feat: require production infrastructure evidence

deploy/server/health-monitor.sh

@@ -21,6 +21,7 @@ alert_webhook_secret_file=${ALERT_WEBHOOK_SECRET_FILE:-/etc/data-terminal-cloud/
 platform_health_report_url=${PLATFORM_HEALTH_REPORT_URL:-}
 platform_health_report_secret_file=${PLATFORM_HEALTH_REPORT_SECRET_FILE:-/etc/data-terminal-cloud/platform-health-callback-secret}
 expected_public_tcp_ports=${EXPECTED_PUBLIC_TCP_PORTS:-22,80,443}
+deployment_profile=${HOST_DEPLOYMENT_PROFILE:-demo}
 if [[ -f "$offsite_config_file" ]]; then
   # shellcheck disable=SC1090
   source "$offsite_config_file"
@@ -41,6 +42,10 @@ if [[ ! "$expected_public_tcp_ports" =~ ^[0-9]+(,[0-9]+)*$ ]]; then
   echo "EXPECTED_PUBLIC_TCP_PORTS must contain comma-separated integers" >&2
   exit 2
 fi
+if [[ "$deployment_profile" != demo && "$deployment_profile" != production ]]; then
+  echo "HOST_DEPLOYMENT_PROFILE must be demo or production" >&2
+  exit 2
+fi
 
 compose=(docker compose -f "$project_root/compose.yaml" -f "$project_root/deploy/server/compose.override.yaml" --env-file "$project_root/deploy/server/.env")
 mkdir -p "$state_dir"
@@ -73,6 +78,21 @@ record_check() {
   esac
 }
 
+record_check deployment_profile healthy "$deployment_profile"
+if [[ -z "$alert_webhook_url" ]]; then
+  if [[ "$deployment_profile" == production ]]; then
+    record_check external_alert_receiver critical not_configured
+  else
+    record_check external_alert_receiver healthy not_configured
+  fi
+elif [[ ! -r "$alert_webhook_secret_file" ]]; then
+  record_check external_alert_receiver critical secret_missing
+elif (( $(tr -d '\r\n' <"$alert_webhook_secret_file" | wc -c) < 32 )); then
+  record_check external_alert_receiver critical secret_invalid
+else
+  record_check external_alert_receiver healthy configured
+fi
+
 public_origin=$(sed -n 's/^PUBLIC_ORIGIN=//p' "$project_root/deploy/server/.env")
 if [[ "$public_origin" == https://* ]]; then
   record_check public_origin healthy "$public_origin"
@@ -113,7 +133,10 @@ else
   record_check oidc_issuer critical request_failed
 fi
 
-required_services=(postgres redis minio keycloak api callbacks worker web gateway mock-provider mock-alert-receiver)
+required_services=(postgres redis minio keycloak api callbacks worker web gateway)
+if [[ "$deployment_profile" == demo ]]; then
+  required_services+=(mock-provider mock-alert-receiver)
+fi
 for service in "${required_services[@]}"; do
   container=$("${compose[@]}" ps -q "$service")
   if [[ -z "$container" ]]; then
@@ -131,6 +154,25 @@ for service in "${required_services[@]}"; do
   fi
 done
 
+mock_services_running=()
+for mock_service in mock-provider mock-alert-receiver; do
+  mock_container=$("${compose[@]}" ps -q "$mock_service")
+  if [[ -n "$mock_container" && $(docker inspect -f '{{.State.Status}}' "$mock_container") == running ]]; then
+    mock_services_running+=("$mock_service")
+  fi
+done
+if [[ "$deployment_profile" == production ]]; then
+  if (( ${#mock_services_running[@]} > 0 )); then
+    record_check mock_services critical unexpected_running
+  else
+    record_check mock_services healthy disabled
+  fi
+elif (( ${#mock_services_running[@]} == 2 )); then
+  record_check mock_services healthy enabled_for_demo
+else
+  record_check mock_services critical incomplete_demo_stack
+fi
+
 latest_backup=$(find "$backup_root" -maxdepth 1 -type f -name 'platform-*.tar.gz.enc' -printf '%T@ %p\n' 2>/dev/null | sort -nr | head -n1 | cut -d' ' -f2- || true)
 if [[ -z "$latest_backup" || ! -f "$latest_backup" ]]; then
   record_check backup_freshness critical missing
@@ -168,7 +210,11 @@ except Exception: print("invalid|0|")' "$offsite_state_file")
     fi
   fi
 else
-  record_check offsite_backup healthy not_required
+  if [[ "$deployment_profile" == production ]]; then
+    record_check offsite_backup critical not_required
+  else
+    record_check offsite_backup healthy not_required
+  fi
 fi
 
 backup_result=$(systemctl show platform-backup.service -p Result --value 2>/dev/null || true)