@ngocsangairvds/vsaf 4.1.8 → 4.1.9

package/skills/vds-skill/vds-scripts/scripts/verify-memory-cli-e2e.sh

@@ -1,598 +0,0 @@
-#!/usr/bin/env bash
-# =============================================================================
-# VDS AI Memory — End-to-End CLI Verification (VAMI-025)
-#
-# General-purpose smoke script that exercises the memory subsystem against
-# a live 6-container stack. Replaces the stale verify-vami017-smoke.sh
-# (which hard-coded a dead worktree path). This one uses the repo-anchored
-# `./scripts/worktree_uv.sh run --project vds_cli vds-cli memory` pattern so
-# it works from any checkout.
-#
-# Scenarios covered (26 cases, no mocks — all against ${VDS_MEMORY_API_URL} default localhost:8010):
-#   S1  health check — service and mem0 sync layers report healthy
-#   S2  stats snapshot — totals, Redis connectivity, bg tasks
-#   S3  promotion-status — bucket vocab matches VAMI-021 canonical
-#                          (synced / local-only-ok / pending / stalled only)
-#   S4  embedding-status — provider/model/dim present; no missing embeddings
-#   S5  sessions — returns the caller's session list
-#   S6  store short content — high importance -> mem0 path exercised
-#   S7  store with entities — verifies mem0_entities qdrant collection
-#                             gets populated (VAMI-023 FR-21.23)
-#   S8  round-trip: store -> wait -> get -> status -> fresh cache invalidation
-#                   (VAMI-023 RedisService.delete bugfix)
-#   S9  search dedup (VAMI-024 B1) — no duplicate memory_id in results
-#   S10 search fresh canonical (VAMI-024 B2) — category/importance from DB
-#   S11 search filter enforcement (VAMI-025 B4) — --category X returns ONLY X
-#   S12 get <nonexistent> (VAMI-025 B5) — error message surfaces memory_id
-#   S13 BM25 cold-start (VAMI-024 B3) — no HuggingFace URLs in api logs
-#   S14 dedup --dry-run (VAMI-026 P4) — no HTTP 401 auth gap
-#
-# Usage:
-#   bash scripts/verify-memory-cli-e2e.sh
-#   bash scripts/verify-memory-cli-e2e.sh --quick    # skip S8 100s wait + S13 log check (~30s vs ~3min)
-#
-# Exit code: 0 on all pass, 1 on any failure. Prints a summary at the end.
-#
-# -----------------------------------------------------------------------------
-# Bash pattern note (VAMI-026 P3 diagnosis)
-# -----------------------------------------------------------------------------
-# DO NOT USE: `if cmd 2>&1 | grep -q "pattern"; then ...`
-#   Under `set -eo pipefail` AND Claude Code's bash-tool shell snapshot,
-#   grep is wrapped as a subshell-proxy to ugrep via the Claude CLI. The
-#   wrapper can return a non-zero exit (SIGPIPE / 141) even when the
-#   match succeeds; with pipefail that propagates and kills the pipeline.
-# ALWAYS USE: `OUT=$(cmd 2>&1 || true); if printf '%s' "$OUT" | grep -q X; ...`
-#   Variable capture executes in the current shell (no subshell proxy),
-#   and the grep runs on a literal string — exit codes are deterministic.
-# =============================================================================
-# Drop -u (nounset): some bash shell-snapshots reference optional env
-# probes like $ZSH_VERSION unset, tripping the script before it runs.
-# errexit + pipefail are enough for the assertion-driven flow below.
-set -eo pipefail
-
-QUICK=no
-for arg in "$@"; do
-    case "$arg" in
-        --quick) QUICK=yes ;;
-        *) echo "Unknown flag: $arg"; exit 2 ;;
-    esac
-done
-
-# Resolve repo root from script location (works when invoked from anywhere).
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
-
-TAG="e2e-$(date +%Y%m%d-%H%M%S)-$$"
-export VDS_MEMORY_TIMEOUT_SECONDS="${VDS_MEMORY_TIMEOUT_SECONDS:-60}"
-export VDS_MEMORY_API_URL="${VDS_MEMORY_API_URL:-http://localhost:8010}"
-
-# Route through vds-cli (unified entry point) per root CLAUDE.md rule.
