@ngocsangairvds/vsaf 4.0.6 → 4.0.8

package/skills/vds-skill/vds-scripts/scripts/deploy-bootstrap.sh

@@ -0,0 +1,201 @@
+#!/usr/bin/env bash
+# =============================================================================
+# VDS Deploy-from-Scratch Bootstrap
+# =============================================================================
+# Phase: ecosystem-infrastructure-evolution v2.16.0
+#
+# Single-command deploy for a fresh machine. Handles:
+#   1. Prerequisite checks (docker, compose plugin)
+#   2. ~/.vds/.env creation from template (interactive: prompts for secrets)
+#   3. docker/.env → ~/.vds/.env symlink
+#   4. PgBouncer userlist.txt generation
+#   5. Image builds (all orchestrators)
+#   6. Infra bring-up (postgres, redis, qdrant, pgbouncer)
+#   7. Wait for health
+#   8. Explicit alembic migrations (audit, progress — memory + scheduler auto-migrate)
+#   9. Service bring-up
+#  10. Smoke test
+#
+# Usage:
+#   bash scripts/deploy-bootstrap.sh              # guided (prompts for secrets)
+#   bash scripts/deploy-bootstrap.sh --non-interactive  # CI mode (pre-existing .env)
+#
+# Environment:
+#   VDS_DEPLOY_SKIP_BUILD=1     skip image builds
+#   VDS_DEPLOY_SKIP_MIGRATE=1   skip explicit migrations
+#   VDS_DEPLOY_SKIP_SMOKE=1     skip smoke test
+# =============================================================================
+
+set -euo pipefail
+
+RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
+log()  { echo -e "${GREEN}[DEPLOY]${NC} $(date '+%H:%M:%S') $*"; }
+warn() { echo -e "${YELLOW}[WARN]${NC}  $(date '+%H:%M:%S') $*"; }
+err()  { echo -e "${RED}[ERROR]${NC} $(date '+%H:%M:%S') $*"; exit 1; }
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+DOCKER_DIR="$REPO_ROOT/docker"
+INTERACTIVE=true
+[[ "${1:-}" == "--non-interactive" ]] && INTERACTIVE=false
+
+log "VDS Deploy Bootstrap — $(date '+%Y-%m-%d')"
+log "Repo root: $REPO_ROOT"
+
+# ── 1. Prerequisites ─────────────────────────────────────────────────────────
+log "Checking prerequisites..."
+command -v docker >/dev/null 2>&1 || err "docker not found — install Docker first"
+docker compose version >/dev/null 2>&1 || err "docker compose plugin not found"
+docker info >/dev/null 2>&1 || err "docker daemon not running — start Docker first"
+
+# ── 2. ~/.vds/.env ────────────────────────────────────────────────────────────
+log "Setting up ~/.vds/.env..."
+if [ ! -f "$HOME/.vds/.env" ]; then
+  if [ -f "$DOCKER_DIR/infrastructure/.env.template" ]; then
+    cp "$DOCKER_DIR/infrastructure/.env.template" "$HOME/.vds/.env"
+    chmod 600 "$HOME/.vds/.env"
+    log "Created ~/.vds/.env from template"
+    if $INTERACTIVE; then
+      echo ""
+      warn "Default secrets detected in ~/.vds/.env."
+      warn "Run: bash scripts/rotate-secrets.sh   (to regenerate all credentials)"
+      echo ""
+    fi
+  else
+    err "No .env.template found at $DOCKER_DIR/infrastructure/.env.template"
+  fi
+else
+  log "~/.vds/.env already exists — skipping"
+fi
+
+# ── 3. docker/.env symlink ────────────────────────────────────────────────────
+log "Setting up docker/.env → ~/.vds/.env symlink..."
