@indigoai-us/hq-cli 5.345.114 → 5.345.115

package/assets/scaffold/core/scripts/outpost-jobs-reconcile.sh

@@ -1,836 +0,0 @@
-#!/usr/bin/env bash
-# hq-core: public
-# outpost-jobs-reconcile.sh — registry YAML → systemd user timers (US-004).
-#
-# Reads personal/jobs/*.yaml and companies/*/jobs/*.yaml from the box HQ tree,
-# validates each with jobs-validate.sh, and materializes disposable units:
-#   ~/.config/systemd/user/hq-job-{id}.service
-#   ~/.config/systemd/user/hq-job-{id}.timer
-# with Persistent=true and RandomizedDelaySec. Timers are armed only when
-# hq-pro jobs status readiness=ready (box cache from probe ingest, or live
-# GET when available). Disabled/deleted jobs have units removed.
-#
-# Company-scoped jobs materialize only when job.owner matches this Outpost's
-# owner identity (creator's box only in v1).
-#
-# Usage:
-#   core/scripts/outpost-jobs-reconcile.sh [options]
-#   core/scripts/outpost-jobs-reconcile.sh --after-sync   # post-sync entrypoint
-#
-# Options:
-#   --hq-root DIR       HQ tree root (default: HQ_ROOT or repo root above core/)
-#   --dry-run           Write units to unit dir / print plan; skip systemctl
-#   --no-probe          Do not probe non-ready jobs
-#   --probe-only        Probe non-ready jobs then exit (no unit changes)
-#   --ensure-hook       Install personal/hooks/Stop/90-outpost-jobs-reconcile.sh
-#   --after-sync        Alias for default reconcile + probe path (sync Stop hook)
-#   -h, --help
-#
-# Env / overrides (tests):
-#   HQ_ROOT, HOME, HQ_JOB_UNIT_DIR, HQ_JOB_SYSTEMCTL, HQ_JOB_STATUS_CACHE_DIR
-#   HQ_JOB_OWNER_EMAIL, HQ_JOB_OWNER_UID, OUTPOST_USER_ID, OUTPOST_ID
-#   HQ_JOB_RANDOMIZE_SEC (default 60), HQ_JOB_RECONCILE_STATE
-#   HQ_PRO_API_URL / HQ_API_URL / HQ_VAULT_API_URL, HQ_ACCESS_TOKEN (optional GET)
-#
-# Exit: 0 success; 1 partial failures; 2 usage/config.
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-HQ_ROOT="${HQ_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
-VALIDATE="$SCRIPT_DIR/jobs-validate.sh"
-PROBE="$SCRIPT_DIR/hq-job-probe.sh"
-
-DRY_RUN=0
-NO_PROBE=0
-PROBE_ONLY=0
-ENSURE_HOOK=0
-
-usage() {
-  sed -n '3,36p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'
-}
-
-die() {
-  echo "outpost-jobs-reconcile: $*" >&2
-  exit 2
-}
-
-log() {
-  echo "outpost-jobs-reconcile: $*" >&2
-}
-
-while [ $# -gt 0 ]; do
-  case "$1" in
-    --hq-root)
-      HQ_ROOT="${2:-}"
-      [ -n "$HQ_ROOT" ] || die "--hq-root requires a directory"
-      shift 2
-      ;;
-    --dry-run)
-      DRY_RUN=1
-      shift
-      ;;
-    --no-probe)
-      NO_PROBE=1
-      shift
-      ;;
-    --probe-only)
-      PROBE_ONLY=1
-      shift
-      ;;
-    --ensure-hook)
-      ENSURE_HOOK=1
-      shift
-      ;;
-    --after-sync)
-      shift
-      ;;
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    -*)
-      die "unknown option: $1"
-      ;;
-    *)
-      die "unexpected argument: $1"
-      ;;
-  esac
-done
-
-# The shell script is also bundled inside hq-cli. Its own SCRIPT_DIR then
-# points into the npm package, while job units must always target the live
-# scaffold forwarder so they survive CLI upgrades and Node switches.
