direxio-deployer 0.1.0 → 0.1.2

package/scripts/orchestrate.sh

@@ -23,9 +23,7 @@ set -uo pipefail
 HERE=$(cd "$(dirname "$0")" && pwd)
 P2P_INSTALL_SCRIPTS_DIR="$HERE"
 
-# Prefer workspace-local tools when present. On Windows, jq may be downloaded
-# into .tools/bin/jq.exe by the operator/system and is discoverable from
-# Git Bash/MSYS only when this path is prepended.
+# Prefer workspace-local tools when present.
 REPO_ROOT=$(cd "$HERE/.." && pwd)
 if [ -d "$REPO_ROOT/.tools/bin" ]; then
   PATH="$REPO_ROOT/.tools/bin:$PATH"
@@ -58,17 +56,12 @@ phase_file() {
 # Dependency check.
 check_deps() {
   local b missing=""
-  for b in aws jq ssh scp curl; do
+  for b in aws ssh scp curl; do
     command -v "$b" >/dev/null 2>&1 || missing="$missing $b"
   done
   [ -z "$missing" ] && return 0
 
   warn "Missing dependencies:$missing"
-  case " $missing " in
-    *" jq "*)
-      warn "jq is required for state.json. If this workspace has .tools/bin/jq.exe, run from a POSIX shell that can see that path."
-      ;;
-  esac
   case " $missing " in
     *" aws "*)
       warn "Install AWS CLI v2 and configure credentials first:"
@@ -108,9 +101,9 @@ cmd_status_inventory() {
     [ -f "$state" ] || continue
     found=1
     service_dir=${state%/state.json}
-    domain=$(jq -r '.domain // empty' "$state")
-    phase=$(jq -r '.phase // empty' "$state")
-    instance=$(jq -r '.resources.instance_id // empty' "$state")
+    domain=$(json_get "$state" domain)
+    phase=$(json_get "$state" phase)
+    instance=$(json_get "$state" resources.instance_id)
     if STATE_JSON="$state" first_unfinished_phase >/dev/null 2>&1; then
       current=$(STATE_JSON="$state" first_unfinished_phase)
     else
@@ -287,7 +280,7 @@ cmd_status() {
     printf "  %-20s %s\n" "$p" "$(phase_status "$p")"
   done
   echo "-- resources --"
-  jq -r '.resources | to_entries[]? | "  \(.key)=\(.value)"' "$STATE_JSON"
+  json_entries "$STATE_JSON" resources | sed 's/^/  /'
   print_recovery_summary "$current"
 }
 
@@ -320,10 +313,10 @@ print_delivery() {
   install_mode=$(state_get agent_install_mode)
   install_status=$(state_get agent_install_status)
   install_command=$(state_get agent_install_command)
-  runtime_summary=$(jq -r '.runtime_checks.summary.status // "not_run"' "$STATE_JSON")
-  app_gate=$(jq -r '.user_confirmations.app_initialization.status // "pending_user_confirmation"' "$STATE_JSON")
-  real_chat_gate=$(jq -r '.user_confirmations.real_chat.status // "pending_user_confirmation"' "$STATE_JSON")
-  agent_runtime_gate=$(jq -r '.user_confirmations.agent_mcp_runtime.status // "pending_runtime_confirmation"' "$STATE_JSON")
+  runtime_summary=$(json_get "$STATE_JSON" runtime_checks.summary.status "not_run")
+  app_gate=$(json_get "$STATE_JSON" user_confirmations.app_initialization.status "pending_user_confirmation")
+  real_chat_gate=$(json_get "$STATE_JSON" user_confirmations.real_chat.status "pending_user_confirmation")
+  agent_runtime_gate=$(json_get "$STATE_JSON" user_confirmations.agent_mcp_runtime.status "pending_runtime_confirmation")
   echo
   echo -e "\033[32m========== Automated Deployment Gates Passed ==========\033[0m"
   echo "  App domain   : $domain"
@@ -391,10 +384,10 @@ ensure_cost_estimate() {
   fi
 