+if [ ! -L "$DOCKER_DIR/.env" ] || [ "$(readlink "$DOCKER_DIR/.env")" != "$HOME/.vds/.env" ]; then
+  rm -f "$DOCKER_DIR/.env"
+  ln -sf "$HOME/.vds/.env" "$DOCKER_DIR/.env"
+  log "Symlinked docker/.env → ~/.vds/.env"
+else
+  log "docker/.env symlink already correct"
+fi
+
+# Source env for compose variable interpolation
+set -a; source "$HOME/.vds/.env"; set +a
+
+# ── 4. PgBouncer userlist ─────────────────────────────────────────────────────
+log "Initializing PgBouncer userlist.txt..."
+USERLIST="$DOCKER_DIR/infrastructure/pgbouncer/userlist.txt"
+if [ ! -f "$USERLIST" ] || [ "$(wc -l < "$USERLIST")" -lt 3 ]; then
+  bash "$SCRIPT_DIR/init-pgbouncer-userlist.sh" 2>/dev/null || {
+    warn "init-pgbouncer-userlist.sh failed — generating minimal userlist"
+    cat > "$USERLIST" <<EOF
+"pgbouncer_admin" "${PGBOUNCER_ADMIN_PASSWORD:-pgbouncer_admin_secret_change_me}"
+"pgbouncer_stats" "${PGBOUNCER_STATS_PASSWORD:-pgbouncer_stats_secret_change_me}"
+"pgbouncer_auth"  "${PGBOUNCER_AUTH_PASSWORD:-pgbouncer_auth_secret_change_me}"
+"postgres"        "${VDS_POSTGRES_PASSWORD:-vds_postgres_secret}"
+EOF
+  }
+  log "userlist.txt created"
+else
+  log "userlist.txt already populated — skipping"
+fi
+
+# ── 5. Build images ───────────────────────────────────────────────────────────
+if [ "${VDS_DEPLOY_SKIP_BUILD:-0}" = "1" ]; then
+  log "Skipping builds (VDS_DEPLOY_SKIP_BUILD=1)"
+else
+  log "Building orchestrator images..."
+  docker compose -p vds-platform \
+    -f "$DOCKER_DIR/docker-compose.infra.yml" \
+    -f "$DOCKER_DIR/docker-compose.services.yml" \
+    -f "$DOCKER_DIR/docker-compose.cli.yml" \
+    --profile full build --parallel 2>&1 | tail -3
+  log "Builds complete"
+fi
+
+# ── 6. Infra bring-up ─────────────────────────────────────────────────────────
+log "Starting shared infrastructure..."
+docker compose -p vds-platform \
+  -f "$DOCKER_DIR/docker-compose.infra.yml" \
+  up -d --wait 2>&1 | tail -5
+
+# Verify
+for svc in vds-postgres vds-redis vds-qdrant vds-pgbouncer; do
+  if docker ps --format '{{.Names}}' | grep -q "$svc"; then
+    log "  $svc — RUNNING"
+  else
+    err "  $svc — NOT RUNNING — check docker logs $svc"
+  fi
+done
+
+# ── 7. Health wait ────────────────────────────────────────────────────────────
+log "Waiting for all infra services healthy..."
+ATTEMPTS=0; MAX_ATTEMPTS=60
+while [ $ATTEMPTS -lt $MAX_ATTEMPTS ]; do
+  UNHEALTHY=$(docker ps --filter "name=vds-" --format '{{.Names}} {{.Status}}' | grep -v "healthy" || true)
+  if [ -z "$UNHEALTHY" ]; then
+    log "All services healthy"
+    break
+  fi
+  ATTEMPTS=$((ATTEMPTS + 1))
+  sleep 2
+done
+if [ $ATTEMPTS -ge $MAX_ATTEMPTS ]; then
+  err "Services did not become healthy within 120s"
+fi
+
+# ── 8. Explicit alembic migrations ────────────────────────────────────────────
+if [ "${VDS_DEPLOY_SKIP_MIGRATE:-0}" = "1" ]; then
+  log "Skipping explicit migrations (VDS_DEPLOY_SKIP_MIGRATE=1)"
+else
+  log "Running explicit alembic migrations (audit, progress)..."
+  for orch in audit progress; do
+    svc="$orch-orchestrator"
+    ini="/app/${orch}_orchestrator/alembic.ini"
+    log "  Migrating $orch..."
