#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
cd "$ROOT_DIR"

LIVE_PI="${RHO_LOCAL_GIT_PI_LIVE:-0}"
if [[ "$LIVE_PI" == "1" ]]; then
  SANDBOX="$ROOT_DIR/sandbox/live-git-pi-sandbox-encrypted"
else
  SANDBOX="$ROOT_DIR/sandbox/local-git-pi-sandbox-encrypted"
fi
REMOTE="$SANDBOX/remote.git"
USER1="$SANDBOX/user1"
USER2="$SANDBOX/user2"
USER1_HOME="$SANDBOX/user1-rho-home"
USER2_HOME="$SANDBOX/user2-rho-home"
USER1_ID="rho://id/github/rho-user1"
USER2_ID="rho://id/github/rho-user2"
USER1_STORAGE="rho-user1"
if [[ "$LIVE_PI" == "1" ]]; then
  UUID="66666666-7777-8888-9999-aaaaaaaaaaaa"
else
  UUID="55555555-6666-7777-8888-999999999999"
fi
REQUEST_ID="req-$UUID"
if [[ "$LIVE_PI" == "1" ]]; then
  RUN_ACTION_ID="act-live-git-pi-run-real-$UUID"
  RELEASE_ACTION_ID="act-live-git-pi-release-$UUID"
  RUN_ID="run-live-git-pi-run-real-$UUID"
  BAD_TOOL_ACTION_ID="act-live-git-pi-bad-tool-$UUID"
  BAD_SCRIPT_ACTION_ID="act-live-git-pi-bad-script-$UUID"
  BAD_OUTPUT_ACTION_ID="act-live-git-pi-bad-output-$UUID"
else
  RUN_ACTION_ID="act-local-pi-run-real-$UUID"
  RELEASE_ACTION_ID="act-local-pi-release-$UUID"
  RUN_ID="run-local-pi-run-real-$UUID"
  BAD_TOOL_ACTION_ID="act-local-pi-bad-tool-$UUID"
  BAD_SCRIPT_ACTION_ID="act-local-pi-bad-script-$UUID"
  BAD_OUTPUT_ACTION_ID="act-local-pi-bad-output-$UUID"
fi
REQUEST_BRANCH="rho-user2/pi-request-$UUID"
RELEASE_BRANCH="rho-user1/pi-result-$UUID"
REQUEST_DIR="rho/messages/inbox/rho-user1/$REQUEST_ID"
RESULT_DIR="rho/messages/inbox/rho-user2/$REQUEST_ID"
if [[ "$LIVE_PI" == "1" ]]; then
  SANDBOX_RUNNER="${RHO_LIVE_SANDBOX_RUNNER:-gondolin}"
else
  SANDBOX_RUNNER="${RHO_LOCAL_GIT_SANDBOX_RUNNER:-fake}"
fi
PROVIDER="${RHO_PI_PROVIDER:-openai-codex}"
MODEL="${RHO_PI_MODEL:-gpt-5.4}"
PI_SANDBOX="${RHO_LOCAL_GIT_PI_SANDBOX:-1}"
PI_ALLOW_HOSTS="${RHO_PI_ALLOW_HOSTS:-chatgpt.com auth.openai.com api.openai.com}"

setup_git_user() {
  local repo="$1"
  local name="$2"
  local email="$3"
  git -C "$repo" config user.name "$name"
  git -C "$repo" config user.email "$email"
  git -C "$repo" config commit.gpgsign false
}

assert_encrypted_blob() {
  local blob="$1"
  local recipient="$2"
  local forbidden="$3"
  grep -q "kind: rho_recipient_envelope" "$blob"
  grep -q "$recipient" "$blob"
  if grep -q "$forbidden" "$blob"; then
    echo "encrypted blob leaked plaintext marker '$forbidden': $blob" >&2
    exit 1
  fi
}