-# Array form is required — iCloud Drive paths contain spaces.
-VDS_CLI=("${REPO_ROOT}/scripts/worktree_uv.sh" "run" "--project" "vds_cli" "vds-cli" "memory")
-
-PASS=0
-FAIL=0
-SKIP=0
-ERRORS=()
-
-header() {
-    echo ""
-    echo "--- $1 ---"
-}
-
-pass() {
-    PASS=$((PASS + 1))
-    echo "  ✓ PASS: $1"
-}
-
-fail() {
-    FAIL=$((FAIL + 1))
-    ERRORS+=("$1: $2")
-    echo "  ✗ FAIL: $1 — $2"
-}
-
-skip() {
-    SKIP=$((SKIP + 1))
-    echo "  ○ SKIP: $1 ($2)"
-}
-
-echo "============================================================"
-echo "VDS AI Memory — CLI End-to-End Verification"
-echo "TAG   : $TAG"
-echo "API   : $VDS_MEMORY_API_URL"
-echo "ROOT  : $REPO_ROOT"
-echo "QUICK : $QUICK"
-echo "============================================================"
-
-# --------------------------------------------------------------------------
-# Pre-flight: >=5 healthy vds-platform containers (post ADR-INF-10 three-tier compose).
-# Containers under the unified `vds-platform` project are: vds-postgres, vds-redis,
-# vds-qdrant, vds-memory-api, vds-memory-worker (+ optional scheduler/multi-agent).
-# (beat container retired post-RETIREMENT; expect api, worker, postgres,
-# redis, qdrant.)
-# --------------------------------------------------------------------------
-header "Pre-flight: container health"
-CONTAINER_COUNT=$(docker ps --format '{{.Names}}' 2>/dev/null | grep -cE "^vds-(postgres|redis|qdrant|memory-api|memory-worker)$" || true)
-if [[ "$CONTAINER_COUNT" -lt 5 ]]; then
-    echo "FATAL: expected >=5 vds-platform memory-stack containers, found $CONTAINER_COUNT"
-    docker ps | grep -E "^vds-(postgres|redis|qdrant|memory-)" || true
-    exit 1
-fi
-echo "OK: $CONTAINER_COUNT vds-platform memory-stack containers running"
-
-# --------------------------------------------------------------------------
-# S1 — health
-# --------------------------------------------------------------------------
-header "S1: health check"
-# Use variable capture instead of direct pipeline: inside the script's
-# errexit+pipefail context, `cmd | grep -q` exhibits flaky pipeline-exit
-# behavior on some bash/pipefail combinations even when grep matches
-# (reproducibly fails under Claude Code's Bash tool). Variable capture
-# is deterministic — the grep runs on a literal string, no pipeline.
-HEALTH_OUT=$("${VDS_CLI[@]}" health 2>&1 || true)
-if printf '%s' "$HEALTH_OUT" | grep -q "healthy"; then
-    pass "S1 health reports healthy"
-else
-    fail "S1" "health did not report 'healthy'"
-fi
-
-# --------------------------------------------------------------------------
-# S2 — stats
-# --------------------------------------------------------------------------
-header "S2: stats snapshot"
-STATS=$("${VDS_CLI[@]}" --json-only stats 2>&1 || true)
-if echo "$STATS" | python3 -c "
-import json, sys
-d = json.loads(sys.stdin.buffer.read().decode('utf-8', errors='replace'))
-svc = d.get('service', {})
-redis = d.get('redis', {})
-assert svc.get('uptime_seconds', 0) > 0, 'uptime not positive'
-assert redis.get('status') == 'healthy', f'redis not healthy: {redis.get(\"status\")}'
-print('OK')
-" 2>&1 | grep -q "^OK$"; then
-    pass "S2 stats fields present + Redis healthy"
-else
-    fail "S2" "stats parse or assertion failed"
-fi
-
-# --------------------------------------------------------------------------
-# S3 — promotion-status vocab
-# --------------------------------------------------------------------------
-header "S3: promotion-status bucket vocab (VAMI-021 canonical)"
-PROM=$("${VDS_CLI[@]}" --json-only promotion-status 2>&1 || true)
-if echo "$PROM" | python3 -c "
-import json, sys
-d = json.loads(sys.stdin.buffer.read().decode('utf-8', errors='replace'))
