAMLF)r   r   	exceptionreasonreason_coder   z0664 fixture accepted)r   r   tempfileTemporaryDirectoryr   chmod
write_textr   r   typer*   rV   r)   )r   rA   r   r   r   r   s         r/   mode_0664_fixture_proofr     s-   **+;<N		$	$,E	F#S	7==/}$f&7&78f&gioiuiuv{i|FNCNN+RSUXU^U^_dUe99'B -..  	aCy!!#::c#hHn>nv}  [  w\  be  qe/vJa  lR  aF  [`  a  a 
G	F
	a 
G	Fs<   A+DB3(D3	D
<:D6D
7DD

DDc                    t        | dd       }t        | dd       }t        |      t        us|dk  s|t        k7  s||k7  rt	        d      ||fS )Nidusernamer   z6wrong Telegram bot identity or administrator readiness)r   r  intBOT_USERNAMEr)   )identityreadiness_bot_idbot_idr  s       r/   validate_network_identityr     sa    8D&F*T1RF|3&!)x/EIY[aIaip  rj  jk  dk(?r.   c           	       K   dd l }t        j                  d      j                  }t        j                  d      }|j	                  t
        dz  j                               }ddd t        t        ddg d	}|j                  ||      }	  ||       4 d {   }t        j                  |j                         d
       d {   }t        j                  |j                  ||      d       d {   }	d d d       d {    t        	      \  }}ddddgt!        |      ||j"                  t%        |j&                        ddS 7 7 7 Z7 L# 1 d {  7  sw Y   \xY w# t        $ r}
t        d      |
d }
~
ww xY ww)Nr   rg   r#   r   rx   ordinary_v10user_idchat_idtopic_id)versionregistry_modediagnostic_session_digestowner	customers   timeout   z:bounded read-only Telegram identity/admin preflight failedztask26-v7-telegram-preflight-v1r   get_meget_chat_member(bot_admin)F)r   r   
operationsr  bot_usernamestaff_chat_inventory_sha256staff_chat_countr   )r   r   r   Botr   rZ   r   OWNERbuild_staff_chat_inventoryasynciowait_forr&  verify_subscription_readinessr   r)   r  rV   r?   lenrows)r   r   r,  gaterA   	synthetic	inventorybotr  readiness_idr   r  r  s                r/   telegram_network_preflightr9     s    
+//Ci6M6M  OA  7B-88:;C=UYmr  ~C  OR  cS  `b  cI--i<Iru::"++CJJLDDH&//0R0RSVW`0ajlmmL : .h|DOF86@P_g  iE  _F  PS  TZ  P[  ks  R[  Rb  Rb  vy  zC  zH  zH  vI  ^c  d  d Dm ::: q7+g#hnqqqs   BFE$ EE$ )EE	.E0E1E5E$  EE$ AFE$ 	EEE$ E!EE!E$ $	E>-E99E>>Fc                    t        |      }|rNt        j                  | |      }t        |      t        us|dk  s|t        |      kD  rt        d      ||d  }|rMy y )Nr   zincomplete write)
memoryviewr   writer  r  r2  r)   )fdrA   viewns       r/   	write_allr@     sU    c?D
HHR7#a1s4y=HZ@[:[ABx r.   F	exclusivec                  | j                   j                  ddd       | j                   j                  d       | j                         rt	        d|        |r| j                         rt	        d|        | j                  d| j                  z   dz   t        j                         j                  z   dz         }t        j                  |t        j                  t        j                  z  t        j                  z  t         z  d      }	 t        j"                  |d       t%        |t'        |             t        j(                  |       t        j*                  |       |r.| j                         r|j-                          t	        d|        t        j.                  ||        t        j                  | d       t        j                  | j                   t        j0                  t        j2                  z  t         z        }t        j(                  |       t        j*                  |       y # t        j*                  |       w xY w# t        j*                  |       w xY w)	NTr   parentsr   exist_okzsymlink output: zone-use output exists: .z.tmpr   )parentmkdirr	  
is_symlinkr)   r   	with_namerb   uuiduuid4hexr   openO_WRONLYO_CREATO_EXCLFLAGSfchmodr@  r;   fsyncr   unlinkreplaceO_RDONLYO_DIRECTORY)rE   r:   rB  tmpr=  dfds         r/   atomicr\     s   KKd>@Q@QRW@X*:4&(A BBT[[]'4KD62R*S$S
..TYYs*4::<+;+;;FB
CC	bkk"**,RYY6u<e	DB
		"eiE%L9288B<XXb\T[[]CJJLBYZ^Y_@`8a2aJJsD288D%0