-RUNNER="$HQ_ROOT/core/scripts/hq-job-run.sh"
-
-command -v yq >/dev/null 2>&1 || die "yq is required (mikefarah/yq)"
-command -v jq >/dev/null 2>&1 || die "jq is required"
-[ -x "$VALIDATE" ] || [ -f "$VALIDATE" ] || die "missing jobs-validate.sh"
-[ -f "$RUNNER" ] || die "missing hq-job-run.sh"
-[ -f "$PROBE" ] || die "missing hq-job-probe.sh"
-
-UNIT_DIR="${HQ_JOB_UNIT_DIR:-${HOME}/.config/systemd/user}"
-STATUS_CACHE_DIR="${HQ_JOB_STATUS_CACHE_DIR:-${HOME}/.hq/jobs/status-cache}"
-STATE_DIR="${HQ_JOB_RECONCILE_STATE:-${HOME}/.hq/jobs/reconcile}"
-SYSTEMCTL_BIN="${HQ_JOB_SYSTEMCTL:-systemctl}"
-RANDOMIZE_SEC="${HQ_JOB_RANDOMIZE_SEC:-60}"
-mkdir -p "$UNIT_DIR" "$STATUS_CACHE_DIR" "$STATE_DIR"
-
-iso_now() {
-  date -u +"%Y-%m-%dT%H:%M:%SZ" 2>/dev/null \
-    || date -u +"%Y-%m-%dT%H:%M:%S+00:00"
-}
-
-api_base() {
-  local base
-  base="${HQ_PRO_API_URL:-${HQ_API_URL:-${HQ_VAULT_API_URL:-https://hqapi.hq.computer}}}"
-  printf '%s' "${base%/}"
-}
-
-# --- owner identity (company jobs: creator's Outpost only) -------------------
-
-resolve_box_owners() {
-  # Emits newline-separated owner identity tokens this box may claim.
-  local tokens=""
-  add_token() {
-    local t="$1"
-    [ -n "$t" ] && [ "$t" != "null" ] || return 0
-    case $'\n'"$tokens"$'\n' in
-      *$'\n'"$t"$'\n'*) ;;
-      *) tokens="${tokens:+${tokens}$'\n'}${t}" ;;
-    esac
-  }
-
-  add_token "${HQ_JOB_OWNER_EMAIL:-}"
-  add_token "${HQ_JOB_OWNER_UID:-}"
-  add_token "${OUTPOST_USER_ID:-}"
-
-  if command -v hq >/dev/null 2>&1; then
-    local who
-    who="$(hq whoami --json 2>/dev/null || hq whoami 2>/dev/null || true)"
-    if [ -n "$who" ]; then
-      local email uid
-      email="$(printf '%s' "$who" | jq -r '.email // .user.email // empty' 2>/dev/null || true)"
-      uid="$(printf '%s' "$who" | jq -r '.personUid // .person_uid // .uid // empty' 2>/dev/null || true)"
-      if [ -z "$email" ]; then
-        email="$(printf '%s' "$who" | sed -n 's/.*Email:[[:space:]]*//Ip;s/.*email[[:space:]]*[:=][[:space:]]*//Ip' | head -1 | tr -d '[:space:]')"
-      fi
-      add_token "$email"
-      add_token "$uid"
-    fi
-  fi
-
-  # Common on-box identity files.
-  if [ -f /etc/outpost/codex-identity.env ]; then
-    # shellcheck disable=SC1091
-    . /etc/outpost/codex-identity.env 2>/dev/null || true
-    add_token "${OUTPOST_USER_ID:-}"
-    add_token "${OUTPOST_OWNER_EMAIL:-}"
-    add_token "${OWNER_EMAIL:-}"
-  fi
-
-  printf '%s' "$tokens"
-}
-
-owner_matches() {
-  local job_owner="$1"
-  local box_owners="$2"
-  [ -n "$job_owner" ] || return 1
-  local t
-  while IFS= read -r t; do
-    [ -n "$t" ] || continue
-    if [ "$t" = "$job_owner" ]; then
-      return 0
-    fi
-    # Case-insensitive email compare
-    if printf '%s' "$t" | grep -qi '@' \
-      && [ "$(printf '%s' "$t" | tr '[:upper:]' '[:lower:]')" = "$(printf '%s' "$job_owner" | tr '[:upper:]' '[:lower:]')" ]; then
-      return 0
-    fi
-  done <<EOF
-$box_owners
-EOF
-  return 1
-}
-
-# --- readiness cache ---------------------------------------------------------
-
-status_cache_path() {
-  printf '%s/%s.json' "$STATUS_CACHE_DIR" "$1"
-}
-
-read_cached_readiness() {
-  local id="$1" path
-  path="$(status_cache_path "$id")"
-  if [ -f "$path" ]; then
-    yq -r '.readiness // "unknown"' "$path" 2>/dev/null || echo unknown
-    return
-  fi
-  # Fall back to probe last-attempt marker when it recorded a successful ingest.
