direxio-deployer 0.1.0 → 0.1.2

package/tests/default_paths_test.sh

@@ -1,58 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT=$(cd "$(dirname "$0")/.." && pwd)
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' EXIT
-
-export HOME="$tmp/home"
-mkdir -p "$HOME"
-unset P2P_WORKDIR
-unset DIREXIO_WORKDIR
-export DOMAIN="IM.Example.test"
-
-# shellcheck disable=SC1090
-source "$ROOT/scripts/lib/state.sh"
-
-[ "$P2P_WORKDIR" = "$HOME/.direxio/nodes/im.example.test" ]
-[ "$STATE_JSON" = "$HOME/.direxio/nodes/im.example.test/state.json" ]
-
-(
-  unset P2P_WORKDIR
-  export DIREXIO_WORKDIR="$HOME/.direxio/custom-workdir"
-  # shellcheck disable=SC1090
-  source "$ROOT/scripts/lib/state.sh"
-  [ "$P2P_WORKDIR" = "$HOME/.direxio/custom-workdir" ]
-  [ "$STATE_JSON" = "$HOME/.direxio/custom-workdir/state.json" ]
-)
-
-rm -rf "$HOME/.direxio"
-(
-  unset DOMAIN P2P_WORKDIR DIREXIO_WORKDIR
-  HOME="$HOME" bash "$ROOT/scripts/orchestrate.sh" status >/dev/null 2>&1
-)
-[ ! -e "$HOME/.direxio/deploy" ]
-[ ! -e "$HOME/.direxio/nodes/state.json" ]
-
-mkdir -p "$HOME/.direxio/nodes/solo.example.test"
-jq -n '{domain:"solo.example.test", phase:"S3_PROVISION", resources:{instance_id:"i-solo"}}' > "$HOME/.direxio/nodes/solo.example.test/state.json"
-(
-  unset DOMAIN P2P_WORKDIR DIREXIO_WORKDIR
-  # shellcheck disable=SC1090
-  source "$ROOT/scripts/lib/state.sh"
-  [ "$P2P_WORKDIR" = "$HOME/.direxio/nodes" ]
-  [ "$STATE_JSON" = "$HOME/.direxio/nodes/state.json" ]
-)
-
-mkdir -p "$HOME/.direxio/nodes/second.example.test"
-jq -n '{domain:"second.example.test", phase:"S6_WIRE_LOCAL", resources:{instance_id:"i-second"}}' > "$HOME/.direxio/nodes/second.example.test/state.json"
-status_output=$(
-  unset DOMAIN P2P_WORKDIR DIREXIO_WORKDIR
-  HOME="$HOME" bash "$ROOT/scripts/orchestrate.sh" status
-)
-[[ "$status_output" == *"solo.example.test"* ]]
-[[ "$status_output" == *"second.example.test"* ]]
-[[ "$status_output" == *"i-solo"* ]]
-[[ "$status_output" == *"i-second"* ]]
-
-echo "default paths ok"

