enigma-memory 0.1.17 → 0.1.22

package/scripts/run-backend-readiness-smoke.mjs

@@ -1,8 +1,17 @@
 #!/usr/bin/env node
 import { once } from 'node:events';
 import { pathToFileURL } from 'node:url';
-import { createRelayServer } from '../apps/relay/src/server.mjs';
-import { createGatewayServer } from '../apps/gateway/src/server.mjs';
+import {
+  FEDERATION_STORAGE_ADAPTER_SCHEMA,
+  RELAY_STATE_ADAPTER_SCHEMA,
+  createRelayServer,
+} from '../apps/relay/src/server.mjs';
+import {
+  GATEWAY_KMS_SIGNER_ADAPTER_SCHEMA,
+  GATEWAY_SIEM_SINK_ADAPTER_SCHEMA,
+  GATEWAY_STATE_ADAPTER_SCHEMA,
+  createGatewayServer,
+} from '../apps/gateway/src/server.mjs';
 
 export const BACKEND_READINESS_SMOKE_SCHEMA = 'enigma.backend_readiness_smoke.v1';
 
@@ -21,6 +30,76 @@ const SHARED_READINESS_REFS = Object.freeze({
   incident_drill_ref: 'incident-drill-smoke-ref',
   backup_restore_drill_ref: 'backup-restore-drill-smoke-ref',
 });
+function transactionalStateAdapter(schema, service, ready) {
+  let snapshot = null;
+  return {
+    schema,
+    ref: `fixture://${service}/durable-state`,
+    durable: true,
+    encryptedAtRest: true,
+    supportsMultiReplica: true,
+    async isReady() { return ready; },
+    async transaction(operation, options) {
+      const result = await operation(snapshot ?? options.initialSnapshot);
+      snapshot = structuredClone(result.snapshot);
+      return result.value;
+    },
+  };
+}
+
+function federationFixture(service, ready) {
+  const bridge = {
+    started: false,
+    async start() { this.started = true; },
+    async stop() { this.started = false; },
+  };
+  return {
+    storage: {
+      schema: FEDERATION_STORAGE_ADAPTER_SCHEMA,
+      ref: `fixture://${service}/opaque-federation-storage`,
+      durable: true,
+      async isReady() { return ready; },
+      async appendOpaqueFrame() {},
+    },
+    authenticator: {
+      ref: `fixture://${service}/federation-auth`,
+      async isReady() { return ready; },
+      async authenticate() { return { ok: false }; },
+    },
+    bridge,
+    kmsRef: `fixture://${service}/kms-custody`,
+  };
+}
+
+function relayRuntimeFixture(ready) {
+  return {
+    relayStateAdapter: transactionalStateAdapter(RELAY_STATE_ADAPTER_SCHEMA, 'relay', ready),
+    federation: federationFixture('relay', ready),
+  };
+}
+
+function gatewayRuntimeFixture(ready) {
+  return {
+    gatewayStateAdapter: transactionalStateAdapter(GATEWAY_STATE_ADAPTER_SCHEMA, 'gateway', ready),
+    kmsSignerAdapter: {
+      schema: GATEWAY_KMS_SIGNER_ADAPTER_SCHEMA,
+      ref: 'fixture://gateway/kms-signer',
+      publicKey: 'fixture-public-key-not-used-by-readiness-smoke',
+      async isReady() { return ready; },
+      async createDecision() { throw new Error('readiness smoke does not request a gateway decision'); },
+    },
+    siemSinkAdapter: {
+      schema: GATEWAY_SIEM_SINK_ADAPTER_SCHEMA,
+      ref: 'fixture://gateway/siem-sink',
+      durable: true,
+      idempotent: true,
+      async isReady() { return ready; },
+      async appendBatch() {},
+    },
+    federation: federationFixture('gateway', ready),
+  };
+}
+
 
 function parseArgs(argv = process.argv.slice(2)) {
   const flags = new Map();
@@ -38,7 +117,7 @@ function parseArgs(argv = process.argv.slice(2)) {
 }
 
 function usage() {
-  return `Usage: node scripts/run-backend-readiness-smoke.mjs [--host 127.0.0.1]\n\nStarts in-process relay/gateway HTTP servers on loopback ephemeral ports, probes /livez and /readyz,\nand verifies fail-closed production readiness plus a fully referenced production-ready local fixture.\nIt does not expose admin/data routes, provision cloud resources, or prove hosted live infrastructure.\n`;
+  return `Usage: node scripts/run-backend-readiness-smoke.mjs [--host 127.0.0.1]\n\nStarts in-process relay/gateway HTTP servers on loopback ephemeral ports, probes /livez and /readyz,\nand verifies fail-closed production readiness plus an explicit operational-runtime fixture with durable state, KMS signer, SIEM sink, federation storage/authentication, and all evidence refs.\nIt does not expose credentials, provision cloud resources, or prove hosted live infrastructure.\n`;
 }
 
 function listen(server, host) {
@@ -53,13 +132,19 @@ function listen(server, host) {
 }
 
 async function close(server) {
+  await server.federationRuntime?.stop();
   if (!server.listening) return;
   server.close();
+  server.closeAllConnections?.();
   await once(server, 'close');
 }
 
 async function getJson(baseUrl, path) {
-  const response = await fetch(`${baseUrl}${path}`, { method: 'GET', headers: { accept: 'application/json' } });
+  const response = await fetch(`${baseUrl}${path}`, {
+    method: 'GET',
+    headers: { accept: 'application/json' },
+    signal: AbortSignal.timeout(5_000),
+  });
   const text = await response.text();
   if (SECRET_OUTPUT_RE.test(text)) throw new Error(`${baseUrl}${path} emitted secret-looking output`);
   let body;
@@ -97,6 +182,7 @@ function relayReadyOptions() {
     monitoring_ref: 'relay-monitoring-smoke-ref',
     ...SHARED_READINESS_REFS,
     operator_acceptance: { decision: 'go', status: 'go', ref: 'relay-operator-acceptance-smoke-ref' },
+    ...relayRuntimeFixture(true),
   };
 }
 