-  local probe_marker="${HOME}/.hq/jobs/probes/${id}/last-attempt.json"
-  if [ -f "$probe_marker" ]; then
-    local reported
-    reported="$(jq -r '.reported_readiness // empty' "$probe_marker" 2>/dev/null || true)"
-    if [ -n "$reported" ] && [ "$reported" != "null" ]; then
-      printf '%s' "$reported"
-      return
-    fi
-  fi
-  printf 'unknown'
-}
-
-write_status_cache() {
-  local id="$1" readiness="$2" source="${3:-reconcile}"
-  local path
-  path="$(status_cache_path "$id")"
-  jq -nc \
-    --arg job_id "$id" \
-    --arg readiness "$readiness" \
-    --arg updated_at "$(iso_now)" \
-    --arg source "$source" \
-    '{job_id:$job_id,readiness:$readiness,updated_at:$updated_at,source:$source}' \
-    >"$path"
-  chmod 600 "$path" 2>/dev/null || true
-}
-
-# Optional live GET when HQ_ACCESS_TOKEN is present (laptop JWT on box is rare).
-fetch_live_readiness() {
-  local id="$1"
-  [ -n "${HQ_ACCESS_TOKEN:-}" ] || return 1
-  local url curl_bin http body tmp
-  url="$(api_base)/outpost/jobs/status/${id}"
-  curl_bin="${HQ_JOB_PROBE_CURL:-curl}"
-  command -v "$curl_bin" >/dev/null 2>&1 || return 1
-  tmp="$(mktemp "${TMPDIR:-/tmp}/hq-job-status.XXXXXX")"
-  http=0
-  set +e
-  "$curl_bin" -sS -m 15 \
-    -H "authorization: Bearer ${HQ_ACCESS_TOKEN}" \
-    -H "accept: application/json" \
-    -o "$tmp" \
-    -w '%{http_code}' \
-    "$url" >"${tmp}.code"
-  set -e
-  http="$(cat "${tmp}.code" 2>/dev/null || echo 0)"
-  body="$(cat "$tmp" 2>/dev/null || true)"
-  rm -f "$tmp" "${tmp}.code"
-  if [ "$http" -ge 200 ] && [ "$http" -lt 300 ]; then
-    local r
-    r="$(printf '%s' "$body" | jq -r '.status.readiness // .readiness // empty' 2>/dev/null || true)"
-    if [ -n "$r" ]; then
-      write_status_cache "$id" "$r" "api-get"
-      printf '%s' "$r"
-      return 0
-    fi
-  fi
-  return 1
-}
-
-job_readiness() {
-  local id="$1" r
-  if r="$(fetch_live_readiness "$id")"; then
-    printf '%s' "$r"
-    return
-  fi
-  read_cached_readiness "$id"
-}
-
-# --- cron → systemd OnCalendar -----------------------------------------------
-
-# Map cron DOW (0/7=Sun … 6=Sat) to systemd weekday names.