package/tests/destroy_local_bridge_test.sh

@@ -1,154 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT=$(cd "$(dirname "$0")/.." && pwd)
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' EXIT
-
-export HOME="$tmp/home"
-mkdir -p "$HOME"
-
-fakebin="$tmp/bin"
-mkdir -p "$fakebin"
-
-cat > "$fakebin/aws" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-printf 'aws' >> "$CALLS"
-printf ' %q' "$@" >> "$CALLS"
-printf '\n' >> "$CALLS"
-
-case "${1:-} ${2:-}" in
-  "sts get-caller-identity")
-    case "$*" in
-      *"--query Arn"*) printf 'arn:aws:iam::123456789012:user/DirexioDeployer-Test\n' ;;
-      *"--query Account"*) printf '123456789012\n' ;;
-      *) printf '{"Account":"123456789012","Arn":"arn:aws:iam::123456789012:user/DirexioDeployer-Test"}\n' ;;
-    esac
-    ;;
-  "ec2 terminate-instances") exit 0 ;;
-  "ec2 wait") exit 0 ;;
-  "ec2 release-address") exit 0 ;;
-  "ec2 delete-security-group") exit 0 ;;
-  "ec2 delete-key-pair") exit 0 ;;
-  *) exit 0 ;;
-esac
-EOF
-chmod 700 "$fakebin/aws"
-
-cat > "$fakebin/direxio-connect" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-printf 'direxio-connect' >> "$CALLS"
-printf ' %q' "$@" >> "$CALLS"
-printf '\n' >> "$CALLS"
-if [ "${1:-}" = "daemon" ] && [ "${2:-}" = "status" ]; then
-  [ "${3:-}" = "--service-name" ]
-  [ -n "${4:-}" ]
-  cat <<STATUS
-cc-connect daemon status
-
-  Status:    Running
-  Platform:  test
-  WorkDir:   ${STATUS_WORK_DIR:-}
-STATUS
-fi
-EOF
-chmod 700 "$fakebin/direxio-connect"
-
-write_state() {
-  local state=$1 domain=$2 service_dir=$3
-  mkdir -p "$(dirname "$state")" "$service_dir/cc-connect"
-  : > "$service_dir/cc-connect/config.toml"
-  jq -n \
-    --arg region "us-east-1" \
-    --arg domain "$domain" \
-    --arg service_dir "$service_dir" \
-    '{
-      region: $region,
-      domain_mode: "user",
-      domain: $domain,
-      as_url: ("https://" + $domain),
-      agent_service_dir: $service_dir,
-      agent_service_id: $domain,
-      resources: {
-        instance_id: "i-test",
-        eip_id: "eipalloc-test",
-        sg_id: "sg-test",
-        key_name: "direxio-test"
-      }
-    }' > "$state"
-}
-
-run_destroy() {
-  local state=$1 calls=$2 status_work_dir=$3
-  : > "$calls"
-  CALLS="$calls" STATUS_WORK_DIR="$status_work_dir" PATH="$fakebin:$PATH" bash "$ROOT/scripts/destroy.sh" "$state" >/dev/null
-}
-
-current_service="$HOME/.direxio/nodes/a5.direxio.ai"
-current_state="$current_service/state.json"
-current_calls="$tmp/current.calls"
-write_state "$current_state" "a5.direxio.ai" "$current_service"
-run_destroy "$current_state" "$current_calls" "$current_service/cc-connect"
-
-grep -q '^direxio-connect daemon status --service-name a5.direxio.ai$' "$current_calls" || {
-  echo "destroy should query the current named daemon status" >&2
-  cat "$current_calls" >&2
-  exit 1
-}
-
-grep -q '^direxio-connect daemon stop --service-name a5.direxio.ai$' "$current_calls" || {
-  echo "destroy should stop the daemon when daemon status WorkDir matches the current service cc-connect dir" >&2
-  cat "$current_calls" >&2
-  exit 1
-}
-
-grep -q '^direxio-connect daemon uninstall --service-name a5.direxio.ai$' "$current_calls" || {
-  echo "destroy should uninstall the daemon after stopping the matching current service daemon" >&2
-  cat "$current_calls" >&2
-  exit 1
-}
-
-if [ -d "$current_service" ]; then
-  echo "destroy should remove the current service directory after stopping its daemon" >&2
-  exit 1
-fi
-
-other_service="$HOME/.direxio/nodes/b5.direxio.ai"
-other_state="$other_service/state.json"
-active_other_service="$HOME/.direxio/nodes/active-other"
-other_calls="$tmp/other.calls"
-mkdir -p "$active_other_service/cc-connect"
-write_state "$other_state" "b5.direxio.ai" "$other_service"
-run_destroy "$other_state" "$other_calls" "$active_other_service/cc-connect"
-
-grep -q '^direxio-connect daemon status --service-name b5.direxio.ai$' "$other_calls" || {
-  echo "destroy should query the named daemon for the service being destroyed" >&2
-  cat "$other_calls" >&2
-  exit 1
-}
-
-if grep -q '^direxio-connect daemon stop' "$other_calls"; then
-  echo "destroy must not stop a daemon whose status WorkDir belongs to a different service" >&2
-  cat "$other_calls" >&2
-  exit 1
-fi
-
-if grep -q '^direxio-connect daemon uninstall' "$other_calls"; then
-  echo "destroy must not uninstall a daemon whose status WorkDir belongs to a different service" >&2
-  cat "$other_calls" >&2
-  exit 1
-fi
-
-if [ -d "$other_service" ]; then
-  echo "destroy should remove the current service directory even when another service daemon is active" >&2
-  exit 1
-fi
-
-if [ ! -d "$active_other_service" ]; then
-  echo "destroy must not remove another service directory" >&2
-  exit 1
-fi
-
-echo "destroy local bridge ok"