+    docker compose -p vds-platform \
+      -f "$DOCKER_DIR/docker-compose.infra.yml" \
+      -f "$DOCKER_DIR/docker-compose.services.yml" \
+      -f "$DOCKER_DIR/docker-compose.cli.yml" \
+      --profile "$orch" \
+      run --rm --no-deps --entrypoint /opt/venv/bin/alembic "$svc" \
+      -c "$ini" upgrade head 2>&1 | tail -2 || warn "  $orch migration failed — may already be up-to-date"
+  done
+  log "Explicit migrations complete"
+fi
+# Memory + Scheduler auto-migrate via their entrypoint.sh — no action needed here
+
+# ── 9. Service bring-up ───────────────────────────────────────────────────────
+log "Starting platform services..."
+docker compose -p vds-platform \
+  -f "$DOCKER_DIR/docker-compose.infra.yml" \
+  -f "$DOCKER_DIR/docker-compose.services.yml" \
+  -f "$DOCKER_DIR/docker-compose.cli.yml" \
+  --profile memory --profile scheduler --profile multi-agent \
+  up -d --wait 2>&1 | tail -5
+
+# ── 10. Smoke test ────────────────────────────────────────────────────────────
+if [ "${VDS_DEPLOY_SKIP_SMOKE:-0}" = "1" ]; then
+  log "Skipping smoke test (VDS_DEPLOY_SKIP_SMOKE=1)"
+else
+  log "Smoke testing endpoints..."
+  for endpoint in \
+    "http://localhost:8000/health memory-api" \
+    "http://localhost:8005/health scheduler" \
+    "http://localhost:8003/health multi-agent"; do
+    url="${endpoint% *}"; name="${endpoint##* }"
+    if curl -sf "$url" >/dev/null 2>&1; then
+      log "  $name — OK ($url)"
+    else
+      warn "  $name — UNREACHABLE ($url)"
+    fi
+  done
+fi
+
+# ── Done ──────────────────────────────────────────────────────────────────────
+echo ""
+log "Deploy complete."
+log "  Services:  memory-api (8000) | scheduler (8005) | multi-agent (8003)"
+log "  Infra:     postgres (5432) | redis (6379) | qdrant (6335) | pgbouncer (6432)"
+log "  Logs:      docker compose -p vds-platform logs -f <service>"
+log "  Stop:      docker compose -p vds-platform --profile full down"
+echo ""

package/skills/vds-skill/vds-scripts/scripts/deployment/load_docker_images_offline.sh

@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat <<'USAGE'
+Usage:
+  load_docker_images_offline.sh --images-dir <directory-with-tar-files> [--dry-run]
+  load_docker_images_offline.sh --image <path-to-image.tar> [--image <path-to-image.tar> ...] [--dry-run]
+
+Description:
+  Load one or more Docker image tar archives in air-gapped/offline deployments.
+
+Options:
+  --images-dir <dir>   Directory containing *.tar Docker image archives
+  --image <path>       Single Docker image tar archive (can be repeated)
+  --dry-run            Print planned docker load commands without executing
+  -h, --help           Show this help
+USAGE
+}
+
+IMAGES_DIR=""
+DRY_RUN=false
+declare -a IMAGE_FILES=()
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --images-dir)
+      shift
+      IMAGES_DIR="${1:-}"
+      ;;
+    --image)
+      shift
+      IMAGE_FILES+=("${1:-}")
+      ;;
+    --dry-run)
+      DRY_RUN=true
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown option: $1" >&2
+      usage
+      exit 2
+      ;;
+  esac
+  shift
+done
+
+if [[ -n "$IMAGES_DIR" && ${#IMAGE_FILES[@]} -gt 0 ]]; then
+  echo "Use either --images-dir or --image, not both." >&2
+  exit 2
+fi
+
+if [[ -n "$IMAGES_DIR" ]]; then
+  if [[ ! -d "$IMAGES_DIR" ]]; then
+    echo "Images directory not found: $IMAGES_DIR" >&2
+    exit 2
+  fi
+  while IFS= read -r -d '' tar_file; do
+    IMAGE_FILES+=("$tar_file")
+  done < <(find "$IMAGES_DIR" -maxdepth 1 -type f -name '*.tar' -print0 | sort -z)
+fi
+
+if [[ ${#IMAGE_FILES[@]} -eq 0 ]]; then
+  echo "No image tar files provided." >&2
+  usage
+  exit 2
+fi
+
+echo "Loading ${#IMAGE_FILES[@]} image archive(s)..."