   if output=$(bash "$HERE/pricing-estimate.sh" "${args[@]}" 2>/dev/null); then
-    status=$(printf '%s\n' "$output" | jq -r '.pricing_status // "unknown"' 2>/dev/null)
-    total=$(printf '%s\n' "$output" | jq -r '.total_monthly_usd // "unknown"' 2>/dev/null)
-    region=$(printf '%s\n' "$output" | jq -r '.region // "unknown"' 2>/dev/null)
-    instance_type=$(printf '%s\n' "$output" | jq -r '.components.ec2_instance.instance_type // "unknown"' 2>/dev/null)
+    status=$(printf '%s\n' "$output" | json_stdin_get pricing_status "unknown" 2>/dev/null)
+    total=$(printf '%s\n' "$output" | json_stdin_get total_monthly_usd "unknown" 2>/dev/null)
+    region=$(printf '%s\n' "$output" | json_stdin_get region "unknown" 2>/dev/null)
+    instance_type=$(printf '%s\n' "$output" | json_stdin_get components.ec2_instance.instance_type "unknown" 2>/dev/null)
     log "Cost estimate recorded (status=${status:-unknown}, region=${region:-unknown}, instance=${instance_type:-unknown}, monthly_usd≈${total:-unknown})."
     if [ "$status" = "fallback" ]; then
       warn "AWS Pricing API was unavailable or incomplete; cost_estimate uses conservative fallback values."
@@ -402,6 +395,25 @@ ensure_cost_estimate() {
   else
     warn "Could not write AWS cost estimate. Continue only after giving the user a manual billing estimate."
   fi
+  ensure_free_tier_credit_notice
+}
+
+ensure_free_tier_credit_notice() {
+  local output plan_status plan_type amount unit expires
+  if output=$(aws freetier get-account-plan-state --output json 2>/dev/null); then
+    plan_type=$(printf '%s\n' "$output" | json_stdin_get accountPlanType "unknown" 2>/dev/null)
+    plan_status=$(printf '%s\n' "$output" | json_stdin_get accountPlanStatus "unknown" 2>/dev/null)
+    amount=$(printf '%s\n' "$output" | json_stdin_get accountPlanRemainingCredits.amount "" 2>/dev/null)
+    unit=$(printf '%s\n' "$output" | json_stdin_get accountPlanRemainingCredits.unit "USD" 2>/dev/null)
+    expires=$(printf '%s\n' "$output" | json_stdin_get accountPlanExpirationDate "" 2>/dev/null)
+    if [ -n "$amount" ]; then
+      log "AWS Free Tier plan: type=${plan_type:-unknown}, status=${plan_status:-unknown}, remaining_credits=${amount} ${unit:-USD}${expires:+, expires=$expires}."
+      warn "Credits can reduce actual charges, but AWS resources still accrue charges until destroyed; verify credit coverage in AWS Billing Console."
+      return 0
+    fi
+  fi
+  warn "AWS new customer accounts may include Free Tier credits, currently advertised as 100 USD initial credits plus possible additional credits."
+  warn "Credits may cover a small trial deployment, but coverage is account-specific; verify credits in AWS Billing Console and destroy the node when finished."
 }
 
 precheck_new_deploy_domain_env() {
@@ -439,7 +451,7 @@ ensure_production_domain_selected() {
   state_domain=$(domain_normalize "$state_domain")
   state_mode=$(state_get domain_mode)
   env_domain=$(domain_normalize "${DOMAIN:-}")
-  confirmed=$(jq -r '.domain_confirmed_irreversible // false' "$STATE_JSON")
+  confirmed=$(json_get "$STATE_JSON" domain_confirmed_irreversible false)
 