package/tests/destroy_root_identity_test.sh

@@ -1,91 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT=$(cd "$(dirname "$0")/.." && pwd)
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' EXIT
-
-export HOME="$tmp/home"
-mkdir -p "$HOME"
-
-fakebin="$tmp/bin"
-mkdir -p "$fakebin"
-
-cat > "$fakebin/aws" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-printf 'aws' >> "$CALLS"
-printf ' %q' "$@" >> "$CALLS"
-printf '\n' >> "$CALLS"
-
-case "${1:-} ${2:-}" in
-  "sts get-caller-identity")
-    case "$*" in
-      *"--query Arn"*) printf 'arn:aws:iam::123456789012:root\n' ;;
-      *"--query Account"*) printf '123456789012\n' ;;
-      *) printf '{"Account":"123456789012","Arn":"arn:aws:iam::123456789012:root"}\n' ;;
-    esac
-    ;;
-  "ec2 terminate-instances"|"ec2 release-address"|"ec2 delete-security-group"|"ec2 delete-key-pair"|"route53 change-resource-record-sets")
-    exit 0
-    ;;
-  *)
-    exit 0
-    ;;
-esac
-EOF
-chmod 700 "$fakebin/aws"
-
-service_dir="$HOME/.direxio/nodes/root-destroy.example.test"
-mkdir -p "$service_dir"
-state="$service_dir/state.json"
-jq -n \
-  --arg service_dir "$service_dir" \
-  '{
-    region: "us-east-1",
-    domain_mode: "user",
-    domain: "root-destroy.example.test",
-    agent_service_dir: $service_dir,
-    agent_service_id: "root-destroy.example.test",
-    resources: {
-      instance_id: "i-root-destroy",
-      eip_id: "eipalloc-root-destroy",
-      sg_id: "sg-root-destroy",
-      key_name: "direxio-root-destroy"
-    }
-  }' > "$state"
-
-calls="$tmp/aws.calls"
-: > "$calls"
-set +e
-CALLS="$calls" PATH="$fakebin:$PATH" bash "$ROOT/scripts/destroy.sh" "$state" > "$tmp/destroy.out" 2>&1
-destroy_rc=$?
-set -e
-
-[ "$destroy_rc" -eq 0 ] || {
-  echo "destroy must allow root identity when the operator chose root credentials" >&2
-  cat "$tmp/destroy.out" >&2
-  exit 1
-}
-grep -q 'source = ' "$tmp/destroy.out"
-
-for expected in 'ec2 terminate-instances' 'ec2 release-address' 'ec2 delete-security-group' 'ec2 delete-key-pair'; do
-  if ! grep -F "$expected" "$calls" >/dev/null; then
-    echo "destroy should process recorded AWS resource with root identity: $expected" >&2
-    cat "$calls" >&2
-    exit 1
-  fi
-done
-
-if grep -F 'route53 change-resource-record-sets' "$calls" >/dev/null; then
-  echo "destroy should not touch Route53 for DOMAIN_MODE=user" >&2
-  cat "$calls" >&2
-  exit 1
-fi
-
-if [ -d "$service_dir" ]; then
-  echo "destroy should remove local service state after processing resources" >&2
-  exit 1
-fi
-
-echo "destroy root identity allowed ok"

