#!/usr/bin/env bash
set -Eeuo pipefail
export LC_ALL=C

echo "============================================================"
echo " SHIRE VOICE — OFFICIAL OPENVOICE V1 LOCAL BOOTSTRAP"
echo "============================================================"

EXPECTED_HOST="Work"
EXPECTED_USER="ray"
EXPECTED_SENTINEL_SHA="4fa53399f013e76ab05b3a4f093a1a7a4d5b48279a5e7a2a336a159a9c271d11"
EXPECTED_DATASET_SHA="917f58c93ffc8d4345f57923019959a0b981fae3dfd0699864271bacaa9f4555"
OPENVOICE_COMMIT="74a1d147b17a8c3092dd5430504bd83ef6c7eb23"

SENTINEL="/home/shire3d/ARMOR/modules/sentinel.py"
DATASET="/home/ray/ARMOR/voice/secure/ray-authorised-v1.tar.gz.enc"
KEY="/etc/shire-voice/voice-dataset.key"

VOICE_ROOT="/home/ray/ARMOR/voice"
SRC_ROOT="$VOICE_ROOT/src"
RUNTIME_ROOT="$VOICE_ROOT/runtime"
MODEL_ROOT="$VOICE_ROOT/models"

OPENVOICE_SRC="$SRC_ROOT/OpenVoice-official"
MODEL_REPO="$MODEL_ROOT/MyShell-OpenVoice-official"
VENV="$RUNTIME_ROOT/openvoice-v1"

VAULT="/SHiREVault/Backup/OSBackups"
STAMP="$(date -u +%Y%m%dT%H%M%SZ)"
EVIDENCE="$VAULT/SHIRE-VOICE-OPENVOICE-V1-BOOTSTRAP-$STAMP"
REPORT="$EVIDENCE/BOOTSTRAP-RECEIPT.txt"

CREATED_OPENVOICE=0
CREATED_MODEL_REPO=0
CREATED_VENV=0

fail() {
    echo
    echo "STOP: $1" >&2
    exit 1
}

rollback_on_error() {
    rc=$?
    trap - ERR

    echo
    echo "ERROR: OpenVoice V1 bootstrap did not complete." >&2
    echo "Removing only newly created SHiRE Voice runtime files." >&2

    if [[ "$CREATED_VENV" == "1" ]]; then
        rm -rf "$VENV" 2>/dev/null || true
    fi

    if [[ "$CREATED_OPENVOICE" == "1" ]]; then
        rm -rf "$OPENVOICE_SRC" 2>/dev/null || true
    fi

    if [[ "$CREATED_MODEL_REPO" == "1" ]]; then
        rm -rf "$MODEL_REPO" 2>/dev/null || true
    fi

    echo "Encrypted voice dataset was not decrypted or modified."
    echo "Evidence: $EVIDENCE"
    exit "$rc"
}
trap rollback_on_error ERR

[[ "$(hostname)" == "$EXPECTED_HOST" ]] ||
    fail "Expected hostname $EXPECTED_HOST."

[[ "$(id -un)" == "$EXPECTED_USER" ]] ||
    fail "Expected user $EXPECTED_USER."

[[ -f "$SENTINEL" ]] ||
    fail "Sentinel source is missing."

[[ "$(sha256sum "$SENTINEL" | awk '{print $1}')" == "$EXPECTED_SENTINEL_SHA" ]] ||
    fail "Sentinel does not match its protected hash."

[[ -f "$DATASET" ]] ||
    fail "Encrypted authorised voice dataset is missing."

[[ "$(sha256sum "$DATASET" | awk '{print $1}')" == "$EXPECTED_DATASET_SHA" ]] ||
    fail "Encrypted authorised voice dataset hash mismatch."

