@topy-ai/maggie 0.7.47 → 0.7.49

package/bundled-tools/clis/maggie_deployment_auth_canary.py

@@ -0,0 +1,216 @@
+#!/usr/bin/env python3
+"""Run declared, role-scoped authenticated API canaries without storing credentials or bodies.
+
+Public route canaries cannot see authenticated failures such as database
+permission errors, schema mismatches, or 403s on account and business APIs.
+This command executes a reviewed probe plan with credentials read only from
+environment variable *names*, and records status codes and contract checks
+only: never cookies, tokens, headers, response bodies, or personal data.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import re
+import sys
+import urllib.error
+import urllib.request
+from datetime import datetime, timezone
+from pathlib import Path
+from urllib.parse import urlparse
+
+PLAN_SCHEMA = "maggie-auth-canary-plan.v1"
+EVIDENCE_SCHEMA = "maggie-deployment-auth-canary.v1"
+MUTATING = {"POST", "PUT", "PATCH", "DELETE"}
+ALLOWED_METHODS = {"GET", "HEAD", "OPTIONS"} | MUTATING
+LOCAL_HOSTS = {"localhost", "127.0.0.1", "::1"}
+ENV_NAME = re.compile(r"^[A-Z][A-Z0-9_]{1,63}$")
+SECRET_VALUE = re.compile(r"(?:Bearer\s+\S{8,}|eyJ[A-Za-z0-9_-]{10,}\.|sk[-_](?:live|test)[-_]|session=|sid=|[A-Fa-f0-9]{32,})")
+
+
+class PlanError(ValueError):
+    pass
+
+
+def classify(status: int | None) -> str:
+    if status is None:
+        return "network"
+    if status in (401, 403):
+        return "authorization"
+    if status >= 500:
+        return "server"
+    if status == 404:
+        return "route"
+    return "contract"
+
+
+def contains_literal_secret(value: object) -> bool:
+    if isinstance(value, dict):
+        return any(contains_literal_secret(item) for item in value.values())
+    if isinstance(value, list):
+        return any(contains_literal_secret(item) for item in value)
+    return isinstance(value, str) and bool(SECRET_VALUE.search(value))
+
+
+def validate_plan(plan: object) -> dict:
+    """Return the normalized plan or raise PlanError for an unsafe/invalid plan."""
+    if not isinstance(plan, dict) or plan.get("schemaVersion") != PLAN_SCHEMA:
+        raise PlanError(f"plan schemaVersion must be {PLAN_SCHEMA}")
+    if contains_literal_secret(plan):
+        raise PlanError("plan contains a literal credential; reference environment variable names only")
+    base = str(plan.get("baseUrl") or "")
+    parsed = urlparse(base)
+    if parsed.scheme not in {"http", "https"} or not parsed.hostname or parsed.query or parsed.fragment:
+        raise PlanError("baseUrl must be an http(s) origin without query or fragment")
+    if parsed.scheme == "http" and parsed.hostname not in LOCAL_HOSTS:
+        raise PlanError("baseUrl must use https outside localhost")
+    roles = plan.get("roles")
+    if not isinstance(roles, dict) or not roles:
+        raise PlanError("roles must declare at least one role")
+    for name, role in roles.items():
+        if not isinstance(role, dict):
+            raise PlanError(f"role {name} must be an object")
+        keys = [key for key in ("tokenEnv", "cookieEnv") if role.get(key)]
+        if len(keys) != 1:
+            raise PlanError(f"role {name} must declare exactly one of tokenEnv or cookieEnv")
+        if not ENV_NAME.fullmatch(str(role[keys[0]])):
+            raise PlanError(f"role {name} {keys[0]} must be an environment variable name")
+        unknown = set(role) - {"tokenEnv", "cookieEnv", "scheme", "description"}
+        if unknown:
+            raise PlanError(f"role {name} has unsupported fields: {', '.join(sorted(unknown))}")
+    probes = plan.get("probes")
+    if not isinstance(probes, list) or not probes:
+        raise PlanError("probes must be a non-empty list")
+    seen = set()
+    for probe in probes:
+        if not isinstance(probe, dict):
+            raise PlanError("each probe must be an object")
+        probe_id = str(probe.get("id") or "")
+        if not re.fullmatch(r"[a-z0-9][a-z0-9._-]{0,63}", probe_id) or probe_id in seen:
+            raise PlanError(f"probe id is missing, invalid, or duplicated: {probe_id or '<empty>'}")
+        seen.add(probe_id)
+        if probe.get("role") not in roles:
