# nh3-svos: [tasks].judge = "app-judge" (U19 step 4), after Prime's three owner grants landed (1641 2026-10-18:
# app-judge -> app:app-interface read, app-judge -> app:app-terminal read, prime -> app:app-judge read).
# From now every root task's approval runs the judge's admit before any seat exists. judge_timeout_seconds stays at its
# default 10 (the app's admit_seconds 8 sits inside). Revert = instance.toml.pre-tasks-judge + reload.
steps:
  - name: back up instance.toml
    sudo: true
    shell: runuser -u svc-svos -- cp -p /var/lib/svos/config/instance.toml /var/lib/svos/config/instance.toml.pre-tasks-judge
    creates: /var/lib/svos/config/instance.toml.pre-tasks-judge
  - name: add judge = "app-judge" under [tasks]
    sudo: true
    shell: |
      runuser -u svc-svos -- python3 - <<'PY'
      import os
      p = "/var/lib/svos/config/instance.toml"; s = open(p).read()
      anchor = '[tasks]\nscratch_root = "/var/lib/svos/apps/terminal/tasks"\n'
      assert s.count(anchor) == 1, s.count(anchor)
      tail = s[s.index(anchor):]; nxt = tail.find("\n[", len(anchor) - 1)
      assert "judge =" not in (tail if nxt < 0 else tail[:nxt])
      s = s.replace(anchor, anchor + 'judge = "app-judge"                  # U19 (v0.0.16, 2026-10-18): admission + routing; judge_timeout_seconds default 10\n')
      t = p + ".tmp"; fd = os.open(t, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
      with os.fdopen(fd, "w") as f: f.write(s)
      os.replace(t, p); print("edited")
      PY
  - name: the kernel accepts it (else restore)
    sudo: true
    shell: |
      if runuser -u svc-svos -- /opt/svos/current/kernel-env/bin/svos-kernel check-config --data-root /var/lib/svos; then exit 0; fi
      runuser -u svc-svos -- cp -p /var/lib/svos/config/instance.toml.pre-tasks-judge /var/lib/svos/config/instance.toml; echo RESTORED; exit 1
  - name: reload
    sudo: true
    shell: systemctl reload svos-kernel; sleep 3; curl -s http://127.0.0.1:8400/health
verify:
  - name: health ok, nothing down, new generation
    shell: h=$(curl -s http://127.0.0.1:8400/health); echo "$h"; echo "$h" | grep -q '"status":"ok"' && echo "$h" | grep -q '"down":0' && ! echo "$h" | grep -q f5330a9978aedc48
    changed_when: "false"