KEY_STATE="$(sudo stat -c '%a:%U:%G' "$KEY")"
[[ "$KEY_STATE" == "600:root:root" ]] ||
    fail "Voice dataset key permissions are unsafe: $KEY_STATE"

findmnt -T "$VAULT" -rn -o FSTYPE |
grep -qx cifs ||
    fail "SHiREVault is not on its CIFS network mount."

mkdir -p "$EVIDENCE"
exec > >(tee "$REPORT") 2>&1

echo "Generated UTC: $(date -u --iso-8601=seconds)"
echo "Host: $(hostname)"
echo "Engine: Official MyShell OpenVoice V1"
echo "Runtime: CPU-only"
echo

echo "--- BASELINE VERIFICATION ---"
echo "Encrypted dataset SHA-256: $EXPECTED_DATASET_SHA"
echo "Voice key state: $KEY_STATE"
echo "PASS: Dataset remains encrypted and protected."

echo
echo "--- OFFICIAL SOURCE AVAILABILITY ---"

OPENVOICE_CHECK_DIR="$(mktemp -d /tmp/shire-openvoice-pincheck.XXXXXX)"
git -C "$OPENVOICE_CHECK_DIR" init -q
git -C "$OPENVOICE_CHECK_DIR" remote add origin \
    https://github.com/myshell-ai/OpenVoice.git

git -C "$OPENVOICE_CHECK_DIR" fetch -q --depth=1 origin "$OPENVOICE_COMMIT" ||
    fail "Pinned official OpenVoice commit could not be fetched directly."

FETCHED_OPENVOICE_COMMIT="$(
    git -C "$OPENVOICE_CHECK_DIR" rev-parse FETCH_HEAD
)"
rm -rf "$OPENVOICE_CHECK_DIR"

[[ "$FETCHED_OPENVOICE_COMMIT" == "$OPENVOICE_COMMIT" ]] ||
    fail "Directly fetched OpenVoice commit does not match the pinned commit."

HF_HEAD="$(
    git ls-remote \
        https://huggingface.co/myshell-ai/OpenVoice \
        HEAD |
    awk 'NR == 1 {print $1}'
)"

[[ "$HF_HEAD" =~ ^[0-9a-f]{40}$ ]] ||
    fail "Official MyShell Hugging Face model repository is unavailable."

echo "Official OpenVoice source commit: $OPENVOICE_COMMIT"
echo "Official MyShell model HEAD:      $HF_HEAD"
echo "PASS: Both official repositories are reachable."

echo
echo "--- INSTALLING ISOLATED BUILD REQUIREMENTS ---"

sudo apt-get update
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y \
    python3.12-venv \
    python3-dev \
    cmake \
    ninja-build \
    git-lfs \
    unzip \
    sox \
    libsndfile1-dev \
    libopenblas0 \
    libopenblas-dev

echo "PASS: Required local build, Git LFS and audio packages installed."

echo
echo "--- PREPARING SHIRE VOICE DIRECTORIES ---"

for path in "$MODEL_REPO" "$VENV"; do
    [[ ! -e "$path" ]] ||
        fail "Refusing to overwrite existing runtime path: $path"
done

mkdir -p "$SRC_ROOT" "$RUNTIME_ROOT" "$MODEL_ROOT"
chmod 700 "$VOICE_ROOT" "$SRC_ROOT" "$RUNTIME_ROOT" "$MODEL_ROOT"

echo
echo "--- PREPARING PINNED OFFICIAL OPENVOICE SOURCE ---"

if [[ -e "$OPENVOICE_SRC" ]]; then
    [[ -d "$OPENVOICE_SRC/.git" ]] ||
        fail "Existing OpenVoice source is not a Git checkout."

    OPENVOICE_REMOTE="$(
        git -C "$OPENVOICE_SRC" remote get-url origin
    )"
    ACTUAL_OPENVOICE_COMMIT="$(
        git -C "$OPENVOICE_SRC" rev-parse HEAD
    )"

    [[ "$OPENVOICE_REMOTE" == "https://github.com/myshell-ai/OpenVoice.git" ]] ||
        fail "Existing OpenVoice source origin is not official."

    [[ "$ACTUAL_OPENVOICE_COMMIT" == "$OPENVOICE_COMMIT" ]] ||
        fail "Existing OpenVoice source is not at the pinned commit."