copy_pi_agent_config() {
  local target="$1"
  mkdir -p "$target"
  if [[ -n "${RHO_PI_AUTH_JSON:-}" ]]; then
    cp "$RHO_PI_AUTH_JSON" "$target/auth.json"
  elif [[ -f "${RHO_PI_AGENT_CONFIG_DIR:-$HOME/.pi/agent}/auth.json" ]]; then
    cp "${RHO_PI_AGENT_CONFIG_DIR:-$HOME/.pi/agent}/auth.json" "$target/auth.json"
  fi
  for name in settings.json models.json; do
    if [[ -f "${RHO_PI_AGENT_CONFIG_DIR:-$HOME/.pi/agent}/$name" ]]; then
      cp "${RHO_PI_AGENT_CONFIG_DIR:-$HOME/.pi/agent}/$name" "$target/$name"
    fi
  done
}

rm -rf "$SANDBOX"
mkdir -p "$SANDBOX"

if [[ "$LIVE_PI" == "1" && "${RHO_PI_USE_GLOBAL_AGENT_DIR:-0}" != "1" ]]; then
  copy_pi_agent_config "$SANDBOX/pi-users/rho-user1/agent"
  copy_pi_agent_config "$SANDBOX/pi-users/rho-user2/agent"
fi

git init --bare "$REMOTE" >/dev/null

RHO_HOME="$USER1_HOME" ./rho id init \
  --github rho-user1 \
  --display-name "Rho User One" \
  --generate-ssh-key >/dev/null
RHO_HOME="$USER2_HOME" ./rho id init \
  --github rho-user2 \
  --display-name "Rho User Two" \
  --generate-ssh-key >/dev/null
RHO_HOME="$USER1_HOME" ./rho id export \
  --identity "$USER1_ID" \
  --out "$SANDBOX/rho-user1-public.yaml" >/dev/null
RHO_HOME="$USER2_HOME" ./rho id export \
  --identity "$USER2_ID" \
  --out "$SANDBOX/rho-user2-public.yaml" >/dev/null
RHO_HOME="$USER1_HOME" ./rho id import "$SANDBOX/rho-user2-public.yaml" >/dev/null
RHO_HOME="$USER2_HOME" ./rho id import "$SANDBOX/rho-user1-public.yaml" >/dev/null

git clone "$REMOTE" "$USER1" >/dev/null
setup_git_user "$USER1" "Rho User One" "user1@example.test"
git -C "$USER1" switch -c main >/dev/null

./rho repo init \
  --root "$USER1" \
  --repo-id rho://repo/local/pi-sandbox-encrypted \
  --owner "$USER1_ID" >/dev/null
RHO_HOME="$USER1_HOME" ./rho id export \
  --identity "$USER1_ID" \
  --out "$USER1/rho/participants/rho-user1.yaml" >/dev/null
RHO_HOME="$USER2_HOME" ./rho id export \
  --identity "$USER2_ID" \
  --out "$USER1/rho/participants/rho-user2.yaml" >/dev/null
cat > "$USER1/rho/membership.yaml" <<EOF
version: 1
members:
  - identity: $USER1_ID
    role: owner
  - identity: $USER2_ID
    role: collaborator
EOF

RHO_HOME="$USER1_HOME" ./rho repo protect-path \
  "rho/messages/inbox/rho-user1/**" \
  --root "$USER1" \
  --rho-bin "$ROOT_DIR/rho" \
  --recipient "$USER1_ID" >/dev/null
RHO_HOME="$USER1_HOME" ./rho repo protect-path \
  "rho/messages/inbox/rho-user2/**" \
  --root "$USER1" \
  --rho-bin "$ROOT_DIR/rho" \
  --recipient "$USER2_ID" >/dev/null

mkdir -p "$USER1/datasets/public/$UUID/mock"
cp prototype/tests/scenarios/two-console-demo/assets/datasets/prices-mock.csv \
  "$USER1/datasets/public/$UUID/mock/prices-mock.csv"
MOCK_SHA256="$(shasum -a 256 "$USER1/datasets/public/$UUID/mock/prices-mock.csv" | awk '{print $1}')"
cat > "$USER1/datasets/public/$UUID/dataset.yaml" <<EOF
version: 1
dataset:
  uuid: $UUID
  name: prices-local-pi-sandbox
  owner: $USER1_ID
  variants:
    mock:
      tier: mock
      relative_path: mock/prices-mock.csv
      file_name: prices-mock.csv
      mime_type: text/csv
      sha256: $MOCK_SHA256
    real:
      tier: real
      availability: private
      staged_under_user_folder: true
EOF

