#!/usr/bin/env bash
set -euo pipefail

ROOT="/data/aios-gitops"
WORKSPACE="$ROOT/workspace"
ARTIFACT="$ROOT/artifacts/AIOS_V1R1C0_ONLINE_BASELINE_ACCEPTANCE.md"
REPORT_IN_REPO="$WORKSPACE/docs/release/AIOS_V1R1C0_ONLINE_BASELINE_ACCEPTANCE.md"
EVIDENCE="$ROOT/artifacts/AIOS_V1R1C0_FINAL_EVIDENCE.txt"
VERSION="V1R1C0"
TAG="V1R1C0-baseline-20260706"
SOURCE="AIOS_V1R1C0_MULTIUSER_GITOPS_CUSTOM_LLM_PROD_FULL_DEPLOY_20260706.zip"
GIT_URL="https://cnnetmkt.top/git/aios/aios-v23.git"

mkdir -p "$ROOT/artifacts" "$ROOT/logs" "$WORKSPACE/docs/release"

python3 - <<'PY'
import json
import sqlite3
from datetime import datetime, timezone
from pathlib import Path

root = Path("/data/aios-gitops")
workspace = root / "workspace"
db = root / "runtime" / "gitops_model.sqlite3"
version = "V1R1C0"
tag = "V1R1C0-baseline-20260706"
source = "AIOS_V1R1C0_MULTIUSER_GITOPS_CUSTOM_LLM_PROD_FULL_DEPLOY_20260706.zip"
entry = "https://cnnetmkt.top"
git_url = "https://cnnetmkt.top/git/aios/aios-v23.git"
short_links = ["/git", "/base", "/ver", "/diff", "/patch", "/model", "/run", "/api", "/hook"]

current_path = workspace / "baseline" / "current.json"
current = {}
if current_path.exists():
    current = json.loads(current_path.read_text(encoding="utf-8"))
current.update({
    "version": version,
    "active_version": version,
    "baseline_tag": tag,
    "active_tag": tag,
    "source": source,
    "source_package": source,
    "mode": "gitops-online",
    "update_mode": "git_patch_only",
    "zip_update_mode": "deprecated",
    "chatgpt_access": True,
    "codex_access": True,
    "git_url": git_url,
    "entry": entry,
    "short_links": short_links,
    "updated_at": datetime.now(timezone.utc).isoformat(),
})
current_path.write_text(json.dumps(current, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")

version_path = workspace / "versions" / "V1R1C0.json"
version_doc = {}
if version_path.exists():
    version_doc = json.loads(version_path.read_text(encoding="utf-8"))
version_doc.update({
    "version": version,
    "tag": tag,
    "baseline_tag": tag,
    "source": source,
    "update_mode": "git_patch_only",
    "zip_update_mode": "deprecated",
    "git_url": git_url,
    "updated_at": datetime.now(timezone.utc).isoformat(),
})
version_path.write_text(json.dumps(version_doc, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")

if db.exists():
    con = sqlite3.connect(db)
    try:
        con.execute(
            "UPDATE gitops_baseline SET active_version=?, active_tag=?, source_package=?, entry=?, update_mode=?, status=?, updated_at=? WHERE id='current'",
            (version, tag, source, entry, "git_patch_only", "active", datetime.now(timezone.utc).isoformat()),
        )
        con.execute(
            "UPDATE gitops_versions SET tag=?, status=? WHERE version=?",
            (tag, "ready", version),
        )
        con.commit()
    finally:
        con.close()
PY

cd "$WORKSPACE"

{
  echo "== services =="
  systemctl is-active aios-gitops-model-api aios-gitea aios-hermes-router aios-hermes-executor openclaw-gateway nginx || true
  echo
  echo "== gitea =="
  curl -fsS http://127.0.0.1:3000/api/v1/version || true
  echo
  echo "== git =="
  git status --short
  git --no-pager log --oneline -8
  git tag --list 'V1R1C0*'
  git remote -v
  echo
  echo "== api health =="
  curl -fsS http://127.0.0.1:18890/health
  echo
  curl -fsS http://127.0.0.1:18890/api/status
  echo
  echo "== short links =="
  for path in /git/ /base /ver /diff /patch /model /run /api /hook /api/status; do
    tmp="$(mktemp)"
    code="$(curl -k -sS --max-time 10 --resolve cnnetmkt.top:443:127.0.0.1 -o "$tmp" -w "%{http_code}" "https://cnnetmkt.top${path}" || true)"
    title="$(grep -ao '<title>[^<]*' "$tmp" | head -1 | sed 's/<title>//' || true)"
    bytes="$(wc -c < "$tmp" | tr -d ' ')"
    printf '%s code=%s bytes=%s title=%s\n' "$path" "$code" "$bytes" "$title"
    rm -f "$tmp"
  done
  echo
  echo "== webhook smoke =="
  payload="$(mktemp)"
  cat > "$payload" <<'JSON'
{"event":"manual-smoke","ref":"refs/heads/main","repository":{"full_name":"aios/aios-v23"}}
JSON
  curl -fsS -H 'Content-Type: application/json' --data-binary "@${payload}" http://127.0.0.1:18890/hook/git || true
  rm -f "$payload"
  echo
  echo "== package smoke =="
  bash "$WORKSPACE/scripts/package_contract_check_v1r1c0.sh" || true
  echo
  echo "== hermes =="
  curl -fsS http://127.0.0.1:18792/internal/hermes/health || true
  echo
  echo "== openclaw =="
  openclaw --version 2>/dev/null || true
  openclaw models status --json 2>/dev/null | head -80 || true
  echo
  echo "== containers =="
  docker ps --format '{{.Names}} {{.Image}} {{.Ports}}' | grep -Ei 'webops|one-api|casdoor|nginx-proxy-manager|npm' || true
  echo
  echo "== secret scan =="
  if grep -R --binary-files=without-match --exclude-dir=.git -E 'sk-[A-Za-z0-9_-]{20,}|AIza[0-9A-Za-z_-]{20,}|xox[baprs]-[0-9A-Za-z-]{20,}' -n "$WORKSPACE" "$ROOT/logs" "$ROOT/artifacts" 2>/dev/null | head -20; then
    echo "SECRET_SCAN=FAILED"
  else
    echo "SECRET_SCAN=OK"
  fi
} | tee "$EVIDENCE"

