#!/bin/sh
# Verifies the multi-account render boundary used by Dev Full before manifests
# reach Kubernetes. Run this after changing an account-scoped app-delivery
# config, its Tilt wiring, or either render script:
#
#   tools/verify-runtime-account-renders.sh
#
# It requires kubectl with built-in Kustomize support. The synthetic account and
# ARNs are never applied; every render command runs with CP9_RENDER_ONLY=true.
# Essential V2 activation must wait for the workload kind declared by
# tidb-mgmt-service.
# DPM writes DataPlanes directly but reads them through its predicate-filtered
# informer cache. Dev Full E2 labels those CRs as shared-multi-tenant, so a
# fixed tenant predicate lets Create see the CR while Get loops forever between
# AlreadyExists and NotFound. The rendered ConfigMap check rejects any tenant
# cache selector while leaving the tenant resourceLabels unchanged.
# Starter's remote renderer must also preserve the AWS account ID as a string
# in KubernetesAgent.spec.eks.accountId. Kustomize removes the source scalar's
# quotes, so the post-render session replacement must restore the string type
# before the manifest reaches the typed apply path.
# E2 workers also need a CPU quota of at least one core. Session 804l selected
# 2C8G through the server/executor RU config and rendered 900m worker Pods; the
# worker runtime truncated that fractional quota to zero threads and crashed.
# Dev Full therefore selects its existing 4C8G pool, whose DPM config advertises
# more than one available core. Keep both consumers and that provider input
# locked together until CP9 pins DPM's precise millicore resource path.
# DPM overlays intentionally carry invalid DNS placeholders. The runtime must
# replace all four Route53 fields, apply the ConfigMap, then read it back before
# validation; validating the seed first makes every fresh session fail.
# This also locks the DGS bootstrap boundary: the separate seed owns database
# creation and must finish before the DGS workload starts.
set -eu

repo_root=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)
work_dir=$(mktemp -d)
trap 'rm -rf "$work_dir"' EXIT

essential_v2_script=$repo_root/personas/dev-full/runtime/scripts/bootstrap-essential-v2-shared-pool.sh
essential_v2_seed=$repo_root/personas/app-delivery/envs/premium/premium-metadb/10-nextgen-global-service-20260521.sql
tidb_mgmt_workload=$repo_root/personas/app-delivery/base/tidb-mgmt-service/workload.yaml
dataplane_manager_config=$repo_root/personas/app-delivery/envs/premium/dataplane-manager/root-config.yaml
dataplane_manager_dev_full_config=$repo_root/personas/app-delivery/envs/dev-full/dataplane-manager/root-config.yaml
dataplane_manager_runtime=$repo_root/personas/dev-full/runtime/scripts/apply-dataplane-manager-runtime.sh
if grep -Fq 'cp9-source-route53-records' "$dataplane_manager_runtime"; then
  echo "dataplane-manager runtime retained the legacy account-414 DNS writer" >&2
  exit 1
fi
for contract in \
  'dns_account != runtime["account"]' \
  'dns_zone_id != runtime["public_dns_zone_id"]' \
  'dns_domain != runtime["public_dns_domain"]'; do
  grep -F "$contract" "$dataplane_manager_runtime" >/dev/null
done
python3 - "$dataplane_manager_runtime" "$dataplane_manager_config" "$dataplane_manager_dev_full_config" <<'PY'
import pathlib
import sys

runtime_path = pathlib.Path(sys.argv[1])
runtime = runtime_path.read_text()
patch_apply = runtime.index('apply -f "$root_config_patch"')
post_patch_read = runtime.index(
    'get configmap regional-server-root-config -o json >"$root_config_live"',
    patch_apply,
)
validation = runtime.index("dns_runtime_json=$(\n", patch_apply)
if not patch_apply < post_patch_read < validation:
    raise SystemExit("dataplane-manager DNS validation must follow patch and read-back")

patch = runtime[runtime.index('python3 - "$runtime_json" "$root_config_live"'):patch_apply]
for expected in (
    "runtime['account']",
    "runtime['public_dns_zone_id']",
    "runtime['public_dns_domain']",
    "runtime['developer_role_arn']",
):
    if expected not in patch:
        raise SystemExit(f"dataplane-manager runtime patch does not consume {expected}")