-cron_dow_to_systemd() {
-  local field="$1"
-  case "$field" in
-    '*'|'*/1') printf ''; return ;;
-  esac
-  local out="" part IFS=','
-  # shellcheck disable=SC2086
-  set -f
-  set -- $field
-  set +f
-  for part in "$@"; do
-    local mapped
-    mapped="$(cron_dow_token_to_systemd "$part")" || return 1
-    [ -n "$mapped" ] || continue
-    out="${out:+$out,}$mapped"
-  done
-  printf '%s' "$out"
-}
-
-cron_dow_token_to_systemd() {
-  local tok="$1"
-  # ranges like 1-5 or Mon-Fri
-  if printf '%s' "$tok" | grep -Eq '^[0-7]+-[0-7]+$'; then
-    local a b
-    a="${tok%-*}"; b="${tok#*-}"
-    printf '%s..%s' "$(cron_dow_num_to_name "$a")" "$(cron_dow_num_to_name "$b")"
-    return
-  fi
-  case "$(printf '%s' "$tok" | tr '[:upper:]' '[:lower:]')" in
-    sun|0|7) printf 'Sun' ;;
-    mon|1) printf 'Mon' ;;
-    tue|2) printf 'Tue' ;;
-    wed|3) printf 'Wed' ;;
-    thu|4) printf 'Thu' ;;
-    fri|5) printf 'Fri' ;;
-    sat|6) printf 'Sat' ;;
-    mon..fri|1-5) printf 'Mon..Fri' ;;
-    *) return 1 ;;
-  esac
-}
-
-cron_dow_num_to_name() {
-  case "$1" in
-    0|7) printf 'Sun' ;;
-    1) printf 'Mon' ;;
-    2) printf 'Tue' ;;
-    3) printf 'Wed' ;;
-    4) printf 'Thu' ;;
-    5) printf 'Fri' ;;
-    6) printf 'Sat' ;;
-    *) return 1 ;;
-  esac
-}
-
-pad2() {
-  local n="$1"
-  if [ "${#n}" -eq 1 ]; then
-    printf '0%s' "$n"
-  else
-    printf '%s' "$n"
-  fi
-}
-
-# Convert a single cron field that is a fixed number or */n or a-b into
-# systemd calendar fragment for hour/minute. Returns empty for '*'.
-cron_time_field() {
-  local field="$1"
-  case "$field" in
-    '*') printf ''; return ;;
-    */*)
-      local step="${field#*/}"
-      printf '*/%s' "$step"
-      return
-      ;;
-    *-*)
-      printf '%s' "$field"
-      return
-      ;;
-    *)
-      if printf '%s' "$field" | grep -Eq '^[0-9]+$'; then
-        pad2 "$field"
-        return
-      fi
-      printf '%s' "$field"
-      ;;
-  esac
-}
-
-cron_to_oncalendar() {
-  # stdin unused; args: minute hour dom month dow → prints OnCalendar value
-  local minute="$1" hour="$2" dom="$3" month="$4" dow="$5"
-  local dow_s date_s time_s h m
-
-  dow_s="$(cron_dow_to_systemd "$dow" || true)"
-
-  # Date part: year-month-day → *-month-day
-  local mon_s day_s
-  case "$month" in
-    '*') mon_s='*' ;;
-    *) mon_s="$(pad2 "$month" 2>/dev/null || printf '%s' "$month")" ;;
-  esac
-  case "$dom" in
-    '*') day_s='*' ;;
-    *) day_s="$(pad2 "$dom" 2>/dev/null || printf '%s' "$dom")" ;;
-  esac
-  date_s="*-${mon_s}-${day_s}"
-
-  m="$(cron_time_field "$minute")"
-  h="$(cron_time_field "$hour")"
-  [ -n "$m" ] || m='00'
-  [ -n "$h" ] || h='*'
-  # Normalize pure numbers already padded; handle hour=*
-  if [ "$h" = '*' ]; then
-    time_s="*:${m}:00"
-  elif printf '%s' "$h" | grep -q '/'; then
-    # e.g. */6 → 0/6
-    local step="${h#*/}"
-    time_s="0/${step}:${m}:00"
-  else
-    time_s="${h}:${m}:00"
-  fi
-
-  if [ -n "$dow_s" ]; then
-    printf '%s %s %s' "$dow_s" "$date_s" "$time_s"
-  else
-    printf '%s %s' "$date_s" "$time_s"
-  fi
-}
-
-# --- unit writers ------------------------------------------------------------
-
-unit_service_path() { printf '%s/hq-job-%s.service' "$UNIT_DIR" "$1"; }
-unit_timer_path() { printf '%s/hq-job-%s.timer' "$UNIT_DIR" "$1"; }
-
-normalize_service_path() {
-  local remaining="$1" entry existing normalized="" has_more seen entry_count=0 index
-  local -a entries=()
-  while :; do
-    if [[ "$remaining" == *:* ]]; then
-      entry="${remaining%%:*}"
-      remaining="${remaining#*:}"
-      has_more=1
-    else
-      entry="$remaining"
