direxio-deployer 0.1.0 → 0.1.2

package/tests/pricing_estimate_test.sh

@@ -1,159 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT=$(cd "$(dirname "$0")/.." && pwd)
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' EXIT
-
-export HOME="$tmp/home"
-mkdir -p "$HOME"
-
-fakebin="$tmp/bin"
-mkdir -p "$fakebin"
-
-cat > "$fakebin/aws" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-printf 'aws' >> "$CALLS"
-printf ' %q' "$@" >> "$CALLS"
-printf '\n' >> "$CALLS"
-
-if [ "${AWS_PRICING_FAIL:-0}" = "1" ]; then
-  exit 255
-fi
-
-case "${1:-} ${2:-}" in
-  "sts get-caller-identity")
-    if [ "${AWS_STS_OK:-0}" = "1" ]; then
-      printf '{"Account":"123456789012","Arn":"arn:aws:iam::123456789012:user/DirexioDeployer","UserId":"AIDAEXAMPLE"}\n'
-      exit 0
-    fi
-    exit 255
-    ;;
-esac
-
-service=""
-for ((i=1; i<=$#; i++)); do
-  arg="${!i}"
-  if [ "$arg" = "--service-code" ]; then
-    j=$((i+1))
-    service="${!j}"
-  fi
-done
-
-case "$service" in
-  AmazonEC2)
-    if printf '%s\n' "$*" | grep -q 'instanceType'; then
-      rate="0.025"
-    else
-      rate="0.096"
-    fi
-    ;;
-  AmazonVPC)
-    rate="0.005"
-    ;;
-  *)
-    rate="0.50"
-    ;;
-esac
-
-jq -n --arg rate "$rate" '{
-  PriceList: [
-    ({
-      terms: {
-        OnDemand: {
-          term: {
-            priceDimensions: {
-              dim: {
-                pricePerUnit: {
-                  USD: $rate
-                }
-              }
-            }
-          }
-        }
-      }
-    } | tojson)
-  ]
-}'
-EOF
-chmod 700 "$fakebin/aws"
-
-assert_file_exists() {
-  [ -s "$1" ] || {
-    echo "expected non-empty file: $1" >&2
-    exit 1
-  }
-}
-
-CALLS="$tmp/aws.calls"
-export CALLS
-export PATH="$fakebin:$PATH"
-
-service_dir="$HOME/.direxio/nodes/pricing.example.test"
-mkdir -p "$service_dir"
-state="$service_dir/state.json"
-jq -n '{
-  domain:"pricing.example.test",
-  region:"ap-northeast-1",
-  domain_mode:"route53",
-  instance_type:"t3.small",
-  resources:{root_volume_gb:"8"},
-  phases:{S7_VERIFY_E2E:{status:"done"}}
-}' > "$state"
-
-estimate=$(bash "$ROOT/scripts/pricing-estimate.sh" --state "$state" --write-state)
-printf '%s\n' "$estimate" > "$tmp/estimate.json"
-
-jq -e '
-  .pricing_status == "queried"
-  and .region == "ap-northeast-1"
-  and .location == "Asia Pacific (Tokyo)"
-  and .hours_per_month == 730
-  and .components.ec2_instance.hourly_usd == 0.025
-  and .components.ec2_instance.monthly_usd == 18.25
-  and .components.ebs_gp3.storage_gb == 8
-  and .components.public_ipv4.hourly_usd == 0.005
-  and .components.public_ipv4.monthly_usd == 3.65
-  and .components.route53_hosted_zone.monthly_usd == 0.5
-  and .components.public_ipv4.billed_even_when_attached == true
-  and (.recommendations | index("Set an AWS Budget or billing alert before leaving the node running.") != null)
-  and (.notes | index("AWS credits may reduce charges only when the account, plan, region, and service usage are eligible; verify in AWS Billing Console.") != null)
-  and .total_monthly_usd > 23
-  and .total_monthly_usd < 24
-' "$tmp/estimate.json" >/dev/null
-
-jq -e '.cost_estimate.pricing_status == "queried" and .cost_estimate.components.public_ipv4.billed_even_when_attached == true' "$state" >/dev/null
-
-auto_workdir="$HOME/.direxio/nodes/auto-pricing.example.test"
-set +e
-AWS_DEFAULT_REGION=ap-northeast-1 \
-DOMAIN=auto-pricing.example.test \
-DOMAIN_MODE=user \
-CONFIRM_DOMAIN_BINDING=1 \
-P2P_WORKDIR="$auto_workdir" \
-bash "$ROOT/scripts/orchestrate.sh" > "$tmp/orchestrate.out" 2> "$tmp/orchestrate.err"
-auto_rc=$?
-set -e
-[ "$auto_rc" -ne 0 ] || {
-  echo "expected orchestrate test run to stop before real provisioning" >&2
-  exit 1
-}
-jq -e '.cost_estimate.pricing_status == "queried" and .cost_estimate.region == "ap-northeast-1"' "$auto_workdir/state.json" >/dev/null
-
-report_output=$(P2P_WORKDIR="$service_dir" bash "$ROOT/scripts/orchestrate.sh" report new_deploy)
-report_path=$(printf '%s\n' "$report_output" | sed -nE 's/^operation report: //p' | tail -n 1)
-assert_file_exists "$report_path"
-jq -e '.billing.cost_estimate.pricing_status == "queried" and .billing.cost_estimate.components.public_ipv4.billed_even_when_attached == true' "$report_path" >/dev/null
-
-fallback=$(AWS_PRICING_FAIL=1 bash "$ROOT/scripts/pricing-estimate.sh" --region ap-southeast-1 --instance-type t3.small --disk-gb 8 --domain-mode user)
-printf '%s\n' "$fallback" > "$tmp/fallback.json"
-jq -e '
-  .pricing_status == "fallback"
-  and .region == "ap-southeast-1"
-  and (.warnings | index("AWS Pricing API unavailable; using conservative fallback estimates") != null)
-  and .components.public_ipv4.billed_even_when_attached == true
-  and .components.route53_hosted_zone.monthly_usd == 0
-' "$tmp/fallback.json" >/dev/null
-
-echo "pricing estimate ok"