RHO_HOME="$USER1_HOME" ./rho repo sign-governance --root "$USER1" >/dev/null
git -C "$USER1" add .gitattributes .gitignore rho rho.yaml datasets
git -C "$USER1" commit -m "Initialize encrypted rho repo with public mock dataset" >/dev/null
git -C "$USER1" push -u origin main >/dev/null
git -C "$REMOTE" symbolic-ref HEAD refs/heads/main
RHO_HOME="$USER1_HOME" ./rho repo doctor --root "$USER1" >/dev/null

git clone "$REMOTE" "$USER2" >/dev/null
setup_git_user "$USER2" "Rho User Two" "user2@example.test"
RHO_HOME="$USER2_HOME" ./rho repo install-filters \
  --root "$USER2" \
  --rho-bin "$ROOT_DIR/rho" >/dev/null
git -C "$USER2" switch -c "$REQUEST_BRANCH" >/dev/null

mkdir -p "$USER2/workspace" "$USER2/$REQUEST_DIR"
if [[ "$LIVE_PI" == "1" ]]; then
  if [[ "$PI_SANDBOX" == "1" ]]; then
    PROMPT="In this repo mounted at /work, write a Python 3 standard-library script to /work/workspace/sum_prices.py. The script must read a CSV with columns date,symbol,price, sum the price column exactly, and print only the final numeric total. Also write a YAML request file to /work/$REQUEST_DIR/request.yaml with version 1 and request fields: id $REQUEST_ID, from $USER2_ID, to $USER1_ID, type pi-generated-private-analysis, dataset_uuid $UUID, code_path rho://repo/workspace/sum_prices.py, and a concise note. Do not run the script. Do not create a controlled action or tool call file."
    AGENT_RUN_ARGS=(
      agent-run
      --sandbox
      --user rho-user2
      --provider "$PROVIDER"
      --model "$MODEL"
      --mount "$USER2:/work:rw"
      --mount "$SANDBOX/pi-users:/pi-users:rw"
      --guest-cwd /work
      --policy-out "$SANDBOX/user2-agent-policy.json"
      --prompt "$PROMPT"
    )
    for host in $PI_ALLOW_HOSTS; do
      AGENT_RUN_ARGS+=(--allow-host "$host")
    done
    ./rho "${AGENT_RUN_ARGS[@]}"
  else
    PROMPT="In this repo, write a Python 3 standard-library script to $USER2/workspace/sum_prices.py. The script must read a CSV with columns date,symbol,price, sum the price column exactly, and print only the final numeric total. Also write a YAML request file to $USER2/$REQUEST_DIR/request.yaml with version 1 and request fields: id $REQUEST_ID, from $USER2_ID, to $USER1_ID, type pi-generated-private-analysis, dataset_uuid $UUID, code_path rho://repo/workspace/sum_prices.py, and a concise note. Do not run the script. Do not create a controlled action or tool call file."
    RHO_USERS_ROOT="$SANDBOX/pi-users" \
    ./rho \
      --provider "$PROVIDER" \
      --model "$MODEL" \
      "rho-user2" \
      "$PROMPT"
  fi
  test -f "$USER2/workspace/sum_prices.py"
  test -f "$USER2/$REQUEST_DIR/request.yaml"
else
  cp prototype/tests/scenarios/two-console-demo/assets/workspace/sum_prices.py \
    "$USER2/workspace/sum_prices.py"
  cat > "$USER2/$REQUEST_DIR/request.yaml" <<EOF
version: 1
request:
  id: $REQUEST_ID
  from: $USER2_ID
  to: $USER1_ID
  type: pi-generated-private-analysis
  dataset_uuid: $UUID
  code_path: rho://repo/workspace/sum_prices.py
  note: cached Pi fixture created this code and private-analysis request
EOF
fi
RHO_HOME="$USER2_HOME" ./rho crypto sign \
  "$USER2/$REQUEST_DIR/request.yaml" \
  --identity "$USER2_ID" \
  --out "$USER2/$REQUEST_DIR/request.rhosig.yaml" >/dev/null