   if [ -n "$env_domain" ] && [ -n "$state_domain" ] && [ "$env_domain" != "$state_domain" ]; then
     warn "Deployment blocked: current state is bound to DOMAIN=$state_domain, but this run passed DOMAIN=${env_domain}."
@@ -484,22 +496,22 @@ ensure_production_domain_selected() {
 guard_existing_state() {
   [ -f "$STATE_JSON" ] || return 0
   local resources_count confirmed action
-  resources_count=$(jq -r '.resources | length' "$STATE_JSON")
+  resources_count=$(json_length "$STATE_JSON" resources)
   [ "$resources_count" -eq 0 ] && return 0
-  if [ "$(jq -r '.domain_mode // empty' "$STATE_JSON")" = "ec2" ]; then
+  if [ "$(json_get "$STATE_JSON" domain_mode)" = "ec2" ]; then
     warn "Found legacy temporary-domain deployment state (domain_mode=ec2). Production deployment no longer supports resuming this mode."
     warn "Destroy and rebuild, or use a new service directory:"
     warn "  P2P_EXISTING_STATE_ACTION=destroy bash $0"
     warn "  DOMAIN=__DOMAIN__ DOMAIN_MODE=user CONFIRM_DOMAIN_BINDING=1 bash $0"
     return 2
   fi
-  confirmed=$(jq -r '.existing_state_confirmed // false' "$STATE_JSON")
+  confirmed=$(json_get "$STATE_JSON" existing_state_confirmed false)
   [ "$confirmed" = "true" ] && return 0
 
   action=${P2P_EXISTING_STATE_ACTION:-}
   if [ -z "$action" ] && [ -t 0 ]; then
     warn "Found existing deployment state with recorded AWS resources:"
-    jq -r '.resources | to_entries[]? | "  \(.key)=\(.value)"' "$STATE_JSON" >&2
+    json_entries "$STATE_JSON" resources | sed 's/^/  /' >&2
     warn "Choose: continue=resume / destroy=destroy and rebuild / abort=stop now"
     printf "Action [abort]: " >&2
     read -r action
@@ -601,7 +613,7 @@ cmd_confirm() {
     warn "DIREXIO_CONFIRM_EVIDENCE is too short; provide a concrete user/runtime evidence note."
     return 1
   fi
-  runtime_summary_status=$(jq -r '.runtime_checks.summary.status // "not_run"' "$STATE_JSON")
+  runtime_summary_status=$(json_get "$STATE_JSON" runtime_checks.summary.status "not_run")
   runtime_probe_confirmed=false
   if [ "$gate" = "agent_mcp_runtime" ]; then
     if [ "$runtime_summary_status" != "passed" ]; then
@@ -614,21 +626,19 @@ cmd_confirm() {
     fi
     runtime_probe_confirmed=true
   fi
-  _state_write '
-    .user_confirmations[$gate] = {
-      status: "confirmed",
-      ts: $ts,
-      evidence: $evidence
-    }
-    + (if $gate == "agent_mcp_runtime" then {
-      runtime_summary_status: $runtime_summary_status,
-      runtime_probe_confirmed: ($runtime_probe_confirmed == "true")
-    } else {} end)
-  ' --arg gate "$gate" \
-    --arg ts "$(_now)" \
-    --arg evidence "$evidence" \
-    --arg runtime_summary_status "$runtime_summary_status" \
-    --arg runtime_probe_confirmed "$runtime_probe_confirmed"
+  if [ "$gate" = "agent_mcp_runtime" ]; then
+    state_set_object "user_confirmations.$gate" \
+      status=confirmed \
+      "ts=$(_now)" \
+      "evidence=$evidence" \
+      "runtime_summary_status=$runtime_summary_status" \
+      "runtime_probe_confirmed=$runtime_probe_confirmed"
+  else
+    state_set_object "user_confirmations.$gate" \
+      status=confirmed \
+      "ts=$(_now)" \
+      "evidence=$evidence"
+  fi
   echo "confirmed gate: $gate"
 }
 