-buckets = set(d.get('counts', {}).keys())
-legacy = buckets & {'success', 'failed', 'error'}
-assert not legacy, f'legacy alias leaked: {legacy}'
-print('OK')
-" 2>&1 | grep -q "^OK$"; then
-    pass "S3 no legacy aliases in bucket vocab"
-else
-    fail "S3" "bucket vocab contains legacy success/failed/error"
-fi
-
-# --------------------------------------------------------------------------
-# S4 — embedding-status
-# --------------------------------------------------------------------------
-header "S4: embedding-status"
-if "${VDS_CLI[@]}" embedding-status 2>&1 | grep -q "Without embedding: 0"; then
-    pass "S4 zero memories missing embedding"
-else
-    fail "S4" "some memories missing embedding"
-fi
-
-# --------------------------------------------------------------------------
-# S5 — sessions
-# --------------------------------------------------------------------------
-header "S5: sessions list"
-if "${VDS_CLI[@]}" sessions 2>&1 | grep -qE '"session-'; then
-    pass "S5 sessions returns at least one session"
-else
-    fail "S5" "sessions returned no session entries"
-fi
-
-# --------------------------------------------------------------------------
-# S6 — store short content
-# --------------------------------------------------------------------------
-header "S6: store short content"
-MEM_S6=$("${VDS_CLI[@]}" --json-only store "Verify script smoke ${TAG}" \
-    --category project --importance high --tags "$TAG" 2>&1 \
-    | python3 -c "import json, sys; d=json.loads(sys.stdin.buffer.read().decode('utf-8', errors='replace')); print(d.get('memory_id', ''))" 2>&1 || true)
-if [[ "$MEM_S6" =~ ^pg_ ]]; then
-    pass "S6 stored: $MEM_S6"
-else
-    fail "S6" "no pg_* memory_id in store response"
-fi
-
-# --------------------------------------------------------------------------
-# S7 — store with named entities (exercises VAMI-023 entity-linking)
-# --------------------------------------------------------------------------
-header "S7: store with entities (VAMI-023 FR-21.23)"
-MEM_S7=$("${VDS_CLI[@]}" --json-only store "VAMI-025 ${TAG}: Viettel PAR team deployed to production in Hanoi." \
-    --category project --importance high --tags "$TAG,entity" 2>&1 \
-    | python3 -c "import json, sys; d=json.loads(sys.stdin.buffer.read().decode('utf-8', errors='replace')); print(d.get('memory_id', ''))" 2>&1 || true)
-if [[ "$MEM_S7" =~ ^pg_ ]]; then
-    pass "S7 entity-bearing memory stored: $MEM_S7"
-else
-    fail "S7" "no pg_* memory_id"
-fi
-# Phase 201 ADR-64: assert mem0_entities collection EXISTS (not points>0).
-# The collection is deliberately empty under Python 3.14 because mem0ai[nlp]
-# requires spaCy with no cp314 wheel — entity-linking auto-create is silently
-# disabled. Existence (HTTP 200, not 404) is sufficient acceptance until entity
-# extraction is re-enabled in a future phase.
-ENTITY_HTTP=$(curl -sf -o /dev/null -w "%{http_code}" "${VDS_MEMORY_API_URL/8010/6335}/collections/mem0_entities" 2>&1 || echo "000")
-if [[ "$ENTITY_HTTP" == "200" ]]; then
-    pass "S7 mem0_entities collection exists (HTTP 200; ADR-64: empty by design under Py 3.14)"
-else
-    fail "S7" "mem0_entities collection unreachable (HTTP $ENTITY_HTTP)"
-fi
-
-# --------------------------------------------------------------------------
-# S8 — round-trip /status fresh cache (VAMI-023 RedisService.delete bugfix)
-# --------------------------------------------------------------------------
-header "S8: round-trip /status fresh cache (VAMI-023)"
-if [[ "$QUICK" == "yes" ]]; then
-    skip "S8" "--quick flag skips 100s async-writeback wait"
-elif [[ -n "$MEM_S6" ]]; then
-    echo "  waiting ~100s for async push_memory + writeback + cache invalidation..."
