#!/usr/bin/env bash

set -Eeuo pipefail
set +x
umask 077

readonly ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd -P)"
readonly SCANNER="$ROOT/scripts/validate/scan-platform-sensitive-source.sh"
# shellcheck source=scan-platform-sensitive-source.sh
source "$SCANNER"

WORK=''
ASSERTIONS=0

fail() {
  printf 'FAIL: %s\n' "$*" >&2
  exit 1
}

pass() {
  ASSERTIONS=$((ASSERTIONS + 1))
  printf 'PASS: %s\n' "$1"
}

cleanup() {
  trap - EXIT HUP INT TERM
  case "$WORK" in
    /tmp/platform-sensitive-source-test.??????)
      rm -rf -- "$WORK"
    ;;
  esac
}
install_cleanup_traps() {
  trap cleanup EXIT
  trap 'exit 129' HUP
  trap 'exit 130' INT
  trap 'exit 143' TERM
}
install_cleanup_traps

new_fixture() {
  cleanup
  install_cleanup_traps
  WORK="$(mktemp -d /tmp/platform-sensitive-source-test.XXXXXX)"
  mkdir -p -- \
    "$WORK/platform/scripts/validate" \
    "$WORK/platform/services/observability" \
    "$WORK/platform/infrastructure" \
    "$WORK/platform/bootstrap" \
    "$WORK/platform/clusters" \
    "$WORK/platform/components" \
    "$WORK/docs/plans"
  chmod 0700 "$WORK" "$WORK/platform" "$WORK/docs"
}

if [[ "${PLATFORM_SENSITIVE_SOURCE_CLEANUP_PROBE:-0}" == 1 ]]; then
  new_fixture
  new_fixture
  exit 0
fi

run_scanner() {
  env -i HOME="$HOME" PATH="${PLATFORM_SENSITIVE_SOURCE_TEST_PATH:-/usr/local/bin:/usr/bin:/bin}" \
    PLATFORM_SENSITIVE_SOURCE_LIBRARY="$SCANNER" \
    PLATFORM_SENSITIVE_SOURCE_PLATFORM_ROOT="$WORK/platform" \
    PLATFORM_SENSITIVE_SOURCE_DOCS_ROOT="$WORK/docs" \
    PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS="${PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS:-}" \
    bash -s -- "$@" <<'RUNNER'
set -Eeuo pipefail
source "$PLATFORM_SENSITIVE_SOURCE_LIBRARY"
scanner_args=("$@")
if [[ -n "$PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS" ]]; then
  scanner_args+=(--rendered-manifest "$PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS")
fi
scan_platform_sensitive_roots \
  "$PLATFORM_SENSITIVE_SOURCE_PLATFORM_ROOT" \
  "$PLATFORM_SENSITIVE_SOURCE_DOCS_ROOT" \
  "${scanner_args[@]}"
RUNNER
}

expect_clean() {
  local description=$1 output
  if ! output="$(run_scanner 2>&1)"; then
    printf '%s\n' "$output" >&2
    fail "$description"
  fi
  [[ "$output" == *'PLATFORM SENSITIVE SOURCE SCAN PASS'* ]] || {
    printf '%s\n' "$output" >&2
    fail "$description did not emit the PASS marker"
  }
  pass "$description"
}

expect_reject() {
  local description=$1 expected_file=$2 output rc=0
  shift 2
  output="$(run_scanner "$@" 2>&1)" || rc=$?
  (( rc != 0 )) || {
    printf '%s\n' "$output" >&2
    fail "$description was accepted"
  }
  [[ "$output" == *"$expected_file"* ]] || {
    printf '%s\n' "$output" >&2
    fail "$description did not report the filename"
  }
  [[ "$output" != *'should-never-be-printed'* ]] || {
    printf '%s\n' "$output" >&2
    fail "$description leaked matched content"
  }
  [[ "$output" != *'hooks.slack.com/services/'* ]] || {
    printf '%s\n' "$output" >&2
    fail "$description leaked a Slack URL"
  }
  pass "$description"
}

expect_scanner_error() {
  local description=$1 output rc=0
  output="$(run_scanner 2>&1)" || rc=$?
  (( rc != 0 )) || {
    printf '%s\n' "$output" >&2
    fail "$description was accepted"
  }
  [[ "$output" == *'SCANNER_ERROR:'* ]] || {
    printf '%s\n' "$output" >&2
    fail "$description did not fail as a scanner error"
  }
  [[ "$output" != *'ActualProductionSecretValue9283'* ]] || {
    fail "$description leaked matched content"
  }
  pass "$description"
}

expect_canonical_test_source_clean() {
  local finding
  finding="$(_sensitive_source_python_scan "$ROOT/scripts/validate/test-scan-platform-sensitive-source.sh" \
    1 "$SCANNER")" || fail 'canonical scanner test content leaf returned an execution error'
  [[ -z "$finding" ]] || {
    [[ "$finding" == CREDENTIAL_LITERAL ]] || \
      fail 'canonical scanner test content leaf returned an unexpected finding class'
    fail 'canonical scanner test content leaf found a credential literal'
  }
  pass 'canonical scanner test source has no content-scan finding'
}

expect_canonical_test_source_clean

new_fixture
expect_clean 'empty full-root fixture is accepted'

mkdir -p "$WORK/platform/docs/superpowers/plans"
printf 'UNRESOLVED_%s\n' 'PLACEHOLDER' >"$WORK/platform/docs/superpowers/plans/pending.md"
expect_reject 'platform/docs remains in the platform-root scan' 'platform/docs/superpowers/plans/pending.md'

new_fixture
newline_file=$'odd\nname.md'
printf 'TO%s should-never-be-printed\n' 'DO' >"$WORK/docs/plans/$newline_file"
expect_reject 'NUL-safe traversal reports a newline filename without content' 'docs/plans/odd'

new_fixture
mkdir -p "$WORK/platform/.git" "$WORK/platform/vendor/.helm"
printf 'TO%s should-never-be-printed\n' 'DO' >"$WORK/platform/.git/ignored"
printf 'TB%s should-never-be-printed\n' 'D' >"$WORK/platform/vendor/.helm/ignored"
expect_clean 'only .git and .helm directory contents are excluded'

new_fixture
mkdir -p "$WORK/platform/.superpowers/sdd/test-scratch"
printf 'password = should-never-be-printed-value\n' > \
  "$WORK/platform/.superpowers/sdd/test-scratch/snapshot.env"
expect_clean 'the exact platform-root SDD scratch subtree is excluded'

new_fixture
mkdir -p "$WORK/platform/.superpowers/not-sdd"
printf 'password = should-never-be-printed-value\n' > \
  "$WORK/platform/.superpowers/not-sdd/source.env"
expect_reject 'a platform-root .superpowers non-SDD subtree remains scanned' \
  'platform/.superpowers/not-sdd/source.env'

new_fixture
mkdir -p "$WORK/docs/.superpowers/sdd/test-scratch"
printf 'password = should-never-be-printed-value\n' > \
  "$WORK/docs/.superpowers/sdd/test-scratch/snapshot.env"
expect_reject 'a .superpowers subtree under another scanned root remains scanned' \
  'docs/.superpowers/sdd/test-scratch/snapshot.env'

new_fixture
printf 'TO%s should-never-be-printed\n' 'DO' >"$WORK/docs/plans/unresolved.md"
expect_reject 'unfinished English marker is rejected' 'docs/plans/unresolved.md'
printf '%s%s should-never-be-printed\n' '나중에' '채움' >"$WORK/docs/plans/unresolved.md"
expect_reject 'unfinished Korean marker is rejected' 'docs/plans/unresolved.md'

new_fixture
printf 'pattern | TO%s real work | TB%s should-never-be-printed\n' 'DO' 'D' > \
  "$WORK/docs/plans/detector-context-bypass.md"
expect_reject 'detector prose cannot exempt real unfinished markers' \
  'docs/plans/detector-context-bypass.md'

new_fixture
mkdir -p "$WORK/docs/mirror/scripts/validate"
printf '%s\n' \
  'unfinished = ("TO" + "DO", "TB" + "D", "나중에" + "채움", "UNRESOLVED_" + "PLACEHOLDER")' > \
  "$WORK/docs/mirror/scripts/validate/scan-platform-sensitive-source.sh"
expect_reject 'only the canonical production scanner may hold the exact detector definition' \
  'docs/mirror/scripts/validate/scan-platform-sensitive-source.sh'