BKK6u<=C	#XXc] XXb\
 XXc]s   
A H, I ,IIc           	         t        j                  | fdddd|}|j                  r6t        d|j                   d| d|j                  j                                |S )NTF)textcapture_outputcheckzcommand failed (z): z: )
subprocessr   
returncoder)   stderrr   )commandkwps      r/   r   r      s^    nnWL$dLLA||7%5all^3wkQSTUT\T\TbTbTdSe#fggHr.   c                     t        dddt        ddddddg
      } t        d | j                  j	                         D              S )	Nrn   ro   rp   rq   ActiveStateSubStateMainPIDc              3  J   K   | ]  }d |v s|j                  d d        ywrv   ry   r{   s     r/   r~   zservice.<locals>.<genexpr>   s#     J(=1A(=r   )r   r   r   r   r   )rf  s    r/   servicerl     sC    	]4PZ[_`i
jkAJ(;(;(=JJJr.   c                     dd l } | j                  t        dz  j                               }|d   d   d   }|d   }|d   |d   |d	   d
S )Nr   r   r   rg   extraadaptive_nutritiondelivery_enabled
activationdeliveryrp  rq  rr  )r   r   rZ   r   )r   r}   rn  as       r/   config_flagsru     sg    
nngm+6689A;PZA[\cAd5hm  oC  iDfg !34!L/]^_i]jkkr.   c                    t        j                  t        dz  j                               t        j                  t        dz  j                               } t        t
        t        t        t        t        d}j                  d      dk7  s"t        fd|j                         D              rt        d      t        t        dz        t        k7  rt        d      | D ]`  }t        |d	   z  }|j                         r2|j!                         j"                  |d
   k7  st        |      |d   k7  sQt        d|d	           dD ]R  }t        j                  t        d| dz  j                               }|j                  d      dk7  sFt        d|        t%        t'        t(              t'        t        dz        g       |S )NzREADINESS-SEAL-v3.jsonzPACKAGE-INVENTORY-v3.json)full_candidate_digestcore_candidate_digestrQ   rR   package_inventory_sha256lifecycle_observer_v7_sha256r   READY_STRICT_REHEARSALc              3  L   K   | ]  \  }}j                  |      |k7    y wr=   r   )r|   r   r   seals      r/   r~   z#verify_candidate.<locals>.<genexpr>   s%     :fUecaPQ488A;>Uer   zcandidate seal mismatchzpackage inventory driftrE   sizer?   zcandidate inventory mismatch: )	objectivesecurityztrainer-freequalityqa
provenancezreview-z.jsonzreview not ready: zverify_successor_v3.py)r7   r   r   r   FULLCOREr]   r^   PACKAGE_SHAOBSERVER_SHArU   r   r\   r)   rF   is_filer   st_sizer   rV   rW   )invr   rd   rf  rb   rr}  s         @r/   verify_candidater     s   	Y77BBD	ED4::W`a|W|  WH  WH  WJ  LKs&*4^h  AL  hs  S_  `Hxx33s:fU]UcUcUe:f7fnu  wP  oQ  iQ
9001;>gNgFh@h
CK
yy{affh..F;s1vs8}?T\c  gE  FI  JP  FQ  ER  eS  ]T  WT  T
**i'$u 55@@B
C55?66gHZ[_Z`Fa>b8b T VS#;;<=>Or.   c            
     B   t               ddddk7  rt        d      t        dz  t        dz  t        dz  t        d	z  t        d
z  t        dz  t        dz  t        dz  t        dz  g	} | D cg c]  }|j                         st	        |        }}t        dz  }|j                         rPt        j                  |j                               j                  dg       g k7  r|j                  t	        |             |rt        ddj                  |      z         t               }|ddddk7  rt        d      t        ddt	        t        j                               ddg      j                  }t!        d |j#                         D              rt        d      d|ddS c c}w )Nr  inactivedead)rj  rh  ri  zservice not inactive/deadcustomers/registry.jsongateway.lockgateway.pidgateway_state.jsonstate.dbr   data/onboardingdata/owner-actionsdata/customerszcron/jobs.jsonjobsz>unexpected live bytes must be archived by cleanup controller: r1   Frs  zconfig safety flags mismatchz/usr/bin/ps-u-ozargs=c              3     K   | ]M  t        t        t              j                               vs,d v xs dv xr t	        fddD               O yw)dualcoachtesttask26c              3  &   K   | ]  }|v  