@@ -638,10 +648,11 @@ cmd_verify_mcp_doctor() {
     return 1
   }
 
-  local credentials mcp_cmd node_id out err report token_status
-  credentials=$(jq -r '.agent_credentials_file // .mcp_credentials_file // empty' "$STATE_JSON")
-  mcp_cmd=$(jq -r '.mcp_command // "direxio-mcp"' "$STATE_JSON")
-  node_id=$(jq -r '.agent_node_id // empty' "$STATE_JSON")
+  local credentials mcp_cmd node_id out err report token_status report_domain report_room
+  credentials=$(json_get "$STATE_JSON" agent_credentials_file)
+  [ -n "$credentials" ] || credentials=$(json_get "$STATE_JSON" mcp_credentials_file)
+  mcp_cmd=$(json_get "$STATE_JSON" mcp_command "direxio-mcp")
+  node_id=$(json_get "$STATE_JSON" agent_node_id)
   [ -n "$credentials" ] || {
     warn "mcp doctor check requires agent_credentials_file or mcp_credentials_file in state.json"
     return 1
@@ -651,45 +662,34 @@ cmd_verify_mcp_doctor() {
   out=$(mktemp)
   err=$(mktemp)
   if ! DIREXIO_CREDENTIALS_FILE="$credentials" DIREXIO_AGENT_NODE_ID="$node_id" bash -c "$mcp_cmd doctor --json" > "$out" 2> "$err"; then
-    _state_write '
-      .runtime_checks.mcp_doctor = {
-        status: "failed",
-        ts: $ts,
-        evidence: "direxio-mcp doctor failed"
-      }
-    ' --arg ts "$(_now)"
+    state_set_object runtime_checks.mcp_doctor status=failed "ts=$(_now)" "evidence=direxio-mcp doctor failed"
     cat "$err" >&2
     rm -f "$out" "$err"
     return 1
   fi
-  if ! jq empty "$out" >/dev/null 2>&1; then
-    _state_write '
-      .runtime_checks.mcp_doctor = {
-        status: "failed",
-        ts: $ts,
-        evidence: "direxio-mcp doctor returned non-json output"
-      }
-    ' --arg ts "$(_now)"
+  if ! json_valid "$out" >/dev/null 2>&1; then
+    state_set_object runtime_checks.mcp_doctor status=failed "ts=$(_now)" "evidence=direxio-mcp doctor returned non-json output"
     rm -f "$out" "$err"
     return 1
   fi
   report=$(cat "$out")
-  token_status=$(printf '%s\n' "$report" | jq -r '
-    if (.token // "") == "redacted" then "redacted"
-    elif ((.token // "") | tostring | length) > 0 then "present_redacted"
-    else "missing"
-    end
-  ')
-  _state_write '
-    .runtime_checks.mcp_doctor = {
-      status: "passed",
-      ts: $ts,
-      evidence: "direxio-mcp doctor --json succeeded",
-      domain: ($report.domain // ""),
-      agent_room_id: ($report.agent_room_id // ""),
-      token: $token_status
-    }
-  ' --arg ts "$(_now)" --argjson report "$report" --arg token_status "$token_status"
+  token_status=$(printf '%s\n' "$report" | json_stdin_get token)
+  if [ "$token_status" = "redacted" ]; then
+    token_status=redacted
+  elif [ -n "$token_status" ]; then
+    token_status=present_redacted
+  else
+    token_status=missing
+  fi
+  report_domain=$(json_get "$out" domain)
+  report_room=$(json_get "$out" agent_room_id)
+  state_set_object runtime_checks.mcp_doctor \
+    status=passed \
+    "ts=$(_now)" \
+    "evidence=direxio-mcp doctor --json succeeded" \
+    "domain=$report_domain" \
+    "agent_room_id=$report_room" \
+    "token=$token_status"
   rm -f "$out" "$err"
   echo "verified runtime check: mcp_doctor"
 }
@@ -700,56 +700,49 @@ cmd_verify_mcp_smoke() {
     return 1
   }
 