+            raise PlanError(f"probe {probe_id} references an undeclared role")
+        method = str(probe.get("method", "GET")).upper()
+        if method not in ALLOWED_METHODS:
+            raise PlanError(f"probe {probe_id} method is unsupported")
+        path = str(probe.get("path") or "")
+        if not path.startswith("/") or "//" in path or "?" in path or "#" in path:
+            raise PlanError(f"probe {probe_id} path must be an absolute path without query or fragment")
+        expect = probe.get("expectStatus", [200])
+        if not isinstance(expect, list) or not expect or not all(isinstance(code, int) and 100 <= code <= 599 for code in expect):
+            raise PlanError(f"probe {probe_id} expectStatus must be a list of HTTP status codes")
+        if method in MUTATING and probe.get("fixture") != "disposable":
+            raise PlanError(f"probe {probe_id} mutates state and must declare fixture: disposable")
+        keys = probe.get("expectJsonKeys", [])
+        if not isinstance(keys, list) or not all(isinstance(key, str) and key for key in keys):
+            raise PlanError(f"probe {probe_id} expectJsonKeys must be a list of key names")
+    return plan
+
+
+def credential_headers(role: dict) -> dict[str, str] | None:
+    if role.get("tokenEnv"):
+        value = os.environ.get(role["tokenEnv"], "")
+        return {"Authorization": f"{role.get('scheme', 'Bearer')} {value}"} if value else None
+    value = os.environ.get(role["cookieEnv"], "")
+    return {"Cookie": value} if value else None
+
+
+def run_probe(base: str, probe: dict, role: dict, timeout: float) -> dict:
+    method = str(probe.get("method", "GET")).upper()
+    record = {"id": probe["id"], "role": probe["role"], "method": method, "path": probe["path"], "expectStatus": probe.get("expectStatus", [200])}
+    if probe.get("fixture"):
+        record["fixture"] = probe["fixture"]
+    headers = credential_headers(role)
+    if headers is None:
+        record.update({"state": "inconclusive", "reason": "credential environment variable is not set"})
+        return record
+    headers["User-Agent"] = "maggie-deployment-auth-canary/1.0"
+    headers["Accept"] = "application/json"
+    data = None
+    if method in MUTATING:
+        headers["Content-Type"] = "application/json"
+        data = json.dumps(probe.get("body", {})).encode("utf-8")
+    request = urllib.request.Request(base.rstrip("/") + probe["path"], data=data, headers=headers, method=method)
+    status: int | None = None
+    body = b""
+    try:
+        with urllib.request.urlopen(request, timeout=timeout) as response:
+            status = response.status
+            body = response.read(1_000_000)
+    except urllib.error.HTTPError as error:
+        status = error.code
+    except (urllib.error.URLError, OSError) as error:
+        record.update({"state": "failed", "status": None, "failureClass": "network", "reason": type(error).__name__})
+        return record
+    record["status"] = status
+    errors = []
+    if status not in record["expectStatus"]:
+        errors.append(f"status {status} not in {record['expectStatus']}")
+    keys = probe.get("expectJsonKeys", [])
+    if keys and not errors:
+        try:
+            payload = json.loads(body.decode("utf-8") or "null")
+        except (UnicodeDecodeError, json.JSONDecodeError):
+            payload = None
+        if not isinstance(payload, dict):
+            errors.append("response is not a JSON object")
+        else:
+            missing = [key for key in keys if key not in payload]
+            record["contractKeys"] = {"expected": len(keys), "present": len(keys) - len(missing)}
+            if missing:
+                errors.append("missing contract keys: " + ", ".join(missing))
+    if errors:
+        record.update({"state": "failed", "failureClass": classify(status) if status not in record["expectStatus"] else "contract", "reason": "; ".join(errors)})
+    else:
+        record["state"] = "passed"
+    return record
+
+
+def auth_canary(plan: dict, allow_mutations: bool, timeout: float = 15.0) -> dict:
+    plan = validate_plan(plan)
+    results = []
+    for probe in plan["probes"]:
+        method = str(probe.get("method", "GET")).upper()