 y wr=   r-   )r|   r}   ls     r/   r~   z%baseline.<locals>.<genexpr>.<genexpr>  s     :vKua16Kus   )observerzjournalctl -fzgateway runN)rV   r   rk   r   r   )r|   r  s    @r/   r~   zbaseline.<locals>.<genexpr>  s       {  AP{|  TW  X\  ]e  Xf  Xn  Xn  Xp  Tq  yz  TzOq 1HMvs:vKu:v7vv  APs
   -A%Azstale target processzinactive/deadr   )rl  flagsunexpected_live_bytes)rl  r)   rZ   r   rV   r7   r   r   rU   appendjoinru  r   r   getuidr   r   r   )	forbiddenrf  
unexpectedr  r  pss         r/   r   r      s   yc
fMMU\]xUyOy001GP]H]^efz^z  |C  DN  |N  OV  Wa  Oa  bi  j{  b{  |C  DX  |X  Y`  aq  Yq  rI )8	1QXXZA	J8	!	!D{{}DNN$4599&DbH*J[J[\_`d\eJf!abebjbjkubv!vww
.E%UeLLT[\zT{N{
M$s299;/W=>EEB
  {  AC  AN  AN  AP  {  {  CJ  Ka  Cb  }b%eANN 9s   +FFc                   d| z   }t         dz  }|j                  j                  d       dt        t        ddg dd d	}t	        ||d
       t        j                  d      }t        j                  d      }t        j                         }|j                  ||j                  |dt        t        d|t        d      ddddd             |j                  |d|j                         dddddd	      }|j                  |j                  t                     j!                  |t"        t              }||j$                  j&                  |j$                  j(                  d|j*                  dS )Ntask26_strict_a_v5_r  r   )r   rx   r  r  r  )r  r   r!  r  r  TrA  r&   r"   zTask26 strict A v5   r   i     )meal_1meal_2meal_3z08:00)r)  owner_id)customer_id
session_idsid_hash
generationcustomer_link)rZ   rH  rI  r-  r\  r   r   r   todayregister_customerCustomerDraftACTORdaytime	isoformatRoomBootstrapStoreroom_bootstrap_state_dir!prepare_rehearsal_customer_inviter  sessionr  r  r  )	lineagecustomerregistryinitialadminr   r  draftr   s	            r/   preparer    s   "7*H..H0E0E50E0QEES!Q^`q~  \`  aG
8Gd+

!
!">
?E%%&UVI
**,E	HU%8%8BVW\]bcfglmtuvmwxyz{  }A  BE  Fb  &c  d

!
!(+?@QRYZ[\]^bcf  hD  EE)))*L*LW*UVxxy~  MY  chx  iH"0@0@0K0KW_WgWgWpWp~  QY  Qg  Qg  h  hr.   c                   t         dz  }t         dz  }t        t        t              ddddddt        |      t        |      g	       d	}t	        j
                  t        t        t              d
|g      j                        }dt        fdt        ffD ]'  \  }}||   d   d   d   }||k7  st        d| d       t               }dt        t        t        t        t        |d   d|}	t        | |	d       |	S )Nrh   ri   z-mpipinstallz	--no-depsz--no-compilez--force-reinstalla  import hashlib,importlib.metadata as m,json
from pathlib import Path
import gateway.platforms.telegram as t,checkin_cli
def d(n):
 x=m.distribution(n).read_text("direct_url.json");return json.loads(x)
print(json.dumps({"hermes_origin":str(Path(t.__file__).resolve()),"profile_origin":str(Path(checkin_cli.__file__).resolve()),"hermes_direct":d("hermes-agent"),"profile_direct":d("physique-checkin-cli")},sort_keys=True))z-chermes_directprofile_directarchive_infohashesr?   z
installed z	 mismatchztask26-strict-deployment-v5rN   )r   candidate_digestcandidate_core_digestcandidate_inventory_digestrQ   rR   loaded_byte_proofTrA  )r   r   rV   rW   r7   r   r   r]   r^   r)   r   r  r  r  r\  )
outhwpwcodeproofr   wantgotloadedreceipts
             r/   deployr    s+   AABi  QH  GH2VT%	+nEXY\]_Y`adegahij 
yD
**S#f+d40188
9E%j13CK2PQD#J~&x0:9GjY$?@@ R F3tdh  GR  is  KV  kq  r{  k|  E  D  EG
3w&wr.   c                   t        j                         |z   }t        j                         |k  rl| j                         r/	 t        j                  | j                               } ||      r|S 	 t        j                  d       t        j                         |k  rlt        d|        # t        t        j                  f$ r Y Vw xY w)N皙?zbounded event timeout: )
r   	monotonicr   r7   r   r   OSErrorJSONDecodeErrorsleepr)   )rE   r$  	predicatedeadliner:   s        r/   	wait_filer    s    ^^g%H
..