    CREATED_OPENVOICE=0
    echo "PASS: Reusing verified pinned official source at $ACTUAL_OPENVOICE_COMMIT."
else
    CREATED_OPENVOICE=1
    git init -q "$OPENVOICE_SRC"
    git -C "$OPENVOICE_SRC" remote add origin \
        https://github.com/myshell-ai/OpenVoice.git
    git -C "$OPENVOICE_SRC" fetch \
        --depth 1 \
        origin \
        "$OPENVOICE_COMMIT"
    git -C "$OPENVOICE_SRC" checkout \
        --detach \
        FETCH_HEAD

    ACTUAL_OPENVOICE_COMMIT="$(
        git -C "$OPENVOICE_SRC" rev-parse HEAD
    )"

    [[ "$ACTUAL_OPENVOICE_COMMIT" == "$OPENVOICE_COMMIT" ]] ||
        fail "Pinned OpenVoice source commit mismatch."

    OPENVOICE_REMOTE="$(
        git -C "$OPENVOICE_SRC" remote get-url origin
    )"

    [[ "$OPENVOICE_REMOTE" == "https://github.com/myshell-ai/OpenVoice.git" ]] ||
        fail "Unexpected OpenVoice source origin."

    echo "PASS: Official source pinned at $ACTUAL_OPENVOICE_COMMIT."
fi

echo
echo "--- VERIFYING OPENVOICE SOURCE LICENCE ---"

OPENVOICE_LICENSE="$OPENVOICE_SRC/LICENSE"

[[ -f "$OPENVOICE_LICENSE" ]] ||
    fail "OpenVoice licence file is missing."

ACTUAL_OPENVOICE_LICENSE_SHA="$(
    sha256sum "$OPENVOICE_LICENSE" | awk '{print $1}'
)"

[[ "$ACTUAL_OPENVOICE_LICENSE_SHA" == "bb3541f421e6273d3a3e3dd5bdba2bd3b79a3c2eadca65cde9c62c2467903ac0" ]] ||
    fail "Pinned OpenVoice licence SHA-256 mismatch."

cp -a "$OPENVOICE_LICENSE" "$EVIDENCE/OpenVoice-LICENSE.txt"
echo "PASS: Exact pinned MIT licence verified and archived."

echo
echo "--- CLONING OFFICIAL MYSHELL MODEL REPOSITORY ---"

CREATED_MODEL_REPO=1
GIT_LFS_SKIP_SMUDGE=1 git clone \
    --depth 1 \
    https://huggingface.co/myshell-ai/OpenVoice \
    "$MODEL_REPO"

git -C "$MODEL_REPO" lfs install --local

git -C "$MODEL_REPO" lfs pull \
    --include="checkpoints/base_speakers/EN/*,checkpoints/converter/*" \
    --exclude=""

MODEL_REMOTE="$(
    git -C "$MODEL_REPO" remote get-url origin
)"

[[ "$MODEL_REMOTE" == "https://huggingface.co/myshell-ai/OpenVoice" ]] ||
    fail "Unexpected model repository origin."

MODEL_COMMIT="$(
    git -C "$MODEL_REPO" rev-parse HEAD
)"

[[ "$MODEL_COMMIT" == "$HF_HEAD" ]] ||
    fail "Official model repository commit changed during installation."

git -C "$MODEL_REPO" lfs fsck

echo "PASS: Official MyShell model repository downloaded at $MODEL_COMMIT."

echo
echo "--- VERIFYING REQUIRED OFFICIAL MODEL FILES ---"

BASE_DIR="$MODEL_REPO/checkpoints/base_speakers/EN"
CONVERTER_DIR="$MODEL_REPO/checkpoints/converter"