@@ -115,6 +201,9 @@ function gatewayReadyOptions() {
     data_plane_auth_ref: 'gateway-data-plane-auth-smoke-ref',
     ...SHARED_READINESS_REFS,
     operator_acceptance: { decision: 'go', status: 'go', ref: 'gateway-operator-acceptance-smoke-ref' },
+    admin_auth_bearer_sha256: `sha256:${'a'.repeat(64)}`,
+    data_plane_auth_bearer_sha256: `sha256:${'b'.repeat(64)}`,
+    ...gatewayRuntimeFixture(true),
   };
 }
 
@@ -122,9 +211,18 @@ async function probeServer({ service, mode, serverFactory, host, expectedReadySt
   const server = serverFactory();
   try {
     const address = await listen(server, host);
+    await server.federationRuntime?.start();
     const baseUrl = `http://${address.address}:${address.port}`;
     const livez = await getJson(baseUrl, '/livez');
     const readyz = await getJson(baseUrl, '/readyz');
+    const failedChecks = Array.isArray(readyz.body?.checks)
+      ? readyz.body.checks
+        .filter((check) => check?.ok !== true && typeof (check?.check ?? check?.name) === 'string')
+        .map((check) => check.check ?? check.name)
+      : [];
+    const missingChecks = Array.isArray(readyz.body?.missing_checks) && readyz.body.missing_checks.length > 0
+      ? [...readyz.body.missing_checks]
+      : failedChecks;
     return {
       service,
       mode,
@@ -134,6 +232,10 @@ async function probeServer({ service, mode, serverFactory, host, expectedReadySt
       livez_ok: livez.body?.ok === true,
       readyz_status: readyz.status,
       readyz_ok: readyz.body?.ok === true,
+      readyz_missing_checks: missingChecks,
+      readyz_blocker_paths: missingChecks.length > 0
+        ? missingChecks.map((check) => `checks.${check}`)
+        : (readyz.body?.error !== undefined ? ['error'] : []),
       readyz_missing_evidence_ref_count: missingCount(readyz.body),
       readyz_all_checks_ok: allChecksOk(readyz.body),
       ok: livez.status === 200
@@ -157,7 +259,7 @@ export async function runBackendReadinessSmoke(options = {}) {
     host,
     expectedReadyStatus: 503,
     expectedReadyOk: false,
-    serverFactory: () => createRelayServer({ mode: 'production', now: '1970-01-01T00:00:00.000Z' }),
+    serverFactory: () => createRelayServer({ mode: 'production', now: '1970-01-01T00:00:00.000Z', ...relayRuntimeFixture(false) }),
   }));
   checks.push(await probeServer({
     service: 'gateway',
@@ -165,11 +267,11 @@ export async function runBackendReadinessSmoke(options = {}) {
     host,
     expectedReadyStatus: 503,
     expectedReadyOk: false,
-    serverFactory: () => createGatewayServer({ mode: 'production' }),
+    serverFactory: () => createGatewayServer({ mode: 'production', ...gatewayRuntimeFixture(false) }),
   }));
   checks.push(await probeServer({
     service: 'relay',
-    mode: 'production-referenced-fixture',
+    mode: 'production-operational-fixture',
     host,
     expectedReadyStatus: 200,
     expectedReadyOk: true,
@@ -177,7 +279,7 @@ export async function runBackendReadinessSmoke(options = {}) {
   }));
   checks.push(await probeServer({
     service: 'gateway',
-    mode: 'production-referenced-fixture',
+    mode: 'production-operational-fixture',
     host,
     expectedReadyStatus: 200,
     expectedReadyOk: true,
@@ -192,8 +294,8 @@ export async function runBackendReadinessSmoke(options = {}) {
     checks,
     claim_boundary: [
       'This smoke starts local in-process HTTP servers on loopback ephemeral ports only.',
-      'It verifies /livez and /readyz behavior, fail-closed production defaults, and fully referenced production fixture readiness.',
-      'It does not prove hosted DNS, TLS, Cloudflare, durable cloud storage, KMS, SIEM, backup, operator acceptance, or customer BYOC infrastructure is live.',
+      'It verifies fail-closed production defaults and an explicit operational fixture with durable transactional state, gateway KMS/SIEM adapters, authenticated federation dependencies, and all readiness refs.',
+      'Fixture adapters are test-scoped and do not prove hosted DNS, TLS, durable cloud storage, KMS, SIEM, backup, operator acceptance, or customer BYOC infrastructure is live.',
     ],
   };
   if (SECRET_OUTPUT_RE.test(JSON.stringify(result))) throw new Error('backend readiness smoke output appears to contain a secret');