+
+loaded_count=0
+for image_tar in "${IMAGE_FILES[@]}"; do
+  if [[ ! -f "$image_tar" ]]; then
+    echo "Missing image archive: $image_tar" >&2
+    exit 2
+  fi
+
+  if [[ "$DRY_RUN" == "true" ]]; then
+    echo "[dry-run] docker load -i \"$image_tar\""
+  else
+    echo "docker load -i \"$image_tar\""
+    docker load -i "$image_tar"
+  fi
+  loaded_count=$((loaded_count + 1))
+done
+
+echo "Completed. Processed $loaded_count archive(s)."

package/skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

@@ -0,0 +1,259 @@
+#!/usr/bin/env bash
+# scripts/dev/cli_smoke.sh — v2.0.17 N.47 (TSK-N.31 closeout)
+#
+# Comprehensive real-CLI smoke matrix for the scheduler orchestrator.
+# Codifies the 30-command sweep that surfaced G19/G20/G21/G22/G29 in v2.0.15.
+# Each step is tagged with the FR / G-finding it covers.
+#
+# Usage:
+#   ./scripts/dev/cli_smoke.sh           # run against localhost:8005
+#   VDS_SCHEDULER_BASE_URL=http://other:8005 ./scripts/dev/cli_smoke.sh
+#
+# Prerequisites:
+#   - Running scheduler container (docker compose --profile scheduler up -d)
+#   - VDS_SCHEDULER_ENABLED=true (kill switch on)
+#   - VDS_SCHEDULER_CAPABILITY=admin (for write ops; falls back to error path)
+#
+# Each test step prints PASS / FAIL / SKIP and a one-line summary. The script
+# exits 0 only if every PASS-required step passed. Cleanup uses the platform
+# capability to delete test artifacts.
+
+set -uo pipefail
+
+VDS_SCHEDULER_BASE_URL="${VDS_SCHEDULER_BASE_URL:-http://localhost:8005}"
+CLI="${VDS_CLI:-./.venv/bin/vds-cli}"
+SUFFIX="$(date +%Y%m%d-%H%M%S)"
+
+# ── Output helpers ────────────────────────────────────────────────────────────
+PASS_COUNT=0
+FAIL_COUNT=0
+SKIP_COUNT=0
+FAILURES=()
+
+pass() { echo "  ✅ PASS — $1"; PASS_COUNT=$((PASS_COUNT + 1)); }
+fail() { echo "  ❌ FAIL — $1"; FAIL_COUNT=$((FAIL_COUNT + 1)); FAILURES+=("$1"); }
+skip() { echo "  ⏭  SKIP — $1"; SKIP_COUNT=$((SKIP_COUNT + 1)); }
+section() { echo ""; echo "═══ $1 ═══"; }
+
+assert_status_eq() {
+    local desc="$1" expected="$2" actual="$3"
+    if [[ "$actual" == *"$expected"* ]]; then pass "$desc"; else fail "$desc — expected '$expected', got '$actual'"; fi
+}
+
+# ── Pre-flight ────────────────────────────────────────────────────────────────
+section "Pre-flight"
+if ! curl -s --max-time 3 "$VDS_SCHEDULER_BASE_URL/health" > /dev/null 2>&1; then
+    echo "FATAL: scheduler unreachable at $VDS_SCHEDULER_BASE_URL"
+    exit 2
+fi
+HEALTH=$(curl -s "$VDS_SCHEDULER_BASE_URL/health" | python3 -c "import sys,json; print(json.load(sys.stdin)['status'])" 2>/dev/null || echo "unknown")
+assert_status_eq "/health returns ok" "ok" "$HEALTH"
+
+KILL_SWITCH=$(curl -s "$VDS_SCHEDULER_BASE_URL/health" | python3 -c "import sys,json; print(json.load(sys.stdin)['scheduler_enabled'])" 2>/dev/null)
+if [[ "$KILL_SWITCH" != "True" && "$KILL_SWITCH" != "true" ]]; then
+    skip "kill switch is OFF — write-side tests will be incomplete (set VDS_SCHEDULER_ENABLED=true to fully exercise)"
+fi
+
+# ── Auth-aware curl helper (v2.0.18 — auto-attach API key when AUTH is on) ────
+# When VDS_SCHEDULER_AUTH_REQUIRED=true is set in the running scheduler, every
+# /api/v1/* probe needs X-VDS-Scheduler-Key. Detect via /health and auto-attach
+# from VDS_SCHEDULER_API_KEY env so downstream tests don't all 401 in auth-mode.