placeholder = '''    accountID: "required"
    zoneId: cp9-local
    domain: cp9.local.invalid'''
for raw_path in sys.argv[2:]:
    path = pathlib.Path(raw_path)
    if placeholder not in path.read_text():
        raise SystemExit(f"{path} must keep the fail-closed Route53 seed")
PY
for path in \
  "$repo_root/cmd/cp9-grpc-json" \
  "$repo_root/internal/cmd" \
  "$repo_root/internal/dbaasui" \
  "$repo_root/personas/app-delivery/envs/premium" \
  "$repo_root/personas/dev-full/runtime/scripts"; do
  if grep -RFq '1000000002' "$path"; then
    echo "Essential V2 runtime still reads the retired fixed pool id: $path" >&2
    exit 1
  fi
done
if grep -Eq 'shared_pool_id=[[:space:]]*[0-9]' "$essential_v2_script" ||
  grep -Eq 'tags\.tidbcloud\.com/shared-pool:[[:space:]]*"[0-9]+"' "$dataplane_manager_config" ||
  grep -Fq '/v1/sharedPools' "$essential_v2_script" ||
  grep -Fq 'UPDATE nextgen_global_service.resource_pools' "$essential_v2_script" ||
  grep -Fq 'INSERT INTO `resource_pools`' "$essential_v2_seed"; then
  echo "Essential V2 runtime bypasses tidb-management-service pool ownership" >&2
  exit 1
fi
grep -F 'resource_pool_service=/tidb_mgmt_service.v1.ResourcePoolService' "$essential_v2_script" >/dev/null
grep -F 'grpc_request CreateResourcePool' "$essential_v2_script" >/dev/null
grep -F 'grpc_request GetResourcePool' "$essential_v2_script" >/dev/null
grep -F '"$port:10001"' "$essential_v2_script" >/dev/null
grep -F 'shared_pool_id=$(profile_value id)' "$essential_v2_script" >/dev/null
grep -F 'tags.get("cp9-session") == name' "$essential_v2_script" >/dev/null
grep -F 'tags.get("cp9-managed") == "true"' "$essential_v2_script" >/dev/null
grep -F '"ttl": ttl.replace(":", "-"),' "$essential_v2_script" >/dev/null
grep -F 'tags.get("cp9-ttl") == sys.argv[5]' "$essential_v2_script" >/dev/null
grep -F 'pool.get("createdBy") == "cp9/" + name' "$essential_v2_script" >/dev/null
grep -F 'if len(named) != 1 or len(matches) != 1:' "$essential_v2_script" >/dev/null
grep -F 'before-invoke-fence' "$essential_v2_script" >/dev/null
grep -F 'refusing to send another create' "$essential_v2_script" >/dev/null
grep -F '"pcaArn": runtime["pca_arn"]' "$essential_v2_script" >/dev/null
tidb_mgmt_kind=$(awk '$1 == "kind:" { print tolower($2); exit }' "$tidb_mgmt_workload")
if [ "$tidb_mgmt_kind" = "" ] ||
  ! grep -F "rollout status $tidb_mgmt_kind/tidb-mgmt-service --timeout=300s" "$essential_v2_script" >/dev/null; then
  echo "Essential V2 activation waits for the wrong tidb-mgmt-service workload kind (declared: $tidb_mgmt_kind)" >&2
  exit 1
fi

target_account=118688039167
remote_public_ip=1.1.1.1
pca_arn=arn:aws:acm-pca:us-west-2:118688039167:certificate-authority/11111111-1111-4111-8111-111111111111
kms_arn=arn:aws:kms:us-west-2:118688039167:key/22222222-2222-4222-8222-222222222222
account_provider_source_cmk_arn=arn:aws:kms:us-west-2:385595570414:key/f15101b5-6aed-48bf-9b9a-fc36406efe92
cluster_certificates_bucket=cp9-account-render-check-cluster-certificates
context_file=$work_dir/session-context.json
outputs_file=$work_dir/terraform-outputs.json

cat >"$outputs_file" <<JSON
{
  "account_config_secret": {
    "value": {"name": "cp9-account-render-check-account-config"}
  },
  "cluster_certificates_storage": {
    "value": {"bucket": "$cluster_certificates_bucket", "region": "us-west-2"}
  },
  "remote_eks": {
    "value": {
      "cluster_name": "cp9-account-render-check-starter-regional",
      "runtime_role_arn": "arn:aws:iam::$target_account:role/cp9-account-render-check-runtime",
      "vpc_id": "vpc-11111111",
      "node_subnet_ids": ["subnet-11111111", "subnet-22222222", "subnet-33333333"],
      "endpoint_security_group_id": "sg-11111111"
    }
  }
}
JSON

cat >"$context_file" <<JSON
{
  "session_name": "cp9-account-render-check",
  "owner": "account-render-check@example.com",
  "created_at": "2098-12-31T23:00:00Z",
  "session_tags": {
    "cp9-owner": "account-render-check@example.com",
    "cp9-session": "cp9-account-render-check"
  },
  "ttl_expires_at": "2099-01-01T00:00:00Z",
  "target": {"account": "$target_account", "region": "us-west-2"},
  "host": {
    "mode": "remote-ec2-k3d",
    "remote": {
      "public_ip": "$remote_public_ip",
      "public_https_url": "https://cp9-account-render-check.$target_account.cp9.dev.aws.tidbcloud.com"
    }
  },
  "terraform": {
    "outputs_path": "$outputs_file",
    "dedicated_public_dns": {
      "zone_id": "ZACCOUNTRENDERCHECK",
      "domain": "cp9-account-render-check.$target_account.cp9.dev.aws.tidbcloud.com"
    },
    "metering": {
      "bucket": "cp9-account-render-check-metering-$target_account",
      "read_write_role_arn": "arn:aws:iam::$target_account:role/cp9-cp9-account-render-check-metering-read-write",
      "writer_role_arn": "arn:aws:iam::$target_account:role/cp9-cp9-account-render-check-metering-writer"
    },
    "iam": {
      "role_arn": "arn:aws:iam::$target_account:role/cp9-developer",
      "dataplane_role_arn": "arn:aws:iam::$target_account:role/cp9-account-render-check-dataplane-manager",
      "dataplane_role_name": "cp9-account-render-check-dataplane-manager"
    },
    "session_product_pca": {"arn": "$pca_arn", "region": "us-west-2"},
    "session_cmk": {"arn": "$kms_arn", "region": "us-west-2"}
  }
}
JSON