package/tests/destroy_route53_zone_test.sh

@@ -1,80 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT=$(cd "$(dirname "$0")/.." && pwd)
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' EXIT
-
-export HOME="$tmp/home"
-mkdir -p "$HOME"
-
-fakebin="$tmp/bin"
-mkdir -p "$fakebin"
-cat > "$fakebin/aws" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-printf 'aws' >> "$CALLS"
-printf ' %q' "$@" >> "$CALLS"
-printf '\n' >> "$CALLS"
-
-case "${1:-} ${2:-}" in
-  "sts get-caller-identity")
-    case "$*" in
-      *"--query Arn"*) printf 'arn:aws:iam::123456789012:user/DirexioDeployer-Test\n' ;;
-      *"--query Account"*) printf '123456789012\n' ;;
-      *) printf '{"Account":"123456789012","Arn":"arn:aws:iam::123456789012:user/DirexioDeployer-Test"}\n' ;;
-    esac
-    ;;
-  "route53 list-hosted-zones")
-    printf '{"HostedZones":[{"Id":"/hostedzone/ZCREATE","Name":"route53-destroy.example.test."}]}\n'
-    ;;
-  "route53 change-resource-record-sets")
-    exit 0
-    ;;
-  "route53 delete-hosted-zone")
-    exit 0
-    ;;
-  "ec2 terminate-instances"|"ec2 wait"|"ec2 release-address"|"ec2 delete-security-group"|"ec2 delete-key-pair")
-    exit 0
-    ;;
-  *)
-    exit 0
-    ;;
-esac
-EOF
-chmod 700 "$fakebin/aws"
-
-service_dir="$HOME/.direxio/nodes/route53-destroy.example.test"
-mkdir -p "$service_dir"
-state="$service_dir/state.json"
-jq -n \
-  --arg service_dir "$service_dir" \
-  '{
-    region: "us-east-1",
-    domain_mode: "route53",
-    domain: "route53-destroy.example.test",
-    agent_service_dir: $service_dir,
-    resources: {
-      public_ip: "203.0.113.99",
-      route53_zone_id: "ZCREATE",
-      route53_zone_name: "route53-destroy.example.test",
-      route53_zone_created_by_deployer: "true"
-    }
-  }' > "$state"
-
-calls="$tmp/aws.calls"
-CALLS="$calls" PATH="$fakebin:$PATH" bash "$ROOT/scripts/destroy.sh" "$state" >/dev/null
-
-grep -q '^aws route53 change-resource-record-sets --hosted-zone-id ZCREATE' "$calls" || {
-  echo "destroy should delete the Route53 A record from the recorded zone" >&2
-  cat "$calls" >&2
-  exit 1
-}
-
-grep -q '^aws route53 delete-hosted-zone --id ZCREATE$' "$calls" || {
-  echo "destroy should delete a deployer-created hosted zone to stop Route53 hosted-zone billing" >&2
-  cat "$calls" >&2
-  exit 1
-}
-
-echo "destroy route53 zone ok"

package/tests/domain_authoritative_dns_test.sh

@@ -1,49 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT=$(cd "$(dirname "$0")/.." && pwd)
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' EXIT
-
-fakebin="$tmp/bin"
-mkdir -p "$fakebin"
-cat > "$fakebin/dig" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-
-if [ "${1:-}" = "+short" ] && [ "${2:-}" = "A" ] && [ "${3:-}" = "app.example.test" ]; then
-  printf '203.0.113.88\n'
-  exit 0
-fi
-
-if [ "${1:-}" = "+short" ] && [ "${2:-}" = "NS" ] && [ "${3:-}" = "app.example.test" ]; then
-  exit 0
-fi
-
-if [ "${1:-}" = "+short" ] && [ "${2:-}" = "NS" ] && [ "${3:-}" = "example.test" ]; then
-  printf 'ns1.example.test.\n'
-  exit 0
-fi
-
-if [ "${1:-}" = "+short" ] && [ "${2:-}" = "@ns1.example.test" ] && [ "${3:-}" = "A" ] && [ "${4:-}" = "app.example.test" ]; then
-  printf '%s\n' "${AUTHORITATIVE_A:-198.51.100.10}"
-  exit 0
-fi
-
-echo "unexpected dig call: $*" >&2
-exit 1
-EOF
-chmod 700 "$fakebin/dig"
-
-PATH="$fakebin:$PATH"
-# shellcheck disable=SC1091
-source "$ROOT/scripts/lib/domain.sh"
-
-if AUTHORITATIVE_A=198.51.100.10 domain_resolves_to_ip app.example.test 203.0.113.88; then
-  echo "recursive DNS alone must not pass when authoritative DNS still points at a different IP" >&2
-  exit 1
-fi
-
-AUTHORITATIVE_A=203.0.113.88 domain_resolves_to_ip app.example.test 203.0.113.88
-
-echo "domain authoritative dns ok"

