scripts/d1_entrypoint.sh

#!/bin/sh
# AmanPay container entrypoint — opt-in one-shot D1 runtime diagnostic, then exec the app.
#
# Default behavior (flag absent/0): immediately exec the app command UNCHANGED — zero overhead,
# no diagnostic, D1 fully dormant.
#
# When AMANPAY_D1_RUNTIME_DIAGNOSTIC=1: run scripts/d1_space_diagnostic.py ONCE (best-effort),
# then continue into ordinary startup. The diagnostic enables no storage, creates no database,
# restores/creates no snapshot, enables no WAL, exposes no endpoint, and must never block startup.
#
# Signal forwarding + clean shutdown are preserved by `exec`-ing the final app process (it becomes
# PID 1's replacement / receives SIGTERM directly).
set -eu

if [ "${AMANPAY_D1_RUNTIME_DIAGNOSTIC:-0}" = "1" ]; then
    echo "[d1-entrypoint] AMANPAY_D1_RUNTIME_DIAGNOSTIC=1 → running one-shot runtime diagnostic (dormant probe)"
    # Never fatal: a failing/absent diagnostic must not prevent the application from starting.
    python scripts/d1_space_diagnostic.py \
        || echo "[d1-entrypoint] diagnostic exited non-zero (non-fatal); continuing to app startup"
else
    : # diagnostic disabled by default — no-op
fi

# D1.2 in-Space synthetic rollback-journal recovery proof (opt-in, isolated, fail-safe). Runs a
# single stage (create|restore|negatives) only when AMANPAY_D1_SPACE_PROOF=1, then continues into
# ordinary startup. It never enables customer storage/WAL, exposes no endpoint, and is never fatal.
if [ "${AMANPAY_D1_SPACE_PROOF:-0}" = "1" ]; then
    echo "[d1-entrypoint] AMANPAY_D1_SPACE_PROOF=1 → running in-Space proof (stage=${AMANPAY_D1_SPACE_PROOF_STAGE:-create})"
    python scripts/d1_space_proof.py \
        || echo "[d1-entrypoint] space-proof exited non-zero (non-fatal); continuing to app startup"
fi

# D2 in-Space synthetic identity/lifecycle + recovery proof (opt-in, isolated, fail-safe). Runs a
# single stage (full|verify|negatives) only when AMANPAY_D2_SPACE_PROOF=1, then continues into
# ordinary startup. Strictly synthetic, no WAL, no participant data, never fatal.
if [ "${AMANPAY_D2_SPACE_PROOF:-0}" = "1" ]; then
    echo "[d1-entrypoint] AMANPAY_D2_SPACE_PROOF=1 → running D2 in-Space proof (stage=${AMANPAY_D2_SPACE_PROOF_STAGE:-full})"
    python scripts/d2_space_proof.py \
        || echo "[d1-entrypoint] d2-space-proof exited non-zero (non-fatal); continuing to app startup"
fi

# Hand off to the application as PID-equivalent so SIGTERM/SIGINT reach it directly.
exec "$@"