-  local service_url token room_id body code payload tmp url
-  service_url=$(jq -r '.as_url // empty' "$STATE_JSON")
+  local service_url token room_id body code payload url response_room_id response_messages_type
+  service_url=$(json_get "$STATE_JSON" as_url)
   if [ -z "$service_url" ]; then
     local domain
-    domain=$(jq -r '.domain // empty' "$STATE_JSON")
+    domain=$(json_get "$STATE_JSON" domain)
     [ -n "$domain" ] && service_url="https://$domain"
   fi
-  token=$(jq -r '.agent_token // empty' "$STATE_JSON")
-  room_id=$(jq -r '.agent_room_id // empty' "$STATE_JSON")
+  token=$(json_get "$STATE_JSON" agent_token)
+  room_id=$(json_get "$STATE_JSON" agent_room_id)
   if [ -z "$service_url" ] || [ -z "$token" ] || [ -z "$room_id" ]; then
     warn "mcp smoke check requires as_url/domain, agent_token, and agent_room_id in state.json"
     return 1
   fi
 
   body=$(mktemp)
-  payload=$(jq -cn --arg room_id "$room_id" '{action:"mcp.messages.list", params:{room_id:$room_id, limit:1}}')
+  payload=$(json_build mcp-messages-list "$room_id")
   url="${service_url%/}/_p2p/query"
   code=$(curl -sk -o "$body" -w '%{http_code}' \
     -X POST "$url" \
     -H 'Content-Type: application/json' \
     -H "Authorization: Bearer $token" \
     -d "$payload" 2>/dev/null)
-  if [ "$code" != "200" ] || ! jq -e '(.messages | type == "array") and (.room_id | type == "string")' "$body" >/dev/null 2>&1; then
-    _state_write '
-      .runtime_checks.mcp_smoke = {
-        status: "failed",
-        ts: $ts,
-        action: "mcp.messages.list",
-        evidence: $evidence
-      }
-    ' --arg ts "$(_now)" --arg evidence "mcp.messages.list returned HTTP $code or invalid response"
+  if [ "$code" != "200" ] || ! json_assert "$body" messages-response >/dev/null 2>&1; then
+    state_set_object runtime_checks.mcp_smoke \
+      status=failed \
+      "ts=$(_now)" \
+      action=mcp.messages.list \
+      "evidence=mcp.messages.list returned HTTP $code or invalid response"
     rm -f "$body"
     return 1
   fi
 
-  tmp=$(mktemp)
-  jq -n --slurpfile response "$body" \
-    --arg ts "$(_now)" \
-    --arg room_id "$room_id" \
-    '{
-      status: "passed",
-      ts: $ts,
-      action: "mcp.messages.list",
-      room_id: $room_id,
-      response_room_id: ($response[0].room_id // ""),
-      response_messages_type: (($response[0].messages // null) | type),
-      evidence: "read-only backend smoke check succeeded"
-    }' > "$tmp"
-  _state_write '.runtime_checks.mcp_smoke = $check[0]' --slurpfile check "$tmp"
-  rm -f "$body" "$tmp"
+  response_room_id=$(json_get "$body" room_id)
+  response_messages_type=$(json_type "$body" messages)
+  state_set_object runtime_checks.mcp_smoke \
+    status=passed \
+    "ts=$(_now)" \
+    action=mcp.messages.list \
+    "room_id=$room_id" \
+    "response_room_id=$response_room_id" \
+    "response_messages_type=$response_messages_type" \
+    "evidence=read-only backend smoke check succeeded"
+  rm -f "$body"
   echo "verified runtime check: mcp_smoke"
 }
 