new_fixture
printf '%s\n' 'readonly SLACK_URL='"'"'https://hooks.slack.com/services/T123/B456/S789'"'" > \
  "$WORK/platform/scripts/validate/test-example.sh"
printf '%s\n' 'readonly ADMIN_PASSWORD='"'"'SyntheticFixturePassword-123456789'"'" >> \
  "$WORK/platform/scripts/validate/test-example.sh"
expect_clean 'clearly synthetic focused-test credential literals are contextually allowed'
printf 'pass%sword = Actual%s\n' '' 'ProductionSecretValue9283' > \
  "$WORK/platform/scripts/validate/test-real-credential.sh"
expect_reject 'test-source context does not exempt a non-synthetic credential literal' \
  'platform/scripts/validate/test-real-credential.sh'
rm -f -- "$WORK/platform/scripts/validate/test-real-credential.sh"
cat >"$WORK/platform/services/reference-only.yaml" <<'YAML'
apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      containers:
        - name: example
          env:
            - name: CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: runtime-only
                  key: client-secret
            - name: PASSWORD_TEMPLATE
              value: ${RUNTIME_PASSWORD}
            - name: ACCESS_KEY_PLACEHOLDER
              value: <non-credential-placeholder>
YAML
printf '%s\n' 'OBSERVABILITY_SLACK_WEBHOOK=CREATE_CONFIRMED' > \
  "$WORK/platform/bootstrap/status.env"
printf '%s\n' \
  "check_pattern PASSWORD_NONPLACEHOLDER 'Password:[[:space:]]*[^<[:space:]][^[:space:]]*'" > \
  "$WORK/docs/plans/scanner-pattern.md"
expect_clean 'references, bare key names, templates, and explicit placeholders are accepted'
printf '%s\n' 'webhook = https://hooks.slack.com/services/should-never-be-printed/B456/S789' > \
  "$WORK/platform/bootstrap/live.env"
expect_reject 'Slack-shaped literal outside test-source context is rejected' 'platform/bootstrap/live.env'
printf '%s\n' 'password = should-never-be-printed-value' >"$WORK/platform/bootstrap/live.env"
expect_reject 'credential literal outside test-source context is rejected' 'platform/bootstrap/live.env'

new_fixture
printf '%s\n' '{"password": "should-never-be-printed-quoted-literal"}' > \
  "$WORK/platform/bootstrap/quoted.json"
expect_reject 'quoted JSON credential key with a literal RHS is rejected' \
  'platform/bootstrap/quoted.json'
printf '%s\n' 'password=should-never-be-printed-$-literal' > \
  "$WORK/platform/bootstrap/dollar.env"
expect_reject 'a literal dollar does not exempt a credential RHS' \
  'platform/bootstrap/dollar.env'

new_fixture
printf '%s\n' 'password = " should-never-be-printed-spaced-literal "' > \
  "$WORK/platform/bootstrap/spaced.env"
expect_reject 'quoted whitespace cannot hide a credential literal' \
  'platform/bootstrap/spaced.env'
rm -f -- "$WORK/platform/bootstrap/spaced.env"
printf 'pass%sword="${RUNTIME_PASSWORD}"-Actual%s\n' '' \
  'ProductionSecretValue9283' >"$WORK/platform/bootstrap/quoted-tail.env"
expect_reject 'a quoted runtime reference cannot hide a literal suffix' \
  'platform/bootstrap/quoted-tail.env'
rm -f -- "$WORK/platform/bootstrap/quoted-tail.env"

for separator in space comma semicolon; do
  case "$separator" in
    space) tail=' ActualProductionSecretValue9283' ;;
    comma) tail=',ActualProductionSecretValue9283' ;;
    semicolon) tail=';ActualProductionSecretValue9283' ;;
  esac
  printf 'pass%sword=${RUNTIME_PASSWORD}%s\n' '' "$tail" > \
    "$WORK/platform/bootstrap/unquoted-$separator-tail.env"
  expect_reject "an unquoted runtime reference cannot hide a $separator literal suffix" \
    "platform/bootstrap/unquoted-$separator-tail.env"
  rm -f -- "$WORK/platform/bootstrap/unquoted-$separator-tail.env"
done

printf 'pass%sword=pass%sword_Actual%s\n' \
  '' '' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/bare-identifier.env"
expect_reject 'a credential-key-prefixed bare identifier RHS is still a literal' \
  'platform/bootstrap/bare-identifier.env'
rm -f -- "$WORK/platform/bootstrap/bare-identifier.env"
printf 'client_%ssecret=client_%ssecret_Actual%s\n' \
  '' '' 'ProductionValue9283' >"$WORK/platform/bootstrap/bare-client-identifier.env"
expect_reject 'a client-secret-prefixed bare identifier RHS is still a literal' \
  'platform/bootstrap/bare-client-identifier.env'

new_fixture
printf '%s; pass%sword=Actual%s\n' \
  "check_pattern X 'Password:[[:space:]]*[^<[:space:]]+'" \
  '' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/mixed-regex.env"
expect_reject 'a detector regex cannot exempt a later credential assignment' \
  'platform/bootstrap/mixed-regex.env'
rm -f -- "$WORK/platform/bootstrap/mixed-regex.env"

printf '%s pass%sword=Actual%s\n' \
  "check_pattern X 'Password:[[:space:]]*[^<[:space:]]+'" \
  '' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/mixed-regex-space.env"
expect_reject 'a detector regex cannot consume a same-statement credential assignment' \
  'platform/bootstrap/mixed-regex-space.env'

new_fixture
printf 'config: {"pass%sword": Actual%s}\n' \
  '' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/mapping-literal.yaml"
expect_reject 'a YAML mapping credential key cannot use a bare literal scalar' \
  'platform/bootstrap/mapping-literal.yaml'
printf 'pass%sword: Actual%s SecretValue9283\n' \
  '' 'Production' >"$WORK/platform/bootstrap/spaced-scalar.yaml"
expect_reject 'YAML credential scalar whitespace is not prose' \
  'platform/bootstrap/spaced-scalar.yaml'
rm -f -- "$WORK/platform/bootstrap/spaced-scalar.yaml"
printf 'pass%sword: Actual%s,tail\n' \
  '' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/comma-scalar.yaml"
expect_reject 'YAML credential scalar punctuation is not prose' \
  'platform/bootstrap/comma-scalar.yaml'

new_fixture
printf 'admin_pass%sword: Actual%s\n' \
  '' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/admin-password.yaml"
expect_reject 'a normalized YAML admin password key is credential-bearing' \
  'platform/bootstrap/admin-password.yaml'
printf 'oidc_client_%ssecret: Actual%s\n' \
  '' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/oidc-client-secret.yaml"
expect_reject 'a normalized YAML OIDC client-secret key is credential-bearing' \
  'platform/bootstrap/oidc-client-secret.yaml'

new_fixture
printf 'OIDCClient%sSecret: Actual%s\n' \
  '' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/acronym-client-secret.yaml"
expect_reject 'an acronym CamelCase OIDC client-secret key is credential-bearing' \
  'platform/bootstrap/acronym-client-secret.yaml'
printf 'DBPass%sword: Actual%s\n' \
  '' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/acronym-password.yaml"
expect_reject 'an acronym CamelCase DB password key is credential-bearing' \
  'platform/bootstrap/acronym-password.yaml'

new_fixture
printf '{"pass\\u0077ord":"Actual%s","pass%sword":"${RUNTIME_PASSWORD}"}\n' \
  'ProductionSecretValue9283' '' >"$WORK/platform/bootstrap/duplicate-key.json"
expect_reject 'JSON rejects a Unicode-decoded duplicate credential key before collapse' \
  'platform/bootstrap/duplicate-key.json'

for value_kind in numeric array object; do
  case "$value_kind" in
    numeric) value='12345678901234567890' ;;
    array) value='["ActualProductionSecretValue9283"]' ;;
    object) value='{"value":"ActualProductionSecretValue9283"}' ;;
  esac
  printf '{"admin_pass%sword":%s}\n' '' "$value" > \
    "$WORK/platform/bootstrap/$value_kind-credential.json"
  expect_reject "a credential-key JSON $value_kind value fails closed" \
    "platform/bootstrap/$value_kind-credential.json"
  rm -f -- "$WORK/platform/bootstrap/$value_kind-credential.json"
done
rm -f -- "$WORK/platform/bootstrap/duplicate-key.json"