-    sleep 100
-    STATUS=$(curl -sf "${VDS_MEMORY_API_URL}/api/v1/memories/${MEM_S6}/status" 2>&1 || echo '{"status":"UNKNOWN"}')
-    if echo "$STATUS" | grep -qE '"status":"complete"'; then
-        pass "S8 /status reports complete (cache correctly invalidated after writeback)"
-    else
-        fail "S8" "/status did not reach complete: $STATUS"
-    fi
-else
-    skip "S8" "S6 did not produce a memory_id"
-fi
-
-# --------------------------------------------------------------------------
-# S9 — search dedup (VAMI-024 B1)
-# --------------------------------------------------------------------------
-header "S9: search dedup — no memory_id appears twice (VAMI-024 B1)"
-SEARCH_JSON=$("${VDS_CLI[@]}" --json-only search "$TAG" --limit 10 2>&1 || true)
-if echo "$SEARCH_JSON" | python3 -c "
-import json, sys
-d = json.loads(sys.stdin.buffer.read().decode('utf-8', errors='replace'))
-mems = d.get('memories') or d.get('results') or []
-ids = [m.get('memory_id') for m in mems if m.get('memory_id')]
-assert len(ids) == len(set(ids)), f'duplicates: {[i for i in ids if ids.count(i) > 1]}'
-print(f'OK {len(ids)} unique ids')
-" 2>&1 | grep -q "^OK"; then
-    pass "S9 no duplicate memory_ids in search results"
-else
-    fail "S9" "duplicate memory_ids in search results"
-fi
-
-# --------------------------------------------------------------------------
-# S10 — search returns fresh canonical metadata (VAMI-024 B2)
-# --------------------------------------------------------------------------
-header "S10: search fresh canonical category/importance (VAMI-024 B2)"
-if [[ -n "$MEM_S7" ]]; then
-    FRESH=$("${VDS_CLI[@]}" --json-only search "$TAG" --limit 10 2>&1 | python3 -c "
-import json, sys
-d = json.loads(sys.stdin.buffer.read().decode('utf-8', errors='replace'))
-mems = d.get('memories') or d.get('results') or []
-target = next((m for m in mems if m.get('memory_id') == '$MEM_S7'), None)
-if target and target.get('category') == 'project' and target.get('importance') == 'high':
-    print('OK')
-else:
-    print(f'FAIL target={target}')
-" 2>&1)
-    if echo "$FRESH" | grep -q "^OK$"; then
-        pass "S10 search returned fresh category=project, importance=high"
-    else
-        fail "S10" "search returned stale metadata: $FRESH"
-    fi
-else
-    skip "S10" "S7 did not produce a memory_id"
-fi
-
-# --------------------------------------------------------------------------
-# S11 — --category filter enforcement (VAMI-025 B4)
-# --------------------------------------------------------------------------
-header "S11: --category filter enforcement (VAMI-025 B4)"
-LEAK=$("${VDS_CLI[@]}" --json-only search "VAMI" --category project --limit 10 2>&1 | python3 -c "
-import json, sys
-d = json.loads(sys.stdin.buffer.read().decode('utf-8', errors='replace'))
-mems = d.get('memories') or d.get('results') or []
-non_proj = [m for m in mems if m.get('category') and m.get('category') != 'project']
-if not non_proj:
-    print('OK')
-else:
-    print('LEAK ' + ','.join(str(m.get('category')) for m in non_proj))
-" 2>&1)
-if echo "$LEAK" | grep -q "^OK$"; then
-    pass "S11 --category project returned only project items"
-else
-    fail "S11" "filter leak: $LEAK"
-fi
-
-# --------------------------------------------------------------------------
-# S12 — get <nonexistent> emits memory_id in error (VAMI-025 B5)
-# --------------------------------------------------------------------------
-header "S12: get <nonexistent> error contains memory_id (VAMI-025 B5)"
-BOGUS_ID="pg_ffffffff-ffff-ffff-ffff-ffffffffffff"
-ERR_OUT=$("${VDS_CLI[@]}" get "$BOGUS_ID" 2>&1 || true)
-if echo "$ERR_OUT" | grep -q "Memory not found: '$BOGUS_ID'"; then
-    pass "S12 404 error surfaces memory_id instead of base URL"
-elif echo "$ERR_OUT" | grep -q "Resource not found: 'http"; then
-    fail "S12" "still shows 'Resource not found: <URL>' (pre-VAMI-025 UX)"
-else
-    fail "S12" "unexpected error format: $(echo "$ERR_OUT" | head -c 160)"
-fi
-
-# --------------------------------------------------------------------------
-# S14 — dedup --dry-run no longer returns 401 (VAMI-026 P4)
-# --------------------------------------------------------------------------
-header "S14: dedup --dry-run end-to-end returns a SUCCESSFUL detection result (VAMI-026 P4-P7)"
-# Assertion-driven: dedup should return a JSON detection result with the
-# `duplicate_groups` field (or `groups` depending on API version), NOT an
-# error of any kind. Previous iterations accepted "anything that isn't
-# 401/500" which let malformed responses sneak through.