package/tests/render_userdata_remote_nodes_test.sh

@@ -1,40 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT=$(cd "$(dirname "$0")/.." && pwd)
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' EXIT
-
-bash "$ROOT/scripts/render/render-userdata.sh" \
-  --domain service.example.test \
-  --acme ops@example.test \
-  --message-server-image direxio/message-server:test \
-  > "$tmp/user-data.yaml"
-
-awk '/encoding: b64/ { getline; sub(/^    content: /, ""); print; exit }' "$tmp/user-data.yaml" \
-  | base64 -d > "$tmp/bundle.tar.gz"
-mkdir "$tmp/bundle"
-tar -xzf "$tmp/bundle.tar.gz" -C "$tmp/bundle"
-
-if grep -q 'P2P_REMOTE_NODE_' "$tmp/user-data.yaml"; then
-  echo "rendered user-data must not configure fixed remote P2P nodes" >&2
-  exit 1
-fi
-
-grep -q '/etc/direxio-message-server/message-server.yaml' "$tmp/bundle/docker-compose.yml"
-grep -q '/var/direxio-message-server/p2p/bootstrap.json' "$tmp/bundle/docker-compose.yml"
-grep -q 'P2P_PORTAL_CREDENTIALS_FILE: /var/direxio-message-server/p2p/bootstrap.json' "$tmp/bundle/docker-compose.yml"
-grep -q 'P2P_PORTAL_PASSWORD: ${P2P_PORTAL_PASSWORD}' "$tmp/bundle/docker-compose.yml"
-grep -q '^    grep -q .*P2P_PORTAL_PASSWORD=' "$tmp/user-data.yaml"
-grep -q '/var/direxio-message-server/p2p/bootstrap.json' "$tmp/bundle/init-tokens.sh"
-grep -q 'portal.bootstrap' "$tmp/bundle/init-tokens.sh"
-grep -q 'agent.matrix_session.create' "$tmp/bundle/init-tokens.sh"
-grep -q '/_matrix/client/v3/createRoom' "$tmp/bundle/init-tokens.sh"
-grep -q '/_matrix/client/v3/rooms/${room_path}/join' "$tmp/bundle/init-tokens.sh"
-
-if grep -R -q '/etc/dendrite\|/var/dendrite\|dendrite.yaml' "$tmp/bundle"; then
-  echo "rendered bundle must use direxio-message-server paths, not legacy dendrite paths" >&2
-  exit 1
-fi
-
-echo "render userdata remote node config absent ok"