8
#;;=8jj!12U#E\#

3 ..
8
# +D62
33 D001747s    ,B) )CCc                b   | dz  }t        |dd      }t        j                  dddt        dd	d
ddg	|t        j                  d      }| dz  }| dz  }t        j                  t        t              t        t        dz        ddt        |      dt        |      gt        j                  t        j                  d      }t        j                  ||f       t        |dd        t        dddt        g       t        j                         dz   }t        j                         |k  rt               }t         dz  }	|j#                  d      dk(  r|j#                  d      dk(  r||	j%                         rlt'        j(                  |	j+                               }
|
j#                  d      dk(  r5|
j#                  d i       j#                  d!i       j#                  d"      d#k(  rn8t        j,                  d$       t        j                         |k  rt/        d%      t         d&z  }t        j                         d'z   }d }t        j                         |k  r|j%                         r]|j+                         j1                         D 
cg c]  }
t'        j(                  |
       }}
t3        d( t5        |      D        d       }|rn-t        j,                  d)       t        j                         |k  r|st/        d*      t7        t               d+         |j8                  |j8                  |d,   |d-   |d.   d/S c c}
w )0Nzjournal.txtwzutf-8)encodingz/usr/bin/journalctlro   r  z-fz-n0z
--no-pagerr  catT)r   rc  start_new_sessionzobserver-events.jsonlzobserver-ready.jsonzlifecycle_observer_v7.pyobservez--eventsz--ready   c                *    | j                  d      dk(  S )Nr   ARMEDr   )r}   s    r/   <lambda>zstart_runtime.<locals>.<lambda>.  s    quuX7r.   rn   startZ   r  rh  activeri  runninggateway_stater   rg   state	connectedg?zgateway readiness timeoutz9data/onboarding/telegram-staff-membership-v1/events.jsonl
   c              3  J   K   | ]  }|j                  d       dk(  s|  yw)eventsubscription_armedNr   r{   s     r/   r~   z start_runtime.<locals>.<genexpr>>  s!     Z>aQUU7^EY5Y>s   ##r  z!membership subscription not armedrj  subscription_epoch_idobserved_at_utcr*  )service_pidobserver_pidmonitor_pidr  subscription_armed_at_utcr*  )rO  ra  Popenr   STDOUTrV   rW   r   DEVNULLr'   extendr  r   r   r  rl  rZ   rU   r   r7   r   r   r  r)   r   r   reversedr  pid)rootjournaljfmonitoreventsr   r  r  sr  r}   r   armedr3  s                 r/   start_runtimer  (  s&   G4W#E3HT'$uUabfglmuw  @J  @Q  @Q  dh  iG''Ft4I/Is6{3y9S/S+TU^_ijmntjuv  AD  EJ  AK  L  T^  Tf  Tf  nx  n@  n@  SW  XHOOWX&'eA78	hww78^^b H
..
8
#
)7#77U55)aeeJ.?.Ju||~jj*+Auu_%y0QUU;r5J5N5NzZ\5]5a5abi5jlw5wy~

2 ..
8
# 34
4RRJ^^b H
E
..
8
#)3)=)=)?)J)J)LM)LA$**Q-)LDMZ8D>Z[_`Ee

3 ..