+        if method in MUTATING and not allow_mutations:
+            results.append({"id": probe["id"], "role": probe["role"], "method": method, "path": probe["path"], "fixture": probe.get("fixture"), "state": "blocked", "reason": "mutating probe requires --allow-mutations"})
+            continue
+        results.append(run_probe(plan["baseUrl"], probe, plan["roles"][probe["role"]], timeout))
+    states = {item["state"] for item in results}
+    status = "failed" if "failed" in states else "inconclusive" if states & {"inconclusive", "blocked"} else "passed"
+    return {
+        "schemaVersion": EVIDENCE_SCHEMA,
+        "generatedAt": datetime.now(timezone.utc).isoformat(),
+        "origin": urlparse(plan["baseUrl"]).netloc,
+        "status": status,
+        "passed": status == "passed",
+        "roles": sorted(plan["roles"]),
+        "probes": results,
+        "privacy": "status codes and contract-key counts only; no credentials, headers, bodies, or personal data",
+    }
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    parser.add_argument("--plan", type=Path, required=True, help=f"{PLAN_SCHEMA} probe plan")
+    parser.add_argument("--allow-mutations", action="store_true", help="run probes that mutate disposable fixtures")
+    parser.add_argument("--timeout", type=float, default=15.0)
+    parser.add_argument("--output", type=Path)
+    args = parser.parse_args()
+    try:
+        report = auth_canary(json.loads(args.plan.read_text(encoding="utf-8")), args.allow_mutations, args.timeout)
+    except (OSError, json.JSONDecodeError, PlanError) as error:
+        print(f"BLOCKED: maggie deployment auth-canary: {error}", file=sys.stderr)
+        return 2
+    encoded = json.dumps(report, indent=2, ensure_ascii=False) + "\n"
+    if args.output:
+        args.output.parent.mkdir(parents=True, exist_ok=True)
+        args.output.write_text(encoded, encoding="utf-8")
+    print(encoded, end="")
+    return 0 if report["passed"] else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/bundled-tools/clis/maggie_deployment_collect.py

@@ -0,0 +1,225 @@
+#!/usr/bin/env python3
+"""Collect standard host release evidence and emit one reproducible readiness report.
+
+`maggie deployment readiness` validates evidence files but does not produce
+them, so each host used to hand-roll browser, SSH, systemd, and retention
+scripts. This collector runs the standard adapters declared in one reviewed
+config (edge/rendered canary, host health, rollback consistency, remote
+release identity, optional authenticated API canary), writes each adapter's
+evidence, and summarizes everything with the existing
+`maggie-deployment-readiness.v1` report. It never deploys, never uses a
+shell, and never records credentials or response bodies.
+"""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import importlib.util
+import json
+import re
+import subprocess
+import sys
+import urllib.error
+import urllib.request
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+from urllib.parse import urlparse
+
+CONFIG_SCHEMA = "maggie-evidence-collector.v1"
+HERE = Path(__file__).resolve().parent
+STANDARD_EVIDENCE = {
+    "unitRegression": ".maggie/verification/unit-regression.json",
+    "packageSmoke": ".maggie/verification/package-smoke.json",
+    "browserEvidence": ".maggie/verification/browser-evidence.json",
+    "deploymentPreflight": ".maggie/release-preflight.json",
+}
+SECRET_ARG = re.compile(r"(?:password|passwd|token|secret|apikey|api_key)=|Bearer\s|sk[-_](?:live|test)[-_]|eyJ[A-Za-z0-9_-]{10,}\.", re.IGNORECASE)
+RELEASE_ID = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$")
+
+
+def load_module(name: str):
+    spec = importlib.util.spec_from_file_location(name, HERE / f"{name}.py")
+    assert spec and spec.loader
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def now() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def resolve(project: Path, value: str | Path) -> Path:
+    path = Path(value).expanduser()
+    return path if path.is_absolute() else project / path
+
+
+def write(path: Path, payload: dict) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(payload, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+
+