-      remaining=""
-      has_more=0
-    fi
-    case "$entry" in
-      /*)
-        seen=0
-        for ((index = 0; index < entry_count; index++)); do
-          existing="${entries[index]}"
-          if [ "$existing" = "$entry" ]; then
-            seen=1
-            break
-          fi
-        done
-        if [ "$seen" -eq 0 ]; then
-          entries+=("$entry")
-          entry_count=$((entry_count + 1))
-        fi
-        ;;
-    esac
-    [ "$has_more" -eq 1 ] || break
-  done
-  if [ "$entry_count" -gt 0 ]; then
-    local IFS=:
-    normalized="${entries[*]}"
-  fi
-  printf '%s' "$normalized"
-}
-
-unit_service_path_value() {
-  local service_path hq_bin npm_prefix hq_bin_dir
-  service_path="${PATH:-/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin}"
-  service_path="$(normalize_service_path "$service_path")"
-  hq_bin=""
-  if [ -n "$service_path" ]; then
-    hq_bin="$(PATH="$service_path" type -P hq 2>/dev/null || true)"
-  fi
-  if [ -z "$hq_bin" ] && PATH="$service_path" command -v npm >/dev/null 2>&1; then
-    npm_prefix="$(PATH="$service_path" npm prefix -g 2>/dev/null || true)"
-    if [ -n "$npm_prefix" ] && [ -x "$npm_prefix/bin/hq" ]; then
-      hq_bin="$npm_prefix/bin/hq"
-    fi
-  fi
-  if [ -n "$hq_bin" ] && [ -x "$hq_bin" ]; then
-    hq_bin_dir="$(cd "$(dirname "$hq_bin")" 2>/dev/null && pwd -P || true)"
-    if [ -n "$hq_bin_dir" ]; then
-      case ":$service_path:" in
-        *":$hq_bin_dir:"*) ;;
-        *) service_path="$hq_bin_dir:$service_path" ;;
-      esac
-    fi
-  fi
-  printf '%s' "$service_path"
-}
-
-systemd_quote() {
-  local value="$1"
-  value="${value//%/%%}"
-  value="${value//\\/\\\\}"
-  value="${value//\"/\\\"}"
-  value="${value//$'\n'/\\n}"
-  value="${value//$'\r'/\\r}"
-  value="${value//$'\t'/\\t}"
-  printf '"%s"' "$value"
-}
-
-write_service_unit() {
-  local id="$1" path service_path
-  path="$(unit_service_path "$id")"
-  service_path="$(unit_service_path_value)"
-  local runner_abs
-  runner_abs="$(cd "$(dirname "$RUNNER")" && pwd)/$(basename "$RUNNER")"
-  cat >"$path" <<EOF
-# Generated by outpost-jobs-reconcile.sh — disposable derived state. Do not edit.
-[Unit]
-Description=HQ Outpost scheduled job: ${id}
-Documentation=file://${HQ_ROOT}/core/knowledge/public/hq-core/outpost-jobs-spec.md
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=oneshot
-Environment=HQ_ROOT=${HQ_ROOT}
-Environment=$(systemd_quote "PATH=$service_path")
-ExecStart=${runner_abs} --hq-root ${HQ_ROOT} --job-id ${id}
-Nice=10
-
-[Install]
-WantedBy=default.target
-EOF
-}
-
-write_timer_unit() {
-  local id="$1" oncal="$2" path
-  path="$(unit_timer_path "$id")"
-  cat >"$path" <<EOF
-# Generated by outpost-jobs-reconcile.sh — disposable derived state. Do not edit.
-[Unit]
-Description=HQ Outpost scheduled job timer: ${id}
-Documentation=file://${HQ_ROOT}/core/knowledge/public/hq-core/outpost-jobs-spec.md
-
-[Timer]
-OnCalendar=${oncal}
-Persistent=true
-RandomizedDelaySec=${RANDOMIZE_SEC}
-Unit=hq-job-${id}.service
-
-[Install]
-WantedBy=timers.target
-EOF
-}
-
-systemctl_user() {
-  if [ "$DRY_RUN" -eq 1 ]; then
-    log "dry-run systemctl --user $*"
-    return 0
-  fi
-  if [ "$SYSTEMCTL_BIN" = ":" ] || [ "$SYSTEMCTL_BIN" = "true" ]; then
-    return 0
-  fi
-  if ! command -v "$SYSTEMCTL_BIN" >/dev/null 2>&1; then
-    log "systemctl not available — units written but not enabled ($*)"
-    return 0
-  fi
-  "$SYSTEMCTL_BIN" --user "$@"
-}
-
-enable_timer() {
-  local id="$1"
-  local output rc=0
-  systemctl_user daemon-reload || true
-  output="$(systemctl_user enable --now "hq-job-${id}.timer" 2>&1)" || rc=$?
