Service Agent Readiness Smoke

Scope

This proof checks that the service responsibility matrix, service-agent dispatch docs, task packs, runtime/deploy manifests, and VitePress docs remain coherent for the current Go microservices rollout.

It does not prove a default public route cutover. Route promotion still needs route-specific live/browser evidence, populated target validation when data is involved, and rollback proof.

Commands

Run these from go-platform/ after changing service task packs, dispatch docs, runtime manifests, Compose, K8s, Helm, or VitePress navigation:

make test-agent-dispatch
make test-service-agent-goal-completion-audit
make test-service-agent-closeout-ledger
make test-service-agent-next-slice-closeout
make test-service-agent-execution-queue
make test-service-readiness
make test-runtime-foundation
make test-compose-migrations
make test-postgres-database-isolation
pnpm docs:build
git diff --check

Latest Local Proof

On 2026-07-15, the integrated readiness path and database-foundation checks passed locally:

make test-service-readiness
make test-compose-migrations
make test-postgres-database-isolation

Observed coverage:

• test-compose-migrations: rendered Compose requires each runtime service and its migration job to use the same service-owned PostgreSQL role/database, with the runtime waiting for schema migration completion.
• test-postgres-database-isolation: a disposable PostgreSQL container verified all 20 owner roles against their own databases and rejected all 380 cross-service CONNECT checks; its cleanup trap removed the temporary container.
• test-agent-dispatch: service-agent manifest, proof ledger, dispatch roster, workflow matrix Dispatch ID rows, wave board, spawn runbook, spawn packets, and alias-only boundaries are coherent.
• test-service-task-packs: service responsibility matrix, canonical task packs, manifest-derived workflow/roster/spawn packet rows, proof ledger, VitePress links, cutover packs, route proof handoffs, and guard scripts are coherent.
• test-service-readmes: active service README coverage is coherent.
• test-service-agent-goal-completion-audit: Service Agent Goal Completion Audit confirms spawn-ready rows remain not-complete, IAM/Profile default promotion still requires production-like populated target validation with the required migrator run report, and proof bundles keep routePromotionApproved=false while live cutover bundles must declare targetProvenance=production-like and matching candidate/gateway route-table hashes.
• test-service-agent-closeout-ledger: Service Agent Closeout Ledger confirms every SVC-001 through SVC-023 row points to a real accepted bounded-slice handoff file with audit, investigate, code, test, and fix evidence while remaining not-complete until route/default gates are closed.
• test-service-agent-next-slice-closeout: Service Agent Next Slice Closeout Ledger confirms each future nextTaskId has a separate not-complete closeout row, preserves the accepted first-slice handoff as acceptedFirstHandoff, and requires the next handoff path, workflow verification, route/default state, rollback notes, and RET-USER retirement prerequisites before any next-slice acceptance. The accepted SVC-001-default-route-proof-bundle records gateway route diff, live/browser route evidence, and rollback notes while keeping default promotion blocked. It also validates the accepted SVC-002-owner-source-gateway-proof handoff with named admin-service owner APIs, gateway route proof, and a real HTTP BFF aggregation test, plus the SVC-005-iam-membership-school-sync-proof handoff with IAM write authority, school read-model sync ordering/tombstone proof, and member-write rollback notes, plus the SVC-006-public-route-guard-proof handoff with classroom tenant-scope, owner-local reference, and legacy-route guard proof, plus the SVC-007-student-course-route-proof handoff with enrolled student projection, progress guard, static route checks, and explicit live/browser gate, plus the SVC-008-question-save-reload-route-proof handoff with update/reload persistence, native route guards, and explicit live editor gate, plus the SVC-009-exam-attempt-public-proof handoff with runtime access contract, snapshot ownership, sensitive-field redaction, and explicit live/browser attempt gate, plus the SVC-010-attempt-public-idempotency-proof handoff with trusted start-to-result workflow, exact replay, timeout/retake, result visibility/redaction, and explicit live/browser route gate, plus the SVC-011-storage-media-browser-proof handoff with storage/media parity, upload/read browser evidence, and explicit rollback gate, plus the SVC-012-import-route-proof-bundle handoff with matching import route, live/browser proof, and explicit rollback gate, plus the SVC-013-formula-adapter-determinism-proof and SVC-014-search-legacy-owner-rebuild-proof and SVC-015-ai-usage-wallet-route-proof and SVC-016-subscription-entitlement-replay-proof and SVC-017-wallet-ledger-route-proof and SVC-018-usage-billing-sync-replay-proof and SVC-019-payment-webhook-reconcile-proof and SVC-020-notification-recipient-route-proof and SVC-021-audit-replay-retention-proof and SVC-022-analytics-rebuildable-projection-proof and SVC-023-admin-owner-source-route-proof and RET-USER-retirement-readiness-proof handoffs and their required verification/evidence strings.
• test-service-agent-execution-queue: Service Agent Execution Queue confirms every SVC-001 through SVC-023 row has a concrete first queued taskId, dependencies, first verification command, and handoff path; because those first handoffs are now accepted, queue statuses are first-slice-accepted-...-not-complete rather than prompts to respawn the same workers. The guard also validates docs/agents/service-agent-next-slice-queue.json against manifest, proof ledger, closeout ledger, accepted first-slice handoffs, unique nextTaskId values, workflowVerification, requiredNextHandoffPath, prompt-ready next-slice spawn packets, and the RET-USER retirement-only rule.
• GOTOOLCHAIN=go1.25.11 go test ./services/... -count=1: all current service packages passed.