+def check_argv(argv: object, label: str) -> list[str]:
+    if not isinstance(argv, list) or not argv or not all(isinstance(item, str) and item for item in argv):
+        raise ValueError(f"{label} command must be a non-empty argv list (no shell string)")
+    if any(SECRET_ARG.search(item) for item in argv):
+        raise ValueError(f"{label} command contains a literal credential; use host configuration or SSH keys")
+    return argv
+
+
+def http_status(url: str, timeout: float) -> int | None:
+    request = urllib.request.Request(url, headers={"User-Agent": "maggie-deployment-collect/1.0"}, method="GET")
+    try:
+        with urllib.request.urlopen(request, timeout=timeout) as response:
+            return response.status
+    except urllib.error.HTTPError as error:
+        return error.code
+    except (urllib.error.URLError, OSError):
+        return None
+
+
+def collect_health(config: dict, timeout: float) -> dict:
+    urls = config.get("urls")
+    if not isinstance(urls, list) or not urls:
+        raise ValueError("health adapter needs a non-empty urls list")
+    expect = config.get("expectStatus", [200])
+    checks = []
+    for url in urls:
+        parsed = urlparse(str(url))
+        if parsed.scheme not in {"http", "https"} or parsed.query:
+            raise ValueError("health URLs must be http(s) without query strings")
+        status = http_status(str(url), timeout)
+        checks.append({"url": f"{parsed.scheme}://{parsed.netloc}{parsed.path or '/'}", "status": status, "passed": status in expect})
+    return {"schemaVersion": "maggie-deployment-health.v1", "generatedAt": now(), "checks": checks, "passed": all(item["passed"] for item in checks)}
+
+
+def collect_release_identity(config: dict, release: str, timeout: float) -> tuple[dict, dict]:
+    run: dict[str, Any] = {}
+    observed = ""
+    if config.get("command"):
+        argv = check_argv(config["command"], "releaseIdentity")
+        completed = subprocess.run(argv, capture_output=True, text=True, timeout=timeout, check=False)
+        run = {"argv": argv, "exitCode": completed.returncode}
+        raw = completed.stdout.strip().splitlines()[-1].strip() if completed.returncode == 0 and completed.stdout.strip() else ""
+        # A `readlink -f <current>` path resolves to .../releases/<release-id>.
+        observed = raw.rstrip("/").rsplit("/", 1)[-1] if raw else ""
+    elif config.get("url"):
+        url = str(config["url"])
+        field = str(config.get("field") or "release")
+        request = urllib.request.Request(url, headers={"User-Agent": "maggie-deployment-collect/1.0", "Accept": "application/json"})
+        try:
+            with urllib.request.urlopen(request, timeout=timeout) as response:
+                payload = json.loads(response.read(200_000).decode("utf-8"))
+            observed = str(payload.get(field, "")) if isinstance(payload, dict) else ""
+            run = {"url": url, "field": field}
+        except (urllib.error.URLError, OSError, ValueError) as error:
+            run = {"url": url, "field": field, "error": type(error).__name__}
+    else:
+        raise ValueError("releaseIdentity adapter needs command (argv) or url")
+    if observed and not RELEASE_ID.fullmatch(observed):
+        observed = "<unrecognized>"
+    evidence = {"schemaVersion": "maggie-release-identity.v1", "generatedAt": now(), "expected": release, "observed": observed, "passed": bool(observed) and observed == release}
+    return evidence, run
+
+
+def collect_rollback(project: Path, config: dict) -> dict:
+    deployment = load_module("maggie_deployment")
+    evidence_path = resolve(project, config.get("evidence", "docs/deployment-rollback-smoke.json"))
+    keep = None
+    if config.get("plan"):
+        plan = json.loads(resolve(project, config["plan"]).read_text(encoding="utf-8"))
+        keep = (plan.get("retention") or {}).get("keep")
+    try:
+        result = deployment.validate_rollback_evidence(json.loads(evidence_path.read_text(encoding="utf-8")), keep)
+    except (OSError, json.JSONDecodeError) as error:
+        result = {"passed": False, "errors": [f"rollback evidence unavailable: {type(error).__name__}"]}