cat >"$WORK/platform/bootstrap/reference-container.yaml" <<'YAML'
envValueFrom:
  GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET:
    secretKeyRef:
      name: grafana-keycloak-oidc
      key: client-secret
YAML
expect_clean 'an exact Kubernetes secretKeyRef container remains a reference'
cat >"$WORK/platform/bootstrap/reference-container.yaml" <<'YAML'
envValueFrom:
  GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET:
    secretKeyRef:
      name: grafana-keycloak-oidc
      key: client-secret
      value: ActualProductionSecretValue9283
YAML
expect_reject 'a secretKeyRef container with a literal child fails closed' \
  'platform/bootstrap/reference-container.yaml'

new_fixture
cat >"$WORK/platform/bootstrap/webhook-feature.yaml" <<'YAML'
operators:
  object-store:
    webhook:
      enabled: true
      replicas: 1
YAML
expect_clean 'the exact chart webhook feature block is not a credential value'
cat >"$WORK/platform/bootstrap/webhook-feature.yaml" <<'YAML'
operators:
  object-store:
    webhook:
      enabled: true
      replicas: 1
      value: ActualProductionSecretValue9283
YAML
expect_reject 'a webhook feature block with a literal child fails closed' \
  'platform/bootstrap/webhook-feature.yaml'

new_fixture
printf 'pass%sword: Actual%s\n' \
  '' 'ProductionSecretValue9283' >"$WORK/docs/plans/literal-password.md"
expect_reject 'Markdown assignment-shaped password literals are rejected' \
  'docs/plans/literal-password.md'
printf 'client-%ssecret: Actual%s\n' \
  '' 'ProductionSecretValue9283' >"$WORK/docs/plans/literal-client-secret.md"
expect_reject 'Markdown assignment-shaped client-secret literals are rejected' \
  'docs/plans/literal-client-secret.md'
rm -f -- "$WORK/docs/plans/literal-password.md" "$WORK/docs/plans/literal-client-secret.md"
printf '  pass%sword: Actual%s\n' \
  '' 'ProductionSecretValue9283' >"$WORK/docs/plans/indented-literal-password.md"
expect_reject 'indented Markdown assignment-shaped password literals are rejected' \
  'docs/plans/indented-literal-password.md'

new_fixture
printf 'pass%sword:Actual%s\n' \
  '' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/literal.conf"
expect_reject 'a colon credential in configuration syntax is not prose' \
  'platform/bootstrap/literal.conf'

new_fixture
printf 'cmd --from-file="pass%sword=${password_file}" pass%sword=Actual%s\n' \
  '' '' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/from-file-tail.sh"
expect_reject 'one safe from-file argv cannot exempt a later credential assignment' \
  'platform/bootstrap/from-file-tail.sh'

new_fixture
cat >"$WORK/platform/bootstrap/references.env" <<'EOF'
password=${RUNTIME_PASSWORD}
client_secret="${OIDC_CLIENT_SECRET}"
access_key=$(runtime_access_key)
webhook='$(runtime_webhook)'
password="   ${SPACED_RUNTIME_PASSWORD}   "
--from-file="password=${password_file}"
EOF
cat >"$WORK/platform/bootstrap/references.py" <<'PY'
sources = {"admin-password": password_file}
item = {"client-secret": base64.b64encode(payload).decode()}
PY
expect_clean 'exact shell interpolation and command references remain accepted'

new_fixture
cat >"$WORK/platform/bootstrap/typed-none-reference.py" <<'PY'
def retain_required(
    webhook: RetainedWebhook,
):
    return webhook

def retain_optional(
    webhook: RetainedWebhook | None = None,
):
    return webhook
PY
printf 'web%shook = runtime / "input-webhook"\n' '' > \
  "$WORK/platform/scripts/validate/test-runtime-path-reference.py"
printf 'web%shook = open_validated_webhook(webhook_file)\nself.web%shook = self.vault.open_validated_webhook(os.fspath(self.webhook_path))\n' \
  '' '' >"$WORK/platform/bootstrap/runtime-call-reference.py"
expect_clean 'Python typed defaults, fixed test paths, and literal-free calls are references'

printf 'web%shook: RetainedWebhook | None = "Actual%s"\n' \
  '' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/typed-literal.py"
expect_reject 'a Python typed credential parameter cannot hide a literal default' \
  'platform/bootstrap/typed-literal.py'
printf 'web%shook = runtime / "Actual%s"\n' \
  '' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/path-literal.py"
expect_reject 'a Python credential runtime path cannot hide a literal basename' \
  'platform/bootstrap/path-literal.py'
for call_kind in string bytes nested star kwargs; do
  case "$call_kind" in
    string) expression='open_validated_webhook("ActualProductionSecretValue9283")' ;;
    bytes) expression='open_validated_webhook(b"ActualProductionSecretValue9283")' ;;
    nested) expression='open_validated_webhook(os.fspath("ActualProductionSecretValue9283"))' ;;
    star) expression='open_validated_webhook(*webhook_file)' ;;
    kwargs) expression='open_validated_webhook(**webhook_file)' ;;
  esac
  printf 'web%shook = %s\n' '' "$expression" > \
    "$WORK/platform/bootstrap/call-$call_kind-literal.py"
  expect_reject "a Python credential call rejects $call_kind literal or expansion input" \
    "platform/bootstrap/call-$call_kind-literal.py"
done

printf 'pass%sword=base64.b64encode(b"Actual%s").decode()\n' \
  '' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/base64-literal.py"
expect_reject 'base64 syntax does not exempt a literal credential' \
  'platform/bootstrap/base64-literal.py'

new_fixture
prompt_expected="$WORK/prompt-fixture.expected"
printf '%s%s\n%s\n' \
  'while b"KeePassXC master pass' \
  'word: " not in observed:' \
  '    observed += read_prompt()' >"$prompt_expected"
printf '%s%s\n%s\n' \
  'while b"KeePassXC master pass' \
  'word: " not in observed:' \
  '    observed += read_prompt()' > \
  "$WORK/platform/scripts/validate/test-python-prompt.py"
cmp -s -- "$prompt_expected" "$WORK/platform/scripts/validate/test-python-prompt.py" || \
  fail 'fixed-format prompt fixture bytes changed'
[[ "$(sha256sum "$WORK/platform/scripts/validate/test-python-prompt.py" | awk '{print $1}')" == \
  3c3cec8dc3f1d273be0e5a4760f2c89a01b11f851e28f0d2bbf960ff37fb1c56 ]] || \
  fail 'fixed-format prompt fixture hash changed'
rm -f -- "$prompt_expected"
expect_clean 'a Python test prompt ending at a credential label is not a credential literal'

new_fixture
cat >"$WORK/platform/scripts/validate/test-python-assert-prompt.py" <<'PY'
self.assertEqual(prompt, b"KeePassXC master password: ")
PY
expect_clean 'a sole Python assertEqual prompt constant remains accepted'

new_fixture
python3 - "$WORK/platform/scripts/validate/test-python-unknown-encoding.py" <<'PY'
import pathlib
import sys

path = pathlib.Path(sys.argv[1])
path.write_bytes(
    b"# coding: unknown-scanner-encoding\n"
    b"pass" b"word = ActualProductionSecretValue9283\n"
)
PY
[[ "$(sha256sum "$WORK/platform/scripts/validate/test-python-unknown-encoding.py" | awk '{print $1}')" == \
  2daee060681860677b2bffc8f7a086505299e2d321c1201cfa187fb24f99a3f4 ]] || \
  fail 'unknown-encoding fixture bytes changed'
expect_scanner_error 'an unknown Python source encoding fails closed as a scanner error'

new_fixture
python3 - "$WORK/platform/scripts/validate/test-python-latin1-prompt.py" <<'PY'
import pathlib
import sys

path = pathlib.Path(sys.argv[1])
path.write_bytes(
    b"# coding: latin-1\n"
    b"marker = 'caf\xe9'\n"
    b"while b'KeePassXC master pass" b"word: ' not in observed:\n"
    b"    observed += read_prompt()\n"
)
PY
python3 -m py_compile "$WORK/platform/scripts/validate/test-python-latin1-prompt.py"
find "$WORK/platform/scripts/validate" -type d -name __pycache__ -exec rm -rf -- {} +
[[ "$(sha256sum "$WORK/platform/scripts/validate/test-python-latin1-prompt.py" | awk '{print $1}')" == \
  06b3e6067415d4241e65b704e861707cfdff0372319075d69cf32f7178f55577 ]] || \
  fail 'Latin-1 prompt fixture bytes changed'
expect_clean 'a valid Latin-1 Python prompt-only context remains accepted'