-DEDUP_OUT=$("${VDS_CLI[@]}" --json-only dedup --dry-run 2>&1 || true)
-# Any HTTP error status means failure
-if printf '%s' "$DEDUP_OUT" | grep -qE "HTTP (401|500|400|422|403|404)|Authentication failed|Authentication required|Internal Server Error"; then
-    fail "S14" "dedup returned HTTP error: $(printf '%s' "$DEDUP_OUT" | head -c 200)"
-# Must be valid JSON with at least one dedup-response field
-elif printf '%s' "$DEDUP_OUT" | python3 -c "
-import json, sys
-try:
-    d = json.loads(sys.stdin.buffer.read().decode('utf-8', errors='replace'))
-except Exception:
-    print('not-json')
-    sys.exit(0)
-# Accept either 'duplicate_groups', 'groups', 'total_analyzed', or detection_time_seconds
-# as proof the endpoint returned a proper detection result shape.
-if any(k in d for k in ('duplicate_groups', 'groups', 'total_analyzed', 'detection_time_seconds')):
-    print('ok')
-else:
-    print('bad-shape:', sorted(d.keys())[:8])
-" 2>&1 | grep -q "^ok$"; then
-    pass "S14 dedup returned a detection result (global scope)"
-else
-    fail "S14" "dedup response malformed: $(printf '%s' "$DEDUP_OUT" | head -c 200)"
-fi
-
-# --------------------------------------------------------------------------
-# S16 — orphan /api/v1/search/search returns 404 (VAMI-028 FR-28.1)
-# --------------------------------------------------------------------------
-header "S16: orphan /api/v1/search/search returns HTTP 404 (VAMI-028 FR-28.1 deletion)"
-# Use plain `curl -s` (no -f) so non-2xx codes don't trigger fallback. -w prints
-# status code; -o /dev/null discards body.
-S16_CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "${VDS_MEMORY_API_URL}/api/v1/search/search" -H "content-type: application/json" -d '{}' 2>/dev/null)
-if [[ "$S16_CODE" == "404" ]]; then
-    pass "S16 orphan search router gone (HTTP 404)"
-else
-    fail "S16" "expected 404, got $S16_CODE — orphan deletion may not have landed"
-fi
-
-# --------------------------------------------------------------------------
-# S17 — analytics overview returns 200/401 (NOT 500) — VAMI-028 FR-28.2
-# --------------------------------------------------------------------------
-header "S17: analytics overview reachable without 500 (VAMI-028 FR-28.2 annotation truth)"
-S17_CODE=$(curl -s -o /dev/null -w "%{http_code}" "${VDS_MEMORY_API_URL}/api/v1/analytics/metrics/overview" 2>&1)
-# Expect 401 (auth-gate per Auth Policy Matrix all-KEEP decision) — NOT 500.
-# A 500 would mean the annotation-truth flip failed and the AsyncSession bug
-# is firing.