@@ -760,9 +753,10 @@ cmd_verify_mcp_tools() {
   }
 
   local credentials mcp_cmd node_id node_cmd node_script out err report
-  credentials=$(jq -r '.agent_credentials_file // .mcp_credentials_file // empty' "$STATE_JSON")
-  mcp_cmd=$(jq -r '.mcp_command // "direxio-mcp"' "$STATE_JSON")
-  node_id=$(jq -r '.agent_node_id // empty' "$STATE_JSON")
+  credentials=$(json_get "$STATE_JSON" agent_credentials_file)
+  [ -n "$credentials" ] || credentials=$(json_get "$STATE_JSON" mcp_credentials_file)
+  mcp_cmd=$(json_get "$STATE_JSON" mcp_command "direxio-mcp")
+  node_id=$(json_get "$STATE_JSON" agent_node_id)
   [ -n "$credentials" ] || {
     warn "mcp tools check requires agent_credentials_file or mcp_credentials_file in state.json"
     return 1
@@ -778,52 +772,29 @@ cmd_verify_mcp_tools() {
   out=$(mktemp)
   err=$(mktemp)
   if ! DIREXIO_CREDENTIALS_FILE="$credentials" DIREXIO_AGENT_NODE_ID="$node_id" "$node_cmd" "$node_script" "$mcp_cmd" > "$out" 2> "$err"; then
-    _state_write '
-      .runtime_checks.mcp_tools = {
-        status: "failed",
-        ts: $ts,
-        evidence: "MCP tools/list failed"
-      }
-    ' --arg ts "$(_now)"
+    state_set_object runtime_checks.mcp_tools status=failed "ts=$(_now)" "evidence=MCP tools/list failed"
     cat "$err" >&2
     rm -f "$out" "$err"
     return 1
   fi
-  if ! jq -e '(.tools | type == "array") and (.tool_count | type == "number")' "$out" >/dev/null 2>&1; then
-    _state_write '
-      .runtime_checks.mcp_tools = {
-        status: "failed",
-        ts: $ts,
-        evidence: "MCP tools/list returned invalid output"
-      }
-    ' --arg ts "$(_now)"
+  if ! json_assert "$out" tools-list >/dev/null 2>&1; then
+    state_set_object runtime_checks.mcp_tools status=failed "ts=$(_now)" "evidence=MCP tools/list returned invalid output"
     rm -f "$out" "$err"
     return 1
   fi
   report=$(cat "$out")
-  _state_write '
-    .runtime_checks.mcp_tools = {
-      status: "passed",
-      ts: $ts,
-      evidence: "MCP tools/list succeeded",
-      tool_count: ($report.tool_count // 0),
-      tools: ($report.tools // [])
-    }
-  ' --arg ts "$(_now)" --argjson report "$report"
+  state_set_object runtime_checks.mcp_tools \
+    status=passed \
+    "ts=$(_now)" \
+    "evidence=MCP tools/list succeeded" \
+    "tool_count=$(json_get "$out" tool_count 0)" \
+    "tools=$(json_get "$out" tools "[]")"
   rm -f "$out" "$err"
   echo "verified runtime check: mcp_tools"
 }
 
 _node_command() {
-  if command -v node >/dev/null 2>&1; then
-    command -v node
-    return 0
-  fi
-  if command -v node.exe >/dev/null 2>&1; then
-    command -v node.exe
-    return 0
-  fi
-  return 1
+  json_node
 }
 
 _node_script_path() {
@@ -907,11 +878,12 @@ cmd_verify_connect_daemon() {
   }
 
   local service_name service_dir config runtime_dir binary target_work_dir status_out daemon_status work_dir evidence agent_error
-  service_name=$(jq -r '.agent_service_id // .domain // empty' "$STATE_JSON")
-  service_dir=$(jq -r '.agent_service_dir // empty' "$STATE_JSON")
-  config=$(jq -r '.cc_connect_config // empty' "$STATE_JSON")
-  runtime_dir=$(jq -r '.cc_connect_runtime_dir // empty' "$STATE_JSON")
-  binary=$(jq -r '.cc_connect_binary // "direxio-connect"' "$STATE_JSON")
+  service_name=$(json_get "$STATE_JSON" agent_service_id)
+  [ -n "$service_name" ] || service_name=$(json_get "$STATE_JSON" domain)
+  service_dir=$(json_get "$STATE_JSON" agent_service_dir)
+  config=$(json_get "$STATE_JSON" cc_connect_config)
+  runtime_dir=$(json_get "$STATE_JSON" cc_connect_runtime_dir)
+  binary=$(json_get "$STATE_JSON" cc_connect_binary "direxio-connect")
   [ -n "$service_name" ] || service_name=cc-connect
   [ -n "$binary" ] || binary=direxio-connect
 
