# nh3-svos: miranda -> app:app-postoffice write becomes autonomous (A171; Prime 2026-10-13 1400 via svos-dev).
steps:
  - name: back up instance.toml
    sudo: true
    shell: runuser -u svc-svos -- cp -p /var/lib/svos/config/instance.toml /var/lib/svos/config/instance.toml.pre-a171
    creates: /var/lib/svos/config/instance.toml.pre-a171
  - name: autonomous = true on the miranda -> app:app-postoffice write grant
    sudo: true
    shell: |
      runuser -u svc-svos -- python3 - <<'PY'
      import os
      p = "/var/lib/svos/config/instance.toml"; s = open(p).read()
      old = '[[grants]]\nprincipal = "miranda"\nobject = "app:app-postoffice"\nmode = "write"\n[[grants]]'
      new = '[[grants]]\nprincipal = "miranda"\nobject = "app:app-postoffice"\nmode = "write"\nautonomous = true                       # A171, Prime 2026-10-13 1400: her own bus sends no longer card\n[[grants]]'
      assert s.count(old) == 1, s.count(old)
      s = s.replace(old, new); t = p + ".tmp"
      fd = os.open(t, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
      with os.fdopen(fd, "w") as f: f.write(s)
      os.replace(t, p); print("edited")
      PY
  - name: the kernel accepts it (else restore)
    sudo: true
    shell: |
      if runuser -u svc-svos -- /opt/svos/current/kernel-env/bin/svos-kernel check-config --data-root /var/lib/svos; then exit 0; fi
      runuser -u svc-svos -- cp -p /var/lib/svos/config/instance.toml.pre-a171 /var/lib/svos/config/instance.toml; echo RESTORED; exit 1
  - name: reload
    sudo: true
    shell: |
      systemctl reload svos-kernel; sleep 6
      curl -s http://127.0.0.1:8400/health; echo
      journalctl -u svos-kernel --since "-20s" --no-pager -o cat | grep -i -E "refus|invalid|error|config" | tail -5 | cut -c1-200
verify:
  - name: the grant reads autonomous
    sudo: true
    shell: runuser -u svc-svos -- python3 -c "import tomllib; d=tomllib.load(open('/var/lib/svos/config/instance.toml','rb')); g=[x for x in d['grants'] if x.get('principal')=='miranda' and x.get('object')=='app:app-postoffice' and x.get('mode')=='write']; print(g); assert len(g)==1 and g[0].get('autonomous') is True"
    changed_when: "false"