8
#  CDDgi	238<<^e^i^i  CH  I`  Ca  ~C  DU  ~V  uz  {X  uY  Z  Z Ns   ;L,c                  K   dd l }t        j                  d      j                  }t        j                  d      }t	        j
                  t        dz  j                               }|j                  t        dz  j                               }	|j                  ||	      }
|
j                  |d   k7  rt        d       ||      4 d {   }|j                  ||
| |t        dz  t        dz  |d   t        t              |d	   d
|d   |d          d {   cd d d       d {    S 7 a7 7 	# 1 d {  7  sw Y   y xY ww)Nr   rg   r#   r  r   r*  zstaff inventory driftr  r  rx   r  r  )
output_pathdeployment_receipt_pathregistry_pathr   r  customer_user_idbootstrap_session_idbootstrap_generationr  r  )r   r   r   r,  r7   r   rZ   r   r   r.  r?   r)   create_pre_activation_evidencer  r  )r  
deploymentr   runtimer   r   r,  r4  r  r   r6  r7  s               r/   r   r   D  s    
+//C		 	 !S	TDZZ!::EEGHHQUQ_Q_ahivav  aB  aB  aD  RE&  QU  Qp  Qp  qy  z@  QA  GP!>??wOfGgAg5zzS88YSZs}  MT  Un  Mn  {B  CP  {P  ]e  fs  ]t  FI  JO  FP  fn  o{  f|  RS  jq  rI  jJ  el  mH  eI8  J  J zz J zzzs[   CED(E
AD.D*D.E"D,#E*D.,E.E 4D75E <Ec                6   t        j                  d      j                  } || d      }|j                  dk7  r"t	        d|j
                  j                  z         |j
                  j                  t        |j                        t        |j                        dS )Nr$   T)receipt_directoryallow_billable_active_prober   zprovider readiness failed: )resultreceipt_sha256receipt_path)
r   r   provider_auth_checkexitr)   r  r:   rF   r  rV   )receipt_dirr  r  s      r/   r   r   M  su    !//0SThhKTXYAvvqy =ahhnn LMMXX^^S5HX[\]\j\jXkllr.   c                  K   dd l }t        j                  d      j                  }| dz  }| dz  }|j	                         s|j	                         rt        d      d|d   z   }t        |dd	t        t        |d
   z   j                               |d   |d
   t        t        |j                               dd       |j                  t        dz  j                               }	  ||      4 d {   }	|	j                  t        t              |d       d {   }
d d d       d {    ddt'        
j(                        t'        |
j*                        t        t        |d
   z   j                               d}t        ||d       |S 7 7 u7 g# 1 d {  7  sw Y   wxY w# t         $ r9}t        | dz  ddt#        |      j$                  dd       t        d      |d }~ww xY ww)Nr   rg   zinvite-intent.jsonzinvite-result.jsonz-invite was already attempted; retry forbiddenu`   DualCoach 시작 초대입니다. 아래 링크를 눌러 본인이 직접 시작해 주세요.
r  ztask26-invite-intent-v1ATTEMPTING_NEVER_RETRYr  r  )r   r   idempotency_keyr  r  destinationmessage_sha256TrA  r   )r  r^  disable_web_page_previewzinvite-unknown.jsonztask26-invite-unknown-v1UNKNOWN_NO_RETRY)r   r   
error_typez*invite outcome unknown; no retry permittedztask26-invite-result-v1SENT_EXACTLY_ONCE)r   r   
message_idr  r#  )r   r   r   r,  r   r)   r\  rB   r  r9   r  r   rZ   r   send_messager  BaseExceptionr  r*   rV   r*  r  )r  r   r   r   r,  intentr  messager   r7  sentr   r:   s                r/   	send_oncer0  S  s    
+//C$$FT2F-Ff}}&--/9h1i+iopx  zI  qJ  JG
65?Wjsuy  {C  DP  {Q  vQ  uY  uY  u[  k\  ks  tA  kB  PX  Ye  Pf  uz  LU  V]  Vd  Vd  Vf  Lg  h  sw  x>>7=0;;=>Fbu::''E
ae'ffD : .7JX[\`\k\kXlwz{  |H  |H  xI  \e  gk  lt  uA  lB  gB  fJ  fJ  fL  \M  NE