RHO_HOME="$USER2_HOME" git -C "$USER2" add workspace "$REQUEST_DIR"
git -C "$USER2" show ":$REQUEST_DIR/request.yaml" > "$SANDBOX/request-index.yaml"
assert_encrypted_blob "$SANDBOX/request-index.yaml" "$USER1_ID" "pi-generated-private-analysis"
grep -q "def main" "$USER2/workspace/sum_prices.py"
git -C "$USER2" commit -m "Submit encrypted Pi analysis request" >/dev/null
git -C "$USER2" push -u origin "$REQUEST_BRANCH" >/dev/null

git -C "$USER1" fetch origin "$REQUEST_BRANCH:$REQUEST_BRANCH" >/dev/null
git -C "$USER1" worktree add "$SANDBOX/user1-review" "$REQUEST_BRANCH" >/dev/null
setup_git_user "$SANDBOX/user1-review" "Rho User One" "user1@example.test"
grep -q "pi-generated-private-analysis" "$SANDBOX/user1-review/$REQUEST_DIR/request.yaml"
test ! -e "$SANDBOX/user1-review/$REQUEST_DIR/action.json"
RHO_HOME="$USER1_HOME" ./rho crypto verify \
  "$SANDBOX/user1-review/$REQUEST_DIR/request.yaml" \
  --signature "$SANDBOX/user1-review/$REQUEST_DIR/request.rhosig.yaml" \
  --identity "$USER2_ID" >/dev/null
RHO_HOME="$USER1_HOME" ./rho repo doctor --root "$SANDBOX/user1-review" >/dev/null

mkdir -p "$SANDBOX/user1-exec/workspace" "$SANDBOX/user1-exec/control/outbox" "$SANDBOX/user1-exec/control/inbox" "$SANDBOX/user1-exec/control/proposals"
cp "$SANDBOX/user1-review/workspace/sum_prices.py" "$SANDBOX/user1-exec/workspace/sum_prices.py"
cargo run --quiet --bin rho -- dataset \
  --name prices-local-pi-sandbox \
  --real prototype/tests/scenarios/two-console-demo/assets/datasets/prices-real.csv \
  --mock prototype/tests/scenarios/two-console-demo/assets/datasets/prices-mock.csv \
  --owner "$USER1_ID" \
  --share-dir "$SANDBOX/user1-private/users/$USER1_STORAGE/datasets/share" \
  --private-dir "$SANDBOX/user1-private/users/$USER1_STORAGE/datasets/private" \
  --uuid "$UUID" \
  --description "Local encrypted Pi sandbox dataset" >/dev/null
cargo run --quiet --bin rho -- publish \
  "$USER1_STORAGE" "$UUID" \
  --source-root "$SANDBOX/user1-private/users" \
  --target-root "$SANDBOX/user1-exec/datasets" >/dev/null
cargo run --quiet --bin rho -- tools install-minimal \
  --shared-root "$SANDBOX/user1-exec" \
  --owner "$USER1_ID" >/dev/null
cargo run --quiet --bin rho -- request create-run \
  --shared-root "$SANDBOX/user1-exec" \
  --id "$REQUEST_ID" \
  --from "$USER2_ID" \
  --to "$USER1_ID" \
  --tool-id run_real \
  --dataset-uuid "$UUID" \
  --code-path "$SANDBOX/user1-exec/workspace/sum_prices.py" \
  --command "python3 sum_prices.py DATASET_CSV" \
  --tier real >/dev/null