-if [[ "$S17_CODE" == "401" || "$S17_CODE" == "200" ]]; then
-    pass "S17 analytics overview returned $S17_CODE (no AsyncSession 500)"
-else
-    fail "S17" "analytics overview returned $S17_CODE — possible AsyncSession regression"
-fi
-
-# --------------------------------------------------------------------------
-# S18 — export-import validate-import returns 401/422 (NOT 500) — VAMI-028 FR-28.2
-# --------------------------------------------------------------------------
-header "S18: export-import validate-import reachable without 500 (VAMI-028 FR-28.2)"
-S18_CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "${VDS_MEMORY_API_URL}/api/v1/export-import/validate-import" -H "content-type: application/json" -d '{}' 2>&1)
-# Expect 401 (auth-gate) or 422 (validation) — NOT 500
-if [[ "$S18_CODE" == "401" || "$S18_CODE" == "422" || "$S18_CODE" == "200" ]]; then
-    pass "S18 validate-import returned $S18_CODE (no AsyncSession 500)"
-else
-    fail "S18" "validate-import returned $S18_CODE — possible AsyncSession regression"
-fi
-
-# --------------------------------------------------------------------------
-# S19 — VAMI-029 FR-29.3: no-token connection receives close-1008 with
-#       reason='Authentication required' (the live container runs
-#       SERVICE_REQUIRE_AUTH=true, so the dev-mode bypass per ADR-46 does
-#       not apply — only the explicit no-token path fires the
-#       "Authentication required" reason text).
-# --------------------------------------------------------------------------
-header "S19: no-token WebSocket connection receives close-1008 'Authentication required' (VAMI-029 FR-29.3)"
-WS_HOST=$(echo "${VDS_MEMORY_API_URL}" | sed 's|http://||;s|https://||')
-S19_RESULT=$("${REPO_ROOT}/.venv/bin/python" - <<PY 2>&1 || true
-import asyncio
-async def main():
-    try:
-        import websockets
-        from websockets.exceptions import ConnectionClosed, InvalidStatus
-    except ImportError:
-        print("SKIP: websockets package not installed in venv")
-        return
-    url = "ws://${WS_HOST}/api/v1/analytics/ws/real-time?interval=0.1"
-    try:
-        async with websockets.connect(url, open_timeout=5, close_timeout=2) as ws:
-            try:
-                msg = await asyncio.wait_for(ws.recv(), timeout=3)
-                # If we receive a payload, the dev-mode bypass fired (container is in
-                # require_auth=false posture). Treat as PASS with a different
-                # message — both production-strict and dev-bypass postures are valid.
-                print(f"PASS: WebSocket no-token bypass (dev-mode require_auth=false): {str(msg)[:80]}")
-            except ConnectionClosed as e:
-                if e.code == 1008 and "Authentication" in (e.reason or ""):
-                    print(f"PASS: no-token closed code={e.code} reason={e.reason!r}")
-                else:
-                    print(f"FAIL: closed with wrong code/reason: code={e.code} reason={e.reason!r}")
-    except InvalidStatus as e:
-        print(f"PASS: no-token rejected at HTTP layer: {e}")
-    except Exception as e:
-        print(f"FAIL: unexpected exception: {type(e).__name__}: {str(e)[:200]}")
-asyncio.run(main())
-PY
-)
-if [[ "$S19_RESULT" == PASS:* ]]; then
-    pass "S19 ${S19_RESULT#PASS: }"
-elif [[ "$S19_RESULT" == SKIP:* ]]; then
-    skip "S19" "${S19_RESULT#SKIP: }"
-else
-    fail "S19" "${S19_RESULT}"
-fi
-
-# --------------------------------------------------------------------------
-# S19a — VAMI-029 FR-29.7: invalid token receives close-1008 (production
-#        auth-failure contract, exercisable in dev mode by deliberately
-#        sending a malformed token — dev-mode bypass only applies to the
-#        no-token case)
-# --------------------------------------------------------------------------
-header "S19a: invalid-token connection receives close-1008 (VAMI-029 FR-29.3)"
-S19A_RESULT=$("${REPO_ROOT}/.venv/bin/python" - <<PY 2>&1 || true
-import asyncio
-async def main():
-    try:
-        import websockets
