#!/usr/bin/env python3
"""Anchored builder: provision-rig-r3.sh (FROZEN) -> provision-rig-r4.sh.

doyle FXKBVGQQ, on the r3 wording: the seed's exposure to `timeout` is NOT an
irreducible floor, it is an accepted containment EXCEPTION for this isolated rig,
and "no export statement" does not mean "no environment inheritance". r4 says
that accurately and names the exception as one. The intended recipients are to be
verified with a DUMMY SENTINEL only, which the control group does; the pre-apply
absence check is retained.

Text only: no behaviour changes in this revision.
"""
import hashlib
import pathlib
import sys

HERE = pathlib.Path(__file__).resolve().parent
SRC = HERE / "provision-rig-r3.sh"
DST = HERE / "provision-rig-r4.sh"
SRC_SHA = "81f65ee38344b486cbe995c775fe347b1d9638e623e2b233aa612e3746806228"

raw = SRC.read_bytes()
got = hashlib.sha256(raw).hexdigest()
if got != SRC_SHA:
    sys.exit(f"SOURCE_DRIFT: {SRC.name} is {got}, pin says {SRC_SHA}")
if DST.exists():
    sys.exit(f"DESTINATION_EXISTS: {DST.name} is some attempt's evidence; it is not overwritten")
text = raw.decode("utf-8")

EDITS = []


def edit(name, old, new):
    EDITS.append((name, old, new))


edit(
    "floor-to-exception",
    """#   - the FLOOR, stated because it cannot be lowered: xtask reads its seed FROM THE ENVIRONMENT,
#     so the signing process must have it, and the timeout that bounds that process is its
#     parent and carries it for the same interval. Two processes, both of them the signing call
#     itself. No other command is launched in that interval;""",
    """#   - AN ACCEPTED CONTAINMENT EXCEPTION, not a floor (doyle FXKBVGQQ corrected this wording).
#     xtask reads its seed FROM THE ENVIRONMENT, so the signing process must have it; the
#     `timeout` that bounds it is its parent, is started by the same assignment, and therefore
#     HAS THE SEED IN ITS OWN ENVIRONMENT for that interval. doyle accepts those two processes
#     for this isolated rig on the condition that no other helper inherits it. That is an
#     exception granted, not a limit of the mechanism: a signer that took its seed another way
#     would not need it.
#     AND SAY IT PROPERLY: "there is no export statement" is NOT "nothing inherits it".
#     Environment inheritance is what a prefix assignment DOES — it hands the variable to that
#     command and to everything that command spawns. What the absence of an export buys is that
#     the assignment's reach is that one command's process tree and nothing else in this shell;""",
)

edit(
    "say-line-accuracy",
    """say "SIGNING_SEED present in the environment, 64 hex characters, VALUE NOT REPORTED. It is now unset from this script's environment and held in a NON-EXPORTED variable; it is never exported, and reaches only the signing command's own environment.\"""",
    """say "SIGNING_SEED present in the environment, 64 hex characters, VALUE NOT REPORTED. It is now unset from this script's environment and held in a NON-EXPORTED variable. It is handed to the signing command by a prefix assignment, so the bounding timeout AND the signing process it spawns both carry it in their environment for that interval — an accepted containment exception (doyle FXKBVGQQ), not an absence of inheritance. Nothing else in this script's environment receives it.\"""",
)

for name, old, new in EDITS:
    n = text.count(old)
    if n != 1:
        sys.exit(f"ANCHOR_{'ABSENT' if n == 0 else 'AMBIGUOUS'}: {name} matched {n} times")
    text = text.replace(old, new, 1)

DST.write_text(text, encoding="utf-8", newline="\n")
print(f"BUILT {DST.name} sha256={hashlib.sha256(DST.read_bytes()).hexdigest()}")
print(f"anchors replaced: {len(EDITS)}")