new_fixture
python3 - "$WORK/platform/scripts/validate/test-python-latin1-literal.py" <<'PY'
import pathlib
import sys

path = pathlib.Path(sys.argv[1])
path.write_bytes(
    b"# coding: latin-1\n"
    b"marker = 'caf\xe9'\n"
    b"pass" b"word = ActualProductionSecretValue9283\n"
)
PY
python3 -m py_compile "$WORK/platform/scripts/validate/test-python-latin1-literal.py"
find "$WORK/platform/scripts/validate" -type d -name __pycache__ -exec rm -rf -- {} +
[[ "$(sha256sum "$WORK/platform/scripts/validate/test-python-latin1-literal.py" | awk '{print $1}')" == \
  f7cf7c400e901e17d8f460ec1aa087cd31c21208e01050d2a81e777b9066ec16 ]] || \
  fail 'Latin-1 literal fixture bytes changed'
expect_reject 'a valid Latin-1 Python credential literal is rejected' \
  'platform/scripts/validate/test-python-latin1-literal.py'

new_fixture
printf '%s%s\n%s\n' \
  'while b"KeePassXC master pass' \
  'word: " not in observed' \
  '    observed += read_prompt()' > \
  "$WORK/platform/scripts/validate/test-python-malformed-prompt.py"
[[ "$(sha256sum "$WORK/platform/scripts/validate/test-python-malformed-prompt.py" | awk '{print $1}')" == \
  05e824e262eec08a1be21c4c3488c9a5d2c32418ee2ab6b1e8a325a898eaed3d ]] || \
  fail 'malformed prompt fixture bytes changed'
expect_scanner_error 'malformed Python containing a credential prompt fails closed as a scanner error'

new_fixture
cat >"$WORK/platform/scripts/validate/test-python-triple-prompt-bypass.py" <<'PY'
message = b"""KeePassXC master password: 
ActualProductionSecretValue9283"""
PY
expect_reject 'a triple-quoted Python prompt token cannot contain a credential literal' \
  'platform/scripts/validate/test-python-triple-prompt-bypass.py'

new_fixture
cat >"$WORK/platform/scripts/validate/test-python-multiline-prompt-bypass.py" <<'PY'
message = (
    b"KeePassXC master password: "
    b"ActualProductionSecretValue9283"
)
PY
expect_reject 'a multiline adjacent Python literal cannot continue an empty credential prompt' \
  'platform/scripts/validate/test-python-multiline-prompt-bypass.py'

new_fixture
printf 'message = b"".join((b"KeePassXC master pass%sword: ", b"Actual%s"))\n' \
  '' 'ProductionSecretValue9283' > \
  "$WORK/platform/scripts/validate/test-python-join-prompt-bypass.py"
expect_reject 'a join expression cannot continue an empty credential prompt with a literal' \
  'platform/scripts/validate/test-python-join-prompt-bypass.py'

new_fixture
printf 'message = b"KeePassXC master pass%sword: " + b"Actual%s"\n' \
  '' 'ProductionSecretValue9283' > \
  "$WORK/platform/scripts/validate/test-python-plus-prompt-bypass.py"
expect_reject 'a plus-joined Python string literal cannot continue an empty credential prompt' \
  'platform/scripts/validate/test-python-plus-prompt-bypass.py'

new_fixture
printf 'message = b"KeePassXC master pass%sword: " b"Actual%s"\n' \
  '' 'ProductionSecretValue9283' > \
  "$WORK/platform/scripts/validate/test-python-adjacent-prompt-bypass.py"
expect_reject 'an adjacent Python string literal cannot continue an empty credential prompt' \
  'platform/scripts/validate/test-python-adjacent-prompt-bypass.py'

new_fixture
printf 'message = "pass%sword: Actual%s; pass%sword: "\n' \
  '' 'ProductionSecretValue9283' '' > \
  "$WORK/platform/scripts/validate/test-python-prompt-bypass.py"
expect_reject 'a later empty Python prompt cannot exempt an earlier quoted credential literal' \
  'platform/scripts/validate/test-python-prompt-bypass.py'
printf 'pass%sword = "Actual%s"\n' '' 'ProductionSecretValue9283' > \
  "$WORK/platform/scripts/validate/test-python-quoted-literal.py"
expect_reject 'a Python test file rejects a quoted credential literal' \
  'platform/scripts/validate/test-python-quoted-literal.py'

new_fixture
cp -- "$ROOT/scripts/validate/test-slack-webhook-recovery-vault.py" \
  "$WORK/platform/scripts/validate/test-slack-webhook-recovery-vault.py"
expect_clean 'a test-named Python vault fixture permits safe test context and nonliteral references'
printf 'web%shook = Actual%s\n' '' 'ProductionSecretValue9283' > \
  "$WORK/platform/scripts/validate/test-python-explicit-literal.py"
expect_reject 'a Python test file rejects an explicit credential literal' \
  'platform/scripts/validate/test-python-explicit-literal.py'

new_fixture
printf '%s\n' '-----BEGIN PRI''VATE KEY-----' 'should-never-be-printed' >"$WORK/docs/private.pem"
expect_reject 'private key header is rejected' 'docs/private.pem'

new_fixture
cat >"$WORK/platform/services/credential-secret.yaml" <<'YAML'
apiVersion: v1
kind: Secret
metadata:
  name: forbidden-source
stringData:
  password: should-never-be-printed
YAML
expect_reject 'source-controlled credential Secret payload is rejected' 'platform/services/credential-secret.yaml'

new_fixture
cat >"$WORK/platform/services/custom-tag-stream.yaml" <<'YAML'
apiVersion: example.test/v1
kind: Synthetic
spec:
  tagged: !!value fixture
---
apiVersion: v1
kind: Secret
metadata:
  name: forbidden-source
stringData:
  opaque: c2hvdWxkLW5ldmVyLWJlLXByaW50ZWQ=
YAML
expect_reject 'custom-tag streams still expose later source Secret payloads' \
  'platform/services/custom-tag-stream.yaml'

new_fixture
cat >"$WORK/platform/services/duplicate-payload.yaml" <<'YAML'
apiVersion: v1
kind: Secret
metadata:
  name: duplicate-payload
stringData:
  opaque: c2hvdWxkLW5ldmVyLWJlLXByaW50ZWQ=
stringData: {}
YAML
expect_reject 'duplicate source Secret keys fail closed' \
  'platform/services/duplicate-payload.yaml'

new_fixture
cat >"$WORK/platform/services/credential-secret.YAML" <<'YAML'
apiVersion: v1
kind: Secret
metadata:
  name: uppercase-extension
stringData:
  opaque: c2hvdWxkLW5ldmVyLWJlLXByaW50ZWQ=
YAML
expect_reject 'uppercase YAML source Secret payload is rejected' \
  'platform/services/credential-secret.YAML'

new_fixture
printf '%s\n' 'kind: [unterminated' >"$WORK/platform/services/malformed.yaml"
expect_reject 'a source YAML parser error fails closed without content' \
  'platform/services/malformed.yaml'

new_fixture
stream_fifo="$WORK/source-stream.yaml"
stream_output="$WORK/source-stream.finding"
mkfifo -m 0600 "$stream_fifo"
PYTHONUNBUFFERED=1 _sensitive_source_yaml_secret_scan "$stream_fifo" >"$stream_output" &
stream_pid=$!
exec {stream_fd}>"$stream_fifo"
printf '%s\n' \
  'apiVersion: v1' \
  'kind: Secret' \
  'metadata:' \
  '  name: first-streamed-secret' \
  'stringData:' \
  '  opaque: c2hvdWxkLW5ldmVyLWJlLXByaW50ZWQ=' >&"$stream_fd"
for stream_document in {1..200}; do
  printf '%s\n' \
    '---' \
    'apiVersion: v1' \
    'kind: ConfigMap' \
    'metadata:' \
    "  name: streamed-padding-$stream_document" >&"$stream_fd"
done
stream_seen=false
for _ in {1..50}; do
  if [[ -s "$stream_output" ]]; then
    stream_seen=true
    break
  fi
  sleep 0.02
done
exec {stream_fd}>&-
wait "$stream_pid"
[[ "$stream_seen" == true ]] || \
  fail 'source YAML scan materialized the stream before reporting the first Secret'
[[ "$(<"$stream_output")" == SECRET_SOURCE_PAYLOAD ]] || \
  fail 'streamed source YAML scan returned an unexpected finding class'
pass 'source YAML documents are inspected incrementally before end-of-stream'