render_premium() {
  path=$1
  output=$2
  shift 2
  CP9_RENDER_ONLY=true \
    CP9_SESSION_CONTEXT="$context_file" \
    "$repo_root/personas/dev-full/runtime/scripts/apply-kustomize-images.sh" \
    "$repo_root/$path" - - - "$@" >"$output"
}

verify_account() {
  name=$1
  rendered=$2
  minimum_count=$3

  if grep -Eq '804837308162|000000000000' "$rendered"; then
    echo "$name retained a fixed or placeholder runtime account" >&2
    exit 1
  fi
  actual_count=$(grep -o "$target_account" "$rendered" | wc -l | tr -d ' ')
  if [ "$actual_count" -lt "$minimum_count" ]; then
    echo "$name rendered $actual_count target-account values; expected at least $minimum_count" >&2
    exit 1
  fi
}

verify_o11y_config() {
  rendered=$1
  configmap=$2
  key=$3
  python3 - "$rendered" "$configmap" "$key" <<'PY'
import sys
import yaml

rendered, configmap, key = sys.argv[1:4]
docs = [doc for doc in yaml.safe_load_all(open(rendered)) if doc]
config = next(
    doc for doc in docs
    if doc.get("kind") == "ConfigMap"
    and doc.get("metadata", {}).get("name") == configmap
)
parsed = yaml.safe_load(config["data"][key])
o11y = parsed["server"]["biz"] if key == "config.yaml" else parsed["appBoxConfig"]
if o11y.get("o11yBizType") != "cp9-account-render-check":
    raise SystemExit(f"{configmap} has wrong o11yBizType")
if o11y.get("o11yAgentNamespace") != "cp9-premium":
    raise SystemExit(f"{configmap} has wrong o11yAgentNamespace")
if key == "config.yaml" and o11y.get("disableO11y") is not False:
    raise SystemExit(f"{configmap} did not enable O11Y")
if key == "config.yaml":
    components = parsed["server"]["ruConfig"]["components"]
    for component in ("tikv_worker", "coprocessor_worker"):
        tiers = components.get(component, {})
        if tiers.get("4c8g", {}).get("min") != 0 or "2c8g" in tiers:
            raise SystemExit(f"{configmap} does not select 4c8g for {component}")
if key == "root-config.yaml":
    predicate = parsed["predicate"]
    tenant_key = "tags.tidbcloud.com/tenant"
    if tenant_key in predicate.get("matchLabels", {}) or any(
        item.get("key") == tenant_key for item in predicate.get("matchExpressions", [])
    ):
        raise SystemExit(f"{configmap} retained a tenant cache filter")
    worker_pool = next(
        (
            pool for pool in parsed["appBoxConfig"]["nodePools"]
            if pool.get("cpu") == 4 and pool.get("memoryGi") == 8
        ),
        None,
    )
    if not worker_pool or worker_pool.get("availableCpu", 0) <= 1:
        raise SystemExit(f"{configmap} lacks a 4c8g worker pool above one available CPU")
PY
}

render_premium personas/app-delivery/envs/dev-full/premium-metadb "$work_dir/metadb.yaml"
verify_account premium-metadb "$work_dir/metadb.yaml" 3
grep -A1 '51-account-iam-essential-v2-20260819.sql: |' "$work_dir/metadb.yaml" | grep -F '    USE account;' >/dev/null
grep -F 'ON DUPLICATE KEY UPDATE `updated_at` = VALUES(`updated_at`), `deleted_at` = VALUES(`deleted_at`), `identity` = VALUES(`identity`)' "$work_dir/metadb.yaml" >/dev/null

render_premium personas/app-delivery/envs/dev-full/dataflow "$work_dir/dataflow.yaml" \
  cp9.local/dataflow:placeholder=example.invalid/dataflow:test
verify_account premium-dataflow "$work_dir/dataflow.yaml" 3
grep -F "$pca_arn" "$work_dir/dataflow.yaml" >/dev/null
grep -F "$kms_arn" "$work_dir/dataflow.yaml" >/dev/null

render_premium personas/app-delivery/envs/dev-full/dedicated-dataflow-svc "$work_dir/dedicated-dataflow.yaml" \
  cp9.local/dataflow-svc:placeholder=example.invalid/dataflow-svc:test
verify_account dedicated-dataflow "$work_dir/dedicated-dataflow.yaml" 3

for service in nextgen-global-service cluster-ng-server; do
  render_premium "personas/app-delivery/envs/dev-full/$service" "$work_dir/$service.yaml"
done
cluster_ng_executor_staging_image=$(python3 - "$repo_root/internal/sourcebacked/contracts.json" <<'PY'
import json
import sys