REQUIRED_FILES=(
    "$BASE_DIR/config.json"
    "$BASE_DIR/checkpoint.pth"
    "$BASE_DIR/en_default_se.pth"
    "$BASE_DIR/en_style_se.pth"
    "$CONVERTER_DIR/config.json"
    "$CONVERTER_DIR/checkpoint.pth"
)

for required in "${REQUIRED_FILES[@]}"; do
    [[ -s "$required" ]] ||
        fail "Required official model file is missing: $required"

    if head -c 80 "$required" 2>/dev/null |
       grep -q 'git-lfs.github.com/spec'; then
        fail "Git LFS pointer was not resolved: $required"
    fi

    printf '%s  %s\n' \
        "$(sha256sum "$required" | awk '{print $1}')" \
        "${required#"$MODEL_REPO"/}" |
    tee -a "$EVIDENCE/model-file-sha256.txt"
done

BASE_SIZE="$(stat -c '%s' "$BASE_DIR/checkpoint.pth")"
CONVERTER_SIZE="$(stat -c '%s' "$CONVERTER_DIR/checkpoint.pth")"

[[ "$BASE_SIZE" -gt 100000000 ]] ||
    fail "English base checkpoint is unexpectedly small."

[[ "$CONVERTER_SIZE" -gt 100000000 ]] ||
    fail "Tone converter checkpoint is unexpectedly small."

if [[ -f "$MODEL_REPO/README.md" ]]; then
    cp -a "$MODEL_REPO/README.md" \
        "$EVIDENCE/MyShell-OpenVoice-model-card.md"
fi

echo "PASS: Required English base and tone-converter files verified."

echo
echo "--- CREATING PYTHON 3.12 RUNTIME ---"

CREATED_VENV=1
python3.12 -m venv "$VENV"

"$VENV/bin/python" -m pip install \
    --upgrade \
    pip \
    setuptools \
    wheel

echo "PASS: Isolated Python 3.12 runtime created."

echo
echo "--- INSTALLING CPU-ONLY PYTORCH ---"

"$VENV/bin/python" -m pip install \
    --index-url https://download.pytorch.org/whl/cpu \
    "torch==2.5.1" \
    "torchaudio==2.5.1"

echo "PASS: CPU-only PyTorch installed."

echo
echo "--- INSTALLING PYTHON 3.12-COMPATIBLE AUDIO DEPENDENCIES ---"

"$VENV/bin/python" -m pip install \
    "numpy==1.26.4" \
    "scipy>=1.11,<1.15" \
    "librosa==0.10.2.post1" \
    "soundfile>=0.12.1,<0.14" \
    "pydub==0.25.1" \
    "eng_to_ipa==0.0.2" \
    "inflect==7.0.0" \
    "unidecode==1.3.7" \
    "pypinyin==0.50.0" \
    "cn2an==0.5.22" \
    "jieba==0.42.1" \
    "langid==1.1.6"

echo "PASS: Compatible local audio dependencies installed."

echo
echo "--- INSTALLING PINNED OPENVOICE CODE WITHOUT LEGACY PINS ---"

"$VENV/bin/python" -m pip install \
    --no-deps \
    -e "$OPENVOICE_SRC"

echo "PASS: Pinned OpenVoice source installed."

echo
echo "--- APPLYING EXPLICIT TRUSTED-CHECKPOINT LOAD COMPATIBILITY ---"

"$VENV/bin/python" - "$OPENVOICE_SRC/openvoice/api.py" <<'PY'
from pathlib import Path
import sys

path = Path(sys.argv[1])
text = path.read_text(encoding="utf-8")

old = (
    "checkpoint_dict = torch.load("
    "ckpt_path, map_location=torch.device(self.device))"
)
new = (
    "checkpoint_dict = torch.load("
    "ckpt_path, map_location=torch.device(self.device), "
    "weights_only=False)"
)

if new in text:
    print("Compatibility patch was already present.")
elif old in text:
    path.write_text(text.replace(old, new, 1), encoding="utf-8")
    print("PASS: Added explicit weights_only=False for official trusted checkpoints.")
else:
    raise SystemExit("Expected torch.load statement was not found.")
PY

PATCHED_API_SHA="$(
    sha256sum "$OPENVOICE_SRC/openvoice/api.py" |
    awk '{print $1}'
)"
echo "Patched api.py SHA-256: $PATCHED_API_SHA"

echo
echo "--- LOADING OFFICIAL MODELS ON CPU ---"