+    return {"schemaVersion": "maggie-deployment-rollback-check.v1", "generatedAt": now(), "retentionKeep": keep, "rollbackAvailable": None if keep is None else keep >= 2, "passed": result["passed"], "errors": result["errors"]}
+
+
+def collect_canary(project: Path, config: dict, destination: Path, timeout: float) -> dict:
+    argv = [sys.executable, str(HERE / "maggie_deployment_canary.py"), "--project", str(project), "--output", str(destination)]
+    for asset in config.get("assets", []):
+        argv += ["--asset", str(asset)]
+    if config.get("renderReport"):
+        argv += ["--render-report", str(resolve(project, config["renderReport"]))]
+    completed = subprocess.run(argv, capture_output=True, text=True, timeout=timeout, check=False)
+    return {"adapter": "maggie_deployment_canary.py", "exitCode": completed.returncode}
+
+
+def collect(project: Path, config: dict, evidence_dir: Path, timeout: float = 60.0) -> dict:
+    if config.get("schemaVersion") != CONFIG_SCHEMA:
+        raise ValueError(f"collector config schemaVersion must be {CONFIG_SCHEMA}")
+    release = str(config.get("release") or "")
+    if not RELEASE_ID.fullmatch(release):
+        raise ValueError("collector config needs the expected release id")
+    adapters = config.get("adapters") or {}
+    unknown = set(adapters) - {"canary", "health", "rollback", "releaseIdentity", "authCanary"}
+    if unknown:
+        raise ValueError("unsupported adapters: " + ", ".join(sorted(unknown)))
+    readiness = load_module("maggie_deployment_readiness")
+    paths = {name: resolve(project, (config.get("evidence") or {}).get(name, default)) for name, default in STANDARD_EVIDENCE.items()}
+    runs: dict[str, Any] = {}
+    canary_path = evidence_dir / "rendered-canary.json"
+    if "canary" in adapters:
+        runs["canary"] = collect_canary(project, adapters["canary"], canary_path, timeout)
+        paths["renderedCanary"] = canary_path
+    else:
+        paths["renderedCanary"] = resolve(project, (config.get("evidence") or {}).get("renderedCanary", ".maggie/deployment-canary.json"))
+    if "health" in adapters:
+        write(evidence_dir / "host-health.json", collect_health(adapters["health"], timeout))
+        paths["hostHealth"] = evidence_dir / "host-health.json"
+        runs["health"] = {"urls": len(adapters["health"].get("urls", []))}
+    if "rollback" in adapters:
+        write(evidence_dir / "rollback-check.json", collect_rollback(project, adapters["rollback"]))
+        paths["rollbackEvidence"] = evidence_dir / "rollback-check.json"
+        runs["rollback"] = {"validator": "validate_rollback_evidence"}
+    if "releaseIdentity" in adapters:
+        evidence, run = collect_release_identity(adapters["releaseIdentity"], release, timeout)
+        write(evidence_dir / "release-identity.json", evidence)
+        paths["releaseIdentity"] = evidence_dir / "release-identity.json"
+        runs["releaseIdentity"] = run
+    if "authCanary" in adapters:
+        auth = load_module("maggie_deployment_auth_canary")
+        spec = adapters["authCanary"]
+        plan = json.loads(resolve(project, spec["plan"]).read_text(encoding="utf-8"))
+        write(evidence_dir / "auth-canary.json", auth.auth_canary(plan, bool(spec.get("allowMutations")), timeout))
+        paths["authenticatedCanary"] = evidence_dir / "auth-canary.json"
+        runs["authCanary"] = {"plan": str(spec["plan"]), "allowMutations": bool(spec.get("allowMutations"))}
+    report = readiness.readiness_report(project, paths)
+    canonical = json.dumps(config, sort_keys=True, ensure_ascii=False).encode("utf-8")
+    report["collector"] = {
+        "schemaVersion": CONFIG_SCHEMA,
+        "configSha256": hashlib.sha256(canonical).hexdigest(),
+        "release": release,
+        "evidenceDir": readiness.display_path(evidence_dir, project),
+        "adapters": runs,
+        "mutation": "not executed",
+    }
+    return report
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    parser.add_argument("--project", type=Path, default=Path.cwd())
+    parser.add_argument("--config", type=Path, default=Path(".maggie/deployment/collector.json"), help=f"{CONFIG_SCHEMA} config")
+    parser.add_argument("--evidence-dir", type=Path, default=Path(".maggie/deployment/collected"))