The runtime/deploy foundation also passed locally on 2026-07-09 19:16 +07:

make test-runtime-foundation

Observed coverage:

• Docker Compose migration wiring.
• IAM/Profile backfill report and loader guards.
• IAM/Profile populated validation and UUID readiness/FK/PK-promotion self-tests.
• IAM/Profile runtime proof and default cutover candidate guard.
• IAM/Profile default cutover proof bundle self-test and offline review-artifact validator self-test, latest bundle summary under output/qa/iam-profile-default-cutover-proof-bundle-20260710-083035/. That bundle remains mode=self-test / targetProvenance=fixture_only; the offline artifact review guard rejects it as expected, so it is not default-route promotion evidence.
• Monetization route and broker transport guards.
• Search rebuild self-test and pending search route rehearsal guard.
• Notification and parent-alert non-default route-table guards.
• Gateway route examples.
• Frontend gateway boundary guard.
• Service task pack/readme coverage.
• K8s service, migration job, observability, Helm render, and Go Formula runtime coverage.

Docs build and diff hygiene also passed on 2026-07-10:

pnpm docs:build
git diff --check

Local Runtime Baseline

On 2026-07-10, the currently running local containers returned HTTP 200 for both /healthz and /readyz on their direct host ports:

Service	Port
payment-service	8096
wallet-service	8097
billing-service	8098
usage-service	8099
docx-import-service	8087
document-service	8088

This is direct process/readiness evidence only. It does not prove Gateway or browser traffic, production-like data, rollback behavior, or that the running container image contains the newest uncommitted service changes.

Local IAM/Profile Candidate Refresh

On 2026-07-10, local IAM/Profile migrations were applied to their separate local databases before an isolated candidate rehearsal. The review-only diff, Gateway live smoke, Playwright browser smoke, and default-table rollback smoke all passed under:

• output/qa/iam-profile-default-candidate-localhost-20260710-1544/
• output/qa/iam-profile-default-candidate-live-20260710-1547/
• output/playwright/iam-profile-default-candidate-browser-20260710-1548/
• output/qa/iam-profile-default-candidate-rollback-20260710-1548/

Each artifact records the same Gateway-normalized route-table hash and defaultRouteTableModified=false. The slice remains local, non-default, and read-only for IAM public routing; it does not satisfy the production-like populated-data, human-review, or promotion gates.

Clean Compose IAM/Profile Runtime

The isolated build-mode clean Compose smoke also passed on 2026-07-10 under output/qa/iam-profile-clean-compose-20260710-1555/. It rebuilt IAM, Profile, and migrator images, recorded every service migration, verified IAM/Profile health and readiness plus IAM JWKS, then removed the temporary project, network, and volume. This validates clean migration ordering and service startup, but it does not replace populated-target reconciliation or route-promotion evidence.

Remaining Cutover Limits

The readiness proof confirms orchestration consistency, not production promotion. Known blockers remain:

• IAM/Profile default route promotion still requires production-like populated target validation with the required migrator run report.
• Profile base/teacher update routes have non-default live/browser proof, but still need candidate default diffs and rollback-after-candidate evidence before promotion.
• IAM session lifecycle routes now have non-default browser proof for register, login, authenticated /api/auth/me, refresh rotation, logout, and rejected refresh reuse under output/playwright/auth-route-session-browser-smoke-20260709-100744/, but default promotion still waits for the IAM/Profile cutover handoff gates.
• KYC, admin routes, and broader learning/monetization public routes remain legacy by default until their own route-specific live/browser/rollback evidence is attached.