-  if [ "$rc" -ne 0 ]; then
-    log "systemctl enable timer failed for job $id exit=$rc: ${output:-no error message}"
-    return "$rc"
-  fi
-  if [ -n "$output" ]; then
-    printf '%s\n' "$output" >&2
-  fi
-  return 0
-}
-
-disable_remove_units() {
-  local id="$1"
-  systemctl_user disable --now "hq-job-${id}.timer" 2>/dev/null || true
-  systemctl_user stop "hq-job-${id}.service" 2>/dev/null || true
-  rm -f "$(unit_service_path "$id")" "$(unit_timer_path "$id")"
-}
-
-units_fingerprint() {
-  local id="$1"
-  local sp tp
-  sp="$(unit_service_path "$id")"
-  tp="$(unit_timer_path "$id")"
-  if [ ! -f "$sp" ] || [ ! -f "$tp" ]; then
-    printf ''
-    return
-  fi
-  # Content hash for idempotency compare
-  cat "$sp" "$tp" | shasum -a 256 2>/dev/null | awk '{print $1}' \
-    || cat "$sp" "$tp" | cksum | awk '{print $1}'
-}
-
-# --- registry scan -----------------------------------------------------------
-
-collect_job_files() {
-  {
-    # Only top-level registry YAMLs — skip sync conflict sidecars and quarantine dirs.
-    find "$HQ_ROOT/personal/jobs" -maxdepth 1 \( -name '*.yaml' -o -name '*.yml' \) -type f 2>/dev/null || true
-    find "$HQ_ROOT/companies" -path '*/jobs/*' -maxdepth 3 \( -name '*.yaml' -o -name '*.yml' \) -type f 2>/dev/null || true
-  } | grep -Ev '\.conflict-|/\.conflicts/' | sort -u
-}
-
-is_company_job_path() {
-  case "$1" in
-    */companies/*/jobs/*) return 0 ;;
-    *) return 1 ;;
-  esac
-}
-
-ensure_sync_hook() {
-  local hook_dir="$HQ_ROOT/personal/hooks/Stop"
-  local hook_path="$hook_dir/90-outpost-jobs-reconcile.sh"
-  mkdir -p "$hook_dir"
-  cat >"$hook_path" <<EOF
-#!/usr/bin/env bash
-# Auto-installed by outpost-jobs-reconcile.sh --ensure-hook (US-004).
-# hq-sync-runner executes personal/hooks/Stop/* after each sync cycle.
-set -u
-HQ_ROOT="\${OUTPOST_HQ_ROOT:-\${HQ_ROOT:-/home/ec2-user/hq}}"
-RECONCILE="\$HQ_ROOT/core/scripts/outpost-jobs-reconcile.sh"
-if [ -x "\$RECONCILE" ] || [ -f "\$RECONCILE" ]; then
-  bash "\$RECONCILE" --hq-root "\$HQ_ROOT" --after-sync >>"\${HOME}/.hq/jobs/reconcile/after-sync.log" 2>&1 || true
-fi
-EOF
-  chmod +x "$hook_path"
-  log "installed sync Stop hook: $hook_path"
-}
-
-# --- main reconcile ----------------------------------------------------------
-
-BOX_OWNERS="$(resolve_box_owners)"
-DESIRED_IDS=""
-ERRORS=0
-ARMED=0
-SKIPPED=0
-REMOVED=0
-PROBE_RAN=0
-
-if [ "$ENSURE_HOOK" -eq 1 ]; then
-  ensure_sync_hook
-fi
-
-# First pass: probe jobs that are not ready (unless --no-probe).
-if [ "$NO_PROBE" -eq 0 ]; then
-  while IFS= read -r jf; do
-    [ -n "$jf" ] || continue
-    if ! bash "$VALIDATE" "$jf" >/dev/null 2>&1; then
-      continue
-    fi
-    jid="$(yq -r '.id // ""' "$jf")"
-    [ -n "$jid" ] || continue
-    if is_company_job_path "$jf"; then
-      jowner="$(yq -r '.owner // ""' "$jf")"
-      if ! owner_matches "$jowner" "$BOX_OWNERS"; then
-        continue
-      fi
-    fi
-    readiness="$(job_readiness "$jid")"
-    if [ "$readiness" != "ready" ]; then
-      log "probe $jid (cached readiness=$readiness)"
-      set +e
-      bash "$PROBE" --hq-root "$HQ_ROOT" "$jf" >/tmp/hq-job-probe-out.$$ 2>/tmp/hq-job-probe-err.$$
-      prc=$?
