#!/usr/bin/env bash
# 🤖 Public fleet hardening posture — the box-side collector (docs/status.md §
# The fleet hardening dashboard). Every 5 minutes (lchat-hardening.timer) this
# publishes, per box in the mesh, whether SSH is locked down: the LOCAL box
# reads its own OS state authoritatively (ufw / sshd / systemd / wireguard),
# and each PEER box is probed from the outside — a connect-and-banner-grab :22
# check, never a login. It writes hardening.json and uploads it + hardening.html
# to the public status bucket the site serves at hardening.html. Installed on
# the box at exactly /opt/lchat/hardening-posture.sh (the unit's ExecStart
# points there).
#
# ============================ WHAT THIS PUBLISHES ============================
# Everything here is PUBLIC, forever (the bucket is versioned). Two design
# points make that safe, and one is the whole reason the page exists:
#   - NO HOSTNAMES. A box is named by its whimsical, hash-derived label
#     ("hypatia-whistling", the SAME label fleet.json shows) and a coarse region
#     ("EU · Finland"). A peer's real hostname is read only to point the :22
#     probe at it and dies in this process — it never reaches the JSON, matching
#     the status site's no-hostnames rule (deploy/status-publish.sh's header).
#   - UNKNOWN IS LOUD, NEVER A GUESSED PASS. Any signal the collector can't read
#     is emitted as "unknown" (a null ssh_internet_facing, or an "unknown"
#     sub-state) and the page renders it as a warn state — never silently as
#     hardened. An unreadable firewall must look unresolved, not safe.
#   - THE POINT: an unhardened box surfaces publicly. If a mesh box is serving
#     SSH to the internet, its :22 probe reads back an "SSH-…" banner and it
#     sorts to the TOP of the page. Transparency, not a security control.
#
# ---------------------- The peer :22 probe is VANTAGE-DEPENDENT --------------
# An external probe sees the fleet from THIS box's viewpoint only: a peer's
# firewall might allow this box but deny everyone else, or vice-versa. So the
# probe is classified conservatively — only a returned SSH banner is a CONFIDENT
# "exposed":
#   - reads back "SSH-…"           -> exposed (true)   [confident BAD]
#   - clean refusal / connect times out -> not reachable (false)   [good]
#   - connects but no SSH banner, or anything that isn't a clean refusal
#                                  -> inconclusive (null) [UNKNOWN — loud warn,
#                                     neither a pass nor a confirmed fail]
# The AUTHORITATIVE signal is a box self-reading its own ufw once it runs this
# collector; the probe is a best-effort outside check that makes a blatantly
# open box impossible to miss. The page says as much in its caveat.
# ============================================================================
#
# This script is DELIBERATELY STANDALONE from deploy/status-publish.sh (the
# box's copy of that script has diverged from main and must not be forced to
# reconcile for this feature): it keeps its own state, writes its own outputs,
# and uploads them itself with the same status-publisher creds. It reads the
# mesh membership from the hibernation bucket exactly as status-publish.sh's
# mesh_peer_boxes does, so the two never need to share code.
#
# Usage:
#   hardening-posture.sh               # what the timer runs
#
# Test mode (no ufw/sshd/systemd/ip, no S3, no :22 probe, no upload): point
# every input at a fixture and pin "now". The command seams eval a shell command
# (so a fixture is just `cat file` printing pre-captured tool output):
#   HARDENING_UFW_CMD='cat ufw.txt'          # replaces `ufw status`
#   HARDENING_SSHD_CMD='cat sshd-T.txt'      # replaces `sshd -T`
#   HARDENING_SYSTEMCTL_CMD='cat au.txt'     # replaces `systemctl is-active unattended-upgrades`
#   HARDENING_IP_CMD='cat wg0.txt'           # replaces `ip link show wg0`
#   HARDENING_ROUTER_ENV=router.env          # LCHAT_MESH_SELF / LCHAT_BOX_REGION seams
#   HARDENING_MEMBERS_FILE=members.tsv       # replaces the S3 listing + stats + :22 probe
#   HARDENING_NOW=<epoch> HARDENING_NO_UPLOAD=1 \
#   HARDENING_STATE_DIR=/tmp/state HARDENING_PAGES_DIR=/tmp/pages ./hardening-posture.sh
#
# HARDENING_MEMBERS_FILE is a TSV, one mesh member per line, four columns:
#   <peerURL> <TAB> <label> <TAB> <region> <TAB> <probe>
# where <probe> is the peer's :22 verdict — serving-ssh | not-reachable |
# inconclusive (aliases reachable | filtered-or-closed | unknown are accepted).
# It is consulted only for PEERS; the row whose <peerURL> equals LCHAT_MESH_SELF
# is the local box and uses the LOCAL OS reads instead. Setting
# HARDENING_MEMBERS_FILE also forces no-upload, so a fixture run is always inert.
#
# Prerequisites on the box: jq (apt install jq) + the aws CLI and
# /data/status.env creds already there for the status publisher. The creds must
# also be able to READ the hibernation bucket (LCHAT_HIBERNATE_BUCKET) — the
# same read status-publish.sh's fleet page already relies on.
set -euo pipefail