+AUTH_HEADER=()
+if [[ -n "${VDS_SCHEDULER_API_KEY:-}" ]]; then
+    POSTURE_PROBE=$(curl -s "$VDS_SCHEDULER_BASE_URL/health" | python3 -c "import sys,json; print(json.load(sys.stdin).get('auth_posture','unknown'))" 2>/dev/null || echo "unknown")
+    if [[ "$POSTURE_PROBE" == "required" ]]; then
+        AUTH_HEADER=(-H "X-VDS-Scheduler-Key: $VDS_SCHEDULER_API_KEY")
+        echo "  ℹ  AUTH detected as required — auto-attaching X-VDS-Scheduler-Key to /api/v1/* probes"
+    fi
+fi
+
+# ── Health endpoint contract ──────────────────────────────────────────────────
+section "Health endpoint contract"
+FULL=$(curl -s "${AUTH_HEADER[@]:-}" "$VDS_SCHEDULER_BASE_URL/api/v1/health/full")
+echo "$FULL" | python3 -c "import sys,json; d=json.load(sys.stdin); assert 'layers' in d and 'dbos' in d['layers'] and 'db' in d['layers']" 2>/dev/null \
+    && pass "/api/v1/health/full has dbos + db layer keys" \
+    || fail "/api/v1/health/full missing required layer keys"
+
+# ── Output extractor: strips uv/typer warnings, captures meaningful response ──
+# CLI may emit warnings (`warning: The package …`) ahead of the real response.
+# Extract by content (HTTP NNN or JSON) rather than by line position.
+extract_resp() {
+    # Concatenate the entire CLI output, then pull the first HTTP NNN match
+    # OR the first {…}-style JSON line. Fallback: the last non-warning line.
+    local all="$1"
+    local http
+    http=$(echo "$all" | grep -oE 'HTTP [0-9]{3}' | head -1)
+    if [[ -n "$http" ]]; then
+        # Include the trailing detail body (everything after the first HTTP NNN)
+        echo "$all" | sed -nE '/HTTP [0-9]{3}/,$p' | tr -d '\n'
+        return
+    fi
+    # No HTTP code → return JSON-or-trailing line, with warnings stripped
+    echo "$all" | grep -vE '^warning:' | tail -1
+}
+
+# ── G19: unknown FQN-shaped alias is permitted with deprecation warning ──────
+# FR-11.3: FQN-based create is permitted as a fallback but emits a deprecation
+# warning. Unknown FQN → schedule created (HTTP 201), warning emitted; failure
+# only at fire time when the dispatcher tries to import the module. (Was "must
+# be 400" pre-v2.0.20 — corrected to match the spec contract. Warn-to-reject
+# promotion deferred to v2.1.0+ when FR-11.3 deprecation matures.)