package/tests/root_volume_tracking_test.sh

@@ -1,41 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT=$(cd "$(dirname "$0")/.." && pwd)
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' EXIT
-
-export HOME="$tmp/home"
-export P2P_WORKDIR="$tmp/work"
-mkdir -p "$HOME" "$P2P_WORKDIR"
-
-fakebin="$tmp/bin"
-mkdir -p "$fakebin"
-cat > "$fakebin/aws" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-case "${1:-} ${2:-}" in
-  "ec2 describe-instances")
-    printf 'vol-root-test\n'
-    ;;
-  *)
-    echo "unexpected aws command: $*" >&2
-    exit 1
-    ;;
-esac
-EOF
-chmod 700 "$fakebin/aws"
-export PATH="$fakebin:$PATH"
-
-# shellcheck disable=SC1091
-source "$ROOT/scripts/lib/state.sh"
-state_init >/dev/null 2>&1
-
-# shellcheck disable=SC1091
-source "$ROOT/scripts/phases/s3_provision.sh"
-
-_record_root_volume_id i-root-test
-
-jq -e '.resources.root_volume_id == "vol-root-test"' "$STATE_JSON" >/dev/null
-
-echo "root volume tracking ok"

package/tests/route53_overwrite_guard_test.sh

@@ -1,86 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT=$(cd "$(dirname "$0")/.." && pwd)
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' EXIT
-
-export HOME="$tmp/home"
-export P2P_WORKDIR="$tmp/work"
-mkdir -p "$HOME" "$P2P_WORKDIR"
-
-fakebin="$tmp/bin"
-mkdir -p "$fakebin"
-cat > "$fakebin/aws" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-printf 'aws' >> "$CALLS"
-printf ' %q' "$@" >> "$CALLS"
-printf '\n' >> "$CALLS"
-
-case "${1:-} ${2:-}" in
-  "route53 list-hosted-zones")
-    printf '{"HostedZones":[{"Id":"/hostedzone/ZEXISTING","Name":"overwrite.example.test."}]}\n'
-    ;;
-  "route53 list-resource-record-sets")
-    printf '{"ResourceRecordSets":[{"Name":"overwrite.example.test.","Type":"A","TTL":60,"ResourceRecords":[{"Value":"198.51.100.10"}]}]}\n'
-    ;;
-  "route53 change-resource-record-sets")
-    printf '{"ChangeInfo":{"Id":"/change/C123","Status":"PENDING"}}\n'
-    ;;
-  "route53 wait")
-    exit 0
-    ;;
-  *)
-    echo "unexpected aws command: $*" >&2
-    exit 1
-    ;;
-esac
-EOF
-chmod 700 "$fakebin/aws"
-export PATH="$fakebin:$PATH"
-
-# shellcheck disable=SC1091
-source "$ROOT/scripts/lib/state.sh"
-state_init >/dev/null 2>&1
-state_set run_id route53-overwrite-test
-state_set domain overwrite.example.test
-state_set domain_mode route53
-
-# shellcheck disable=SC1091
-source "$ROOT/scripts/phases/s3_provision.sh"
-
-CALLS="$tmp/blocked.calls"
-export CALLS
-set +e
-_upsert_route53_record overwrite.example.test 203.0.113.88 > "$tmp/blocked.out" 2>&1
-blocked_rc=$?
-set -e
-[ "$blocked_rc" -eq 2 ] || {
-  echo "Route53 overwrite without confirmation should return waiting_user rc=2" >&2
-  cat "$tmp/blocked.out" >&2
-  exit 1
-}
-grep -q 'Route53 A record overwrite requires confirmation' "$tmp/blocked.out"
-if grep -q 'route53 change-resource-record-sets' "$CALLS"; then
-  echo "Route53 overwrite without confirmation must not change records" >&2
-  cat "$CALLS" >&2
-  exit 1
-fi
-jq -e '
-  .phases.S3_PROVISION.status == "waiting_user"
-  and .resources.route53_existing_a_value == "198.51.100.10"
-  and .resources.route53_pending_a_value == "203.0.113.88"
-' "$STATE_JSON" >/dev/null
-
-CALLS="$tmp/confirmed.calls"
-export CALLS
-DIREXIO_CONFIRM_DNS_OVERWRITE=1 _upsert_route53_record overwrite.example.test 203.0.113.88
-grep -q 'route53 change-resource-record-sets' "$CALLS"
-jq -e '
-  .resources.route53_existing_a_value == "198.51.100.10"
-  and .resources.route53_pending_a_value == "203.0.113.88"
-  and .resources.route53_overwrite_confirmed == "true"
-' "$STATE_JSON" >/dev/null
-
-echo "route53 overwrite guard ok"