package/tests/mcp_doctor_runtime_check_test.sh

@@ -1,86 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT=$(cd "$(dirname "$0")/.." && pwd)
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' EXIT
-
-export HOME="$tmp/home"
-mkdir -p "$HOME"
-
-fakebin="$tmp/bin"
-mkdir -p "$fakebin"
-cat > "$fakebin/direxio-mcp" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-
-[ "${1:-}" = "doctor" ]
-[ "${2:-}" = "--json" ]
-[ "${DIREXIO_CREDENTIALS_FILE:-}" = "${EXPECTED_CREDENTIALS_FILE:-}" ]
-
-cat <<JSON
-{
-  "ok": true,
-  "domain": "mcp-check.example.test",
-  "agent_room_id": "!agent:mcp-check.example.test",
-  "token": "redacted"
-}
-JSON
-EOF
-chmod 700 "$fakebin/direxio-mcp"
-
-service_dir="$HOME/.direxio/nodes/mcp-check.example.test"
-mkdir -p "$service_dir"
-credentials="$service_dir/credentials.json"
-: > "$credentials"
-expected_credentials="$credentials"
-if command -v cygpath >/dev/null 2>&1; then
-  expected_credentials=$(cygpath -m "$expected_credentials")
-fi
-state="$service_dir/state.json"
-jq -n \
-  --arg service_dir "$service_dir" \
-  --arg credentials "$credentials" \
-  '{
-    run_id: "mcp-doctor-test",
-    region: "ap-northeast-1",
-    domain_mode: "user",
-    domain: "mcp-check.example.test",
-    agent_service_id: "mcp-check.example.test",
-    agent_service_dir: $service_dir,
-    agent_credentials_file: $credentials,
-    mcp_credentials_file: $credentials,
-    mcp_command: "direxio-mcp",
-    phase: "S7_VERIFY_E2E",
-    phases: {
-      S0_PREREQ_AWS: {status: "done"},
-      S1_PREFLIGHT: {status: "done"},
-      S2_DOMAIN: {status: "done"},
-      S3_PROVISION: {status: "done"},
-      S4_BOOTSTRAP_STACK: {status: "done"},
-      S5_INIT_TOKENS: {status: "done"},
-      S6_WIRE_LOCAL: {status: "done"},
-      S7_VERIFY_E2E: {status: "done"}
-    },
-    resources: {}
-  }' > "$state"
-
-verify_output=$(P2P_WORKDIR="$service_dir" PATH="$fakebin:$PATH" EXPECTED_CREDENTIALS_FILE="$expected_credentials" bash "$ROOT/scripts/orchestrate.sh" verify mcp_doctor)
-printf '%s\n' "$verify_output" | grep -q 'verified runtime check: mcp_doctor'
-
-jq -e '
-  .runtime_checks.mcp_doctor.status == "passed"
-  and .runtime_checks.mcp_doctor.domain == "mcp-check.example.test"
-  and .runtime_checks.mcp_doctor.agent_room_id == "!agent:mcp-check.example.test"
-  and .runtime_checks.mcp_doctor.token == "redacted"
-  and (.user_confirmations.agent_mcp_runtime | not)
-' "$state" >/dev/null
-
-report_output=$(P2P_WORKDIR="$service_dir" bash "$ROOT/scripts/orchestrate.sh" report new_deploy)
-report_path=$(printf '%s\n' "$report_output" | sed -nE 's/^operation report: //p' | tail -n 1)
-jq -e '
-  .runtime_checks.mcp_doctor.status == "passed"
-  and .gates.user_confirmation.agent_mcp_runtime == "pending_runtime_confirmation"
-' "$report_path" >/dev/null
-
-echo "mcp doctor runtime check ok"