+section "G19 — unknown FQN alias permitted with deprecation warning (FR-11.3)"
+SCHED_NAME="smoke-g19-$SUFFIX"
+RESP=$(extract_resp "$("$CLI" scheduler schedules create "$SCHED_NAME" --workflow "totally.fake.alias" --cron "0 9 * * *" --queue ops-default 2>&1)")
+if [[ "$RESP" == *"HTTP 201"* || "$RESP" == *'"schedule_name"'* ]]; then
+    pass "FQN alias create returns 201 per FR-11.3"
+else
+    fail "FQN alias create unexpected response: ${RESP:0:120}"
+fi
+# Cleanup: delete the orphan schedule (would never fire successfully).
+curl -s -o /dev/null -X DELETE "${AUTH_HEADER[@]:-}" -H "X-Capability: platform" "$VDS_SCHEDULER_BASE_URL/api/v1/schedules/$SCHED_NAME"
+
+# ── G20: unknown queue on chains → 400 (was 201) ──────────────────────────────
+section "G20 — chains create with unknown queue maps to 400"
+RESP=$(extract_resp "$("$CLI" scheduler chains create "smoke-g20-$SUFFIX" --trigger "event:foo" --target "scheduler.autoscale" --queue "fake_q" 2>&1)")
+assert_status_eq "chains bad queue → 400" "HTTP 400" "$RESP"
+
+# ── G21: secret scanner — all 10 patterns ─────────────────────────────────────
+section "G21 — secret scanner (10 pattern classes)"
+test_secret() {
+    local name="$1" payload="$2"
+    local resp
+    resp=$(extract_resp "$("$CLI" scheduler events publish "smoke-g21.$name.$SUFFIX" --payload "$payload" 2>&1)")
+    if [[ "$resp" == *"HTTP 400"* ]] && [[ "$resp" == *"secret"* ]]; then
+        pass "$name pattern blocked"
+    elif [[ "$resp" == *event_id* ]]; then
+        fail "$name pattern NOT blocked (HTTP 201 — security regression)"
+    else
+        fail "$name pattern unexpected response: ${resp:0:80}"
+    fi
+}
+test_secret "aws_key" '{"k":"AKIAIOSFODNN7EXAMPLE"}'
+test_secret "github_pat" '{"k":"ghp_1234567890abcdefghij1234567890abcdef12"}'
+test_secret "jwt" '{"jwt":"eyJabc.eyJxyz.signature"}'
+test_secret "slack" '{"k":"xoxb-1234567890-abcdefg"}'
+test_secret "gcp" '{"k":"AIzaSyDuMmYyAaBbCcDdEeFfGgHhIiJjKkLlMm0"}'
+test_secret "stripe" '{"k":"sk_live_1234567890abcdefghij1234"}'
+test_secret "bearer" '{"k":"Bearer ya29.A0AfH6SMA-fake"}'
+
+# ── TSK-N.62: chains capability gating ────────────────────────────────────────
+# Verifies the full guest→403 / platform→201/204 matrix. Auto-attaches API key
+# via $AUTH_HEADER when AUTH_REQUIRED=true so capability test isn't masked by 401.
+section "TSK-N.62 — chains capability gating (guest 403 / platform 201/204)"
+CHAIN_NAME="smoke-n62-$SUFFIX"
+# Step 1: create as platform (must succeed) so we have a chain to delete-test against
+CREATE_RESP=$(curl -s -o /dev/null -w "%{http_code}" -X POST "${AUTH_HEADER[@]:-}" \
+  -H "Content-Type: application/json" \
+  -H "X-Capability: platform" \
+  -d "{\"chain_name\":\"$CHAIN_NAME\",\"trigger_kind\":\"on_complete\",\"trigger_source\":\"scheduler.autoscale\",\"target_workflow_fqn\":\"scheduler.health_check\"}" \
+  "$VDS_SCHEDULER_BASE_URL/api/v1/chains")
+case "$CREATE_RESP" in
+    201) pass "chain create as platform → 201" ;;
+    *)   fail "chain create as platform unexpected status: $CREATE_RESP" ;;
+esac
+# Step 2: delete as guest (must be 403)
+DEL_RESP=$(curl -s -o /dev/null -w "%{http_code}" -X DELETE "${AUTH_HEADER[@]:-}" \
