Attempt Live Smoke

The attempt live smoke is opt-in because it needs a disposable published exam, a student bearer token, and an organization id.

Self-test:

ATTEMPT_LIVE_SELF_TEST=1 bash scripts/test/attempt-live-smoke.sh

Required route-table proof:

make test-attempt-routes
GATEWAY_ROUTE_TABLE=deploy/gateway/routes.attempt-native-localhost-example.json

Confirmed live run:

GATEWAY_ROUTE_TABLE=deploy/gateway/routes.attempt-native-localhost-example.json \
ATTEMPT_LIVE_CONFIRM=attempt-native \
ATTEMPT_EXAM_ID=<published-exam-id> \
ATTEMPT_AUTHORIZATION='Bearer <student-token>' \
ATTEMPT_ORGANIZATION_ID=<org-id> \
make test-attempt-live

Do not promote default attempt routes until this live proof, browser proof, and rollback notes are recorded.

Rollback is switching the gateway back to deploy/gateway/routes.json and rerunning make test-attempt-routes to confirm the default table stays legacy-safe.

Local Fixture Evidence (2026-07-13)

• output/qa/attempt-public-idempotency-proof-20260713/final-live/ captures a non-default Gateway workflow through a disposable runtime-access fixture and in-memory attempt-service: list, start, answer save, event, submit, result, and exact start replay after grading.
• The runtime /v1/routes response normalizes the adapter's unused target field to legacy; scripts/test/attempt-live-smoke.sh accepts that value while still requiring exam_target, attempt_target, and exam_start_adapter.
• rollback-default/ proves the unchanged default table returns 502 with exams/legacy_proxy and attempts/legacy_proxy when the legacy upstream is deliberately unavailable.

This is not a seeded running exam-service proof and does not authorize default-route promotion.