@@ -930,13 +902,7 @@ cmd_verify_connect_daemon() {
     */*|[A-Za-z]:/*|[A-Za-z]:\\*) ;;
     *)
       command -v "$binary" >/dev/null 2>&1 || {
-        _state_write '
-          .runtime_checks.connect_daemon = {
-            status: "failed",
-            ts: $ts,
-            evidence: "direxio-connect binary not found"
-          }
-        ' --arg ts "$(_now)"
+        state_set_object runtime_checks.connect_daemon status=failed "ts=$(_now)" "evidence=direxio-connect binary not found"
         warn "connect daemon check could not find binary: $binary"
         return 1
       }
@@ -944,14 +910,7 @@ cmd_verify_connect_daemon() {
   esac
 
   status_out=$("$binary" daemon status --service-name "$service_name" 2>/dev/null) || {
-    _state_write '
-      .runtime_checks.connect_daemon = {
-        status: "failed",
-        ts: $ts,
-        service_name: $service_name,
-        evidence: "direxio-connect daemon status failed"
-      }
-    ' --arg ts "$(_now)" --arg service_name "$service_name"
+    state_set_object runtime_checks.connect_daemon status=failed "ts=$(_now)" "service_name=$service_name" "evidence=direxio-connect daemon status failed"
     return 1
   }
   daemon_status=$(printf '%s\n' "$status_out" | sed -nE 's/^[[:space:]]*Status:[[:space:]]*//p' | head -n 1)
@@ -966,68 +925,45 @@ cmd_verify_connect_daemon() {
   else
     agent_error=$(connect_daemon_agent_error_from_logs "$binary" "$service_name")
     if [ -n "$agent_error" ]; then
-      _state_write '
-        .runtime_checks.connect_daemon = {
-          status: "failed",
-          ts: $ts,
-          evidence: "direxio-connect daemon logs report ACP session initialization failure",
-          service_name: $service_name,
-          daemon_status: $daemon_status,
-          work_dir: $work_dir,
-          expected_work_dir: $target_work_dir,
-          agent_error: $agent_error
-        }
-      ' --arg ts "$(_now)" \
-        --arg service_name "$service_name" \
-        --arg daemon_status "$daemon_status" \
-        --arg work_dir "$(normalize_check_path "$work_dir")" \
-        --arg target_work_dir "$(normalize_check_path "$target_work_dir")" \
-        --arg agent_error "$agent_error"
+      state_set_object runtime_checks.connect_daemon \
+        status=failed \
+        "ts=$(_now)" \
+        "evidence=direxio-connect daemon logs report ACP session initialization failure" \
+        "service_name=$service_name" \
+        "daemon_status=$daemon_status" \
+        "work_dir=$(normalize_check_path "$work_dir")" \
+        "expected_work_dir=$(normalize_check_path "$target_work_dir")" \
+        "agent_error=$agent_error"
       warn "direxio-connect daemon logs report ACP session initialization failure"
       return 1
     fi
-    _state_write '
-      .runtime_checks.connect_daemon = {
-        status: "passed",
-        ts: $ts,
-        evidence: "direxio-connect daemon is running for this service",
-        service_name: $service_name,
-        daemon_status: $daemon_status,
-        work_dir: $work_dir,
-        expected_work_dir: $target_work_dir
-      }
-    ' --arg ts "$(_now)" \
-      --arg service_name "$service_name" \
-      --arg daemon_status "$daemon_status" \
-      --arg work_dir "$(normalize_check_path "$work_dir")" \
-      --arg target_work_dir "$(normalize_check_path "$target_work_dir")"
+    state_set_object runtime_checks.connect_daemon \
+      status=passed \
+      "ts=$(_now)" \
+      "evidence=direxio-connect daemon is running for this service" \
+      "service_name=$service_name" \
+      "daemon_status=$daemon_status" \
+      "work_dir=$(normalize_check_path "$work_dir")" \
+      "expected_work_dir=$(normalize_check_path "$target_work_dir")"
     echo "verified runtime check: connect_daemon"
     return 0
   fi
 