new_fixture
mkdir -p "$WORK/render-handoff"
cat >"$WORK/render-handoff/rendered.yaml" <<'YAML'
apiVersion: v1
kind: Secret
metadata:
  name: alertmanager-observability-core-kube-pr-alertmanager
  namespace: observability
type: Opaque
data:
  alertmanager.yaml: cmVjZWl2ZXJzOgotIG5hbWU6ICJudWxsIgpyb3V0ZToKICByZWNlaXZlcjogIm51bGwiCiAgcm91dGVzOiBbXQo=
YAML
PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS="$WORK/render-handoff/rendered.yaml" \
  run_scanner >/dev/null || \
  fail 'credential-free allowlisted rendered Secret was rejected'
pass 'credential-free allowlisted rendered Secret is accepted'
source_secret_rc=0
cp -- "$WORK/render-handoff/rendered.yaml" "$WORK/platform/rendered.yaml"
source_secret_output="$(run_scanner 2>&1)" || source_secret_rc=$?
(( source_secret_rc != 0 )) || fail 'an allowlisted-looking Secret in source was accepted'
[[ "$source_secret_output" == *'platform/rendered.yaml'* ]] || \
  fail 'allowlisted-looking source Secret did not report its filename'
pass 'an allowlisted-looking Secret remains forbidden in source'
python3 - "$WORK/platform/rendered.yaml" <<'PY'
import base64
import pathlib
import sys

path = pathlib.Path(sys.argv[1])
encoded = base64.b64encode(b"password: should-never-be-printed\n").decode()
text = path.read_text()
head, _ = text.rsplit("  alertmanager.yaml: ", 1)
path.write_text(head + "  alertmanager.yaml: " + encoded + "\n")
PY
cp -- "$WORK/platform/rendered.yaml" "$WORK/render-handoff/rendered.yaml"
rm -f -- "$WORK/platform/rendered.yaml"
PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS="$WORK/render-handoff/rendered.yaml" \
  expect_reject 'decoded rendered Secret credential payload is rejected' 'rendered.yaml'
cat >"$WORK/render-handoff/rendered.yaml" <<'YAML'
apiVersion: v1
kind: Secret
metadata:
  name: gitea
  namespace: gitea
type: Opaque
stringData:
  assertions: ""
  config_environment.sh: synthetic-fixture
---
apiVersion: v1
kind: Secret
metadata:
  name: gitea-init
  namespace: gitea
type: Opaque
stringData:
  configure_gitea.sh: synthetic-fixture
  configure_gpg_environment.sh: synthetic-fixture
  init_directory_structure.sh: synthetic-fixture
---
apiVersion: v1
kind: Secret
metadata:
  name: gitea-inline-config
  namespace: gitea
type: Opaque
stringData:
  _generals_: ""
  actions: synthetic-fixture
  cache: synthetic-fixture
  database: synthetic-fixture
  indexer: synthetic-fixture
  metrics: synthetic-fixture
  packages: synthetic-fixture
  queue: synthetic-fixture
  repository: synthetic-fixture
  security: synthetic-fixture
  server: synthetic-fixture
  service: synthetic-fixture
  session: synthetic-fixture
YAML
if PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS="$WORK/render-handoff/rendered.yaml" \
  run_scanner >/dev/null; then
  pass 'expected credential-free Gitea renderer Secrets are accepted'
else
  fail 'expected credential-free Gitea renderer Secrets were rejected'
fi
python3 - "$WORK/render-handoff/rendered.yaml" <<'PY'
import sys
import yaml

path = sys.argv[1]
with open(path, encoding="utf-8") as stream:
    documents = list(yaml.safe_load_all(stream))
documents[0]["stringData"]["config_environment.sh"] = (
    "pass" + "word = Actual" + "ProductionSecretValue9283"
)
with open(path, "w", encoding="utf-8") as stream:
    yaml.safe_dump_all(documents, stream, explicit_start=True, sort_keys=False)
PY
PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS="$WORK/render-handoff/rendered.yaml" \
  expect_reject 'literal credential inside an allowlisted Gitea Secret is rejected' 'rendered.yaml'
python3 - "$WORK/render-handoff/rendered.yaml" <<'PY'
import sys
import yaml

path = sys.argv[1]
with open(path, encoding="utf-8") as stream:
    documents = list(yaml.safe_load_all(stream))
documents[0]["stringData"]["config_environment.sh"] = (
    "password = should-never-be-printed-${RUNTIME_SUFFIX}"
)
with open(path, "w", encoding="utf-8") as stream:
    yaml.safe_dump_all(documents, stream, explicit_start=True, sort_keys=False)
PY
PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS="$WORK/render-handoff/rendered.yaml" \
  expect_reject 'a decoded literal prefix plus interpolation is rejected' 'rendered.yaml'
python3 - "$WORK/render-handoff/rendered.yaml" <<'PY'
import sys
import yaml

path = sys.argv[1]
with open(path, encoding="utf-8") as stream:
    documents = list(yaml.safe_load_all(stream))
documents[0]["stringData"]["config_environment.sh"] = (
    'pass' + 'word = "   ${RUNTIME_PASSWORD}   "'
)
with open(path, "w", encoding="utf-8") as stream:
    yaml.safe_dump_all(documents, stream, explicit_start=True, sort_keys=False)
PY
if PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS="$WORK/render-handoff/rendered.yaml" \
  run_scanner >/dev/null; then
  pass 'a decoded quoted and spaced exact runtime reference remains accepted'
else
  fail 'a decoded quoted and spaced exact runtime reference was rejected'
fi
python3 - "$WORK/render-handoff/rendered.yaml" <<'PY'
import sys
import yaml

path = sys.argv[1]
with open(path, encoding="utf-8") as stream:
    documents = list(yaml.safe_load_all(stream))
documents[0]["stringData"]["config_environment.sh"] = (
    'pass' + 'word="${RUNTIME_PASSWORD}"-ActualProductionSecretValue9283'
)
with open(path, "w", encoding="utf-8") as stream:
    yaml.safe_dump_all(documents, stream, explicit_start=True, sort_keys=False)
PY
PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS="$WORK/render-handoff/rendered.yaml" \
  expect_reject 'a decoded quoted runtime reference cannot hide a literal suffix' \
  'rendered.yaml'
cat >"$WORK/render-handoff/rendered.yaml" <<'YAML'
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: synthetic.example.test
spec:
  synthetic: !!value fixture
---
apiVersion: v1
kind: Secret
metadata:
  name: alertmanager-observability-core-kube-pr-alertmanager
  namespace: observability
type: Opaque
data:
  alertmanager.yaml: cmVjZWl2ZXJzOgotIG5hbWU6ICJudWxsIgpyb3V0ZToKICByZWNlaXZlcjogIm51bGwiCiAgcm91dGVzOiBbXQo=
YAML
if PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS="$WORK/render-handoff/rendered.yaml" \
  run_scanner >/dev/null; then
  pass 'non-Secret CRD custom tags do not block streamed Secret validation'
else
  fail 'non-Secret CRD custom tag blocked streamed Secret validation'
fi
cat >"$WORK/render-handoff/rendered.yaml" <<'YAML'
apiVersion: v1
kind: Secret
metadata:
  name: alertmanager-observability-core-kube-pr-alertmanager
  namespace: observability
type: Opaque
data:
  alertmanager.yaml: cmVjZWl2ZXJzOgotIG5hbWU6ICJudWxsIgpyb3V0ZToKICByZWNlaXZlcjogIm51bGwiCiAgcm91dGVzOiBbXQo=
  alertmanager.yaml: cmVjZWl2ZXJzOgotIG5hbWU6ICJudWxsIgpyb3V0ZToKICByZWNlaXZlcjogIm51bGwiCiAgcm91dGVzOiBbXQo=
YAML
PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS="$WORK/render-handoff/rendered.yaml" \
  expect_reject 'duplicate rendered Secret keys fail closed' 'rendered.yaml'
cat >"$WORK/render-handoff/rendered.yaml" <<'YAML'
apiVersion: v1
kind: Secret
metadata:
  name: unexpected-rendered-secret
  namespace: observability
type: Opaque
data:
  allowed-looking-key: bm9uY3JlZGVudGlhbAo=
YAML
PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS="$WORK/render-handoff/rendered.yaml" \
  expect_reject 'a rendered Secret outside the exact allowlist is rejected' 'rendered.yaml'

