#!/usr/bin/env bash
# Execute under the durable, resource-bounded heavy-lock service. Dedicated
# rootful fixture store avoids even initializing the operator's rootless netns.
set -euo pipefail
ROOT=$PWD
[[ -f "$ROOT/scripts/runtime_uplink.py" ]]
REPORT=${1:?new absolute report directory}
[[ $(id -u) == 0 && "$REPORT" = /* && ! -e "$REPORT" ]]
NAME=runtime-uplink-fixture-$(date +%s)
P=(podman --root /tmp/opencode/c01-rootful-fixtures/root --runroot /tmp/opencode/c01-rootful-fixtures/run --cgroup-manager=cgroupfs)
PARENT=$(python3 -c 'from pathlib import Path; p=Path(Path("/proc/self/cgroup").read_text().strip().split(":",2)[2]); assert p.name=="supervisor"; print(p.parent)')
IMAGE=4e0767914ee4
mkdir "$REPORT"
python3 - "$PARENT" "$REPORT" <<'PY'
import json, sys
from pathlib import Path
group = Path('/sys/fs/cgroup') / sys.argv[1].lstrip('/')
actual = {name: (group / name).read_text().strip() for name in ('cpu.max', 'memory.max', 'memory.swap.max')}
assert actual['memory.max'] == '8589934592' and actual['memory.swap.max'] == '0'
quota, period = map(int, actual['cpu.max'].split())
assert quota / period == 2
Path(sys.argv[2], 'resource-limits.json').write_text(json.dumps(actual, sort_keys=True) + '\n')
PY
cleanup() {
    local status=$?
    "${P[@]}" exec "$NAME" journalctl --no-pager > "$REPORT/journal.log" 2>&1 || true
    "${P[@]}" logs "$NAME" > "$REPORT/container.log" 2>&1 || true
    "${P[@]}" stop --time 10 "$NAME" > "$REPORT/stop.log" 2>&1 || true
    printf '%s\n' "$status" > "$REPORT/exit-code.txt"
}
trap cleanup EXIT
"${P[@]}" image inspect "$IMAGE" --format '{{.Id}}' > "$REPORT/image-id.txt"
"${P[@]}" run --detach --tty --pull=never --name "$NAME" --hostname runtime-uplink-fixture \
    --cgroup-parent="$PARENT" --network=none --cgroupns=private --systemd=always --security-opt=unmask=ALL --security-opt=apparmor=unconfined \
    --cap-add=SYS_ADMIN --cap-add=NET_ADMIN --memory=8g --memory-swap=8g --cpus=2 --pids-limit=256 \
    --tmpfs /run --tmpfs /tmp --entrypoint /sbin/init "$IMAGE" --unit=basic.target --log-target=console > "$REPORT/container-id.txt"
"${P[@]}" exec "$NAME" mkdir /opt/uplink
for source in scripts/runtime_uplink.py scripts/provision-d09-lifecycle.py scripts/test-runtime-uplink-isolated.sh image-recipe/configs/81-c01-runtime-access.conf.in image-recipe/configs/archipelago-runtime-worker.service image-recipe/configs/79-runtime-uplink.conf image-recipe/configs/archipelago-runtime-podman.service image-recipe/configs/79-legacy-manager-uplink.conf tests/regression/runtime-uplink-systemd.py; do
    sha256sum "$source" >> "$REPORT/source.sha256"
    "${P[@]}" cp "$ROOT/$source" "$NAME:/opt/uplink/$(basename "$source")"
done
"${P[@]}" exec --env RUNTIME_UPLINK_DISPOSABLE=1 "$NAME" python3 -B /opt/uplink/runtime-uplink-systemd.py 2>&1 | tee "$REPORT/test.log"
sha256sum --check "$REPORT/source.sha256" > "$REPORT/source-unchanged.txt"