unoverse 0.1.185 → 0.1.186

package/operator/lib/deploy.sh

@@ -1034,9 +1034,25 @@ EOF
       # so a universe that boots "JWT enforced on /mcp" — every Cognito/AWS deployment —
       # reported FAIL on a correctly protected endpoint and turned a healthy deploy red.
       _smoke "MCP initialize" sh -c "code=\$(curl -s -m 10 -o /dev/null -w '%{http_code}' -X POST '$smoke_api/mcp' -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-06-18\",\"capabilities\":{},\"clientInfo\":{\"name\":\"smoke\",\"version\":\"0\"}}}'); [ \"\$code\" = 200 ] || [ \"\$code\" = 401 ]"
-      # Engine → Postgres canary: 200 (auth off) or 401 (auth on) prove the chain; a 500
-      # is the DB-unreachable incident that hides behind an otherwise healthy stack.
-      _smoke "engine reaches database" sh -c "code=\$(curl -s -m 10 -o /dev/null -w '%{http_code}' '$smoke_api/marketplace'); [ \"\$code\" = 200 ] || [ \"\$code\" = 401 ]"
+      # THE MARKETPLACE LANE ANSWERS. 200 (auth off), or 401/404 (auth on) — all three
+      # prove the listener is up and routing; a 5xx is a stack that is live and broken.
+      #
+      # RENAMED FROM "engine reaches database" (2026-08-31), because it stopped being able
+      # to prove that and a check that overclaims is worse than one that does less. The
+      # capability gate (server/src/security/gate.ts) refuses an unauthenticated request
+      # with 404 BEFORE the handler runs — deliberately, so a 403 cannot tell an attacker
+      # which routes exist — so on any auth-enabled universe this request never reaches
+      # Postgres at all. It also, until this change, failed every deploy: the check expected
+      # 401, the gate returned 404, and a healthy stack reported FAIL.
+      #
+      # WHAT STILL COVERS THE 2026-08-13 INCIDENT (an engine→Postgres 500 hiding behind a
+      # healthy-looking stack): the wait above. `/health` answers 200 only when isReady(),
+      # and readiness comes after the catalogue has loaded FROM THE DATABASE, so a universe
+      # that cannot reach Postgres never becomes healthy and never gets here. That is
+      # boot-time proof, not live proof. Proving it LIVE needs a probe that reaches a
+      # handler — an authenticated call, or a public deep-health route — and neither exists
+      # yet. Left as a known gap rather than papered over with a check that cannot see it.
+      _smoke "marketplace lane answers" sh -c "code=\$(curl -s -m 10 -o /dev/null -w '%{http_code}' '$smoke_api/marketplace'); [ \"\$code\" = 200 ] || [ \"\$code\" = 401 ] || [ \"\$code\" = 404 ]"
       if [ -n "$smoke_canvas" ]; then
         # The canvas page and the hashed bundle it names: present, compressed, cacheable.
         _smoke "canvas page + compressed bundle" sh -c "asset=\$(curl -sf -m 10 '$smoke_canvas/' | grep -o '/assets/index-[^\"]*\.js' | head -1); [ -n \"\$asset\" ] && curl -sf -m 20 -H 'accept-encoding: gzip' -D - \"$smoke_canvas\$asset\" -o /dev/null | grep -qi '^content-encoding: gzip'"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.185",
+  "version": "0.1.186",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",