-      set -e
-      PROBE_RAN=$((PROBE_RAN + 1))
-      # Refresh cache from probe JSON stdout when present.
-      if [ -f /tmp/hq-job-probe-out.$$ ]; then
-        pready="$(jq -r '.readiness // empty' /tmp/hq-job-probe-out.$$ 2>/dev/null || true)"
-        if [ -n "$pready" ]; then
-          # Only cache definitive ready/blocked from a successful ingest path.
-          ingest="$(jq -r '.ingest // empty' /tmp/hq-job-probe-out.$$ 2>/dev/null || true)"
-          if [ "$ingest" = "ok" ] || [ "$ingest" = "dry_run" ]; then
-            write_status_cache "$jid" "$pready" "probe"
-          elif [ "$pready" = "blocked" ]; then
-            write_status_cache "$jid" "blocked" "probe-local"
-          fi
-        fi
-      fi
-      rm -f /tmp/hq-job-probe-out.$$ /tmp/hq-job-probe-err.$$
-      if [ "$prc" -ge 2 ] && [ "$prc" -ne 3 ]; then
-        ERRORS=$((ERRORS + 1))
-      fi
-    fi
-  done < <(collect_job_files)
-fi
-
-if [ "$PROBE_ONLY" -eq 1 ]; then
-  log "probe-only done (probed=$PROBE_RAN errors=$ERRORS)"
-  [ "$ERRORS" -eq 0 ] || exit 1
-  exit 0
-fi
-
-# Second pass: materialize / remove units.
-while IFS= read -r jf; do
-  [ -n "$jf" ] || continue
-
-  job_id_hint="$(yq -r '.id // ""' "$jf" 2>/dev/null || true)"
-  tz="$(yq -r '.timezone // ""' "$jf" 2>/dev/null || true)"
-  if [ -n "$tz" ] && [[ ! "$tz" =~ ^[A-Za-z0-9/_+-]+$ ]]; then
-    log "skip ${job_id_hint:-unknown} — invalid timezone contains unsafe characters"
-    ERRORS=$((ERRORS + 1))
-    continue
-  fi
-
-  if ! bash "$VALIDATE" "$jf" >/dev/null 2>&1; then
-    log "skip invalid job YAML: $jf"
-    ERRORS=$((ERRORS + 1))
-    continue
-  fi
-
-  jid="$job_id_hint"
-  jname="$(yq -r '.name // ""' "$jf")"
-  jowner="$(yq -r '.owner // ""' "$jf")"
-  enabled="$(yq -o=json '.' "$jf" | jq -r 'if has("enabled") then (.enabled|tostring) else "true" end')"
-  schedule="$(yq -r '.schedule // ""' "$jf")"
-  if is_company_job_path "$jf"; then
-    if ! owner_matches "$jowner" "$BOX_OWNERS"; then
-      log "skip company job $jid — owner '$jowner' does not match this Outpost"
-      SKIPPED=$((SKIPPED + 1))
-      # Ensure we do not leave a stale timer if ownership changed.
-      if [ -f "$(unit_timer_path "$jid")" ]; then
-        disable_remove_units "$jid"
-        REMOVED=$((REMOVED + 1))
-      fi
-      continue
-    fi
-  fi
-
-  if [ "$enabled" = "false" ] || [ "$enabled" = "False" ] || [ "$enabled" = "0" ]; then
-    log "remove units for disabled job $jid"
-    if [ -f "$(unit_timer_path "$jid")" ] || [ -f "$(unit_service_path "$jid")" ]; then
-      disable_remove_units "$jid"
-      REMOVED=$((REMOVED + 1))
-    fi
-    continue
-  fi
-
-  readiness="$(job_readiness "$jid")"
-  if [ "$readiness" != "ready" ]; then
-    log "skip arming $jid — readiness=$readiness (need ready)"
-    SKIPPED=$((SKIPPED + 1))
-    if [ -f "$(unit_timer_path "$jid")" ]; then
-      disable_remove_units "$jid"
-      REMOVED=$((REMOVED + 1))
-      log "stopped timer for non-ready job $jid"
-    fi
-    continue
-  fi
-
-  # Parse 5-field cron
-  set -f
-  # shellcheck disable=SC2086
-  set -- $schedule
-  set +f
-  if [ "$#" -ne 5 ]; then
-    log "skip $jid — schedule not 5-field cron: $schedule"
-    ERRORS=$((ERRORS + 1))
-    continue
-  fi
-  oncal="$(cron_to_oncalendar "$1" "$2" "$3" "$4" "$5")" || {
-    log "skip $jid — cannot convert cron to OnCalendar: $schedule"
-    ERRORS=$((ERRORS + 1))
-    continue
-  }
-  if [ -n "$tz" ]; then
-    case " $oncal " in
-      *" $tz "*) ;;
-      *) oncal="$oncal $tz" ;;
-    esac
-  fi
-
-  DESIRED_IDS="${DESIRED_IDS:+${DESIRED_IDS}$'\n'}${jid}"
-
-  # Write to temp then compare for idempotency.