new_fixture
printf 'target: spring-boot\n' >"$WORK/platform/services/observability/future-target.yaml"
expect_reject 'future observability target is rejected' 'platform/services/observability/future-target.yaml'
printf 'monitor-target: batch\n' >"$WORK/platform/services/observability/future-target.yaml"
expect_reject 'future batch target is rejected' 'platform/services/observability/future-target.yaml'
printf 'alert-target: backup\n' >"$WORK/platform/services/observability/future-target.yaml"
expect_reject 'future backup target is rejected' 'platform/services/observability/future-target.yaml'
rm -f -- "$WORK/platform/services/observability/future-target.yaml"
printf 'target: spring-boot\n' >"$WORK/platform/services/observability/future-target.md"
expect_reject 'future observability target in Markdown is rejected' \
  'platform/services/observability/future-target.md'

new_fixture
cat >"$WORK/platform/scripts/validate/fake-renderer" <<'SH'
#!/usr/bin/env bash
set -Eeuo pipefail
out=''
component=''
while (( $# > 0 )); do
  case "$1" in
    --verified-output-dir) out=$2; shift 2 ;;
    --component) component=$2; shift 2 ;;
    *) shift ;;
  esac
done
label="$(basename -- "$0")"
handoff=no
[[ -z "$out" ]] || handoff=yes
printf '%s\n' "$label${component:+:$component}:handoff=$handoff" >>"$PLATFORM_SENSITIVE_SOURCE_RENDER_LOG"

emit_phase1_log() {
  local publish=$1 name
  for name in namespaces ssd-local-pv; do
    printf 'Rendered %-20s %8d bytes\n' "$name" 123
  done
  printf 'Verified %-20s SHA-256 %064d\n' cloudnative-pg-chart 1
  for name in cnpg-operator platform-postgres; do
    printf 'Rendered %-20s %8d bytes\n' "$name" 123
  done
  printf 'Verified %-20s SHA-256 %064d\n' gitea-chart 2
  for name in gitea gitea-oidc; do
    printf 'Rendered %-20s %8d bytes\n' "$name" 123
  done
  if [[ "$publish" == yes ]]; then
    printf 'Preserved six verified manifests for the apply handoff.\n'
  fi
  printf 'Phase 1 baseline and Gitea OIDC desired rendering invariants passed.\n'
  printf 'Temporary rendered manifests and generated chart caches will be removed on exit.\n'
}

emit_core_log() {
  local name count=10
  for name in prometheus-operator-crds kube-prometheus-stack loki tempo alloy \
    prometheus-node-exporter grafana prometheus-blackbox-exporter; do
    printf 'Verified %-28s SHA-256 %064d\n' "$name" "$count"
    count=$((count + 1))
  done
  for name in namespaces crds storage kps loki tempo alloy node-exporter grafana \
    blackbox core-policies targets core-rules alerting dashboards aggregate; do
    printf 'Rendered %-18s %8d bytes  SHA-256 %064d\n' "$name" 123 "$count"
    count=$((count + 1))
  done
  printf 'OBSERVABILITY CORE STATIC RENDER PASS\n'
}

emit_access_log() {
  local name count=40
  for name in prometheus-operator-crds kube-prometheus-stack loki tempo alloy \
    prometheus-node-exporter grafana prometheus-blackbox-exporter; do
    if [[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_ACCESS_MISSING_VERIFIED:-0}" != 0 && \
      "$name" == grafana ]]; then
      continue
    fi
    printf 'Verified %-28s SHA-256 %064d\n' "$name" "$count"
    count=$((count + 1))
  done
  access_rendered=(
    namespaces crds storage kps loki tempo alloy node-exporter grafana
    blackbox core-policies targets core-rules alerting dashboards aggregate
  )
  if [[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_ACCESS_SWAP_RENDERED:-0}" != 0 ]]; then
    access_rendered=(crds namespaces "${access_rendered[@]:2}")
  fi
  for name in "${access_rendered[@]}"; do
    printf 'Rendered %-18s %8d bytes  SHA-256 %064d\n' "$name" 123 "$count"
    count=$((count + 1))
  done
  printf 'OBSERVABILITY CORE STATIC RENDER PASS\n'
  printf 'OBSERVABILITY ACCESS STATIC RENDER PASS\n'
}

emit_admin_metadata_log() {
  case "${PLATFORM_SENSITIVE_SOURCE_FAKE_ADMIN_LOG_VARIANT:-safe}" in
    safe)
      printf 'Pulled: docker.io/dpage/pgadmin4-helm:9.16.0\n'
      printf 'Digest: sha256:%064d\n' 8
      ;;
    wrong-registry)
      printf 'Pulled: registry.example.test/dpage/pgadmin4-helm:9.16.0\n'
      printf 'Digest: sha256:%064d\n' 8
      ;;
    wrong-chart)
      printf 'Pulled: docker.io/dpage/other-chart:9.16.0\n'
      printf 'Digest: sha256:%064d\n' 8
      ;;
    wrong-version)
      printf 'Pulled: docker.io/dpage/pgadmin4-helm:9.16.1\n'
      printf 'Digest: sha256:%064d\n' 8
      ;;
    bad-digest)
      printf 'Pulled: docker.io/dpage/pgadmin4-helm:9.16.0\n'
      printf 'Digest: sha256:%063d\n' 8
      ;;
    wrong-order)
      printf 'Digest: sha256:%064d\n' 8
      printf 'Pulled: docker.io/dpage/pgadmin4-helm:9.16.0\n'
      ;;
    extra)
      printf 'Pulled: docker.io/dpage/pgadmin4-helm:9.16.0\n'
      printf 'Digest: sha256:%064d\n' 8
      printf 'Fetched chart metadata.\n'
      ;;
    *) exit 44 ;;
  esac
}

if [[ "$label" == render-observability-access.sh ]]; then
  [[ -z "$out" ]] || exit 42
  [[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_ACCESS_FAIL:-0}" == 0 ]] || exit 41
  emit_access_log
  if [[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_ACCESS_PATH:-0}" != 0 ]]; then
    printf 'Rendered /tmp/should-never-be-printed %d bytes  SHA-256 %064d\n' 123 2
  fi
  if [[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_ACCESS_DUPLICATE_CORE:-0}" != 0 ]]; then
    printf 'OBSERVABILITY CORE STATIC RENDER PASS\n'
  fi
  if [[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_ACCESS_SECRET:-0}" != 0 ]]; then
    printf '%s\n' 'apiVersion: v1' 'kind: Secret' 'stringData:' '  password: should-never-be-printed'
  fi
  exit 0
fi
[[ -n "$out" && -d "$out" ]]
case "$label" in
  render-phase1.sh)
    names=(namespaces ssd-local-pv cnpg-operator platform-postgres gitea gitea-oidc)
    ;;
  render-phase2.sh)
    names=(phase2-namespaces aistor-local-pv keycloak-operator platform-postgres-keycloak keycloak aistor-operator minio-aistor aistor-network-policies)
    ;;
  render-admin-services.sh)
    names=(admin-namespace pgadmin-local-pv coredns-custom aistor-admin-oidc pgadmin)
    ;;
  render-observability-core.sh)
    names=(namespaces crds storage kps loki tempo alloy node-exporter grafana blackbox core-policies targets core-rules alerting dashboards aggregate)
    ;;
  *) exit 43 ;;
esac
for name in "${names[@]}"; do
  cat >"$out/$name.yaml" <<YAML
apiVersion: v1
kind: ConfigMap
metadata:
  name: synthetic-$name
YAML
done
if [[ "$label" == render-phase1.sh ]]; then
  for artifact in gitea gitea-oidc; do
    cat >"$out/$artifact.yaml" <<'YAML'
apiVersion: v1
kind: Secret
metadata:
  name: gitea
  namespace: gitea
type: Opaque
stringData:
  assertions: ""
  config_environment.sh: synthetic-fixture
---
apiVersion: v1
kind: Secret
metadata:
  name: gitea-init
  namespace: gitea
type: Opaque
stringData:
  configure_gitea.sh: synthetic-fixture
  configure_gpg_environment.sh: synthetic-fixture
  init_directory_structure.sh: synthetic-fixture
---
apiVersion: v1
kind: Secret
metadata:
  name: gitea-inline-config
  namespace: gitea
type: Opaque
stringData:
  _generals_: ""
  actions: synthetic-fixture
  cache: synthetic-fixture
  database: synthetic-fixture
  indexer: synthetic-fixture
  metrics: synthetic-fixture
  packages: synthetic-fixture
  queue: synthetic-fixture
  repository: synthetic-fixture
  security: synthetic-fixture
  server: synthetic-fixture
  service: synthetic-fixture
  session: synthetic-fixture
YAML
    if [[ "$artifact" == gitea && \
      "${PLATFORM_SENSITIVE_SOURCE_FAKE_BASELINE_OIDC_KEYS:-0}" != 0 ]]; then
      printf '  oauth2_client: synthetic-fixture\n' >>"$out/$artifact.yaml"
    fi
    if [[ "$artifact" == gitea-oidc && \
      "${PLATFORM_SENSITIVE_SOURCE_FAKE_OIDC_BASELINE_KEYS:-0}" == 0 ]]; then
      printf '  oauth2_client: synthetic-fixture\n' >>"$out/$artifact.yaml"
    fi
  done
fi
if [[ "$label" == render-observability-core.sh ]]; then
  if [[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_CORE_MISSING:-0}" == 0 ]]; then
    secret_name=alertmanager-observability-core-kube-pr-alertmanager
    [[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_UNKNOWN:-0}" == 0 ]] || secret_name=unexpected-rendered-secret
    cat >"$out/kps.yaml" <<YAML
apiVersion: v1
kind: Secret
metadata:
  name: $secret_name
  namespace: observability
type: Opaque
data:
  alertmanager.yaml: cmVjZWl2ZXJzOgotIG5hbWU6ICJudWxsIgpyb3V0ZToKICByZWNlaXZlcjogIm51bGwiCiAgcm91dGVzOiBbXQo=
YAML
  fi
  if [[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_AGGREGATE_MISSING:-0}" == 0 ]]; then
    cat >>"$out/aggregate.yaml" <<'YAML'
---
apiVersion: v1
kind: Secret
metadata:
  name: alertmanager-observability-core-kube-pr-alertmanager
  namespace: observability
type: Opaque
data:
  alertmanager.yaml: cmVjZWl2ZXJzOgotIG5hbWU6ICJudWxsIgpyb3V0ZToKICByZWNlaXZlcjogIm51bGwiCiAgcm91dGVzOiBbXQo=
YAML
  fi
  python3 - "$out" <<'PY'
import hashlib
import json
import os
import sys
import yaml