contracts = json.load(open(sys.argv[1]))["contracts"]
print(next(item["stagingImage"] for item in contracts if item["name"] == "cluster-ng-executor"))
PY
)
render_premium personas/app-delivery/envs/dev-full/cluster-ng-executor "$work_dir/cluster-ng-executor.yaml" \
  "385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/ng-executor:release-v0.31-5506a950e74516c28b915fa22c8f4bd54c984a88=$cluster_ng_executor_staging_image"
grep -F "$cluster_ng_executor_staging_image" "$work_dir/cluster-ng-executor.yaml" >/dev/null
verify_account nextgen-global-service "$work_dir/nextgen-global-service.yaml" 3
verify_account cluster-ng-server "$work_dir/cluster-ng-server.yaml" 1
verify_account cluster-ng-executor "$work_dir/cluster-ng-executor.yaml" 1
if [ "$(grep -Foc "$pca_arn" "$work_dir/nextgen-global-service.yaml")" -ne 2 ]; then
  echo "nextgen-global-service must use the session PCA for issuance and ca.pem lookup" >&2
  exit 1
fi
for service in cluster-ng-server cluster-ng-executor; do
  grep -F "enablePca: true" "$work_dir/$service.yaml" >/dev/null
done
verify_o11y_config "$work_dir/cluster-ng-server.yaml" cluster-ng-server-root-config config.yaml
verify_o11y_config "$work_dir/cluster-ng-executor.yaml" cluster-ng-executor-root-config config.yaml

render_premium personas/app-delivery/envs/dev-full/account-provider "$work_dir/account-provider.yaml" \
  cp9.local/account-provider:placeholder=example.invalid/account-provider:test
verify_account account-provider "$work_dir/account-provider.yaml" 1
grep -F "$kms_arn" "$work_dir/account-provider.yaml" >/dev/null
grep -A1 'command:' "$work_dir/account-provider.yaml" | grep -F '/cp9-hotfix/account-provider' >/dev/null
if [ "$(grep -Foc "$account_provider_source_cmk_arn" "$work_dir/account-provider.yaml")" -ne 1 ]; then
  echo "account-provider must retain exactly one source CMK replacement needle" >&2
  exit 1
fi
grep -F '${#source_cmk_arn}' "$work_dir/account-provider.yaml" >/dev/null
grep -F '! grep -aq "${source_cmk_arn}"' "$work_dir/account-provider.yaml" >/dev/null

CP9_RENDER_ONLY=true \
  CP9_SESSION_CONTEXT="$context_file" \
  "$repo_root/personas/dev-full/runtime/scripts/apply-kustomize-images.sh" \
  "$repo_root/personas/app-delivery/envs/dev-full/dedicated-cluster-controller" - - - \
  >"$work_dir/dedicated-cluster-controller.yaml"
verify_account dedicated-cluster-controller "$work_dir/dedicated-cluster-controller.yaml" 2
grep -F "$pca_arn" "$work_dir/dedicated-cluster-controller.yaml" >/dev/null

render_dedicated() {
  path=$1
  output=$2
  CP9_RENDER_ONLY=true \
    CP9_SESSION_CONTEXT="$context_file" \
    "$repo_root/personas/dev-full/runtime/scripts/apply-kustomize-images.sh" \
    "$repo_root/$path" - - - >"$output"
}

render_dedicated personas/app-delivery/envs/dev-full/regional-server "$work_dir/regional-server.yaml"
verify_account regional-server "$work_dir/regional-server.yaml" 2
grep -F 'o11yBizType: cp9-account-render-check' "$work_dir/regional-server.yaml" >/dev/null
grep -F "$pca_arn" "$work_dir/regional-server.yaml" >/dev/null
if [ "$(grep -Foc "$remote_public_ip/32" "$work_dir/regional-server.yaml")" -ne 2 ]; then
  echo "regional-server must seed the remote public /32 on both Dedicated entry Services" >&2
  exit 1
fi
if [ "$(grep -Foc 'service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing' "$work_dir/regional-server.yaml")" -ne 1 ]; then
  echo "regional-server must render the Dedicated Kong gateway as internet-facing" >&2
  exit 1
fi

python3 "$repo_root/personas/dev-full/runtime/scripts/render-dedicated-account-contract.py" \
  --account-list "$repo_root/personas/app-delivery/envs/dev-full/regional-server/account-list.yaml" \
  --context "$context_file" \
  --output-account-list "$work_dir/dedicated-account-list.yaml" \
  --output-provider-configs "$work_dir/dedicated-provider-configs.yaml"
verify_account dedicated-account-list "$work_dir/dedicated-account-list.yaml" 2
verify_account dedicated-provider-configs "$work_dir/dedicated-provider-configs.yaml" 3
grep -F "arn:aws:iam::$target_account:role/cp9-developer" "$work_dir/dedicated-provider-configs.yaml" >/dev/null
if grep -F "cp9-source-route53-records" "$work_dir/dedicated-provider-configs.yaml" >/dev/null; then
  echo "dedicated provider configs retained the legacy account-414 runtime writer" >&2
  exit 1
fi

