# nh3-svos -> SVOS v0.0.12 (d95078c): the kernel wheel alone (runtime `process`, placeholders inside task_argv args).
# No migration (schema stays 13), no config change in this playbook; the hermes runtime edit follows on 0.0.12.
steps:
  - name: Private staging dir
    shell: install -d -m 0700 /tmp/svos-stage-d95078c
  - {name: stage release, upload: {src: /tmp/claude-1000/-home-lkraven-development-eshpfi-management/a0a50e2d-b274-4f8c-b8e6-0606c48d35b5/scratchpad/svos-d95078c/svos-release-d95078c.tar.gz, dest: /tmp/svos-stage-d95078c/release.tar.gz, mode: "0644"}}
  - {name: stage uv, upload: {src: /home/lkraven/bin/uv, dest: /tmp/svos-stage-d95078c/uv, mode: "0755"}}
  - {name: stage installer, upload: {src: /tmp/claude-1000/-home-lkraven-development-eshpfi-management/a0a50e2d-b274-4f8c-b8e6-0606c48d35b5/scratchpad/svos-d95078c/install-release.py, dest: /tmp/svos-stage-d95078c/install-release.py, mode: "0644"}}
  - name: Verify staged hashes
    shell: cd /tmp/svos-stage-d95078c && printf '%s  %s\n' c1be1519edf4fc91b4a87c384a645bd28b655ff64ae0abbd353a76cc9a50f195 release.tar.gz 83aa128da93e168283ed32cf75cd819fe17b135b3fc1f7ccb3c912eec198d9fb uv | sha256sum -c -
    changed_when: "false"
  - name: Install release d95078c beside the live one (current NOT switched)
    sudo: true
    shell: python3 /tmp/svos-stage-d95078c/install-release.py
  - name: New kernel accepts the live configuration as it is
    sudo: true
    shell: runuser -u svc-svos -- /opt/svos/releases/d95078c/kernel-env/bin/svos-kernel check-config --data-root /var/lib/svos
  - name: Stop the local apps then the kernel (terminal, postoffice, miranda, agent run on nh3-dev since U13)
    sudo: true
    shell: systemctl stop svos-voice svos-knowledge svos-interface svos-kernel; systemctl is-active svos-kernel svos-interface svos-knowledge svos-voice | tr '\n' ' '; echo
  - name: Offline backup to /var/lib/svos/backup/pre-d95078c (schema 13 database + config)
    sudo: true
    shell: |
      set -e
      d=/var/lib/svos/backup/pre-d95078c
      runuser -u svc-svos -- install -d -m 0700 $d
      runuser -u svc-svos -- python3 -c "
      import sqlite3
      src = sqlite3.connect('/var/lib/svos/state/svos.db'); dst = sqlite3.connect('/var/lib/svos/backup/pre-d95078c/svos.db')
      src.backup(dst); dst.close(); src.close()
      c = sqlite3.connect('file:/var/lib/svos/backup/pre-d95078c/svos.db?mode=ro', uri=True)
      print('integrity', c.execute('pragma integrity_check').fetchone()[0], 'user_version', c.execute('pragma user_version').fetchone()[0])"
      runuser -u svc-svos -- tar -C /var/lib/svos -cf $d/config-keys-apps.tar config state/keys state/apps state/config-generations apps
      runuser -u svc-svos -- cp -p /var/lib/svos/config/instance.toml /var/lib/svos/config/instance.toml.pre-d95078c
      ls -la $d | tail -3
  - name: Switch current to d95078c
    sudo: true
    shell: ln -sfn /opt/svos/releases/d95078c /opt/svos/current.new && chgrp -h svc-svos /opt/svos/current.new && mv -T /opt/svos/current.new /opt/svos/current && readlink /opt/svos/current
  - name: Start the kernel (READY-gated; no migration) then the local apps
    sudo: true
    shell: |
      t0=$(date +%s.%N); systemctl start svos-kernel.service; rc=$?; t1=$(date +%s.%N)
      echo "kernel start rc=$rc after $(python3 -c "print(round($t1-$t0,2))") s"
      systemctl start svos-interface svos-knowledge svos-voice
      for i in $(seq 1 60); do h=$(curl -s http://127.0.0.1:8400/health); case "$h" in *'"down":0'*) case "$h" in *'"unknown":0'*) break;; esac;; esac; sleep 1; done
      echo "$h"; systemctl is-active svos-kernel svos-interface svos-knowledge svos-voice | tr '\n' ' '; echo
      journalctl -u svos-kernel --since "-90s" --no-pager -o cat | grep -i -E "migrat|0013|schema|error|refus" | tail -6 | cut -c1-200
  - name: Regenerate the front door inventory (452a592 becomes the previous release)
    sudo: true
    shell: /usr/local/sbin/svos-front-inventory 2>&1 | grep -E 'GENERATED|updated|root \*|path /assets' | head -6
verify:
  - name: Inventory current
    sudo: true
    shell: /usr/local/sbin/svos-front-inventory --check
    changed_when: "false"
  - name: Health is schema 13, status ok, nothing down
    shell: h=$(curl -s http://127.0.0.1:8400/health); echo "$h"; echo "$h" | grep -q '"schema_version":13' && echo "$h" | grep -q '"status":"ok"' && echo "$h" | grep -q '"down":0'
    changed_when: "false"
  - name: App listener still refuses an uncredentialed kernel-key (401 from the kernel)
    shell: test "$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8410/auth/kernel-key)" = 401
    changed_when: "false"