PROPOSAL_PATH="$SANDBOX/user1-exec/control/proposals/$RUN_ACTION_ID.yaml"
if [[ "$LIVE_PI" == "1" ]]; then
  if [[ "$PI_SANDBOX" == "1" ]]; then
    REVIEW_PROMPT="You are the receiver rho-user1. Read /review/$REQUEST_DIR/request.yaml and /review/workspace/sum_prices.py. Decide whether this is a bounded price-summing request suitable for the host run_real tool. If suitable, write exactly one YAML proposal to /exec/control/proposals/$RUN_ACTION_ID.yaml with version: 1 and proposed_action fields: action_id $RUN_ACTION_ID, request_id $REQUEST_ID, tool_id run_real, requested_by $USER2_ID, requested_for $USER1_ID, action_type run_real_data, script_path /exec/workspace/sum_prices.py, output_path /exec/.rho/runs/$RUN_ID/stdout.txt, summary, and reason. Do not write control/outbox. Do not run the script."
    REVIEW_AGENT_RUN_ARGS=(
      agent-run
      --sandbox
      --user rho-user1
      --provider "$PROVIDER"
      --model "$MODEL"
      --mount "$SANDBOX/user1-review:/review:ro"
      --mount "$SANDBOX/user1-exec:/exec:rw"
      --mount "$SANDBOX/pi-users:/pi-users:rw"
      --guest-cwd /review
      --policy-out "$SANDBOX/user1-review-agent-policy.json"
      --prompt "$REVIEW_PROMPT"
    )
    for host in $PI_ALLOW_HOSTS; do
      REVIEW_AGENT_RUN_ARGS+=(--allow-host "$host")
    done
    ./rho "${REVIEW_AGENT_RUN_ARGS[@]}"
  else
    REVIEW_PROMPT="Read $SANDBOX/user1-review/$REQUEST_DIR/request.yaml and $SANDBOX/user1-review/workspace/sum_prices.py. Decide whether this is a bounded price-summing request suitable for the host run_real tool. If suitable, write exactly one YAML proposal to $PROPOSAL_PATH with version: 1 and proposed_action fields: action_id $RUN_ACTION_ID, request_id $REQUEST_ID, tool_id run_real, requested_by $USER2_ID, requested_for $USER1_ID, action_type run_real_data, script_path /exec/workspace/sum_prices.py, output_path /exec/.rho/runs/$RUN_ID/stdout.txt, summary, and reason. Do not write control/outbox. Do not run the script."
    RHO_USERS_ROOT="$SANDBOX/pi-users" \
    ./rho \
      --provider "$PROVIDER" \
      --model "$MODEL" \
      "rho-user1" \
      "$REVIEW_PROMPT"
  fi
else
  cat > "$PROPOSAL_PATH" <<EOF
version: 1
proposed_action:
  action_id: $RUN_ACTION_ID
  request_id: $REQUEST_ID
  tool_id: run_real
  requested_by: $USER2_ID
  requested_for: $USER1_ID
  action_type: run_real_data
  script_path: /exec/workspace/sum_prices.py
  output_path: /exec/.rho/runs/$RUN_ID/stdout.txt
  summary: Run the reviewed price summing script on real data.
  reason: Fixture receiver accepted the signed request and submitted script shape.
EOF
fi

test -f "$PROPOSAL_PATH"
grep -Fq "action_id: $RUN_ACTION_ID" "$PROPOSAL_PATH"
grep -Fq "request_id: $REQUEST_ID" "$PROPOSAL_PATH"
grep -Fq "tool_id: run_real" "$PROPOSAL_PATH"
grep -Fq "requested_by: $USER2_ID" "$PROPOSAL_PATH"
grep -Fq "requested_for: $USER1_ID" "$PROPOSAL_PATH"
grep -Fq "action_type: run_real_data" "$PROPOSAL_PATH"
grep -Fq "script_path: /exec/workspace/sum_prices.py" "$PROPOSAL_PATH"
grep -Fq "output_path: /exec/.rho/runs/$RUN_ID/stdout.txt" "$PROPOSAL_PATH"
grep -Fq "summary:" "$PROPOSAL_PATH"
grep -Fq "reason:" "$PROPOSAL_PATH"

BAD_TOOL_PROPOSAL="$SANDBOX/user1-exec/control/proposals/$BAD_TOOL_ACTION_ID.yaml"
cat > "$BAD_TOOL_PROPOSAL" <<EOF
version: 1
proposed_action:
  action_id: $BAD_TOOL_ACTION_ID
  request_id: $REQUEST_ID
  tool_id: run_mock
  requested_by: $USER2_ID
  requested_for: $USER1_ID
  action_type: run_real_data
  script_path: /exec/workspace/sum_prices.py
  output_path: /exec/.rho/runs/$RUN_ID/stdout.txt
  summary: Attempt to use a non-allowlisted tool.
  reason: Security negative test.
EOF
if cargo run --quiet --bin rho -- run proposal-action \
  --proposal "$BAD_TOOL_PROPOSAL" \
  --control-root "$SANDBOX/user1-exec/control" \
  --action-id "$BAD_TOOL_ACTION_ID" \
  --map "/exec=$SANDBOX/user1-exec" \
  --script-root "$SANDBOX/user1-exec/workspace" \
  --output-root "$SANDBOX/user1-exec/.rho/runs" \
  --allow-tool run_real \
  --allow-requested-by "$USER2_ID" \
  --allow-requested-for "$USER1_ID" \
  --allow-action-type run_real_data; then
  echo "proposal-action allowed non-allowlisted tool" >&2
  exit 1
fi
test ! -e "$SANDBOX/user1-exec/control/outbox/$BAD_TOOL_ACTION_ID.json"