render_dedicated personas/app-delivery/envs/dev-full/dedicated-global-service "$work_dir/dedicated-global-service.yaml"
verify_account dedicated-global-service "$work_dir/dedicated-global-service.yaml" 2
grep -F "bucket: $cluster_certificates_bucket" "$work_dir/dedicated-global-service.yaml" >/dev/null
grep -F "$pca_arn" "$work_dir/dedicated-global-service.yaml" >/dev/null
grep -F "$kms_arn" "$work_dir/dedicated-global-service.yaml" >/dev/null
if grep -Eq '^[[:space:]]*apply_dedicated_global_service_seed[[:space:]]*$' \
  "$repo_root/personas/dev-full/runtime/scripts/apply-kustomize-images.sh"; then
  echo "dedicated-global-service parent apply must not seed before its workload phase" >&2
  exit 1
fi

python3 - "$repo_root/personas/dev-full/runtime/example.Tiltfile" <<'PY'
import sys
from pathlib import Path

text = Path(sys.argv[1]).read_text()
if '_source_build_chain_deps("live-binary"' in text:
    raise SystemExit("manual live-binary resources must not wait on an untriggered build chain")
if text.count("allow_parallel=False,\n        auto_init=False") != 2:
    raise SystemExit("manual live-binary compiles must use Tilt's serial execution bound")
seed = text.index('_resource(\n    "dedicated-global-service-seed"')
service = text.index(
    '_dedicated_global_service_resource(\n'
    '    "../../app-delivery/envs/dev-full/dedicated-global-service"'
)
if seed > service:
    raise SystemExit("dedicated-global-service seed must be declared before the service")
if 'resource_deps=["premium-metadb"]' not in text[seed:service]:
    raise SystemExit("dedicated-global-service seed must depend on premium-metadb")
service_end = text.index("\n_kustomize_image_resource(\n    \"tempo-proxy\"", service)
if '"dedicated-global-service-seed"' not in text[service:service_end]:
    raise SystemExit("dedicated-global-service must depend on its database seed")
PY

seed_bin=$work_dir/seed-bin
seed_apply_log=$work_dir/seed-apply
mkdir -p "$seed_bin"
cat >"$seed_bin/kubectl" <<'SH'
#!/bin/sh
set -eu
case " $* " in
  *" exec -i deploy/premium-metadb "*" mysql -h 127.0.0.1 "*)
    cat >/dev/null
    : >"$SEED_APPLY_LOG"
    ;;
  *) exit 1 ;;
esac
SH
cat >"$seed_bin/seq" <<'SH'
#!/bin/sh
echo 1
SH
cat >"$seed_bin/sleep" <<'SH'
#!/bin/sh
:
SH
chmod +x "$seed_bin/kubectl" "$seed_bin/seq" "$seed_bin/sleep"
if ! PATH="$seed_bin:$PATH" SEED_APPLY_LOG="$seed_apply_log" \
  "$repo_root/personas/dev-full/runtime/scripts/apply-dedicated-global-service-seed.sh" \
  - - "$repo_root/personas/app-delivery/envs/premium/premium-metadb/64-dedicated-global-service-local-seed-20260625.sql"; then
  echo "dedicated-global-service seed must bootstrap an absent database once MySQL accepts SQL" >&2
  exit 1
fi
test -f "$seed_apply_log"

for service in serverless-service serverless-global-service; do
  CP9_RENDER_ONLY=true \
    CP9_SESSION_CONTEXT="$context_file" \
    "$repo_root/personas/dev-full/runtime/scripts/apply-kustomize-images.sh" \
    "$repo_root/personas/app-delivery/envs/dev-full/$service" - - - \
    >"$work_dir/$service.yaml"
  verify_account "$service" "$work_dir/$service.yaml" 2
  grep -F "$pca_arn" "$work_dir/$service.yaml" >/dev/null
  grep -F "$kms_arn" "$work_dir/$service.yaml" >/dev/null
done

CP9_RENDER_ONLY=true \
  "$repo_root/personas/dev-full/runtime/scripts/apply-dataplane-manager-runtime.sh" \
  "$repo_root/personas/app-delivery/envs/dev-full/dataplane-manager" \
  cp9-premium - - "$context_file" \
  385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/dataplane-manager:17c3c9bc2bcfda9c67b9d77d2395ec9f4d373384@sha256:dbd2ce62e131a43442e1a0dfb83a83356f9d94a5c7ab95d85cda0134bda3a89a=example.invalid/dataplane-manager:test \
  >"$work_dir/dataplane-manager.yaml"
verify_account dataplane-manager "$work_dir/dataplane-manager.yaml" 3
grep -F "$pca_arn" "$work_dir/dataplane-manager.yaml" >/dev/null
if grep -Eq 'accountID:[[:space:]]*"?385595570414"?|clusters\.dev\.tidb-cloud\.com' "$work_dir/dataplane-manager.yaml"; then
  echo "dataplane-manager render retained the central account DNS fallback" >&2
  exit 1
fi
grep -F 'domain: cp9.local.invalid' "$work_dir/dataplane-manager.yaml" >/dev/null
if grep -Eq 'tags\.tidbcloud\.com/shared-pool:[[:space:]]*"[0-9]+"' "$work_dir/dataplane-manager.yaml"; then
  echo "dataplane-manager render retained a fixed shared-pool label" >&2
  exit 1
fi
verify_o11y_config "$work_dir/dataplane-manager.yaml" regional-server-root-config root-config.yaml