package/tests/mcp_smoke_runtime_check_test.sh

@@ -1,121 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT=$(cd "$(dirname "$0")/.." && pwd)
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' EXIT
-
-export HOME="$tmp/home"
-mkdir -p "$HOME"
-
-fakebin="$tmp/bin"
-mkdir -p "$fakebin"
-cat > "$fakebin/curl" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-
-printf '%s\n' "$*" >> "$CURL_CALLS"
-
-want_url="https://mcp-smoke.example.test/_p2p/query"
-case " $* " in
-  *" $want_url "*|*" $want_url")
-    ;;
-  *)
-    echo "unexpected curl URL: $*" >&2
-    exit 1
-    ;;
-esac
-
-case " $* " in
-  *"Authorization: Bearer AGENT_TOKEN_SMOKE"*) ;;
-  *)
-    echo "missing or wrong Authorization header: $*" >&2
-    exit 1
-    ;;
-esac
-
-case " $* " in
-  *'"action":"mcp.messages.list"'*'"room_id":"!agent:mcp-smoke.example.test"'*) ;;
-  *)
-    echo "wrong smoke request body: $*" >&2
-    exit 1
-    ;;
-esac
-
-body_path=""
-write_code=0
-while [ "$#" -gt 0 ]; do
-  case "$1" in
-    -o)
-      body_path=$2
-      shift 2
-      ;;
-    -w)
-      write_code=1
-      shift 2
-      ;;
-    *)
-      shift
-      ;;
-  esac
-done
-
-payload='{"room_id":"!agent:mcp-smoke.example.test","messages":[]}'
-if [ -n "$body_path" ]; then
-  printf '%s\n' "$payload" > "$body_path"
-else
-  printf '%s\n' "$payload"
-fi
-[ "$write_code" -eq 1 ] && printf '200'
-EOF
-chmod 700 "$fakebin/curl"
-
-service_dir="$HOME/.direxio/nodes/mcp-smoke.example.test"
-mkdir -p "$service_dir"
-state="$service_dir/state.json"
-jq -n \
-  --arg service_dir "$service_dir" \
-  '{
-    run_id: "mcp-smoke-test",
-    region: "ap-northeast-1",
-    domain_mode: "user",
-    domain: "mcp-smoke.example.test",
-    as_url: "https://mcp-smoke.example.test",
-    agent_service_id: "mcp-smoke.example.test",
-    agent_service_dir: $service_dir,
-    agent_token: "AGENT_TOKEN_SMOKE",
-    agent_room_id: "!agent:mcp-smoke.example.test",
-    phase: "S7_VERIFY_E2E",
-    phases: {
-      S0_PREREQ_AWS: {status: "done"},
-      S1_PREFLIGHT: {status: "done"},
-      S2_DOMAIN: {status: "done"},
-      S3_PROVISION: {status: "done"},
-      S4_BOOTSTRAP_STACK: {status: "done"},
-      S5_INIT_TOKENS: {status: "done"},
-      S6_WIRE_LOCAL: {status: "done"},
-      S7_VERIFY_E2E: {status: "done"}
-    },
-    resources: {}
-  }' > "$state"
-
-calls="$tmp/curl.calls"
-verify_output=$(P2P_WORKDIR="$service_dir" PATH="$fakebin:$PATH" CURL_CALLS="$calls" bash "$ROOT/scripts/orchestrate.sh" verify mcp_smoke)
-printf '%s\n' "$verify_output" | grep -q 'verified runtime check: mcp_smoke'
-
-jq -e '
-  .runtime_checks.mcp_smoke.status == "passed"
-  and .runtime_checks.mcp_smoke.action == "mcp.messages.list"
-  and .runtime_checks.mcp_smoke.room_id == "!agent:mcp-smoke.example.test"
-  and .runtime_checks.mcp_smoke.response_messages_type == "array"
-  and (.user_confirmations.agent_mcp_runtime | not)
-' "$state" >/dev/null
-
-report_output=$(P2P_WORKDIR="$service_dir" bash "$ROOT/scripts/orchestrate.sh" report new_deploy)
-report_path=$(printf '%s\n' "$report_output" | sed -nE 's/^operation report: //p' | tail -n 1)
-jq -e '
-  .runtime_checks.mcp_smoke.status == "passed"
-  and .gates.user_confirmation.agent_mcp_runtime == "pending_runtime_confirmation"
-' "$report_path" >/dev/null
-
-echo "mcp smoke runtime check ok"