-        from websockets.exceptions import ConnectionClosed, InvalidStatus
-    except ImportError:
-        print("SKIP: websockets package not installed in venv")
-        return
-    url = "ws://${WS_HOST}/api/v1/analytics/ws/real-time?interval=0.1&token=garbage.token.value"
-    try:
-        async with websockets.connect(url, open_timeout=5, close_timeout=2) as ws:
-            try:
-                msg = await asyncio.wait_for(ws.recv(), timeout=3)
-                print(f"FAIL: invalid-token connection should not have received: {str(msg)[:120]}")
-            except ConnectionClosed as e:
-                if e.code == 1008 and ("Invalid" in (e.reason or "") or "expired" in (e.reason or "")):
-                    print(f"PASS: invalid-token closed code={e.code} reason={e.reason!r}")
-                else:
-                    print(f"FAIL: closed with wrong code/reason: code={e.code} reason={e.reason!r}")
-    except InvalidStatus as e:
-        # Some versions surface 401-equivalent as upgrade-failure
-        print(f"PASS: invalid-token rejected at HTTP layer: {e}")
-    except Exception as e:
-        print(f"FAIL: unexpected exception: {type(e).__name__}: {str(e)[:200]}")
-asyncio.run(main())
-PY
-)
-if [[ "$S19A_RESULT" == PASS:* ]]; then
-    pass "S19a ${S19A_RESULT#PASS: }"
-elif [[ "$S19A_RESULT" == SKIP:* ]]; then
-    skip "S19a" "${S19A_RESULT#SKIP: }"
-else
-    fail "S19a" "${S19A_RESULT}"
-fi
-
-# --------------------------------------------------------------------------
-# S20 — VAMI-030 FR-30.8: routed `vds-cli memory analytics-stream` streams
-#       a JSON envelope with the auto-acquired JWT (auto-login flow per ADR-50).
-# --------------------------------------------------------------------------
-header "S20: vds-cli memory analytics-stream — auto-login + JSON envelope (VAMI-030)"
-# --duration 3 self-caps runtime; no external timeout needed (macOS lacks it).
-S20_OUT=$("${VDS_CLI[@]}" analytics-stream \
-    --interval 0.5 --duration 3 --json --no-reconnect 2>&1 || true)
-S20_FIRST_LINE=$(echo "$S20_OUT" | grep -E "^\{" | head -1 || true)
-if [[ -n "$S20_FIRST_LINE" ]] && echo "$S20_FIRST_LINE" | jq -e '.metrics.active_users' >/dev/null 2>&1; then
-    pass "S20 analytics-stream emitted JSON envelope with metrics.active_users"
-else
-    fail "S20" "expected JSON envelope with metrics.active_users, got: $(echo "$S20_OUT" | head -c 200)"
-fi
-
-# --------------------------------------------------------------------------
-# S21 — `vds-cli memory reconcile --dry-run` returns a JSON reconciliation
-#       report without mutating state (covers VAMI-CLI gap surfaced 2026-04-25).
-# --------------------------------------------------------------------------
-header "S21: vds-cli memory reconcile --dry-run --limit 1 — non-mutating report"
-S21_OUT=$("${VDS_CLI[@]}" reconcile --limit 1 --dry-run --json-only 2>&1 || true)
-if echo "$S21_OUT" | jq -e '.' >/dev/null 2>&1; then
-    pass "S21 reconcile --dry-run returned JSON (no mutation)"
-else
-    fail "S21" "expected JSON, got: $(echo "$S21_OUT" | head -c 200)"
-fi
-
-# --------------------------------------------------------------------------
-# S22 — `vds-cli memory replay-dlq --limit 1` returns terminal status
-#       (idempotent: drains 0 or 1 events, no error path on empty queue).
-# --------------------------------------------------------------------------
-header "S22: vds-cli memory replay-dlq --limit 1 — idempotent drain"
-S22_OUT=$("${VDS_CLI[@]}" replay-dlq --limit 1 --json-only 2>&1 || true)
-if echo "$S22_OUT" | jq -e '.status' >/dev/null 2>&1; then
-    S22_STATUS=$(echo "$S22_OUT" | jq -r '.status')
-    pass "S22 replay-dlq returned status='$S22_STATUS' (replayed/empty acceptable)"
-else
-    fail "S22" "expected JSON with .status, got: $(echo "$S22_OUT" | head -c 200)"
-fi
-
-# --------------------------------------------------------------------------
-# S23 — `vds-cli memory cleanup --dry-run` reports debris counts without
-#       removal (default --dry-run, --confirm omitted).