fake_bin=$work_dir/bin
fake_overlay=$work_dir/envs/dev-full/serverless-global-service
fake_apply_log=$work_dir/apply-log
mkdir -p "$fake_bin" "$fake_overlay" "$fake_apply_log"

cat >"$fake_bin/kubectl" <<'SH'
#!/bin/sh
set -eu
case " $* " in
  *" patch --local "*)
    exec "$REAL_KUBECTL" "$@"
    ;;
  *" kustomize "*"starter-regional/o11y-agent-control-server "*)
    exec "$REAL_KUBECTL" "$@"
    ;;
  *" kustomize "*"starter-regional/cluster-proxy "*)
    cat <<'YAML'
apiVersion: v1
kind: ConfigMap
metadata:
  name: dbaas-proxy-config
data:
  config.yaml: |
    infra:
      cmkArn: arn:aws:kms:us-west-2:000000000000:key/cp9-session-placeholder
    aws:
      pcaArn: arn:aws:acm-pca:us-west-2:000000000000:certificate-authority/cp9-session-placeholder
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dbaas-proxy
spec:
  selector:
    matchLabels:
      app: dbaas-proxy
  template:
    metadata:
      labels:
        app: dbaas-proxy
    spec:
      containers:
        - name: dbaas-proxy
          image: example.invalid/dbaas-proxy:test
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: unrelated-starter-workload
spec:
  selector:
    matchLabels:
      app: unrelated-starter-workload
  template:
    metadata:
      labels:
        app: unrelated-starter-workload
    spec:
      containers:
        - name: unrelated-starter-workload
          image: example.invalid/unrelated:test
YAML
    ;;
  *" kustomize "*)
    cat <<'YAML'
apiVersion: v1
kind: ConfigMap
metadata:
  name: serverless-global-service-config
data:
  config.yaml: |
    infra:
      cmkArn: arn:aws:kms:us-west-2:000000000000:key/cp9-session-placeholder
    aws:
      pcaArn: arn:aws:acm-pca:us-west-2:000000000000:certificate-authority/cp9-session-placeholder
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: serverless-global-service
spec:
  selector:
    matchLabels:
      app: serverless-global-service
  template:
    metadata:
      labels:
        app: serverless-global-service
    spec:
      containers:
        - name: serverless-global-service
          image: example.invalid/serverless-global-service:test
          volumeMounts:
            - name: config
              mountPath: /etc/serverless-global-service
      volumes:
        - name: config
          configMap:
            name: serverless-global-service-config
YAML
    ;;
  *" get configmap serverless-global-service-config -o json "*)
    cat <<'JSON'
{"data":{"config.yaml":"infra:\n  cmkArn: arn:aws:kms:us-west-2:118688039167:key/22222222-2222-4222-8222-222222222222\naws:\n  pcaArn: arn:aws:acm-pca:us-west-2:118688039167:certificate-authority/11111111-1111-4111-8111-111111111111\n"}}
JSON
    ;;
  *" get configmap serverless-global-service -o json "*)
    exit 1
    ;;
  *" get configmap/serverless-global-service-config --ignore-not-found -o json "*)
    cat <<'JSON'
{"apiVersion":"v1","kind":"ConfigMap","metadata":{"name":"serverless-global-service-config"},"data":{"config.yaml":"session-materialized"}}
JSON
    ;;
  *" get secret/proxy-certificate-secret -o json "*)
    printf '{"apiVersion":"v1","kind":"Secret","metadata":{"name":"proxy-certificate-secret"},"type":"Opaque","data":{"tls.crt":"%s"}}\n' "$FAKE_EXTERNAL_SECRET_DATA"
    ;;
  *" apply "*)
    previous=
    for argument in "$@"; do
      if [ "$previous" = "-f" ]; then
        cp "$argument" "$FAKE_APPLY_LOG/$(printf '%03d' "$(($(find "$FAKE_APPLY_LOG" -type f | wc -l) + 1))").yaml"
        exit 0
      fi
      previous=$argument
    done
    exit 1
    ;;
  *" patch configmap "*)
    exit 0
    ;;
  *)
    echo "unexpected fake kubectl call: $*" >&2
    exit 1
    ;;
esac
SH
chmod +x "$fake_bin/kubectl"

real_kubectl=$(command -v kubectl)
PATH="$fake_bin:$PATH" \
REAL_KUBECTL="$real_kubectl" \
FAKE_APPLY_LOG="$fake_apply_log" \
CP9_SESSION_CONTEXT="$context_file" \
  "$repo_root/personas/dev-full/runtime/scripts/apply-kustomize-images.sh" \
  "$fake_overlay" cp9-global fake-kubeconfig fake-context

first_apply=$fake_apply_log/001.yaml
second_apply=$fake_apply_log/002.yaml
grep -F "kind: ConfigMap" "$first_apply" >/dev/null
if grep -F "kind: Deployment" "$first_apply" >/dev/null; then
  echo "session config phase started a workload before materialization" >&2
  exit 1
fi
grep -F "kind: Deployment" "$second_apply" >/dev/null
grep -F "cp9.tidbcloud.com/runtime-config-sha256" "$second_apply" >/dev/null
if grep -Eq '385595570414|000000000000|cp9-session-placeholder' "$second_apply"; then
  echo "workload phase retained a fixed or placeholder runtime account" >&2
  exit 1
fi