+  -H "X-Capability: guest" \
+  "$VDS_SCHEDULER_BASE_URL/api/v1/chains/$CHAIN_NAME")
+case "$DEL_RESP" in
+    403) pass "chain delete as guest → 403 (capability gate enforced)" ;;
+    204) fail "TSK-N.62 regression — guest deleted platform-owned chain (privilege escalation)" ;;
+    401) skip "AUTH on but VDS_SCHEDULER_API_KEY not in env — set it to exercise capability gate" ;;
+    *)   fail "chain delete as guest unexpected status: $DEL_RESP" ;;
+esac
+# Step 3: cleanup as platform
+curl -s -o /dev/null -X DELETE "${AUTH_HEADER[@]:-}" -H "X-Capability: platform" "$VDS_SCHEDULER_BASE_URL/api/v1/chains/$CHAIN_NAME"
+
+# ── TSK-N.63: auth-flag posture check ─────────────────────────────────────────
+section "TSK-N.63 — auth posture check"
+AUTH_HEALTH=$(curl -s "$VDS_SCHEDULER_BASE_URL/health" | python3 -c "import sys,json; print(json.load(sys.stdin).get('auth_posture','unknown'))" 2>/dev/null || echo "unknown")
+if [[ "$AUTH_HEALTH" == "required" ]]; then
+    pass "auth_posture=required detected"
+    API_KEY="${VDS_SCHEDULER_API_KEY:-}"
+    if [[ -n "$API_KEY" ]]; then
+        RESP=$(curl -s -o /dev/null -w "%{http_code}" -H "X-VDS-Scheduler-Key: $API_KEY" "$VDS_SCHEDULER_BASE_URL/api/v1/schedules")
+        if [[ "$RESP" == "200" ]]; then pass "auth enabled — valid key returns 200 ($RESP)"
+        else fail "auth enabled — valid key returned $RESP (expected 200)"; fi
+    else
+        skip "VDS_SCHEDULER_API_KEY not set — cannot test valid key path"
+    fi
+    RESP=$(curl -s -o /dev/null -w "%{http_code}" "$VDS_SCHEDULER_BASE_URL/api/v1/schedules")
+    if [[ "$RESP" == "401" ]]; then pass "auth enabled — no key returns 401 ($RESP)"
+    else fail "auth enabled — no key returned $RESP (expected 401)"; fi
+elif [[ "$AUTH_HEALTH" == "optional" ]]; then
+    pass "auth_posture=optional (default)"
+    RESP=$(curl -s -o /dev/null -w "%{http_code}" "$VDS_SCHEDULER_BASE_URL/api/v1/schedules")
+    if [[ "$RESP" == "200" ]]; then pass "auth optional — no key returns 200 ($RESP)"
+    else fail "auth optional — no key returned $RESP (expected 200)"; fi
+else
+    skip "auth_posture unknown: $AUTH_HEALTH"
+fi
+
+# ── G22: events publish --trace-id flows ──────────────────────────────────────
+section "G22 — events publish --trace-id round-trips"
+TID="smoke-tid-$SUFFIX"
+RESP=$("$CLI" scheduler events publish "smoke-g22.$SUFFIX" --payload '{"x":1}' --trace-id "$TID" 2>&1 | grep -vE '^warning:')
+if [[ "$RESP" == *"\"trace_id\": \"$TID\""* ]]; then pass "trace_id round-trips"; else fail "trace_id missing — got: ${RESP:0:80}"; fi
+
+# ── G29: capability mismatch → 403 (was 500) ──────────────────────────────────
+section "G29 — capability mismatch maps to HTTP 403"
+# Test against the seed schedule `evolution-auto-promote` (owner =
+# evolution_orchestrator). Send X-Capability: guest, which doesn't match
+# the owner and isn't 'platform' — must surface as HTTP 403, not 500.
+# Pre-v2.0.17 G29 used `audit-deep-monthly` which is no longer in the
+# shared-infra seed; the smoke step was masked by the idempotent NOT-FOUND
+# 204 path. v2.0.17 G29-followup landed X-Capability header extraction so
+# this step now exercises the route → domain wiring end-to-end.