STATE_DIR=${HARDENING_STATE_DIR:-/data/hardening}
PAGES_DIR=${HARDENING_PAGES_DIR:-/opt/lchat/status-pages}
# The PUBLIC status bucket — upload target for hardening.json + hardening.html,
# the same bucket (and creds) status-publish.sh and ssh-ledger-collect.sh use.
BUCKET=${STATUS_BUCKET:-eleven-status-427880590669}
REGION=${STATUS_REGION:-eu-west-1}
STATUS_ENV=${STATUS_ENV_FILE:-/data/status.env}
# The router's own env — read (same file the router loads) only for the mesh's
# bucket/prefix/region and this box's own identity/region. Absent
# LCHAT_HIBERNATE_BUCKET just means the mesh isn't configured here: the page
# then shows this one box, byte-consistent with a single-box fleet.
ROUTER_ENV=${HARDENING_ROUTER_ENV:-/data/router.env}
# Staleness cutoff for a membership object — three missed beats, mirroring
# mesh.go's meshStaleAfter (3 × meshHeartbeatInterval, 60s). A box whose
# heartbeat has aged past this is presumed dead and dropped, so the page never
# lists a long-gone box (its S3 membership key lingers until lifecycle prunes
# it, but its LastModified stops advancing).
STALE_SECONDS=${HARDENING_MESH_STALE_SECONDS:-180}
# Probe budget: PROBE_TIMEOUT bounds the whole connect+banner-read; BANNER_READ
# is how long we wait for the SSH banner once connected (kept comfortably under
# PROBE_TIMEOUT so a fast connect always leaves room to read).
PROBE_TIMEOUT=${HARDENING_PROBE_TIMEOUT:-6}
BANNER_READ=${HARDENING_BANNER_READ:-5}

OUT="$PAGES_DIR/hardening.json"

command -v jq >/dev/null 2>&1 || { echo "jq missing (apt install jq)" >&2; exit 1; }
mkdir -p "$STATE_DIR" "$PAGES_DIR"

TMP=$(mktemp -d)
trap 'rm -rf "$TMP"' EXIT

NOW=${HARDENING_NOW:-$(date -u +%s)}

# iso <epoch> — GNU date on the box; the -r fallback keeps test mode runnable on
# a BSD/macOS dev machine.
iso() { date -u -d "@$1" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -r "$1" +%Y-%m-%dT%H:%M:%SZ; }
NOW_ISO=$(iso "$NOW")

# atomic_write <src> <dest> — temp beside the target + mv, so a reader (or a
# mid-write upload) never sees a half-written JSON. Same-directory temp keeps
# the rename atomic (never across filesystems).
atomic_write() { cp "$1" "$2.tmp.$$" && mv "$2.tmp.$$" "$2"; }