package/tests/route53_zone_auto_create_test.sh

@@ -1,66 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT=$(cd "$(dirname "$0")/.." && pwd)
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' EXIT
-
-export HOME="$tmp/home"
-export P2P_WORKDIR="$tmp/work"
-mkdir -p "$HOME" "$P2P_WORKDIR"
-
-fakebin="$tmp/bin"
-mkdir -p "$fakebin"
-cat > "$fakebin/aws" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-printf 'aws' >> "$CALLS"
-printf ' %q' "$@" >> "$CALLS"
-printf '\n' >> "$CALLS"
-
-case "${1:-} ${2:-}" in
-  "route53 list-hosted-zones")
-    printf '{"HostedZones":[]}\n'
-    ;;
-  "route53 create-hosted-zone")
-    printf '{"HostedZone":{"Id":"/hostedzone/ZCREATE","Name":"auto-zone.example.test."},"DelegationSet":{"NameServers":["ns-1.awsdns.test","ns-2.awsdns.test"]}}\n'
-    ;;
-  "route53 change-resource-record-sets")
-    printf '{"ChangeInfo":{"Id":"/change/C123","Status":"PENDING"}}\n'
-    ;;
-  "route53 wait")
-    exit 0
-    ;;
-  *)
-    echo "unexpected aws command: $*" >&2
-    exit 1
-    ;;
-esac
-EOF
-chmod 700 "$fakebin/aws"
-export CALLS="$tmp/aws.calls"
-export PATH="$fakebin:$PATH"
-
-# shellcheck disable=SC1091
-source "$ROOT/scripts/lib/state.sh"
-state_init >/dev/null 2>&1
-state_set run_id route53-test
-state_set domain auto-zone.example.test
-state_set domain_mode route53
-
-# shellcheck disable=SC1091
-source "$ROOT/scripts/phases/s3_provision.sh"
-
-_upsert_route53_record auto-zone.example.test 203.0.113.88
-
-jq -e '
-  .resources.route53_zone_id == "ZCREATE"
-  and .resources.route53_zone_name == "auto-zone.example.test"
-  and .resources.route53_zone_created_by_deployer == "true"
-  and (.resources.route53_name_servers | contains("ns-1.awsdns.test"))
-' "$STATE_JSON" >/dev/null
-
-grep -q 'route53 create-hosted-zone' "$CALLS"
-grep -q 'route53 change-resource-record-sets' "$CALLS"
-
-echo "route53 zone auto create ok"