starter_apply_log=$work_dir/starter-apply-log
mkdir -p "$starter_apply_log"
PATH="$fake_bin:$PATH" \
REAL_KUBECTL="$real_kubectl" \
FAKE_APPLY_LOG="$starter_apply_log" \
CP9_SESSION_CONTEXT="$context_file" \
  "$repo_root/personas/dev-full/starter/apply-remote-kustomize-images.sh" \
  "$fake_overlay" cp9-global fake-kubeconfig fake-context
grep -F "cp9.tidbcloud.com/runtime-config-sha256" "$starter_apply_log/001.yaml" >/dev/null
grep -F "$pca_arn" "$starter_apply_log/001.yaml" >/dev/null
grep -F "$kms_arn" "$starter_apply_log/001.yaml" >/dev/null
if grep -Eq '000000000000|cp9-session-placeholder' "$starter_apply_log/001.yaml"; then
  echo "Starter remote workload retained a PCA/KMS session placeholder" >&2
  exit 1
fi

starter_o11y_apply_log=$work_dir/starter-o11y-apply-log
mkdir -p "$starter_o11y_apply_log"
PATH="$fake_bin:$PATH" \
REAL_KUBECTL="$real_kubectl" \
FAKE_APPLY_LOG="$starter_o11y_apply_log" \
CP9_SESSION_CONTEXT="$context_file" \
  "$repo_root/personas/dev-full/starter/apply-remote-kustomize-images.sh" \
  "$repo_root/personas/app-delivery/envs/dev-full/starter-regional/o11y-agent-control-server" \
  observability fake-kubeconfig fake-context
python3 - "$starter_o11y_apply_log/001.yaml" "$target_account" <<'PY'
import sys
import yaml

documents = [document for document in yaml.safe_load_all(open(sys.argv[1])) if document]
agent = next(document for document in documents if document.get("kind") == "KubernetesAgent")
account_id = agent["spec"]["eks"]["accountId"]
if not isinstance(account_id, str) or account_id != sys.argv[2]:
    raise SystemExit(
        f"Starter KubernetesAgent accountId must be string {sys.argv[2]!r}, "
        f"got {account_id!r} ({type(account_id).__name__})"
    )
PY

starter_external_overlay=$work_dir/envs/dev-full/starter-regional/cluster-proxy
starter_external_alpha=$work_dir/starter-external-alpha
starter_external_beta=$work_dir/starter-external-beta
mkdir -p "$starter_external_overlay" "$starter_external_alpha" "$starter_external_beta"
for secret_data in alpha beta; do
  if [ "$secret_data" = alpha ]; then
    external_log=$starter_external_alpha
  else
    external_log=$starter_external_beta
  fi
  PATH="$fake_bin:$PATH" \
  REAL_KUBECTL="$real_kubectl" \
  FAKE_APPLY_LOG="$external_log" \
  FAKE_EXTERNAL_SECRET_DATA="$secret_data" \
  CP9_SESSION_CONTEXT="$context_file" \
    "$repo_root/personas/dev-full/starter/apply-remote-kustomize-images.sh" \
    "$starter_external_overlay" cp9-global fake-kubeconfig fake-context
done
alpha_stamp=$(grep 'cp9.tidbcloud.com/external-config-sha256:' "$starter_external_alpha/001.yaml" | head -1)
beta_stamp=$(grep 'cp9.tidbcloud.com/external-config-sha256:' "$starter_external_beta/001.yaml" | head -1)
if [ "$alpha_stamp" = "$beta_stamp" ]; then
  echo "Starter external certificate changes must change the workload config stamp" >&2
  exit 1
fi
for external_log in "$starter_external_alpha/001.yaml" "$starter_external_beta/001.yaml"; do
  if [ "$(grep -c 'cp9.tidbcloud.com/external-config-sha256:' "$external_log")" -ne 1 ]; then
    echo "Starter external certificate stamp must target exactly one workload" >&2
    exit 1
  fi
done
unrelated_alpha_digest=$(
  python3 - "$starter_external_alpha/001.yaml" <<'PY'
import hashlib
import re
import sys
from pathlib import Path

for document in re.split(r"(?m)^---\s*$", Path(sys.argv[1]).read_text()):
    if re.search(r"(?m)^\s*name:\s*unrelated-starter-workload\s*$", document):
        print(hashlib.sha256(document.strip().encode()).hexdigest())
        break
PY
)
unrelated_beta_digest=$(
  python3 - "$starter_external_beta/001.yaml" <<'PY'
import hashlib
import re
import sys
from pathlib import Path

for document in re.split(r"(?m)^---\s*$", Path(sys.argv[1]).read_text()):
    if re.search(r"(?m)^\s*name:\s*unrelated-starter-workload\s*$", document):
        print(hashlib.sha256(document.strip().encode()).hexdigest())
        break
PY
)
if [ -z "$unrelated_alpha_digest" ] || [ "$unrelated_alpha_digest" != "$unrelated_beta_digest" ]; then
  echo "Starter external certificate changes must not alter unrelated workloads" >&2
  exit 1
fi