# env_str <file> <VAR> — one string value from a dotenv file (bucket names,
# prefixes, the mesh self URL). Empty when the file or var is absent. Mirrors
# status-publish.sh's env_str exactly so the two read router.env identically.
env_str() { grep -E "^$2=" "$1" 2>/dev/null | head -n1 | cut -d= -f2- || true; }

# b64url_decode reverses encodeHeartbeatKey (internal/activator/heartbeat.go):
# url-safe alphabet, padding stripped — re-add it (len mod 4 tells how much)
# before the standard decoder. Same helper, same reason, as status-publish.sh.
b64url_decode() {
  local s
  s=$(printf '%s' "$1" | tr -- '-_' '+/')
  case $(( ${#s} % 4 )) in
    2) s="${s}==" ;;
    3) s="${s}=" ;;
  esac
  printf '%s' "$s" | base64 -d 2>/dev/null
}

# The local-OS reads are behind command seams (HARDENING_*_CMD): eval a shell
# command so a test can point each at a `cat fixture` printing pre-captured tool
# output. Real mode runs the actual tool. These vars are operator/test set — the
# same trust boundary as this root script itself.
run_ufw()    { if [ -n "${HARDENING_UFW_CMD:-}" ]; then eval "$HARDENING_UFW_CMD"; else ufw status 2>/dev/null; fi; }
run_sshd()   { if [ -n "${HARDENING_SSHD_CMD:-}" ]; then eval "$HARDENING_SSHD_CMD"; else sshd -T 2>/dev/null; fi; }
run_autoupd(){ if [ -n "${HARDENING_SYSTEMCTL_CMD:-}" ]; then eval "$HARDENING_SYSTEMCTL_CMD"; else systemctl is-active unattended-upgrades 2>/dev/null; fi; }
run_ip_wg()  { if [ -n "${HARDENING_IP_CMD:-}" ]; then eval "$HARDENING_IP_CMD"; else ip link show wg0 2>/dev/null; fi; }

# host_of <peerURL> — the bare host a :22 probe dials, scheme + port + any path
# stripped. IPv6 literals ([::1]:80) are handled so a colon in the address is
# never mistaken for the port separator.
host_of() {
  local u=${1#*://}   # drop scheme://
  u=${u%%/*}          # drop /path
  case "$u" in
    \[*\]*) u=${u%%\]*}; printf '%s' "${u#\[}" ;;  # [ipv6]:port -> ipv6
    *:*)    printf '%s' "${u%:*}" ;;               # host:port -> host
    *)      printf '%s' "$u" ;;
  esac
}

# box_label — this box's stable, whimsical, anonymous name ("hypatia-whistling"),
# an exact port of deploy/status-publish.sh's box_label (and meshstats.go's Go
# twin): sha256 of /etc/machine-id, first 16 hex chars split into two 8-char
# slices indexing the names/actions lists. The lists MUST stay identical to
# those two — same hash, same label, whichever side computes it — so a peer's
# self-published label and this box's local one agree. Falls back to `hostname`
# when the machine-id file is unreadable, matching bash's twin byte-for-byte.
box_label() {
  local names=(ada alan grace marie nikola leonardo cleopatra homer sappho
    darwin einstein curie turing hopper tesla gandalf frodo sherlock watson
    ahab ishmael gatsby scout atticus hermione matilda mowgli merlin arthur
    morgana beowulf odysseus penelope achilles athena apollo freya thor loki
    amelia boudicca cyrano quixote sancho ophelia viola rosalind puck oberon
    titania darcy pip scrooge nemo phileas zorro heidi galileo kepler newton
    archimedes hypatia confucius rumi frida vincent wolfgang ludwig clara)
  local actions=(stargazing juggling whistling painting sailing gardening
    baking skating humming doodling fishing knitting strolling yodeling
    beekeeping fencing waltzing sketching brewing climbing cartwheeling
    birdwatching pondering inventing exploring composing conducting
    spelunking kayaking orienteering puppeteering tinkering)
  local idfile=${HARDENING_MACHINE_ID_FILE:-/etc/machine-id}
  local seed
  seed=$( { cat "$idfile" 2>/dev/null || hostname; } | sha256sum | cut -c1-16)
  local n=$(( 16#${seed:0:8} % ${#names[@]} ))
  local a=$(( 16#${seed:8:8} % ${#actions[@]} ))
  printf '%s-%s' "${names[$n]}" "${actions[$a]}"
}