"$VENV/bin/python" - \
    "$BASE_DIR" \
    "$CONVERTER_DIR" <<'PY'
import sys
from pathlib import Path

base_dir = Path(sys.argv[1])
converter_dir = Path(sys.argv[2])

import torch
import torchaudio
from openvoice.api import BaseSpeakerTTS, ToneColorConverter

if torch.cuda.is_available():
    raise SystemExit("Unexpected CUDA runtime; SHiRE Voice must use CPU here.")

base = BaseSpeakerTTS(
    str(base_dir / "config.json"),
    device="cpu",
)
base.load_ckpt(str(base_dir / "checkpoint.pth"))

converter = ToneColorConverter(
    str(converter_dir / "config.json"),
    device="cpu",
    enable_watermark=False,
)
converter.load_ckpt(str(converter_dir / "checkpoint.pth"))

source_se = torch.load(
    str(base_dir / "en_default_se.pth"),
    map_location="cpu",
    weights_only=False,
)

if source_se.numel() == 0:
    raise SystemExit("English source speaker embedding is empty.")

print("PASS: torch:", torch.__version__)
print("PASS: torchaudio:", torchaudio.__version__)
print("PASS: English base speaker loaded on CPU.")
print("PASS: Tone-colour converter loaded on CPU.")
print("PASS: English source embedding loaded.")
print("PASS: Watermark network disabled for this local bootstrap test.")
PY

echo
echo "--- RECORDING REPRODUCIBLE ENGINE MANIFEST ---"

"$VENV/bin/python" -m pip freeze \
    > "$EVIDENCE/python-packages.txt"

cat > "$EVIDENCE/engine-manifest.json" <<EOF
{
  "schema": "shire.voice.engine.bootstrap.v1",
  "created_utc": "$(date -u --iso-8601=seconds)",
  "engine": "OpenVoice V1",
  "source_origin": "official MyShell GitHub",
  "source_commit": "$OPENVOICE_COMMIT",
  "model_origin": "official myshell-ai/OpenVoice Hugging Face repository",
  "model_commit": "$MODEL_COMMIT",
  "device": "cpu",
  "python": "$("$VENV/bin/python" --version 2>&1)",
  "torch": "$("$VENV/bin/python" -c 'import torch; print(torch.__version__)')",
  "patched_api_sha256": "$PATCHED_API_SHA",
  "encrypted_dataset_sha256": "$EXPECTED_DATASET_SHA",
  "dataset_decrypted": false,
  "speaker_profile_created": false,
  "synthetic_audio_generated": false
}
EOF

chmod -R go-rwx "$VOICE_ROOT"

FINAL_DATASET_SHA="$(
    sha256sum "$DATASET" |
    awk '{print $1}'
)"

[[ "$FINAL_DATASET_SHA" == "$EXPECTED_DATASET_SHA" ]] ||
    fail "Encrypted dataset changed unexpectedly."

FINAL_SENTINEL_SHA="$(
    sha256sum "$SENTINEL" |
    awk '{print $1}'
)"

[[ "$FINAL_SENTINEL_SHA" == "$EXPECTED_SENTINEL_SHA" ]] ||
    fail "Sentinel changed unexpectedly."

trap - ERR

echo
echo "============================================================"
echo " SHIRE OFFICIAL OPENVOICE V1 BOOTSTRAP PASSED"
echo "============================================================"
echo "Runtime:       $VENV"
echo "Source commit: $OPENVOICE_COMMIT"
echo "Model commit:  $MODEL_COMMIT"
echo "Models:        $MODEL_REPO/checkpoints"
echo "Evidence:      $EVIDENCE"
echo
echo "Encrypted dataset decrypted: no"
echo "Ray speaker profile extracted: no"
echo "Synthetic test phrase generated: no"
echo "User audio uploaded: no"
echo "Public service opened: no"
echo "Sentinel modified or restarted: no"
echo "Academy changed: no"
echo "Forge remains locked: yes"