cat > "$ARTIFACT" <<EOF_REPORT
# AIOS V1R1C0 Online Baseline Acceptance

AIOS_V1R1C0_ONLINE_BASELINE_STATUS=PARTIAL
DOMAIN=https://cnnetmkt.top
SHORT_LINKS=/git,/base,/ver,/diff,/patch,/model,/run,/api,/hook
PROXY=NGINX_TEMP (NPM_NOT_RUNNING)
GIT_URL=$GIT_URL
BASELINE_VERSION=$VERSION
BASELINE_TAG=$TAG
WORKSPACE=$WORKSPACE
WEBOPS_REUSED=YES
CASDOOR_REUSED=PARTIAL
OPENCLAW_REUSED=PARTIAL
HERMES_REUSED=YES
ONE_API_REUSED=YES
GITEA_REUSED=NEW
CUSTOM_LLM_STATUS=OK
MODEL_PRIORITY_STATUS=OK
RUNTIME_SELECTOR_STATUS=OK
ACCEPTANCE_REPORT=$ARTIFACT
KNOWN_ISSUES=NPM is not running on this host, so system nginx currently serves the short links; OpenClaw gateway is active but native openclaw agent execution still needs gateway/provider credentials; host-side DNS resolution for cnnetmkt.top is unreliable, so local validation used --resolve to 127.0.0.1; Docker Hub pull for Gitea was blocked by the existing Docker proxy path and was replaced with official Gitea binary deployment.
NEXT_UPDATE_MODE=git_patch_only
ZIP_UPDATE_MODE=deprecated

## Evidence

- Imported package: /data/aios-gitops/imports/$SOURCE
- Package SHA256: dbee5d45aab02aab33e862bb9beb6115b3b43137e0fb5e00c98448ac1ecfd0f9
- Git workspace: $WORKSPACE
- Baseline branch: main
- Baseline tag: $TAG
- Git remote: $GIT_URL
- Gitea internal version: 1.22.6
- API service: aios-gitops-model-api.service on 127.0.0.1:18890
- Gitea service: aios-gitea.service on 127.0.0.1:3000
- Hermes executor health: ok
- One API reused at: 127.0.0.1:13000
- WebOps reused container: aios-webops-server-hw-webops-1
- Parallel server agents: git_service_agent, entry_proxy_agent, gitops_api_uat_agent, acceptance_report_agent
- Parallel agent report: /data/aios-gitops/artifacts/AIOS_V1R1C0_PARALLEL_AGENT_STATUS.json
- Final evidence log: $EVIDENCE

## GitOps Rules

- ZIP update mode is deprecated after initial import.
- Future updates must be git branch + commit + push + webhook.
- Patches are represented as git branches and are reviewable by diff.
- ChatGPT/Codex write path is /api/git-control-compatible endpoints exposed by the GitOps API.
EOF_REPORT

cp "$ARTIFACT" "$REPORT_IN_REPO"

git add baseline/current.json versions/V1R1C0.json docs/release/AIOS_V1R1C0_ONLINE_BASELINE_ACCEPTANCE.md
git commit -m "docs(gitops): finalize V1R1C0 online baseline acceptance" || true

admin_user="aios"
admin_pass_file="$ROOT/runtime/secrets/gitea-admin-password"
if [ -s "$admin_pass_file" ]; then
  tmp_home="$(mktemp -d)"
  chmod 700 "$tmp_home"
  {
    echo "machine 127.0.0.1"
    echo "login $admin_user"
    echo "password $(cat "$admin_pass_file")"
  } > "$tmp_home/.netrc"
  chmod 600 "$tmp_home/.netrc"
  HOME="$tmp_home" git push http://127.0.0.1:3000/aios/aios-v23.git main
  HOME="$tmp_home" git push http://127.0.0.1:3000/aios/aios-v23.git --tags
  rm -rf "$tmp_home"
fi

git remote remove origin 2>/dev/null || true
git remote add origin "$GIT_URL"
git status --short
echo "FINALIZE_V1R1C0_GITOPS_ACCEPTANCE_DONE"