directory = sys.argv[1]
artifacts = (
    "namespaces", "crds", "storage", "kps", "loki", "tempo", "alloy",
    "node-exporter", "grafana", "blackbox", "core-policies", "targets",
    "core-rules", "alerting", "dashboards",
)
with open(os.path.join(directory, "resource-index.tsv"), "w", encoding="utf-8") as target:
    target.write("order\tartifact\tapiVersion\tkind\tnamespace\tname\tcanonicalSha256\n")
    order = 0
    for artifact in artifacts:
        with open(os.path.join(directory, artifact + ".yaml"), encoding="utf-8") as source:
            for item in yaml.safe_load_all(source):
                if item is None:
                    continue
                order += 1
                metadata = item.get("metadata") or {}
                identity = (
                    str(item.get("apiVersion", "")), str(item.get("kind", "")),
                    str(metadata.get("namespace", "")), str(metadata.get("name", "")),
                )
                canonical = json.dumps(item, sort_keys=True, separators=(",", ":"), ensure_ascii=False)
                digest = hashlib.sha256(canonical.encode("utf-8")).hexdigest()
                target.write("\t".join((str(order), artifact, *identity, digest)) + "\n")
PY
  if [[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_INDEX_BAD:-0}" != 0 ]]; then
    sed -i '2s/[0-9a-f]$/0/' "$out/resource-index.tsv"
  fi
fi
if [[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_GITEA_WRONG_ARTIFACT:-0}" != 0 && \
  "$label" == render-phase1.sh ]]; then
  cat >"$out/namespaces.yaml" <<'YAML'
apiVersion: v1
kind: Secret
metadata:
  name: gitea
  namespace: gitea
type: Opaque
stringData:
  assertions: synthetic-fixture
  config_environment.sh: synthetic-fixture
YAML
fi
if [[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_CORE_MISSING_GITEA_CROSSOVER:-0}" != 0 && \
  "$label" == render-phase1.sh ]]; then
  cat >"$out/gitea.yaml" <<'YAML'
apiVersion: v1
kind: Secret
metadata:
  name: gitea
  namespace: gitea
type: Opaque
stringData:
  assertions: synthetic-fixture
  config_environment.sh: synthetic-fixture
YAML
fi
if [[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_EXTRA_FILE:-0}" != 0 ]]; then
  printf 'unexpected\n' >"$out/unexpected.bin"
fi
case "$label" in
  render-phase1.sh)
    emit_phase1_log yes
    ;;
  render-phase2.sh)
    printf 'Validating the Phase 1 baseline and Gitea OIDC desired profile first.\n'
    emit_phase1_log no
    for name in phase2-namespaces aistor-local-pv aistor-network-policies \
      keycloak-operator platform-postgres-keycloak keycloak; do
      printf 'Rendered %-24s %8d bytes\n' "$name" 123
    done
    printf 'Verified %-24s SHA-256 %064d\n' aistor-operator-chart 3
    printf 'Rendered %-24s %8d bytes\n' aistor-operator 123
    printf 'Verified %-24s SHA-256 %064d\n' aistor-objectstore-chart 4
    printf 'Rendered %-24s %8d bytes\n' minio-aistor 123
    printf 'Preserved eight verified manifests for the AIStor apply handoff.\n'
    printf 'Phase 2 rendering and source invariants passed.\n'
    printf 'No live ObjectStore CRD or Kubernetes cluster access was required.\n'
    printf 'Temporary Phase 2 rendered manifests and generated chart caches will be removed on exit.\n'
    ;;
  render-admin-services.sh)
    emit_admin_metadata_log
    printf '검증 %-18s SHA-256 %064d\n' pgadmin 5
    printf '검증 %-18s SHA-256 %064d\n' aistor-objectstore 6
    for name in admin-namespace pgadmin-local-pv coredns-custom aistor-admin-oidc pgadmin; do
      printf '렌더 %-20s %8d bytes  SHA-256 %064d\n' "$name" 123 7
    done
    printf 'ADMIN SERVICES STATIC RENDER PASS\n'
    ;;
  render-observability-core.sh)
    emit_core_log
    ;;
esac
if [[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_LOG_INJECTION_LABEL:-}" == "$label" ]]; then
  printf 'password: should-never-be-printed-renderer-log\n'
fi
SH
chmod 0755 "$WORK/platform/scripts/validate/fake-renderer"
for renderer in \
  render-phase1.sh render-phase2.sh render-admin-services.sh \
  render-observability-core.sh render-observability-access.sh; do
  cp -- "$WORK/platform/scripts/validate/fake-renderer" \
    "$WORK/platform/scripts/validate/$renderer"
done
: >"$WORK/renderer.log"
export PLATFORM_SENSITIVE_SOURCE_RENDER_LOG="$WORK/renderer.log"
scan_platform_renderer_secrets "$WORK/platform" >/dev/null || \
  fail 'private renderer orchestration rejected safe exact outputs'
expected_renderers=$'render-phase1.sh:handoff=yes\nrender-phase2.sh:handoff=yes\nrender-admin-services.sh:handoff=yes\nrender-observability-core.sh:handoff=yes\nrender-observability-access.sh:grafana:handoff=no'
[[ "$(cat "$WORK/renderer.log")" == "$expected_renderers" ]] || \
  fail 'private renderer orchestration did not run the exact renderer set'
pass 'private renderer orchestration scans the exact renderer set'
pass 'access renderer receives no verified output handoff'
pass 'core metadata is validated separately from exact YAML Secret inputs'
: >"$WORK/renderer.log"
renderer_rc=0
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_INDEX_BAD=1 \
  scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
(( renderer_rc != 0 )) || fail 'mismatched core canonical resource index was accepted'
[[ "$renderer_output" == *'observability-core resource index contract failed'* ]] || \
  fail 'mismatched core canonical resource index did not fail at its contract'
pass 'core canonical resource index mismatch fails closed'
: >"$WORK/renderer.log"
renderer_rc=0
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_EXTRA_FILE=1 \
  scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
(( renderer_rc != 0 )) || fail 'unknown renderer handoff entry was accepted'
[[ "$renderer_output" == *'renderer handoff entry contract failed'* ]] || \
  fail 'unknown renderer handoff entry did not fail at its entry contract'
pass 'unknown renderer handoff entries fail closed'
: >"$WORK/renderer.log"
renderer_rc=0
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_UNKNOWN=1 \
  scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
(( renderer_rc != 0 )) || fail 'non-allowlisted Secret from renderer orchestration was accepted'
[[ "$renderer_output" != *'alertmanager.yaml:'* ]] || fail 'renderer failure leaked manifest content'
pass 'private renderer orchestration rejects non-allowlisted Secret output'
: >"$WORK/renderer.log"
renderer_rc=0
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_CORE_MISSING=1 \
  scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
(( renderer_rc != 0 )) || fail 'missing allowlisted core Secret was accepted'
[[ "$renderer_output" == *'RENDERED_REQUIRED_SECRET_MISSING'* ]] || \
  fail 'missing allowlisted core Secret did not produce its filename-free finding'
pass 'private renderer orchestration requires the core allowlisted Secret'
: >"$WORK/renderer.log"
renderer_rc=0
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_AGGREGATE_MISSING=1 \
  scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
(( renderer_rc != 0 )) || fail 'core aggregate without its Alertmanager Secret was accepted'
[[ "$renderer_output" == *'RENDERED_REQUIRED_SECRET_MISSING'* ]] || \
  fail 'missing aggregate Alertmanager Secret did not produce its filename-free finding'
pass 'core aggregate requires its own exact Alertmanager Secret'
: >"$WORK/renderer.log"
renderer_rc=0
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_GITEA_WRONG_ARTIFACT=1 \
  scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
(( renderer_rc != 0 )) || fail 'allowlisted Gitea Secret in the wrong artifact was accepted'
pass 'Gitea rendered Secrets are pinned to their exact handoff artifacts'
: >"$WORK/renderer.log"
baseline_key_rc=0
baseline_key_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_BASELINE_OIDC_KEYS=1 \
  scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || baseline_key_rc=$?
: >"$WORK/renderer.log"
oidc_key_rc=0
oidc_key_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_OIDC_BASELINE_KEYS=1 \
  scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || oidc_key_rc=$?
(( baseline_key_rc != 0 )) || fail 'OIDC-only inline config keys were accepted in baseline Gitea'
(( oidc_key_rc != 0 )) || fail 'baseline inline config keys were accepted in OIDC Gitea'
[[ "$baseline_key_output$oidc_key_output" != *'should-never-be-printed'* ]] || \
  fail 'Gitea artifact-specific key rejection leaked content'
pass 'Gitea inline config keys are exact for baseline and OIDC artifacts'
: >"$WORK/renderer.log"
renderer_rc=0
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_CORE_MISSING=1 \
  PLATFORM_SENSITIVE_SOURCE_FAKE_CORE_MISSING_GITEA_CROSSOVER=1 \
  scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
(( renderer_rc != 0 )) || fail 'a Gitea Secret satisfied the missing core Secret requirement'
[[ "$renderer_output" == *'RENDERED_REQUIRED_SECRET_MISSING'* ]] || \
  fail 'missing exact core Secret did not produce its filename-free finding'
pass 'Gitea allowlist results cannot satisfy the core Secret requirement'
for admin_log_variant in \
  wrong-registry wrong-chart wrong-version bad-digest wrong-order extra; do
  : >"$WORK/renderer.log"
  renderer_rc=0
  renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_ADMIN_LOG_VARIANT="$admin_log_variant" \
    scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
  (( renderer_rc != 0 )) || fail "admin $admin_log_variant metadata output was accepted"
  [[ "$renderer_output" == *'unexpected renderer output contract: admin'* ]] || \
    fail "admin $admin_log_variant metadata did not fail at its output contract"
  pass "admin metadata rejects $admin_log_variant output"
done
: >"$WORK/renderer.log"
renderer_rc=0
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_ACCESS_FAIL=1 \
  scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
(( renderer_rc != 0 )) || fail 'nonzero access renderer was accepted'
[[ "$renderer_output" == *'renderer failed: observability-access RC=41'* ]] || \
  fail 'nonzero access renderer did not fail closed at the access boundary'
pass 'private renderer orchestration fails closed on access renderer failure'
: >"$WORK/renderer.log"
renderer_rc=0
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_ACCESS_DUPLICATE_CORE=1 \
  scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
(( renderer_rc != 0 )) || fail 'duplicate access CORE PASS marker was accepted'
pass 'access output requires exactly one ordered CORE PASS marker'
: >"$WORK/renderer.log"
renderer_rc=0
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_ACCESS_MISSING_VERIFIED=1 \
  scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
(( renderer_rc != 0 )) || fail 'access output with only seven Verified lines was accepted'
pass 'access output requires the exact eight ordered Verified lines'
: >"$WORK/renderer.log"
renderer_rc=0
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_ACCESS_SWAP_RENDERED=1 \
  scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
(( renderer_rc != 0 )) || fail 'access output with reordered Rendered lines was accepted'
pass 'access output requires the exact sixteen ordered Rendered lines'
: >"$WORK/renderer.log"
renderer_rc=0
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_ACCESS_PATH=1 \
  scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
(( renderer_rc != 0 )) || fail 'access path-bearing progress output was accepted'
[[ "$renderer_output" != *'should-never-be-printed'* ]] || \
  fail 'access path-bearing output leaked its path'
pass 'access output rejects path-bearing progress diagnostics'
: >"$WORK/renderer.log"
renderer_rc=0
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_ACCESS_SECRET=1 \
  scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
(( renderer_rc != 0 )) || fail 'unexpected access renderer Secret output was accepted'
[[ "$renderer_output" != *'should-never-be-printed'* ]] || \
  fail 'unexpected access output leaked content'
pass 'access renderer cannot smuggle an independently unscanned Secret'
for injected_renderer in \
  render-phase1.sh render-phase2.sh render-admin-services.sh \
  render-observability-core.sh; do
  : >"$WORK/renderer.log"
  renderer_rc=0
  renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_LOG_INJECTION_LABEL="$injected_renderer" \
    scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
  (( renderer_rc != 0 )) || fail "$injected_renderer unexpected stdout was accepted"
  [[ "$renderer_output" != *'should-never-be-printed'* ]] || \
    fail "$injected_renderer unexpected stdout leaked content"
  pass "$injected_renderer stdout is restricted to its bounded grammar"
done
unset PLATFORM_SENSITIVE_SOURCE_RENDER_LOG