BAD_SCRIPT_PROPOSAL="$SANDBOX/user1-exec/control/proposals/$BAD_SCRIPT_ACTION_ID.yaml"
cat > "$BAD_SCRIPT_PROPOSAL" <<EOF
version: 1
proposed_action:
  action_id: $BAD_SCRIPT_ACTION_ID
  request_id: $REQUEST_ID
  tool_id: run_real
  requested_by: $USER2_ID
  requested_for: $USER1_ID
  action_type: run_real_data
  script_path: /exec/private/secret.py
  output_path: /exec/.rho/runs/$RUN_ID/stdout.txt
  summary: Attempt to execute code outside the workspace allowlist.
  reason: Security negative test.
EOF
if cargo run --quiet --bin rho -- run proposal-action \
  --proposal "$BAD_SCRIPT_PROPOSAL" \
  --control-root "$SANDBOX/user1-exec/control" \
  --action-id "$BAD_SCRIPT_ACTION_ID" \
  --map "/exec=$SANDBOX/user1-exec" \
  --script-root "$SANDBOX/user1-exec/workspace" \
  --output-root "$SANDBOX/user1-exec/.rho/runs" \
  --allow-tool run_real \
  --allow-requested-by "$USER2_ID" \
  --allow-requested-for "$USER1_ID" \
  --allow-action-type run_real_data; then
  echo "proposal-action allowed script path outside workspace" >&2
  exit 1
fi
test ! -e "$SANDBOX/user1-exec/control/outbox/$BAD_SCRIPT_ACTION_ID.json"

BAD_OUTPUT_PROPOSAL="$SANDBOX/user1-exec/control/proposals/$BAD_OUTPUT_ACTION_ID.yaml"
cat > "$BAD_OUTPUT_PROPOSAL" <<EOF
version: 1
proposed_action:
  action_id: $BAD_OUTPUT_ACTION_ID
  request_id: $REQUEST_ID
  tool_id: run_real
  requested_by: $USER2_ID
  requested_for: $USER1_ID
  action_type: run_real_data
  script_path: /exec/workspace/sum_prices.py
  output_path: /exec/results/leak.txt
  summary: Attempt to write output outside the run artifact allowlist.
  reason: Security negative test.
EOF
if cargo run --quiet --bin rho -- run proposal-action \
  --proposal "$BAD_OUTPUT_PROPOSAL" \
  --control-root "$SANDBOX/user1-exec/control" \
  --action-id "$BAD_OUTPUT_ACTION_ID" \
  --map "/exec=$SANDBOX/user1-exec" \
  --script-root "$SANDBOX/user1-exec/workspace" \
  --output-root "$SANDBOX/user1-exec/.rho/runs" \
  --allow-tool run_real \
  --allow-requested-by "$USER2_ID" \
  --allow-requested-for "$USER1_ID" \
  --allow-action-type run_real_data; then
  echo "proposal-action allowed output path outside runs" >&2
  exit 1
fi
test ! -e "$SANDBOX/user1-exec/control/outbox/$BAD_OUTPUT_ACTION_ID.json"