6%$' f ::: bt))4NXjx|  ~A  yB  yK  yK  +L  W[  	\  dk  lX  dY  _b  ^bbs   CG+"F& .F/F& 2%FFFF& 'F(F& ,AG+F& FF& F#FF#F& &	G(/4G##G((G+c                    t        j                  dddt        gdd       t        D ]S  }|j                         t        j                  |j                  t        j                         |j                  d       U t        j                  ddd	t        gd
       | dz  }|j                  dd       dD ]f  }t        |z  }|j                         s|j!                         r.||z  }|j"                  j                  ddd       t        j$                  ||       h t'        | dz  d|d       y # t        $ r Y w xY w# t        $ rB t        j                  |j                  t        j                         n# t        $ r Y nw xY wY ew xY w)Nrn   ro   stopT   )r_  r$  r  r#  zreset-failed)r_  zrollback-archiver   )r   rF  )r!  r  r  r  r  r  r  r  zstate.db-shmzstate.db-walr   rD  zblocked.jsonBLOCKED_CLEAN_ROLLBACK)r   r  )ra  r   r   r   r'   pollr   killpgr  signalSIGTERMwaitSIGKILLrI  rZ   r   rJ  rH  renamer\  )r  r  childr   relrf  qs          r/   rollbackr?  c  s=   	-hvgFVZcf	g::<599V^^4ejjj6L  NN(.IY]^##GW]]t]%L {
#+88:allnckA188>>$E4>PRTR[R[\]^_R` { 4)A6RS d  'YYuyy8 &$&'sG    D2 A E2	D?>D?	F.E:9F:	FFFFFc                
   |j                         }| j                  d      D ]P  }|j                         s|j                         r%|j	                         }||v s:t        d|j                          y # t
        $ r Y _w xY w)N*z!credential leaked into evidence: )r9   rglobr  rJ  rD   r  r)   rb   )r  r   needlerE   rA   s        r/   assert_secret_absentrD  t  sl    <<>F

3<<>$//"3__&}G.OPTPYPY{,[$\\	   $H$s   A66	BBc                   | dz  }t        |dt        t        t                    t        t        |d               dd       |j	                         D ci c]  \  }}||
 }	}}t        | dz  |	d       t        | dz  |d       t        | d	z  |d       t        j                  t              j                  d
      dz   t        j                         j                  d d z   }
d}	 t               }t        | dz  |       t               }t        | dz  |       t        |
      }|j                  d      }t        | dz  |       ||d<   t!        | dz        }t#        |       }t        | dz  |       t%        j&                  t)        | dz  | dz  |||            }|j+                  d      }|j+                  d      }t-        |t.              r|rt1        d |D              rt3        d      t-        |t.              rt1        d |D              rt3        d      t5        | dz        }t               |k7  st7               |d   k7  rt3        d      t        | dz  d|d    |d!       t9        | |       t%        j&                  t;        | ||            }d}t9        | |       d"}i d#d$d%d&d't=        t>              d(t@        d)tB        d*tD        d+|d+   d,|d,   d-tG               d.|d.   d/|d    d0|d1   d2d3d4|d5dd6dd7d}t        | d8z  |d       |S c c}}w # tH        $ r}|stK        | t=        |              d }~ww xY w)9Nz
ONE-USE-v7CLAIMED_path)r   r   permission_sha256TrA  z00-interpreter-v7.jsonz00-secret-resolution-v7.jsonz00-network-preflight-v7.jsonz%Y%m%d%H%M%S_r  Fz01-verified.jsonz02-baseline.jsonr  z03-prepared.jsonz04-deployment.jsonz05-runtime.jsonz06-membership.jsonmembership_resultsprivate_dm_resultsc              3  h   K   | ]*  }t        |t               xs |j                  d       dv , yw)r   >   leftkickedNr   r   rU   r|   rd   s     r/   r~   zexecute.<locals>.<genexpr>  s\       Nq  ap  Z]R\]`aeRfNf  OUjmjqjqrzj{  DU  kU  OU  ap   02z-fresh left/kicked membership evidence missingc              3  h   K   | ]*  }t        |t               xs |j                  d       du , yw)identity_separatedTNrO  rP  s     r/   r~   zexecute.<locals>.<genexpr>  sH       4S  FR  B