new_fixture
mkdir -p "$WORK/fake-bin"
printf '#!/usr/bin/env bash\nexit 2\n' >"$WORK/fake-bin/find"
chmod 0755 "$WORK/fake-bin/find"
PLATFORM_SENSITIVE_SOURCE_TEST_PATH="$WORK/fake-bin:/usr/local/bin:/usr/bin:/bin"
find_error_rc=0
output="$(run_scanner 2>&1)" || find_error_rc=$?
(( find_error_rc != 0 )) || fail 'find error was accepted'
[[ "$output" == *'SCANNER_ERROR'* ]] || {
  printf '%s\n' "$output" >&2
  fail 'find error did not fail closed'
}
pass 'find errors fail closed'

new_fixture
mkdir -p "$WORK/fake-bin"
printf '#!/usr/bin/env bash\nexit 2\n' >"$WORK/fake-bin/rg"
chmod 0755 "$WORK/fake-bin/rg"
printf 'ordinary input\n' >"$WORK/docs/plans/scanner-error.md"
PLATFORM_SENSITIVE_SOURCE_TEST_PATH="$WORK/fake-bin:/usr/local/bin:/usr/bin:/bin"
scanner_error_rc=0
output="$(run_scanner 2>&1)" || scanner_error_rc=$?
(( scanner_error_rc != 0 )) || fail 'scanner error was accepted'
[[ "$output" == *'SCANNER_ERROR'* ]] || {
  printf '%s\n' "$output" >&2
  fail 'scanner error did not fail closed'
}
pass 'rg errors fail closed'

cleanup_before="$(
  find /tmp -maxdepth 1 -type d -name 'platform-sensitive-source-test.??????' \
    -printf '%f\n' | LC_ALL=C sort
)"
PLATFORM_SENSITIVE_SOURCE_CLEANUP_PROBE=1 bash "$BASH_SOURCE"
cleanup_after="$(
  find /tmp -maxdepth 1 -type d -name 'platform-sensitive-source-test.??????' \
    -printf '%f\n' | LC_ALL=C sort
)"
[[ "$cleanup_after" == "$cleanup_before" ]] || \
  fail 'focused cleanup probe left a platform-sensitive-source-test directory'
pass 'focused test cleanup leaves no temporary fixture residue'

printf 'PLATFORM SENSITIVE SOURCE ASSERTION TEST PASS (%d assertions)\n' "$ASSERTIONS"