-  _state_write '
-    .runtime_checks.connect_daemon = {
-      status: "failed",
-      ts: $ts,
-      evidence: $evidence,
-      service_name: $service_name,
-      daemon_status: $daemon_status,
-      work_dir: $work_dir,
-      expected_work_dir: $target_work_dir
-    }
-  ' --arg ts "$(_now)" \
-    --arg evidence "$evidence" \
-    --arg service_name "$service_name" \
-    --arg daemon_status "$daemon_status" \
-    --arg work_dir "$(normalize_check_path "$work_dir")" \
-    --arg target_work_dir "$(normalize_check_path "$target_work_dir")"
+  state_set_object runtime_checks.connect_daemon \
+    status=failed \
+    "ts=$(_now)" \
+    "evidence=$evidence" \
+    "service_name=$service_name" \
+    "daemon_status=$daemon_status" \
+    "work_dir=$(normalize_check_path "$work_dir")" \
+    "expected_work_dir=$(normalize_check_path "$target_work_dir")"
   warn "$evidence"
   return 1
 }
 
 runtime_check_status() {
   local check=$1
-  jq -r --arg check "$check" '.runtime_checks[$check].status // "not_run"' "$STATE_JSON"
+  json_get "$STATE_JSON" "runtime_checks.$check.status" "not_run"
 }
 
 cmd_verify_runtime() {
@@ -1053,47 +989,28 @@ cmd_verify_runtime() {
   done
 
   if [ "$failed_count" -eq 0 ]; then
-    _state_write '
-      .runtime_checks.summary = {
-        status: "passed",
-        ts: $ts,
-        failed_count: 0,
-        evidence: "all runtime checks passed",
-        checks: {
-          connect_daemon: $connect_status,
-          mcp_doctor: $doctor_status,
-          mcp_tools: $tools_status,
-          mcp_smoke: $smoke_status
-        }
-      }
-    ' --arg ts "$(_now)" \
-      --arg connect_status "$connect_status" \
-      --arg doctor_status "$doctor_status" \
-      --arg tools_status "$tools_status" \
-      --arg smoke_status "$smoke_status"
+    state_set_object runtime_checks.summary \
+      status=passed \
+      "ts=$(_now)" \
+      failed_count=0 \
+      "evidence=all runtime checks passed" \
+      "checks.connect_daemon=$connect_status" \
+      "checks.mcp_doctor=$doctor_status" \
+      "checks.mcp_tools=$tools_status" \
+      "checks.mcp_smoke=$smoke_status"
     echo "verified runtime checks: passed"
     return 0
   fi
 
-  _state_write '
-    .runtime_checks.summary = {
-      status: "failed",
-      ts: $ts,
-      failed_count: ($failed_count | tonumber),
-      evidence: "one or more runtime checks failed",
-      checks: {
-        connect_daemon: $connect_status,
-        mcp_doctor: $doctor_status,
-        mcp_tools: $tools_status,
-        mcp_smoke: $smoke_status
-      }
-    }
-  ' --arg ts "$(_now)" \
-    --arg failed_count "$failed_count" \
-    --arg connect_status "$connect_status" \
-    --arg doctor_status "$doctor_status" \
-    --arg tools_status "$tools_status" \
-    --arg smoke_status "$smoke_status"
+  state_set_object runtime_checks.summary \
+    status=failed \
+    "ts=$(_now)" \
+    "failed_count=$failed_count" \
+    "evidence=one or more runtime checks failed" \
+    "checks.connect_daemon=$connect_status" \
+    "checks.mcp_doctor=$doctor_status" \
+    "checks.mcp_tools=$tools_status" \
+    "checks.mcp_smoke=$smoke_status"
   warn "runtime checks failed: $failed_count"
   return "${rc:-1}"
 }