unoverse 0.1.143 → 0.1.145

package/operator/ansible/playbooks/test-connectivity.yml

@@ -212,7 +212,11 @@
         echo "HTTP $RESULT"
         [ "$RESULT" -ge 200 ] && [ "$RESULT" -lt 500 ]
       loop:
-        - { name: "Canvas", sub: "", path: "/" }
+        # canvas.<domain>, NEVER the bare apex. Neither ground creates an apex record
+        # (aws/main.tf and digitalocean/main.tf publish api.<domain> and canvas.<domain>
+        # only), so `sub: ""` asked for a hostname that has no DNS at all and reported
+        # HTTP 000 FAILED on every healthy deploy.
+        - { name: "Canvas", sub: "canvas.", path: "/" }
         - { name: "API Server", sub: "api.", path: "/health" }
       register: domain_checks
       ignore_errors: yes

package/operator/lib/deploy.sh

@@ -934,6 +934,25 @@ EOF
     if [ -n "$smoke_api" ]; then
       echo ""
       info "Smoke-testing the deployed stack ${DIM}($smoke_api)${NC}"
+      # WAIT FOR STEADY STATE FIRST. A restart is ~36s of boot plus however many
+      # health-check intervals the load balancer needs to re-admit the droplet, and
+      # during that window EVERY api-side probe answers 503. The smoke test measures
+      # the stack's steady state, not the race — so it starts at the first 200 from
+      # /health THROUGH the balancer (which proves both the app and re-admission), and
+      # only a stack that never gets there fails. Observed live 2026-08-16: a healthy
+      # v1.13.79 deploy reported four FAILs and "fix forward or roll back", all of it
+      # re-admission lag. A false stop after the irreversible half is the worst kind.
+      local smoke_wait=0
+      until [ "$(curl -s -m 5 -o /dev/null -w '%{http_code}' "$smoke_api/health")" = 200 ]; do
+        if [ "$smoke_wait" -ge 180 ]; then
+          echo -e "    ${RED}FAIL${NC} stack never became healthy (/health ≠ 200 after ${smoke_wait}s)"
+          smoke_fail=1
+          break
+        fi
+        [ "$smoke_wait" = 0 ] && echo -e "    ${DIM}waiting for /health through the balancer (boot + LB re-admission)...${NC}"
+        sleep 5; smoke_wait=$((smoke_wait + 5))
+      done
+      [ "$smoke_fail" = 0 ] && [ "$smoke_wait" -gt 0 ] && echo -e "    ${DIM}healthy after ${smoke_wait}s${NC}"
       _smoke() { # name, then the test itself as "$@"
         local name="$1"; shift
         if "$@" >/dev/null 2>&1; then echo -e "    ${GREEN}ok${NC} $name"
@@ -944,7 +963,11 @@ EOF
       # Embed doorway is served AND compressed (identity-encoded JS was a live outage).
       _smoke "embed.js gzipped" sh -c "curl -sf -m 10 -H 'accept-encoding: gzip' -D - '$smoke_api/embed.js' -o /dev/null | grep -qi '^content-encoding: gzip'"
       # MCP lane accepts an initialize (every external connector dies here first).
-      _smoke "MCP initialize" sh -c "curl -sf -m 10 -X POST '$smoke_api/mcp' -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-06-18\",\"capabilities\":{},\"clientInfo\":{\"name\":\"smoke\",\"version\":\"0\"}}}' -o /dev/null"
+      # 200 (auth off) or 401 (auth on) prove the lane is ALIVE, the same judgement the
+      # database canary below makes. This used `curl -sf`, which fails on any error status,
+      # so a universe that boots "JWT enforced on /mcp" — every Cognito/AWS deployment —
+      # reported FAIL on a correctly protected endpoint and turned a healthy deploy red.
+      _smoke "MCP initialize" sh -c "code=\$(curl -s -m 10 -o /dev/null -w '%{http_code}' -X POST '$smoke_api/mcp' -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-06-18\",\"capabilities\":{},\"clientInfo\":{\"name\":\"smoke\",\"version\":\"0\"}}}'); [ \"\$code\" = 200 ] || [ \"\$code\" = 401 ]"
       # Engine → Postgres canary: 200 (auth off) or 401 (auth on) prove the chain; a 500
       # is the DB-unreachable incident that hides behind an otherwise healthy stack.
       _smoke "engine reaches database" sh -c "code=\$(curl -s -m 10 -o /dev/null -w '%{http_code}' '$smoke_api/marketplace'); [ \"\$code\" = 200 ] || [ \"\$code\" = 401 ]"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.143",
+  "version": "0.1.145",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",