```bash
#!/usr/bin/env bash
set -euo pipefail

# selinux-boolean-assess.sh
#
# Purpose:
#   Safely inspect one or more SELinux booleans on CentOS, review their
#   descriptions, and optionally enable or disable a boolean at runtime or
#   persistently after confirmation.
#
# Usage:
#   ./selinux-boolean-assess.sh -b BOOLEAN_NAME [-s STATE] [-p] [-y]
#   ./selinux-boolean-assess.sh -l [FILTER]
#
# Examples:
#   ./selinux-boolean-assess.sh -b httpd_can_network_connect
#   ./selinux-boolean-assess.sh -b httpd_can_network_connect -s on -p -y
#   ./selinux-boolean-assess.sh -l httpd
#
# Notes:
#   - By default, the script only inspects and reports.
#   - Use -p to make a change persistent.
#   - Use -y to skip the interactive confirmation prompt.

usage() {
  cat <<'EOF'
Usage:
  selinux-boolean-assess.sh -b BOOLEAN_NAME [-s on|off] [-p] [-y]
  selinux-boolean-assess.sh -l [FILTER]

Options:
  -b BOOLEAN_NAME   Boolean to inspect or change.
  -s on|off         Desired state when changing a boolean (default: inspect only).
  -p                Make the change persistent with setsebool -P.
  -y                Skip confirmation prompt before changing a boolean.
  -l [FILTER]       List available SELinux booleans, optionally filtered.
  -h                Show this help message.
EOF
}

need_cmd() {
  command -v "$1" >/dev/null 2>&1 || {
    echo "Error: required command not found: $1" >&2
    exit 1
  }
}

list_booleans() {
  local filter="${1:-}"
  need_cmd semanage

  if [[ -n "$filter" ]]; then
    semanage boolean -l | grep -i -- "$filter" || true
  else
    semanage boolean -l
  fi
}

show_boolean() {
  local boolean_name="$1"
  need_cmd getsebool
  need_cmd semanage

  echo "== Current runtime state =="
  if ! getsebool "$boolean_name"; then
    echo "Note: getsebool could not read '$boolean_name'. Verify the boolean name on this host." >&2
  fi

  echo
  echo "== Policy description =="
  semanage boolean -l | awk -v b="$boolean_name" '$1 == b {print; found=1} END {if (!found) exit 1}' || {
    echo "Note: no matching entry found in 'semanage boolean -l' for '$boolean_name'." >&2
  }
}

change_boolean() {
  local boolean_name="$1"
  local desired_state="$2"
  local persistent="$3"
  local confirm="$4"

  need_cmd setsebool
  need_cmd getsebool

  if [[ "$desired_state" != "on" && "$desired_state" != "off" ]]; then
    echo "Error: state must be 'on' or 'off'." >&2
    exit 1
  fi

  echo "You are about to set '$boolean_name' to '$desired_state'${persistent:+ persistently}."
  echo "Current state:"
  getsebool "$boolean_name" || true
  echo

  if [[ "$confirm" != "yes" ]]; then
    read -r -p "Proceed? [y/N] " reply
    case "$reply" in
      y|Y|yes|YES) ;;
      *) echo "Aborted."; exit 0 ;;
    esac
  fi

  if [[ "$persistent" == "yes" ]]; then
    setsebool -P "$boolean_name" "$desired_state"
  else
    setsebool "$boolean_name" "$desired_state"
  fi

  echo "Updated state:"
  getsebool "$boolean_name" || true
}

main() {
  local boolean_name=""
  local state=""
  local persistent="no"
  local confirm="no"
  local list_mode="no"
  local list_filter=""

  while getopts ":b:s:plyh" opt; do
    case "$opt" in
      b) boolean_name="$OPTARG" ;;
      s) state="$OPTARG" ;;
      p) persistent="yes" ;;
      y) confirm="yes" ;;
      l) list_mode="yes" ;;
      h) usage; exit 0 ;;
      :) echo "Error: option -$OPTARG requires an argument." >&2; usage; exit 1 ;;
      \?) echo "Error: invalid option -$OPTARG." >&2; usage; exit 1 ;;
    esac
  done
  shift $((OPTIND - 1))

  if [[ "$list_mode" == "yes" ]]; then
    list_filter="${1:-}"
    list_booleans "$list_filter"
    exit 0
  fi

  if [[ -z "$boolean_name" ]]; then
    echo "Error: -b BOOLEAN_NAME is required unless using -l." >&2
    usage
    exit 1
  fi

  if [[ -n "$state" || "$persistent" == "yes" ]]; then
    : "${state:=on}"
    change_boolean "$boolean_name" "$state" "$persistent" "$confirm"
  else
    show_boolean "$boolean_name"
  fi
}

main "$@"
```