# ---- 1. the LOCAL box's posture, from OS state (root reads) -------------------
# The local box answers about itself authoritatively — never self-probe :22 (it
# would hairpin through the host's own NAT and read nothing meaningful).

ufw_out=$(run_ufw || true)
first_line=$(printf '%s\n' "$ufw_out" | head -n1)
case "$first_line" in *"Status: active"*) firewall_active=true ;; *) firewall_active=false ;; esac

# firewall_ssh_scope: hardened ("wireguard-only") iff there is NO bare
# "22/tcp ... ALLOW ... Anywhere" rule (public port 22) AND there IS a "22/tcp
# ... on wg0 ... ALLOW" rule (SSH reachable only over the admin tunnel).
# "internet-facing" the moment a bare 22 allow exists. Anything else — ufw
# inactive/unreadable, or active but with no recognizable 22 rule at all — is
# "unknown": we can't PROVE wireguard-only, and the contract says unproven reads
# loud, never as a silent pass. Matches both `ufw status` (ALLOW) and
# `ufw status verbose` (ALLOW IN) by keying on the "ALLOW" substring.
bare22=$(printf '%s\n' "$ufw_out" | awk '
  /^22(\/tcp)?[ \t]/ && /ALLOW/ && /Anywhere/ && !/wg0/ { f=1 } END { print f+0 }')
wg22=$(printf '%s\n' "$ufw_out" | awk '
  /^22(\/tcp)?[ \t]+on[ \t]+wg0/ && /ALLOW/ { f=1 } END { print f+0 }')
if [ "$firewall_active" != true ] || [ -z "$ufw_out" ]; then
  firewall_ssh_scope=unknown
elif [ "$bare22" = 1 ]; then
  firewall_ssh_scope=internet-facing
elif [ "$wg22" = 1 ]; then
  firewall_ssh_scope=wireguard-only
else
  firewall_ssh_scope=unknown
fi

# root_login / password_auth from sshd's EFFECTIVE config (`sshd -T`) — the
# resolved values, not whatever a config file happens to say. Missing line
# (sshd -T failed, e.g. not root) -> unknown, never assumed safe.
sshd_out=$(run_sshd || true)
root_login=$(printf '%s\n' "$sshd_out" | awk '$1=="permitrootlogin"{print $2; exit}')
[ -n "$root_login" ] || root_login=unknown
password_auth=$(printf '%s\n' "$sshd_out" | awk '$1=="passwordauthentication"{print $2; exit}')
[ -n "$password_auth" ] || password_auth=unknown

# auto_updates: unattended-upgrades active/inactive; anything else (failed,
# absent, systemctl missing) -> unknown.
au_out=$(printf '%s' "$(run_autoupd || true)" | tr -d '[:space:]')
case "$au_out" in
  active)   auto_updates=active ;;
  inactive) auto_updates=inactive ;;
  *)        auto_updates=unknown ;;
esac

# wireguard: wg0 present and up. `ip link show wg0` is empty/non-zero when the
# device is absent; a wireguard interface reports its admin state via the UP
# flag (often "state UNKNOWN" for L3 virtual links), so match the UP flag or a
# literal "state UP".
wg_out=$(run_ip_wg || true)
if [ -z "$wg_out" ]; then
  wireguard=absent
elif printf '%s' "$wg_out" | grep -qE 'state UP|[<,]UP[,>]'; then
  wireguard=up
else
  wireguard=down
fi

