import io


def rw(path, pairs):
    s = io.open(path, 'r', encoding='utf-8', newline='').read()
    out = s
    for old, new in pairs:
        assert old in out, 'anchor missing in %s: %r' % (path, old[:70])
        out = out.replace(old, new, 1)
    assert out != s
    io.open(path, 'w', encoding='utf-8', newline='').write(out)
    print('patched', path)


# ---------------------------------------------------------------- the capture pin
rw('_part1_header.sh', [(
    "EXE_SHA='72d309011415b419aabfdb0b4065df1183bfd0069a9f95b5779da62e43349b10'",
    "EXE_SHA='72d309011415b419aabfdb0b4065df1183bfd0069a9f95b5779da62e43349b10'\n"
    "# THE CAPTURE SCRIPT IS A SUBJECT TOO (doyle LIRX7EUS). The elevated leg runs BOTH the product\n"
    "# and this script, and every document this run reasons about is whatever THIS file produced.\n"
    "# An acknowledgment that measures only the executable proves the leg can see one of the two.\n"
    "CAPTURE_SHA='a0e7afbee4dce9f310ade9704c199b3b759715c06da7e033d286beb7cfda8c06'")])

# ---------------------------------------------------------------- PREPARED: both hashes
rw('_part_main.sh', [(
    """handoff_request prepare \\
  "ACKNOWLEDGE ONLY -- RUN NOTHING. Confirm you are prepared to execute the setup leg and that you have started nothing yet, and report the sha256 of the pinned executable AS YOU MEASURE IT NOW." \\
  "ACKNOWLEDGEMENT ONLY. Do not run the product. Reply in the receipt with the three tokens: PREPARED, NOT_STARTED, and executable_sha256=<the sha256 you measure of "$EXE">\"""",
    """handoff_request prepare \\
  "ACKNOWLEDGE ONLY -- RUN NOTHING. Confirm you are prepared to execute the setup leg and that you have started nothing yet, and report the sha256 of BOTH subjects this leg would run, AS YOU MEASURE THEM NOW: the pinned executable and the capture script." \\
  "ACKNOWLEDGEMENT ONLY. Do not run the product. Reply in the receipt with the four tokens: PREPARED, NOT_STARTED, executable_sha256=<the sha256 you measure of "$EXE">, and capture_sha256=<the sha256 you measure of "$BIN/d2_capture.ps1">\"""")])

rw('_part_main.sh', [(
    """grep -q "executable_sha256=$EXE_SHA" "$PREPARED_ACK" 2>/dev/null || ack_missing="$ack_missing executable_sha256=$EXE_SHA\"""",
    """grep -q "executable_sha256=$EXE_SHA" "$PREPARED_ACK" 2>/dev/null || ack_missing="$ack_missing executable_sha256=$EXE_SHA"
# BOTH SUBJECTS, NOT ONE (doyle LIRX7EUS). The leg runs the product AND the capture script, and the
# documents this run reasons about are whatever the capture script produced. An acknowledgment that
# measured only the executable proved the leg could see half of what it is about to run.
grep -q "capture_sha256=$CAPTURE_SHA" "$PREPARED_ACK" 2>/dev/null || ack_missing="$ack_missing capture_sha256=$CAPTURE_SHA\"""")])

rw('_part_main.sh', [(
    """record "PREPARED_ACK_VERIFIED - the executor reports PREPARED and NOT_STARTED and measured the pinned executable as $EXE_SHA\"""",
    """record "PREPARED_ACK_VERIFIED - the executor reports PREPARED and NOT_STARTED and measured BOTH subjects: executable $EXE_SHA and capture script $CAPTURE_SHA"
record "PREPARED_IS_NOT_AUTHORIZATION - readiness says the leg CAN act; it does not say this run MAY. The window stays shut until a separate, run-bound GO authorization is verified below."''""")])

# ---------------------------------------------------------------- the separate GO authorization
rw('_part_main.sh', [(
    """# THE REMOVAL INSTRUMENT IS REQUIRED BEFORE THE WINDOW OPENS (doyle 2026-09-13).""",
    """# READINESS IS NOT AUTHORIZATION (doyle LIRX7EUS). The predecessor ran PREPARED and then called
# go() on the next line: verifying that the executor was READY opened the experimental window by
# itself, so a leg that answered a preparation question had, without being asked, started a 300s
# clock on the host. THE TWO ARE NOW SEPARATE ACTS. This second request asks for an AUTHORIZATION,
# it carries its own nonce, and the receipt must quote that nonce back -- so an authorization is
# bound to THIS run and THIS request and cannot be a stale or reused token from another.
prep_check go-authorization
handoff_request go-authorization \\
  "AUTHORIZE ONLY -- RUN NOTHING. This is not a readiness question; you have already answered that. Authorize the experimental window to OPEN for this run, knowing the 300s activity clock starts when it does." \\
  "AUTHORIZATION ONLY. Do not run the product. Reply in the receipt with BOTH tokens: GO_AUTHORIZED and the nonce of THIS request, quoted exactly."
GO_ACK="$HO_RECEIPT"; GO_ACK_NONCE="$HO_NONCE"
handoff_await trial || die "no GO authorization within the preparation budget. The experimental window is NEVER OPENED: readiness alone does not open it, nothing was dispatched, and there is nothing to tear down."
go_missing=''
grep -q "GO_AUTHORIZED" "$GO_ACK" 2>/dev/null || go_missing="$go_missing GO_AUTHORIZED"
grep -q "$GO_ACK_NONCE" "$GO_ACK" 2>/dev/null || go_missing="$go_missing nonce=$GO_ACK_NONCE"
if [ -n "$go_missing" ]; then
  record "GO_ACK_CONTENTS: [$(tr -d '\\r' < "$GO_ACK" 2>/dev/null | tr "\\n" " ")]"
  die "the GO authorization is missing:$go_missing. An authorization that cannot quote the nonce of the request it answers is not bound to this run, and this window does not open on it."
fi
record "GO_AUTHORIZED_VERIFIED nonce=$GO_ACK_NONCE - a separate, run-bound authorization, distinct from the readiness acknowledgment"

# THE REMOVAL INSTRUMENT IS REQUIRED BEFORE THE WINDOW OPENS (doyle 2026-09-13).""")])

rw('_part_main.sh', [(
    'go "prepared acknowledgment verified and the reviewed removal instrument verified"',
    'go "GO authorization verified (run-bound), both subject hashes measured by the executor, and the reviewed removal instrument verified"')])