fix: close deployment decoupling review

2026-08-05 07:52:32 +02:00
parent 5d037e97c4
commit 09834d5cd4
45 changed files with 1082 additions and 791 deletions
@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# Fresh Compose flow: mounted Pi policy/auth must produce a selectable, credential-ready provider.
+set -euo pipefail
+
+root="$(cd "$(dirname "$0")/.." && pwd -P)"
+tmp="$(mktemp -d "${TMPDIR%/}/thoth-provider-readiness.XXXXXX")"
+project="thothii-provider-readiness-$$"
+compose=(
+  docker compose --project-name "$project" --env-file "$tmp/local.env"
+  -f "$root/compose.yaml" -f "$root/deploy/compose.local.yaml"
+)
+cleanup() {
+  "${compose[@]}" down --volumes --remove-orphans >/dev/null 2>&1 || true
+  rm -rf "$tmp"
+}
+trap cleanup EXIT HUP INT TERM
+
+printf '%s\n' '{"zai":{"type":"api_key","key":"fixture-native-auth-key"}}' >"$tmp/pi-auth.json"
+printf '%s\n' 'THT_MODEL_API_KEY=fixture-model-api-key' >"$tmp/thothii.secrets"
+chmod 0600 "$tmp/pi-auth.json" "$tmp/thothii.secrets"
+printf '%s\n' \
+  'THT_WORKSPACE_GIT_REMOTE=https://git.example.invalid/platform/thoth-workspaces.git' \
+  "PI_AUTH_FILE=$tmp/pi-auth.json" \
+  "THT_SECRETS_FILE=$tmp/thothii.secrets" \
+  'THOTH_CORE_HTTP_PORT=0' \
+  'THOTH_HTTP_PORT=0' \
+  >"$tmp/local.env"
+
+"${compose[@]}" up --detach --wait --wait-timeout 90 --build core
+core_id="$("${compose[@]}" ps -q core)"
+core_address="$("${compose[@]}" port core 8787 | head -n 1)"
+
+"${compose[@]}" exec -T core sh -ceu '
+  test -r /home/thoth/.pi/agent/auth.json
+  test -r /home/thoth/.pi/agent/models.json
+  test -r /home/thoth/.pi/agent/settings.json
+  test -r /run/secrets/thothii.secrets
+'
+
+curl --fail --silent --show-error "http://$core_address/models" >"$tmp/models.json"
+node - "$tmp/models.json" <<'NODE'
+const fs = require("fs");
+const body = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+if (!body.models?.some((model) => model.provider === "zai" && model.id === "glm-5.2")) {
+  throw new Error("fresh Compose did not expose the mounted Pi-enabled model");
+}
+NODE
+
+curl --fail --silent --show-error -X PUT \
+  -H 'content-type: application/json' \
+  --data '{"provider":"zai","model":"glm-5.2","reasoning":"low"}' \
+  "http://$core_address/pi-management/config" >"$tmp/configured.json"
+curl --fail --silent --show-error \
+  "http://$core_address/pi-management/status" >"$tmp/status.json"
+node - "$tmp/status.json" <<'NODE'
+const fs = require("fs");
+const body = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+if (!body.ready || body.credentials !== "present") {
+  throw new Error("mounted Pi provider is not credential-ready");
+}
+if (body.config?.provider !== "zai" || body.config?.model !== "glm-5.2") {
+  throw new Error("Pi provider configuration was not persisted");
+}
+NODE
+
+inspect="$(docker inspect "$core_id")"
+for secret in fixture-native-auth-key fixture-model-api-key; do
+  if grep -Fq "$secret" <<<"$inspect"; then
+    echo "container inspection leaked $secret" >&2
+    exit 1
+  fi
+done
+
+echo "Compose provider-readiness contract passed."