# Fold the local firewall scope into the shared verdict fields every box row
# carries: ssh_internet_facing is a TRISTATE — true (exposed), false (hardened),
# or JSON null (unknown -> the page's loud "not reported").
case "$firewall_ssh_scope" in
  wireguard-only)  self_facing=false; self_detail="wireguard-only" ;;
  internet-facing) self_facing=true;  self_detail="port 22 open to the internet" ;;
  *)               self_facing=null;  self_detail="firewall status not readable" ;;
esac

SELF=$(env_str "$ROUTER_ENV" LCHAT_MESH_SELF)
SELF=$(printf '%s' "$SELF" | tr -d '[:space:]'); SELF=${SELF%/}   # trim like meshFromEnv
SELF_LABEL=$(box_label)
SELF_REGION=$(env_str "$ROUTER_ENV" LCHAT_BOX_REGION)

# ---- 2. enumerate the mesh + probe peers -------------------------------------
# enumerate_members prints one TSV row per live mesh member:
#   <peerURL> <TAB> <label> <TAB> <region> <TAB> <probe-hint>
# The probe-hint is empty in real mode (the loop runs the real :22 probe); a
# fixture supplies it directly. A member's label/region come from its
# self-published stats object (the same one fleet.json reads).
enumerate_members() {
  if [ -n "${HARDENING_MEMBERS_FILE:-}" ]; then
    cat "$HARDENING_MEMBERS_FILE"
    return
  fi
  local bucket prefix region mesh_prefix
  bucket=$(env_str "$ROUTER_ENV" LCHAT_HIBERNATE_BUCKET)
  prefix=$(env_str "$ROUTER_ENV" LCHAT_HIBERNATE_PREFIX)
  [ -n "$bucket" ] && [ -n "$prefix" ] || return   # mesh off -> no peers, just self
  region=$(env_str "$ROUTER_ENV" LCHAT_HIBERNATE_REGION); region=${region:-eu-west-1}
  # Layout per hc.meshPrefix() (activator.go): membership at
  # "<prefix>/mesh/members/<peer>", stats at "<prefix>/mesh/members-stats/<peer>".
  mesh_prefix="${prefix}/mesh/members"

  # `aws s3 ls` (high-level), never `aws s3api list-objects*` — the latter
  # crashes on this fleet's aws-cli/Python combination (a botocore/argparse
  # regression), same reason status-publish.sh gives. `s3 ls` prints
  # "YYYY-MM-DD HH:MM:SS SIZE KEY"; the key is the b64url leaf.
  #
  # Members are enumerated from the "-stats/" SIBLING prefix, not members/
  # itself: the status-publisher credential is deliberately scoped to
  # "*-stats/*" in the hibernation bucket (infra/prod/status.tf) so it can
  # never touch instance replicas, and a members/ listing comes back
  # AccessDenied — silently empty here, which published a peer-less page on
  # the collector's first real run (2026-07-19). Both prefixes carry the same
  # b64url(peerURL) leaf at the same heartbeat cadence, so the stats listing
  # is the same membership signal — read exactly as status-publish.sh's
  # mesh_peer_boxes reads it.
  local listing cutoff line date_part time_part key peer statsfile label reg
  listing=$(aws s3 ls "s3://$bucket/${mesh_prefix}-stats/" --region "$region" 2>/dev/null) || true
  [ -n "$listing" ] || return
  cutoff=$(date -u -d "-${STALE_SECONDS} seconds" '+%Y-%m-%d %H:%M:%S')