bootstrap_bin=$work_dir/bootstrap-bin
bootstrap_log=$work_dir/bootstrap-apply.log
bootstrap_state=$work_dir/bootstrap-state
mkdir -p "$bootstrap_bin" "$bootstrap_state/kubeconfigs"
touch "$bootstrap_state/host.kubeconfig" "$bootstrap_state/admin.kubeconfig"
cat >"$bootstrap_state/host.yaml" <<'YAML'
apiVersion: v1
kind: ConfigMap
metadata:
  name: dedicated-api-host
YAML
cat >"$bootstrap_state/bootstrap.yaml" <<'YAML'
apiVersion: v1
kind: Namespace
metadata:
  name: cp9-dedicated
YAML

cat >"$bootstrap_bin/kubectl" <<'SH'
#!/bin/sh
set -eu
printf 'CALL %s\n' "$*" >>"$BOOTSTRAP_LOG"
case " $* " in
  *" kustomize "*)
    exec "$REAL_KUBECTL" "$@"
    ;;
  *" get --raw=/readyz "*)
    exit 0
    ;;
  *" get crd -o name "*)
    printf '%s\n' customresourcedefinition.apiextensions.k8s.io/widgets.example.com
    ;;
  *" get crd -o json "*)
    printf '%s\n' '{"items":[{"metadata":{"name":"widgets.example.com"},"status":{"conditions":[{"type":"Established","status":"True"}]}}]}'
    ;;
  *" get pods,jobs,deployments,statefulsets,daemonsets "*)
    exit 0
    ;;
  *" create secret generic dedicated-api-kubeconfigs "*)
    cat <<'YAML'
apiVersion: v1
kind: Secret
metadata:
  name: dedicated-api-kubeconfigs
YAML
    ;;
  *" create secret generic dedicated-upbound-tls "*)
    cat <<'YAML'
apiVersion: v1
kind: Secret
metadata:
  name: dedicated-upbound-tls
YAML
    ;;
  *" rollout status "*)
    exit 0
    ;;
  *" apply "*)
    previous=
    for argument in "$@"; do
      if [ "$previous" = "-f" ]; then
        if [ "$argument" = "-" ]; then
          cat >>"$BOOTSTRAP_LOG"
        elif [ -f "$argument" ]; then
          cat "$argument" >>"$BOOTSTRAP_LOG"
        fi
        printf '\n' >>"$BOOTSTRAP_LOG"
        exit 0
      fi
      previous=$argument
    done
    exit 0
    ;;
  *)
    echo "unexpected bootstrap kubectl call: $*" >&2
    exit 1
    ;;
esac
SH
chmod +x "$bootstrap_bin/kubectl"

PATH="$bootstrap_bin:$PATH" \
REAL_KUBECTL="$real_kubectl" \
BOOTSTRAP_LOG="$bootstrap_log" \
CP9_SESSION_CONTEXT="$context_file" \
  "$repo_root/personas/dev-full/runtime/scripts/bootstrap-dedicated-api.sh" \
  "$bootstrap_state/host.kubeconfig" fake-host \
  "$bootstrap_state/admin.kubeconfig" \
  "$bootstrap_state/bootstrap.yaml" \
  "$repo_root/personas/app-delivery/envs/dev-full/dedicated-regional-api-crds" \
  "$repo_root/personas/app-delivery/envs/dev-full/dedicated-infra-api-crds" \
  "$repo_root/personas/app-delivery/base/dedicated-infra-api-crds" \
  "$repo_root/personas/app-delivery/envs/dev-full/dedicated-ticdc-api-crds" \
  "$repo_root/personas/app-delivery/base/o11y-agent-crds" \
  "$repo_root/personas/app-delivery/envs/dev-full/dedicated-cluster-control-server-support" \
  "$repo_root/personas/app-delivery/envs/dev-full/regional-server/account-list.yaml" \
  "$repo_root/personas/app-delivery/envs/dev-full/dedicated-infra-api-crds/dm-provider.yaml" \
  "$bootstrap_state/evidence.json"

grep -F 'name: account-list' "$bootstrap_log" >/dev/null
grep -F 'name: dedicated-upbound-tls' "$bootstrap_log" >/dev/null
grep -F "default: \"$target_account\"" "$bootstrap_log" >/dev/null
grep -F "name: \"$target_account\"" "$bootstrap_log" >/dev/null
grep -F "roleARN: arn:aws:iam::$target_account:role/cp9-developer" "$bootstrap_log" >/dev/null
account_apply_line=$(grep -n 'name: account-list' "$bootstrap_log" | head -1 | cut -d: -f1)
provider_apply_line=$(grep -n "name: \"$target_account\"" "$bootstrap_log" | head -1 | cut -d: -f1)
if [ "$account_apply_line" -ge "$provider_apply_line" ]; then
  echo "Dedicated account-list must be applied before its ProviderConfig" >&2
  exit 1
fi
grep -F '"status":"ready"' "$bootstrap_state/evidence.json" >/dev/null

echo "runtime account renders: PASS"