+    parser.add_argument("--timeout", type=float, default=60.0)
+    parser.add_argument("--output", type=Path, help="readiness report path (default: <evidence-dir>/readiness.json)")
+    args = parser.parse_args()
+    project = args.project.resolve()
+    evidence_dir = resolve(project, args.evidence_dir)
+    try:
+        config = json.loads(resolve(project, args.config).read_text(encoding="utf-8"))
+        report = collect(project, config, evidence_dir, args.timeout)
+    except (OSError, ValueError, KeyError, subprocess.SubprocessError) as error:
+        print(f"BLOCKED: maggie deployment collect: {error}", file=sys.stderr)
+        return 2
+    write(resolve(project, args.output) if args.output else evidence_dir / "readiness.json", report)
+    print(json.dumps(report, indent=2, ensure_ascii=False))
+    return 0 if report["status"] == "passed" else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/bundled-tools/clis/maggie_deployment_readiness.py

@@ -92,6 +92,39 @@ def validate_runtime_parity(payload: dict[str, Any]) -> tuple[bool, str]:
     return True, "worker/browser runtime parity passed"
 
 
+def validate_host_health(payload: dict[str, Any]) -> tuple[bool, str]:
+    if payload.get("schemaVersion") != "maggie-deployment-health.v1":
+        return False, "host health evidence schemaVersion is unsupported"
+    checks = payload.get("checks")
+    if payload.get("passed") is not True or not isinstance(checks, list) or not checks:
+        return False, "host health evidence must contain passing checks"
+    return True, "host health checks passed"
+
+
+def validate_release_identity(payload: dict[str, Any]) -> tuple[bool, str]:
+    if payload.get("schemaVersion") != "maggie-release-identity.v1":
+        return False, "release identity evidence schemaVersion is unsupported"
+    if payload.get("passed") is not True or not payload.get("expected") or payload.get("observed") != payload.get("expected"):
+        return False, "remote release identity does not match the expected release"
+    return True, "remote release identity matches"
+
+
+def validate_rollback_check(payload: dict[str, Any]) -> tuple[bool, str]:
+    if payload.get("schemaVersion") != "maggie-deployment-rollback-check.v1":
+        return False, "rollback check schemaVersion is unsupported"
+    if payload.get("passed") is not True:
+        return False, "rollback evidence is inconsistent with the retention policy or not passed"
+    return True, "rollback evidence is consistent with the retention policy"
+
+
+def validate_auth_canary(payload: dict[str, Any]) -> tuple[bool, str]:
+    if payload.get("schemaVersion") != "maggie-deployment-auth-canary.v1":
+        return False, "authenticated canary schemaVersion is unsupported"
+    if payload.get("status") != "passed" or payload.get("passed") is not True:
+        return False, "authenticated API canary did not pass"
+    return True, "authenticated API canary passed"
+
+
 VALIDATORS: dict[str, Callable[[dict[str, Any]], tuple[bool, str]]] = {
     "unitRegression": validate_unit,
     "packageSmoke": validate_package,
@@ -99,7 +132,12 @@ VALIDATORS: dict[str, Callable[[dict[str, Any]], tuple[bool, str]]] = {
     "renderedCanary": validate_canary,
     "deploymentPreflight": validate_preflight,
     "runtimeParity": validate_runtime_parity,
+    "hostHealth": validate_host_health,
+    "releaseIdentity": validate_release_identity,
+    "rollbackEvidence": validate_rollback_check,
+    "authenticatedCanary": validate_auth_canary,
 }
+OPTIONAL_CHECKS = ("runtimeParity", "hostHealth", "releaseIdentity", "rollbackEvidence", "authenticatedCanary")
 
 
 def inspect_check(name: str, path: Path, project: Path) -> dict[str, Any]:
@@ -120,7 +158,7 @@ def inspect_check(name: str, path: Path, project: Path) -> dict[str, Any]:
     return result
 
 
-def readiness(project: Path, paths: dict[str, Path], output: Path | None = None) -> int:
+def readiness_report(project: Path, paths: dict[str, Path]) -> dict[str, Any]:
     checks = {name: inspect_check(name, path, project) for name, path in paths.items()}
     states = {item["state"] for item in checks.values()}