  while IFS= read -r line; do
    [ -n "$line" ] || continue
    date_part=$(printf '%s' "$line" | awk '{print $1}')
    time_part=$(printf '%s' "$line" | awk '{print $2}')
    key=$(printf '%s' "$line" | awk '{print $4}')
    [ -n "$key" ] || continue
    [ "$date_part $time_part" '>' "$cutoff" ] || continue   # stale -> dead box, skip
    peer=$(b64url_decode "$key"); [ -n "$peer" ] || continue
    # Join the sibling stats object for label + region (same values fleet.json
    # shows). Absent/garbage stats -> empty; the loop labels it "unidentified".
    statsfile="$TMP/stats-$(printf '%s' "$key" | tr '/+=' '___').json"
    label=""; reg=""
    if aws s3 cp "s3://$bucket/${mesh_prefix}-stats/$key" "$statsfile" --region "$region" >/dev/null 2>&1; then
      label=$(jq -r '.label // empty' "$statsfile" 2>/dev/null || true)
      reg=$(jq -r '.region // empty' "$statsfile" 2>/dev/null || true)
    fi
    printf '%s\t%s\t%s\t\n' "$peer" "$label" "$reg"
  done <<< "$listing"
}

# probe_ssh22 <host> — connect-and-banner-grab of :22 from THIS box (an outside
# viewpoint for a peer). Echoes "<verdict>\t<banner>". See the VANTAGE-DEPENDENT
# note above: only a returned "SSH-…" banner is a confident "exposed"; a clean
# refusal or a connect timeout is "not reachable" (good); a completed connection
# with no SSH banner — or anything else that isn't a clean refusal — is
# "inconclusive" (loud unknown, never a pass). No bytes are sent; no login is
# attempted. Prefer bash /dev/tcp for the connect + banner read.
probe_ssh22() {
  local host=$1 out banner
  [ -n "$host" ] || { printf 'inconclusive\t'; return; }
  # Resolve first so an NXDOMAIN reads as "inconclusive" (couldn't probe),
  # distinct from a resolvable host that cleanly refuses :22.
  getent hosts "$host" >/dev/null 2>&1 || { printf 'inconclusive\t'; return; }
  out=$(timeout "$PROBE_TIMEOUT" bash -c '
    h=$1
    exec 3<>/dev/tcp/"$h"/22 2>/dev/null || { printf "REFUSED"; exit 0; }
    b=""
    IFS= read -r -n 60 -t "'"$BANNER_READ"'" b <&3 2>/dev/null || true
    exec 3>&- 2>/dev/null || true
    if [ -n "$b" ]; then printf "BANNER\t%s" "$b"; else printf "NOBANNER"; fi
  ' _ "$host" 2>/dev/null) || out=""
  case "$out" in
    BANNER*)
      banner=${out#BANNER}; banner=${banner#$'\t'}
      banner=$(printf '%s' "$banner" | tr -cd '[:print:]' | cut -c1-48)
      case "$banner" in
        SSH-*) printf 'serving-ssh\t%s' "$banner" ;;
        *)     printf 'inconclusive\t' ;;   # answered, but not an SSH banner
      esac ;;
    NOBANNER) printf 'inconclusive\t' ;;     # connected, silent — vantage-dependent
    REFUSED)  printf 'not-reachable\t' ;;     # clean refusal — good
    *)        printf 'not-reachable\t' ;;     # empty = connect timed out — good
  esac
}

# classify_probe <verdict> [banner] -> sets FACING (true/false/null) + DETAIL.
# Inconclusive maps to null so the page renders it loud, per the contract.
classify_probe() {
  case "$1" in
    serving-ssh|reachable)
      FACING=true
      if [ -n "${2:-}" ]; then DETAIL="port 22 serving SSH ($2)"; else DETAIL="port 22 serving SSH"; fi ;;
    not-reachable|filtered-or-closed)
      FACING=false; DETAIL="port 22 not reachable" ;;
    *)
      FACING=null;  DETAIL="port 22 filtered/inconclusive" ;;
  esac
}