3t8L4L4yPSPWPWXlPmuyPy4y  FRrQ  z)private staff identity separation missingr   r  z&candidate/config changed after startupz07-ready.jsonREADY_TO_INVITEevidence_sha256)r   membership_evidence_sha256r   zCustomer 8527916639: open the single DualCoach invite in this private DM and tap Start yourself; do not send onboarding answers yet.r   ztask26-strict-launch-result-v7r   READY_CUSTOMER_CLAIMr   rS   rT   	candidater  r  rl  r  rV  invite_message_idr*  invite_countrx   first_user_instructionrq  rr  delivery_capability_issuedzREADY_CUSTOMER_CLAIM.json)&r\  rF   r   rk   r\   r   nowr   strftimerL  rM  rN  r  r   r  popr  r  r/  r   r   rU   r   listr   r)   r   ru  rD  r0  rV   rW   r_   r`   r  rl  r   r?  )r  r   
permissionr   r   networkmarkerr   r   r  r  invitedpinsbaser   private_linkr  r  rc   membership_rowsprivate_rowsprovider_resultinvitehandofffinalr   s                             r/   executern  |  s   FfViTWX\]eXfTg|  AE  FP  QX  FY  AZ  }[  -\  gk  l%++-
.-31Q1Q3-E
.t<T7TUZei0j
4..x$GPTUsPst{  GK  JLLL&&~6s:4::<;K;KBQ;OOGG-?(?!EZ%7 7=!_0M<vVZ[mVmnvOw".!$334
d#VD1B,B7%K{{:d+?&?EY@YZbcjkpqr

#78ZZ 45/$/#  Nq  ap  Nq  Kq  y@  Ap  yq  sq,t,  4S  FR  4S  1S  [b  cN  [O  UO j1t#|~tG}'DGT|L}F}tO#.?]cdu]v  CR  %S  	TT%({{9T(59:DGT%( W G	x8  G	BX  G	Yfgjkqgr  G	  tO  Pf  G	  gA  BW  G	  Xc  dh  G	  iv  w  @M  wN  G	  O[  \d  eq  \r  G	  s|  }D  }F  G	  GU  V]  ^l  Vm  G	  nJ  KQ  Rc  Kd  G	  ex  y  @L  yM  G	  N\  ]^  G	  _w  x  G	  @L  MR  G	  S]  ^c  G	  d@	  A	F	  G	t//Ee|1 /2  c#h/s   L)H/L 	M(M  Mc                   t        t              }t               }t               }t	               }t               }t        t              }||k7  rt        d      ddt        ||||t        dddgddd	||d
}	t        | dz  |	d       |	S )Nzdry-run mutated profileztask26-strict-launch-dry-run-v7PASS_ZERO_MUTATIONSPASS_CONTRACTr&  r'  F)r   r(  network_executedr   )r   r   rX  r   secret_resolution_contractchecksr   planned_boundariesread_only_transportr   exact_profile_preflightmode_0664_fixturezdry-run.jsonTrA  )
r   rZ   r   r  r  r   r)   r  
BOUNDARIESr\  )
r  r   r   r   actualfixturere  rf  r   r:   s
             r/   dry_runr|    s    !F*G*I6SjSl7  tD  tFnr  MU  MW  HL  _l  mt  _u  Y^u}G$=>>5?Tae  {F  dl  vz  FJ  `j  KZ  iq  rN  hO  ch  Ai  EF  ag  |C  DE
4ut4Ulr.   c           
     f   g }t        | j                  d            D ]  }|j                         }|j	                  |       j                         }|j                         r(|j                  |dt        j                  |      f       j|j                         r4|j                  |d|j                  |j                  t        |      f       |j                         s|j                  |dt        j                   |j"                        f        t%        t'        |            S # t        $ r Y w xY w)NrA  LFD)sortedrB  lstatFileNotFoundErrorrelative_toas_posixrJ  r  r   readlinkr  r  st_mtime_nsrF   is_dirr   r   r   rB   r;   )r  r3  rf  str=  s        r/   r   r     s    	DDJJsO$	RMM$((*<<>4;;CA'?@YY[$++s3rzz"..Q&PQXXZc#dll2::.F%GH % U4[!! !*(*s   D##	D0/D0c                  *    e Zd ZdZddZddddddZy)	BoundaryModelzHDeterministic model used to prove ordering/crash/unknown-outcome policy.c                .    d| _         d| _        d| _        y )Nr   F)index	attemptedr/  )selfs    r/   __init__zBoundaryModel.__init__  s    1