     status = "failed" if "failed" in states else "inconclusive" if "inconclusive" in states else "passed"
@@ -132,6 +170,12 @@ def readiness(project: Path, paths: dict[str, Path], output: Path | None = None)
         "checks": checks,
         "nextAction": "resolve failed evidence before release" if status == "failed" else "collect the missing host adapter evidence" if status == "inconclusive" else "all declared readiness evidence passed",
     }
+    return report
+
+
+def readiness(project: Path, paths: dict[str, Path], output: Path | None = None) -> int:
+    report = readiness_report(project, paths)
+    status = report["status"]
     if output:
         destination = output if output.is_absolute() else project / output
         destination.parent.mkdir(parents=True, exist_ok=True)
@@ -150,6 +194,10 @@ def main() -> int:
     parser.add_argument("--rendered-canary", type=Path, default=Path(".maggie/deployment-canary.json"))
     parser.add_argument("--deployment-preflight", type=Path, default=Path(".maggie/release-preflight.json"))
     parser.add_argument("--runtime-parity", type=Path, help="validated worker/browser parity report from maggie deployment parity")
+    parser.add_argument("--host-health", type=Path, help="maggie-deployment-health.v1 evidence (e.g. from maggie deployment collect)")
+    parser.add_argument("--release-identity", type=Path, help="maggie-release-identity.v1 evidence")
+    parser.add_argument("--rollback-check", type=Path, help="maggie-deployment-rollback-check.v1 evidence")
+    parser.add_argument("--auth-canary", type=Path, help="maggie-deployment-auth-canary.v1 evidence")
     parser.add_argument("--output", type=Path)
     args = parser.parse_args()
     project = args.project.resolve()
@@ -159,8 +207,10 @@ def main() -> int:
         name: (getattr(args, option).resolve() if getattr(args, option).is_absolute() else project / getattr(args, option))
         for name, option in CHECKS
     }
-    if args.runtime_parity:
-        paths["runtimeParity"] = args.runtime_parity.resolve() if args.runtime_parity.is_absolute() else project / args.runtime_parity
+    for name, option in (("runtimeParity", "runtime_parity"), ("hostHealth", "host_health"), ("releaseIdentity", "release_identity"), ("rollbackEvidence", "rollback_check"), ("authenticatedCanary", "auth_canary")):
+        value = getattr(args, option)
+        if value:
+            paths[name] = value.resolve() if value.is_absolute() else project / value
     try:
         return readiness(project, paths, args.output)
     except (OSError, ValueError) as error:

package/bundled-tools/clis/maggie_design.py

@@ -854,9 +854,26 @@ commands:
   resume       restart a failed design workflow
   author       plan an original first-party page
   markup-check validate optional style attributes, content keys, and entities
+  pressable-check flag pressables/buttons nested in another pressable (JSX/TSX)
+  layer-check  flag unlayered CSS that overrides Tailwind v4 utilities
+  palette      generate or validate a semantic palette role contract
+  verify       run automatable design-job steps and record evidence
+  icon-glyph-check render icons and prove font load and glyph paint
   reference-ui, init, validate-ui, app-init, app-validate, rebrand, review
 """)
         return 0
+    if len(sys.argv) > 1 and sys.argv[1] in {"pressable-check", "layer-check"}:
+        from maggie_design_lint import main as lint_main
+        return lint_main(sys.argv[1:])
+    if len(sys.argv) > 1 and sys.argv[1] == "verify":
+        from maggie_design_verify import main as verify_main
+        return verify_main(sys.argv[2:])
+    if len(sys.argv) > 1 and sys.argv[1] == "icon-glyph-check":
+        from maggie_icon_glyph_check import main as glyph_main
+        return glyph_main(sys.argv[2:])
+    if len(sys.argv) > 1 and sys.argv[1] == "palette":
+        from maggie_palette import main as palette_main
+        return palette_main(sys.argv[2:])
     if len(sys.argv) > 1 and sys.argv[1] == "reference-ui":
         command = argparse.ArgumentParser(description="Record sanitized blog/service UI evidence from a read-only reference project.")
         command.add_argument("--project", type=Path, default=Path.cwd())