# usage: leg-runner.sh <request-file> <dry|run> <start-guard-utc e.g. 2026-09-13T07:20:00Z>
REQ="$1"; MODE="$2"; GUARD="$3"
L="C:/Users/decid/AppData/Local/Temp/claude/C--Users-decid-Documents-projects-spt-core/1212783f-c73e-4b6f-a6b2-fa9a428720d5/scratchpad/nonce-ledger.txt"
tr -d '\r' < "$REQ" > /tmp/leg-req.$$ ; R=/tmp/leg-req.$$
N=$(grep -m1 '^nonce: ' "$R" | sed 's/^nonce: //')
RCPT=$(grep -m1 '^receipt_file: ' "$R" | sed 's/^receipt_file: //')
SETUP=$(awk 'f{print; exit} /^run_exactly:$/{f=1}' "$R")
CAP=$(awk 'f{print; exit} /then_run_exactly/{f=1}' "$R")
st() { grep -m1 "stamp_utc_now_to (immediately $1 step $2[,)]" "$R" | sed 's/.*): //'; }
S1=$(st BEFORE 2); S4=$(st AFTER 2); S6=$(st BEFORE 7); S8=$(st AFTER 7)
SEXIT=$(grep -m1 'write_the_exit_preserved_in_step_3_to: ' "$R" | sed 's/.*_to: //')
CEXIT=$(grep -m1 'then_write_its_native_exit_to: ' "$R" | sed 's/.*_to: //')
EXE_PIN=$(grep -m1 'executable_identity_REQUIRED: sha256 ' "$R" | sed 's/.*sha256 //')
EXE_PATH=$(grep -A1 'executable_identity_REQUIRED' "$R" | sed -n '2p' | sed 's/^ *at //; s/ — .*//')
CAPPS=$(printf '%s' "$CAP" | sed -n "s/^& '\([^']*\)'.*/\1/p")
echo "NONCE=[$N]"; echo "RECEIPT=[$RCPT]"; echo "SETUP=[$SETUP]"; echo "CAP=[$CAP]"
echo "STAMPS=[$S1] [$S4] [$S6] [$S8]"; echo "SEXIT=[$SEXIT] CEXIT=[$CEXIT]"
echo "EXE_PIN=[$EXE_PIN] EXE_PATH=[$EXE_PATH] CAPPS=[$CAPPS]"
for v in N RCPT SETUP CAP S1 S4 S6 S8 SEXIT CEXIT EXE_PIN EXE_PATH CAPPS; do [ -z "${!v}" ] && { echo "EXTRACT_FAILED $v"; exit 80; }; done
eh=$(sha256sum "$EXE_PATH" | cut -d' ' -f1); ch=$(sha256sum "$CAPPS" | cut -d' ' -f1)
echo "exe_measured=$eh cap_measured=$ch"
[ "$eh" = "$EXE_PIN" ] || { echo "EXE_MISMATCH"; exit 81; }
[ -n "$GRANT_EXE" ] && [ "$eh" = "$GRANT_EXE" ] || { echo "EXE_NOT_GRANT_PIN"; exit 82; }
[ -n "$GRANT_CAP" ] && [ "$ch" = "$GRANT_CAP" ] || { echo "CAP_NOT_GRANT_PIN"; exit 83; }
[ -e "$RCPT" ] && { echo "RECEIPT_EXISTS"; exit 84; }
grep -q -- "$N STARTED" "$L" 2>/dev/null && { echo "NONCE_IN_LEDGER"; exit 85; }
[ "$MODE" = run ] || { echo "DRY_OK"; exit 0; }
now=$(date -u +%s); lim=$(date -u -d "$GUARD" +%s); [ "$now" -gt "$lim" ] && { echo "NOT_STARTED past guard $GUARD"; exit 90; }
echo "$N STARTED $(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$L"
stamp() { MSYS_NO_PATHCONV=1 powershell.exe -NoLogo -NoProfile -NonInteractive -Command "[DateTime]::UtcNow.ToString('yyyy-MM-ddTHH:mm:ssZ') | Set-Content -NoNewline -Encoding ascii '$1'"; }
stamp "$S1"
eval "$SETUP"
SETUP_RC=$?
stamp "$S4"
printf '%s' "$SETUP_RC" > "$SEXIT"
echo "$N SETUP_EXIT=$SETUP_RC $(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$L"
stamp "$S6"
MSYS_NO_PATHCONV=1 powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$CAP; exit \$LASTEXITCODE"
CAP_RC=$?
printf '%s' "$CAP_RC" > "$CEXIT"
stamp "$S8"
echo "$N CAPTURE_EXIT=$CAP_RC $(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$L"
printf 'nonce: %s\nexit=%s\ncapture status recorded separately in %s as %s\nexecutable and capture hashes measured by liam before step 1: %s %s\nall 8 steps run in order under one leg; stamps and capture via powershell.exe, setup via bash\n' "$N" "$SETUP_RC" "$CEXIT" "$CAP_RC" "$eh" "$ch" > "$RCPT"
echo "$N RECEIPT_WRITTEN $(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$L"
echo "DONE setup_rc=$SETUP_RC cap_rc=$CAP_RC"