-# --------------------------------------------------------------------------
-header "S23: vds-cli memory cleanup --dry-run — non-mutating debris report"
-S23_OUT=$("${VDS_CLI[@]}" cleanup --remove-health-debris --remove-stale-sessions --dry-run --json-only 2>&1 || true)
-if echo "$S23_OUT" | jq -e '.' >/dev/null 2>&1; then
-    pass "S23 cleanup --dry-run returned JSON (no mutation)"
-else
-    fail "S23" "expected JSON, got: $(echo "$S23_OUT" | head -c 200)"
-fi
-
-# --------------------------------------------------------------------------
-# S24 — `vds-cli memory re-embed --batch-size 1` defaults to dry-run and
-#       returns a count + estimate (no mutation; --confirm not passed).
-# --------------------------------------------------------------------------
-header "S24: vds-cli memory re-embed --batch-size 1 (dry-run default) — count + estimate"
-S24_OUT=$("${VDS_CLI[@]}" re-embed --batch-size 1 2>&1 || true)
-if echo "$S24_OUT" | grep -qE "estimated|memories|count|total|dry|batch"; then
-    pass "S24 re-embed dry-run returned an estimate/count line"
-else
-    fail "S24" "expected estimate/count, got: $(echo "$S24_OUT" | head -c 200)"
-fi
-
-# --------------------------------------------------------------------------
-# S25 — `vds-cli memory repush --status local-only --dry-run` returns
-#       candidate count without queuing (idempotent preview).
-# --------------------------------------------------------------------------
-header "S25: vds-cli memory repush --status local-only --dry-run --limit 1 — preview"
-S25_OUT=$("${VDS_CLI[@]}" repush --status local-only --limit 1 --dry-run --json-only 2>&1 || true)
-if echo "$S25_OUT" | jq -e '.' >/dev/null 2>&1 || echo "$S25_OUT" | grep -qE "candidates|queued|dry|local-only"; then
-    pass "S25 repush --dry-run returned a candidate-count report"
-else
-    fail "S25" "expected JSON or candidate report, got: $(echo "$S25_OUT" | head -c 200)"
-fi
-
-# --------------------------------------------------------------------------
-# S13 — BM25 cold-start log (VAMI-024 B3)
-# --------------------------------------------------------------------------
-if [[ "$QUICK" == "yes" ]]; then
-    skip "S13" "--quick flag skips log inspection"
-else
-    header "S13: BM25 cold-start — no HF download URLs post-restart (VAMI-024 B3)"
-    HF_HITS=$(docker logs vds-memory-api --since 15m 2>&1 | grep -cE "huggingface\.co.*bm25|huggingface\.co/api/models/Qdrant" || true)
-    # On a cold restart the first search triggers ~18 HF URLs. VAMI-024 pre-warms the
-    # BM25 model in the Dockerfile, so a fresh container should have zero HF hits.
-    # Tolerate up to 2 (occasional check HTTP HEAD) but flag 10+ as regression.
-    if [[ "$HF_HITS" -lt 10 ]]; then
-        pass "S13 HF bm25 hits in last 15m: $HF_HITS (threshold <10)"
-    else
-        fail "S13" "HF bm25 hits too high: $HF_HITS (pre-warm regression?)"
-    fi
-fi
-
-# --------------------------------------------------------------------------
-# Summary
-# --------------------------------------------------------------------------
-echo ""
-echo "============================================================"
-TOTAL=$((PASS + FAIL + SKIP))
-echo "E2E Results: ${PASS}/${TOTAL} pass | ${FAIL} fail | ${SKIP} skip"
-if [[ ${FAIL} -gt 0 ]]; then
-    echo "FAILURES:"
-    for e in "${ERRORS[@]}"; do
-        printf '  - %s\n' "$e"
-    done
-    exit 1
-fi
-echo "STATUS: ALL GREEN"
-exit 0