-  tmp_dir="$(mktemp -d "${TMPDIR:-/tmp}/hq-job-unit.XXXXXX")"
-  OLD_UNIT_DIR="$UNIT_DIR"
-  UNIT_DIR="$tmp_dir"
-  write_service_unit "$jid"
-  write_timer_unit "$jid" "$oncal"
-  UNIT_DIR="$OLD_UNIT_DIR"
-
-  new_hash="$(cat "$tmp_dir/hq-job-${jid}.service" "$tmp_dir/hq-job-${jid}.timer" | shasum -a 256 2>/dev/null | awk '{print $1}' \
-    || cat "$tmp_dir/hq-job-${jid}.service" "$tmp_dir/hq-job-${jid}.timer" | cksum | awk '{print $1}')"
-  old_hash="$(units_fingerprint "$jid")"
-
-  if [ "$new_hash" = "$old_hash" ] && [ -n "$old_hash" ]; then
-    log "noop $jid — units unchanged ($jname)"
-    rm -rf "$tmp_dir"
-    # Ensure timer still enabled
-    if enable_timer "$jid"; then
-      ARMED=$((ARMED + 1))
-    else
-      SKIPPED=$((SKIPPED + 1))
-      ERRORS=$((ERRORS + 1))
-    fi
-    continue
-  fi
-
-  cp "$tmp_dir/hq-job-${jid}.service" "$(unit_service_path "$jid")"
-  cp "$tmp_dir/hq-job-${jid}.timer" "$(unit_timer_path "$jid")"
-  rm -rf "$tmp_dir"
-  if enable_timer "$jid"; then
-    log "armed $jid OnCalendar=$oncal readiness=ready"
-    ARMED=$((ARMED + 1))
-  else
-    SKIPPED=$((SKIPPED + 1))
-    ERRORS=$((ERRORS + 1))
-  fi
-done < <(collect_job_files)
-
-# Remove units for jobs no longer in the desired set (deleted from registry).
-for unit_file in "$UNIT_DIR"/hq-job-*.timer; do
-  [ -e "$unit_file" ] || continue
-  base="$(basename "$unit_file" .timer)"
-  uid="${base#hq-job-}"
-  found=0
-  while IFS= read -r d; do
-    [ "$d" = "$uid" ] && found=1 && break
-  done <<EOF
-$DESIRED_IDS
-EOF
-  if [ "$found" -eq 0 ]; then
-    log "remove orphaned units for deleted/unarmed job $uid"
-    disable_remove_units "$uid"
-    REMOVED=$((REMOVED + 1))
-  fi
-done
-
-SUMMARY="$(jq -nc \
-  --argjson armed "$ARMED" \
-  --argjson skipped "$SKIPPED" \
-  --argjson removed "$REMOVED" \
-  --argjson probed "$PROBE_RAN" \
-  --argjson errors "$ERRORS" \
-  --arg dry_run "$DRY_RUN" \
-  --arg at "$(iso_now)" \
-  '{armed:$armed,skipped:$skipped,removed:$removed,probed:$probed,errors:$errors,dry_run:($dry_run=="1"),at:$at}')"
-printf '%s\n' "$SUMMARY" | tee "$STATE_DIR/last-reconcile.json" >/dev/null
-log "done armed=$ARMED skipped=$SKIPPED removed=$REMOVED probed=$PROBE_RAN errors=$ERRORS"
-
-[ "$ERRORS" -eq 0 ] || exit 1
-exit 0