package/tests/runtime_summary_check_test.sh

@@ -1,203 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT=$(cd "$(dirname "$0")/.." && pwd)
-tmp=$(mktemp -d "$ROOT/.tmp-runtime-summary.XXXXXX")
-trap 'rm -rf "$tmp"' EXIT
-
-export HOME="$tmp/home"
-mkdir -p "$HOME"
-
-fakebin="$tmp/bin"
-mkdir -p "$fakebin"
-
-windows_path() {
-  local path=$1 drive rest
-  case "$path" in
-    /mnt/[A-Za-z]/*)
-      drive=${path#/mnt/}
-      drive=${drive%%/*}
-      rest=${path#/mnt/$drive/}
-      printf '%s:\\%s\n' "$(printf '%s' "$drive" | tr '[:lower:]' '[:upper:]')" "$(printf '%s' "$rest" | sed 's#/#\\#g')"
-      ;;
-    /[A-Za-z]/*)
-      drive=${path#/}
-      drive=${drive%%/*}
-      rest=${path#/$drive/}
-      printf '%s:\\%s\n' "$(printf '%s' "$drive" | tr '[:lower:]' '[:upper:]')" "$(printf '%s' "$rest" | sed 's#/#\\#g')"
-      ;;
-    *) printf '%s\n' "$path" ;;
-  esac
-}
-
-cat > "$fakebin/direxio-connect" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-[ "${1:-}" = "daemon" ]
-[ "${2:-}" = "status" ]
-[ "${3:-}" = "--service-name" ]
-[ "${4:-}" = "runtime-summary.example.test" ]
-cat <<STATUS
-cc-connect daemon status
-
-  Status:    Running
-  Platform:  test
-  WorkDir:   ${CONNECT_WORK_DIR:-}
-STATUS
-EOF
-chmod 700 "$fakebin/direxio-connect"
-
-cat > "$fakebin/direxio-mcp" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-if [ "${DIREXIO_CREDENTIALS_FILE:-}" != "${EXPECTED_CREDENTIALS_FILE:-}" ]; then
-  echo "wrong DIREXIO_CREDENTIALS_FILE" >&2
-  exit 1
-fi
-
-if [ "${1:-}" = "doctor" ] && [ "${2:-}" = "--json" ]; then
-  printf '{"ok":true,"domain":"runtime-summary.example.test","agent_room_id":"!agent:runtime-summary.example.test","token":"redacted"}\n'
-  exit 0
-fi
-
-frame() {
-  local body=$1
-  printf 'Content-Length: %s\r\n\r\n%s' "${#body}" "$body"
-}
-
-frame '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{"tools":{}},"serverInfo":{"name":"fake-direxio-mcp","version":"0.0.0"}}}'
-frame '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"search_rooms"},{"name":"send_message"},{"name":"list_messages"}]}}'
-EOF
-chmod 700 "$fakebin/direxio-mcp"
-
-cat > "$tmp/fake-mcp.ps1" <<'EOF'
-if ($env:DIREXIO_CREDENTIALS_FILE -ne $env:EXPECTED_CREDENTIALS_FILE) {
-  [Console]::Error.WriteLine("wrong DIREXIO_CREDENTIALS_FILE")
-  exit 1
-}
-
-if (($args.Count -ge 2) -and ($args[0] -eq "doctor") -and ($args[1] -eq "--json")) {
-  [Console]::Out.WriteLine('{"ok":true,"domain":"runtime-summary.example.test","agent_room_id":"!agent:runtime-summary.example.test","token":"redacted"}')
-  exit 0
-}
-
-function Frame($body) {
-  [Console]::Out.Write("Content-Length: $($body.Length)`r`n`r`n$body")
-}
-
-Frame '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{"tools":{}},"serverInfo":{"name":"fake-direxio-mcp","version":"0.0.0"}}}'
-Frame '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"search_rooms"},{"name":"send_message"},{"name":"list_messages"}]}}'
-EOF
-
-mcp_command=direxio-mcp
-case "$(uname -s)" in
-  MINGW*|MSYS*|CYGWIN*) use_windows_mcp=1 ;;
-  *) use_windows_mcp=0 ;;
-esac
-if { [ "$use_windows_mcp" = "1" ] || ! command -v node >/dev/null 2>&1; } && command -v node.exe >/dev/null 2>&1; then
-  fake_mcp_ps1=$(windows_path "$tmp/fake-mcp.ps1")
-  mcp_command="powershell.exe -NoProfile -ExecutionPolicy Bypass -File \"$fake_mcp_ps1\""
-fi
-
-cat > "$fakebin/curl" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-body_path=""
-write_code=0
-while [ "$#" -gt 0 ]; do
-  case "$1" in
-    -o) body_path=$2; shift 2 ;;
-    -w) write_code=1; shift 2 ;;
-    *) shift ;;
-  esac
-done