+RESP=$(curl -s -o /dev/null -w "%{http_code}" -X DELETE "${AUTH_HEADER[@]:-}" -H "X-Capability: guest" "$VDS_SCHEDULER_BASE_URL/api/v1/schedules/evolution-auto-promote")
+case "$RESP" in
+    403) pass "capability mismatch returns 403 ($RESP)" ;;
+    404) skip "schedule not present — 404 (seed missing evolution-auto-promote)" ;;
+    500) fail "G29 regression — DELETE returned 500 (CapabilityError leaked)" ;;
+    204) fail "G29 regression — DELETE returned 204 (privilege escalation: caller capability ignored)" ;;
+    401) skip "AUTH on but VDS_SCHEDULER_API_KEY not in env — set it to exercise capability gate" ;;
+    *) skip "unexpected status $RESP — manual investigation needed" ;;
+esac
+
+# ── G24 + N.39 + N.40: evolution.auto-promote workflow alive ──────────────────
+section "G24+N.39+N.40 — evolution.auto-promote workflow firing"
+EVO_COUNT=$("$CLI" scheduler workflows list --status all --since 5m --limit 20 2>&1 | python3 -c "import sys,json; d=json.load(sys.stdin); print(sum(1 for w in d if 'evolution_auto_promote' in w.get('name','')))" 2>/dev/null || echo "0")
+if [[ "$EVO_COUNT" -gt 0 ]]; then pass "evolution_auto_promote_workflow appeared $EVO_COUNT times in last 5m"; else skip "no evolution_auto_promote runs in window — kill switch OFF or wait longer"; fi
+
+# ── N.49: health endpoint DSN sanitization ────────────────────────────────────
+section "N.49 — health endpoint redacts DSN credentials"
+# This test requires the DB to be unreachable to surface the credential-leak path.
+# In a healthy system we just verify the response shape doesn't have plaintext DSN.
+ERROR_FIELD=$(echo "$FULL" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['layers']['db'].get('error',''))" 2>/dev/null)
+if [[ -n "$ERROR_FIELD" ]] && [[ "$ERROR_FIELD" == *"@"* ]] && [[ "$ERROR_FIELD" != *"[redacted]"* ]]; then
+    fail "DSN credentials leaked in /api/v1/health/full error: ${ERROR_FIELD:0:80}"
+else
+    pass "health/full does not leak DSN credentials (error: '$ERROR_FIELD')"
+fi
+
+# ── Read endpoints (reachability + shape) ─────────────────────────────────────
+section "Read endpoints"
+"$CLI" scheduler schedules list 2>&1 | python3 -c "import sys,json; d=json.load(sys.stdin); assert isinstance(d, list)" 2>/dev/null \
+    && pass "schedules list returns a JSON array" \
+    || fail "schedules list returned non-array"
+"$CLI" scheduler workflows registry list 2>&1 | python3 -c "import sys,json; d=json.load(sys.stdin); assert isinstance(d, list)" 2>/dev/null \
+    && pass "workflows registry list returns a JSON array" \
+    || fail "workflows registry list returned non-array"
+
+# ── Cleanup test artifacts ────────────────────────────────────────────────────
+section "Cleanup"
+docker exec vds-postgres psql -U postgres -d vds_platform -c "DELETE FROM sched.events_outbox WHERE topic LIKE 'smoke-%';" > /dev/null 2>&1 \
+    && pass "test events removed via SQL" \
+    || skip "SQL cleanup unavailable (not running against vds-postgres) — operator may need manual cleanup"
+
+# ── Summary ───────────────────────────────────────────────────────────────────
+echo ""
+echo "═══════════════════════════════════════════════"
+echo "Smoke matrix: $PASS_COUNT passed · $FAIL_COUNT failed · $SKIP_COUNT skipped"
+if [[ "$FAIL_COUNT" -gt 0 ]]; then
+    echo ""
+    echo "Failures:"
+    for f in "${FAILURES[@]}"; do echo "  - $f"; done
+    exit 1
+fi
+echo "═══════════════════════════════════════════════"
+exit 0