cargo run --quiet --bin rho -- run proposal-action \
  --proposal "$PROPOSAL_PATH" \
  --control-root "$SANDBOX/user1-exec/control" \
  --action-id "$RUN_ACTION_ID" \
  --map "/exec=$SANDBOX/user1-exec" \
  --script-root "$SANDBOX/user1-exec/workspace" \
  --output-root "$SANDBOX/user1-exec/.rho/runs" \
  --allow-tool run_real \
  --allow-requested-by "$USER2_ID" \
  --allow-requested-for "$USER1_ID" \
  --allow-action-type run_real_data >/dev/null
RHO_SANDBOX_RUNNER="$SANDBOX_RUNNER" cargo run --quiet --bin rho -- run grant-action \
  --shared-root "$SANDBOX/user1-exec" \
  --control-root "$SANDBOX/user1-exec/control" \
  --action-id "$RUN_ACTION_ID" \
  --granted-by "$USER1_ID" \
  --input "code:$SANDBOX/user1-exec/workspace/sum_prices.py" >/dev/null
RUN_STATUS_PATH="$(RHO_SANDBOX_RUNNER="$SANDBOX_RUNNER" cargo run --quiet --bin rho -- run controlled-action \
  --shared-root "$SANDBOX/user1-exec" \
  --control-root "$SANDBOX/user1-exec/control" \
  --action-id "$RUN_ACTION_ID" \
  --private-root "$SANDBOX/user1-private/users/$USER1_STORAGE/datasets/private")"
grep -q "completed" "$RUN_STATUS_PATH"
test "$(cat "$SANDBOX/user1-exec/.rho/runs/$RUN_ID/stdout.txt")" = "1113.03"
grep -q "runner: $SANDBOX_RUNNER" "$SANDBOX/user1-exec/.rho/runs/$RUN_ID/sandbox-run.yaml"

git -C "$USER1" worktree add -b "$RELEASE_BRANCH" "$SANDBOX/user1-release" main >/dev/null
setup_git_user "$SANDBOX/user1-release" "Rho User One" "user1@example.test"
mkdir -p "$SANDBOX/user1-release/$RESULT_DIR"
cat > "$SANDBOX/user1-release/$RESULT_DIR/result.yaml" <<EOF
version: 1
result:
  request_id: $REQUEST_ID
  from: $USER1_ID
  to: $USER2_ID
  output: "1113.03"
  run_id: $RUN_ID
  runner: $SANDBOX_RUNNER
  note: encrypted result released from approved sandbox run
EOF
RHO_HOME="$USER1_HOME" ./rho crypto sign \
  "$SANDBOX/user1-release/$RESULT_DIR/result.yaml" \
  --identity "$USER1_ID" \
  --out "$SANDBOX/user1-release/$RESULT_DIR/result.rhosig.yaml" >/dev/null
RHO_HOME="$USER1_HOME" git -C "$SANDBOX/user1-release" add "$RESULT_DIR"
git -C "$SANDBOX/user1-release" show ":$RESULT_DIR/result.yaml" > "$SANDBOX/result-index.yaml"
assert_encrypted_blob "$SANDBOX/result-index.yaml" "$USER2_ID" "1113.03"
git -C "$SANDBOX/user1-release" commit -m "Release encrypted sandbox result" >/dev/null
git -C "$SANDBOX/user1-release" push -u origin "$RELEASE_BRANCH" >/dev/null
RHO_HOME="$USER1_HOME" ./rho repo doctor --root "$SANDBOX/user1-release" >/dev/null

git -C "$USER2" fetch origin "$RELEASE_BRANCH:$RELEASE_BRANCH" >/dev/null
git -C "$USER2" worktree add "$SANDBOX/user2-review" "$RELEASE_BRANCH" >/dev/null
setup_git_user "$SANDBOX/user2-review" "Rho User Two" "user2@example.test"
grep -q "1113.03" "$SANDBOX/user2-review/$RESULT_DIR/result.yaml"
RHO_HOME="$USER2_HOME" ./rho crypto verify \
  "$SANDBOX/user2-review/$RESULT_DIR/result.yaml" \
  --signature "$SANDBOX/user2-review/$RESULT_DIR/result.rhosig.yaml" \
  --identity "$USER1_ID" >/dev/null
git -C "$SANDBOX/user2-review" show "HEAD:$RESULT_DIR/result.yaml" > "$SANDBOX/result-commit.yaml"
assert_encrypted_blob "$SANDBOX/result-commit.yaml" "$USER2_ID" "1113.03"
RHO_HOME="$USER2_HOME" ./rho repo doctor --root "$SANDBOX/user2-review" >/dev/null

echo "inspect sandbox: $SANDBOX"
find "$SANDBOX" \
  -path "*/.git" -prune -o \
  -path "*/remote.git" -prune -o \
  -maxdepth 7 -type f -print | sort
if [[ "$LIVE_PI" == "1" ]]; then
  echo "live git pi sandbox encrypted e2e passed"
else
  echo "local git pi sandbox encrypted e2e passed"
fi