# peer_posture <label> — a peer's own self-published posture row, if fresh.
# Every box running this collector uploads its self row to
# "posture/<label>.json" in the status bucket (see the upload section), so any
# box can read back every other box's AUTHORITATIVE local read instead of
# stopping at the outside :22 hint. This is also what lets N collector boxes
# share the one hardening.json without flip-flopping viewpoints: whichever box
# uploads last, it built the same merged rows from the same self-reports.
# Freshness gates on the row's own `generated` stamp — a box that stopped
# collecting (or died) falls back to the probe view within POSTURE_STALE_SECONDS.
# Test seam: HARDENING_POSTURE_DIR serves "<label>.json" files instead of S3.
POSTURE_STALE_SECONDS=${HARDENING_POSTURE_STALE_SECONDS:-900}
peer_posture() {
  local label=$1 f gen now age
  [ -n "$label" ] || return 0
  f="$TMP/posture-$label.json"
  if [ -n "${HARDENING_POSTURE_DIR:-}" ]; then
    cat "$HARDENING_POSTURE_DIR/$label.json" 2>/dev/null || true
    return 0
  fi
  aws s3 cp "s3://$BUCKET/posture/$label.json" "$f" --region "$REGION" >/dev/null 2>&1 || return 0
  gen=$(jq -r '.generated // empty' "$f" 2>/dev/null) || true
  [ -n "$gen" ] || return 0
  now=$(date -u +%s)
  age=$(( now - $(date -u -d "$gen" +%s 2>/dev/null || echo 0) ))
  [ "$age" -ge 0 ] && [ "$age" -le "$POSTURE_STALE_SECONDS" ] || return 0
  cat "$f"
}

# ---- 3. build the boxes array ------------------------------------------------
echo '[]' > "$TMP/boxes.json"
add_box() { # $1 = a JSON object string
  jq --argjson b "$1" '. + [$b]' "$TMP/boxes.json" > "$TMP/boxes.next" \
    && mv "$TMP/boxes.next" "$TMP/boxes.json"
}

self_added=0
add_self() {
  local obj
  obj=$(jq -n \
    --arg label "$SELF_LABEL" --arg region "$SELF_REGION" \
    --argjson facing "$self_facing" --arg detail "$self_detail" \
    --arg root "$root_login" --arg pass "$password_auth" \
    --arg auto "$auto_updates" --arg wg "$wireguard" \
    --argjson fwactive "$firewall_active" \
    '{label:$label, is_self:true, ssh_internet_facing:$facing, detail:$detail,
      root_login:$root, password_auth:$pass, auto_updates:$auto, wireguard:$wg,
      firewall_active:$fwactive, source:"local"}
     + (if $region == "" then {} else {region:$region} end)')
  add_box "$obj"
  # The same row, stamped, becomes this box's self-report for PEERS to merge
  # (posture/<label>.json — see peer_posture). Uploaded in section 4.
  printf '%s' "$obj" | jq --arg now "$NOW_ISO" '. + {generated:$now}' > "$TMP/self-posture.json"
  self_added=1
}