-payload='{"room_id":"!agent:runtime-summary.example.test","messages":[]}'
-if [ -n "$body_path" ]; then
-  printf '%s\n' "$payload" > "$body_path"
-else
-  printf '%s\n' "$payload"
-fi
-[ "$write_code" -eq 1 ] && printf '200'
-EOF
-chmod 700 "$fakebin/curl"
-
-service_dir="$HOME/.direxio/nodes/runtime-summary.example.test"
-mkdir -p "$service_dir/cc-connect"
-credentials="$service_dir/credentials.json"
-config="$service_dir/cc-connect/config.toml"
-: > "$credentials"
-: > "$config"
-expected_credentials="$credentials"
-if command -v cygpath >/dev/null 2>&1; then
-  expected_credentials=$(cygpath -m "$expected_credentials")
-fi
-state="$service_dir/state.json"
-jq -n \
-  --arg service_dir "$service_dir" \
-  --arg credentials "$credentials" \
-  --arg config "$config" \
-  --arg mcp_command "$mcp_command" \
-  '{
-    run_id: "runtime-summary-test",
-    region: "ap-northeast-1",
-    domain_mode: "user",
-    domain: "runtime-summary.example.test",
-    as_url: "https://runtime-summary.example.test",
-    agent_service_id: "runtime-summary.example.test",
-    agent_service_dir: $service_dir,
-    agent_credentials_file: $credentials,
-    mcp_credentials_file: $credentials,
-    mcp_command: $mcp_command,
-    agent_token: "AGENT_TOKEN_RUNTIME",
-    agent_room_id: "!agent:runtime-summary.example.test",
-    cc_connect_config: $config,
-    cc_connect_binary: "direxio-connect",
-    phase: "S7_VERIFY_E2E",
-    phases: {
-      S0_PREREQ_AWS: {status: "done"},
-      S1_PREFLIGHT: {status: "done"},
-      S2_DOMAIN: {status: "done"},
-      S3_PROVISION: {status: "done"},
-      S4_BOOTSTRAP_STACK: {status: "done"},
-      S5_INIT_TOKENS: {status: "done"},
-      S6_WIRE_LOCAL: {status: "done"},
-      S7_VERIFY_E2E: {status: "done"}
-    },
-    resources: {}
-  }' > "$state"
-
-verify_output=$(P2P_WORKDIR="$service_dir" PATH="$fakebin:$PATH" EXPECTED_CREDENTIALS_FILE="$expected_credentials" CONNECT_WORK_DIR="$service_dir/cc-connect" bash "$ROOT/scripts/orchestrate.sh" verify runtime)
-printf '%s\n' "$verify_output" | grep -q 'verified runtime checks: passed'
-
-jq -e '
-  .runtime_checks.summary.status == "passed"
-  and .runtime_checks.summary.failed_count == 0
-  and .runtime_checks.summary.checks.connect_daemon == "passed"
-  and .runtime_checks.summary.checks.mcp_doctor == "passed"
-  and .runtime_checks.summary.checks.mcp_tools == "passed"
-  and .runtime_checks.summary.checks.mcp_smoke == "passed"
-  and (.user_confirmations.agent_mcp_runtime | not)
-' "$state" >/dev/null
-
-report_output=$(P2P_WORKDIR="$service_dir" bash "$ROOT/scripts/orchestrate.sh" report new_deploy)
-report_path=$(printf '%s\n' "$report_output" | sed -nE 's/^operation report: //p' | tail -n 1)
-jq -e '.runtime_checks.summary.status == "passed"' "$report_path" >/dev/null
-
-set +e
-P2P_WORKDIR="$service_dir" PATH="$fakebin:$PATH" EXPECTED_CREDENTIALS_FILE="$expected_credentials" CONNECT_WORK_DIR="$HOME/.direxio/nodes/other.example.test/cc-connect" bash "$ROOT/scripts/orchestrate.sh" verify runtime > "$tmp/runtime-fail.out" 2>&1
-fail_rc=$?
-set -e
-[ "$fail_rc" -ne 0 ] || {
-  echo "runtime summary must fail when any runtime check fails" >&2
-  exit 1
-}
-jq -e '
-  .runtime_checks.summary.status == "failed"
-  and .runtime_checks.summary.failed_count == 1
-  and .runtime_checks.summary.checks.connect_daemon == "failed"
-  and .runtime_checks.summary.checks.mcp_doctor == "passed"
-  and .runtime_checks.summary.checks.mcp_tools == "passed"
-  and .runtime_checks.summary.checks.mcp_smoke == "passed"
-' "$state" >/dev/null
-
-echo "runtime summary check ok"