UdnaDIr.   F)crash_beforecrash_afterunknownc                  | j                   t        t              k\  s|t        | j                      k7  rt        d      |rt	        d      |dk(  r| j
                  rt        d      d| _        |dk(  r9| j
                  st        d      |rt        d      | xj                  d	z  c_        | xj                   d	z  c_         |rt	        d
      y )Nzorder violationzcrash-beforer   zduplicate inviteTr    zmissing intentzunknown-no-retryrx   zcrash-after)r  r2  ry  r)   RuntimeErrorr  r/  )r  rb   r  r  r  s        r/   crosszBoundaryModel.cross  s    ::Z(D*TZZ2H,HPWXiPjJj|N;; ~~011DN >>1A)B#Bg&899IIqLI

A
l=99;r.   N)returnNone)
rb   rV   r  boolr  r  r  r  r  r  )r*   r+   r,   __doc__r  r  r-   r.   r/   r  r    s    RO05uZ_ :r.   r  c                    t        j                         } | j                  dd       | j                  dt        d       | j                  dt        d       | j	                         }	 t               }t        |j                        }t        |j                        |d<   t               }|j                  d	k(  r2t        |j                        |j                  d
      k7  rt        d      |j                  d	k(  rdt               \  }}t        j                   t#        |            }|j                  j%                  ddd       t'        |j                  |||||      }n5|j                  j%                  ddd       t)        |j                  ||      }t+        t-        j.                  |d             y# t0        $ r&}t+        d|t2        j4                         Y d }~yd }~ww xY w)Nr   )zdry-runrn  )choicesz--rootT)r  requiredz--permissionrG  rn  authorized_run_rootzv7 authorized run root mismatchr   )r   rE  rF  )r3   r   zBLOCKED:)file   )argparseArgumentParseradd_argumentr   
parse_argsr   r   ra  rV   r   r   r  rU   r)   r   r/  r   r9  rI  rn  r|  printr7   r8   r   r   rc  )	rf  rt  r   ra  r   r   rb  r  r   s	            r/   mainr    s   A?T!UWXWeWefntx  CGWe  XH  JK  JX  JX  Yg  mq  {  JX  J@  DE  DP  DP  DR  BC	M%'4Eall4SilmnmymyizU_`gUh  FW  FY  }E669QVV
?T0U!U]d  fG  ^H  XH66968NE('++NhinNoBp'FFLLeD$L?PQPVPVWbcmnst|  ~E  IFFFLLeD$L?PQPVPVWbckHldjj$/0LU:cszzB1Ls   )E
F4 4	G#=GG#__main__)r:   r	   r  bytes)rA   r  r  rV   )rE   r   r  rV   )ra   dict[str, Any]r  r  )r  r  )rE   r   r  r  )r  ztuple[str, dict[str, Any]])r  r	   r  r	   r  ztuple[int, str])r   rV   r  r  )r=  r  rA   r  r  r  )rE   r   r:   r	   rB  r  r  r  )rd  z	list[str]re  r	   r  z subprocess.CompletedProcess[str])r  zdict[str, str])r  zdict[str, bool])r  rV   r  r  )r  r   r  r  )rE   r   r$  floatr  zCallable[[Any], bool]r  r	   )r  r   r  r  )r  r   r  r   r   r  r  r  r   rV   r  r  )r   r   r  r  )r  r   r   r  r   rV   r  r  )r  r   r  rV   r  r  )r  r   r   rV   r  r  )r  r   r   r  ra  r  r   rV   r   r  rb  r  r  r  )r  r   r   r  r   r  r  r  )r  r   r  rV   )r  r  )[r  
__future__r   r  r/  r>   r   importlib.metadataimportlib.utilr7   r   r7  r   ra  r   r  r   rL  r   r   r   r   r  pathlibr   typingr	   r
   ROOTr   rZ   rX   rW   rY   r   r   r_   r`   r  r  r]   r^   r  r  r  r-  r  ry  	O_CLOEXECr   rS  r[   r'   __annotations__r  r)   r;   rB   rF   re   r   r   r   r   r   r  r  r9  r@  r\  r   rl  ru  r  r   r  r  r  r  r   r   r0  r?  rD  rn  r|  r   r  r  r*   
SystemExitr-   r.   r/   <module>r     s   = "        	    
     9 9   78^^	
:
;	8	9	"	";;
0XX[ Z IIO
PPQ* R

wr<33"A5g8m)O,"A )+
% * !l !g I ?q!7Fw(j
u
/
d 9> 
Kl
Oh
7	4Z8Jm6 T"]>C	": :"M Zz$&11r.   