# Split each TSV row by tab MANUALLY (not `read -r a b c d`): tab is IFS
# whitespace, so read collapses consecutive tabs and an empty column (a peer
# with no region) would silently shift the later fields left. Parameter
# expansion on a fixed 4-field (3-tab) row preserves every empty.
while IFS= read -r row; do
  [ -n "$row" ] || continue
  peer=${row%%$'\t'*};  rest=${row#*$'\t'}
  label=${rest%%$'\t'*}; rest=${rest#*$'\t'}
  region=${rest%%$'\t'*}; hint=${rest#*$'\t'}
  if [ -n "$SELF" ] && [ "$peer" = "$SELF" ]; then
    add_self
    continue
  fi
  # A peer: probe its :22 (a fixture hint wins in test mode).
  if [ -n "$hint" ]; then
    verdict=$hint; banner=""
  else
    probe_out=$(probe_ssh22 "$(host_of "$peer")")
    verdict=${probe_out%%$'\t'*}; banner=${probe_out#*$'\t'}
  fi
  classify_probe "$verdict" "$banner"
  # Prefer the peer's own fresh self-report over the probe-only row — but the
  # probe still has veto power the loud way: an SSH banner WE saw from outside
  # overrides whatever the peer claims about itself (a compromised or
  # misconfigured box must not be able to self-report its exposure away).
  # Every other field (root login, wireguard, firewall…) only the box itself
  # can know, so the self-report carries them verbatim.
  posture=$(peer_posture "$label")
  if [ -n "$posture" ]; then
    obj=$(printf '%s' "$posture" | jq \
      --argjson pfacing "$FACING" --arg pdetail "$DETAIL" \
      'del(.generated)
       + {is_self:false, source:"self-reported"}
       + (if $pfacing == true then {ssh_internet_facing:true, detail:$pdetail} else {} end)')
    add_box "$obj"
    continue
  fi
  [ -n "$label" ] || label="unidentified box"
  obj=$(jq -n \
    --arg label "$label" --arg region "$region" \
    --argjson facing "$FACING" --arg detail "$DETAIL" \
    '{label:$label, is_self:false, ssh_internet_facing:$facing, detail:$detail,
      root_login:"unknown", auto_updates:"unknown", wireguard:"unknown",
      source:"probe"}
     + (if $region == "" then {} else {region:$region} end)')
  add_box "$obj"
done < <(enumerate_members)

# Self may not have appeared in the membership listing (mesh off, or this box's
# own heartbeat hasn't landed yet) — always publish the local box's own row.
[ "$self_added" = 1 ] || add_self

# Sort problems to the TOP: internet-facing (true) first, then inconclusive
# (null), then hardened (false); ties broken by label for a stable order. The
# loud rows a viewer needs to see never hide below the calm ones.
jq --arg now "$NOW_ISO" \
  '{generated: $now,
    boxes: sort_by(
      (if .ssh_internet_facing == true then 0
       elif .ssh_internet_facing == null then 1
       else 2 end),
      (.label // ""))}' \
  "$TMP/boxes.json" > "$TMP/hardening.json"
atomic_write "$TMP/hardening.json" "$OUT"

# ---- 4. upload ---------------------------------------------------------------
# Standalone by design (see header): uploads its own outputs with the same
# scoped status-publisher creds status-publish.sh uses. A fixture run (members
# fixture) or an explicit HARDENING_NO_UPLOAD=1 never uploads. Re-uploading the
# page every run self-heals a missed copy, same as the other publishers.
upload=1
[ "${HARDENING_NO_UPLOAD:-}" = "1" ] && upload=0
[ -n "${HARDENING_MEMBERS_FILE:-}" ] && upload=0
if [ "$upload" = 1 ]; then
  command -v aws >/dev/null 2>&1 || { echo "aws CLI missing — collected, not uploaded" >&2; exit 1; }
  if [ -z "${AWS_ACCESS_KEY_ID:-}" ] && [ -f "$STATUS_ENV" ]; then
    set -a; . "$STATUS_ENV"; set +a
  fi
  up() { aws s3 cp "$1" "s3://$BUCKET/$2" --region "$REGION" \
           --content-type "$3" --cache-control "$4" --no-progress >/dev/null; }
  up "$OUT" hardening.json "application/json" "max-age=60"
  # The self-report peers merge (peer_posture) — short cache: it's read
  # box-to-box via s3 cp, so the cache header only matters if a human fetches it.
  [ -f "$TMP/self-posture.json" ] && up "$TMP/self-posture.json" "posture/$SELF_LABEL.json" "application/json" "max-age=60"
  [ -f "$PAGES_DIR/hardening.html" ] && up "$PAGES_DIR/hardening.html" hardening.html "text/html; charset=utf-8" "max-age=300"
  echo "hardening posture published to s3://$BUCKET ($NOW_ISO)"
fi