# O11Y platform functional proof

These tools verify the live, session-owned O11Y Phase-1 contract after a Remote
Dev full `cp9 up` has reached `ready`. They are intentionally outside the
Session Tiltfile: ordinary runtime convergence must not create/delete test O11Y
clusters or write marker metrics.

Run the platform proof first:

```bash
tools/o11y-platform-proof/run-platform-proof.sh \
  .cp9/<session>/kubeconfig.yaml \
  k3d-<session> \
  .cp9/<session>/tilt/reports/evidence \
  .cp9/<session>/context/context.json
```

It waits for GS, RS, DS, and the minimal VMCluster; calls GS create/list and
hands the exact proof cluster to the gateway proof; requires the RS-returned VictoriaMetrics account/project,
DNS name, and endpoint-service name to match the session; writes and queries a
unique metric; and records `o11y-platform-readiness.json`.

Then run the gateway proof:

```bash
tools/o11y-platform-proof/run-gateway-proof.sh \
  .cp9/<session>/kubeconfig.yaml \
  k3d-<session> \
  .cp9/<session>/tilt/reports/evidence \
  .cp9/<session>/context/context.json
```

The route precheck is centralized in `gateway-route-filter.jq`, which the
runtime proof consumes.

Run it immediately after the platform proof. It exercises the session's public
HTTPS URL, verifies all five Gateway API routes, Auth0-protected GS routes,
anonymous metrics rejection, authenticated write/query, and rejection of the
private write path through both public load balancers because that route exists
only on Regional Kong. It also verifies the separate public and Regional Kong
deployments plus the Regional port-81 proxy. It then deletes the handed-off GS cluster,
verifies zero remains, and records `o11y-gateway-readiness.json`.

Both tools create a short-lived proof Pod and ConfigMap in `observability` and
delete them on success or interruption. They read runtime credentials only
through existing Kubernetes Secrets and never print them. Proofs fail unless
the current source branch is named and clean; the evidence records its exact
commit and the three released O11Y runtime image IDs. A failing proof is a
functional-test failure, not a reason to patch live resources. Diagnose the
owning CP9 source/config, rerun the proof, and finish the session with the
normal `cp9 destroy` closeout.