feat: one verify command; retire the health check that cannot fail

[Robobc]

What

Usability-review blocker 3. scripts/test.py was the README's headline health check, and it could not fail: invoke exceptions were caught and printed as "expected", resource discovery hardcoded the default project name, zero SSM parameters still earned a ✓, and there was no non-zero exit path anywhere in the file. A broken deployment ended with Done. and exit 0.

The replacement

scripts/verify.py — also reachable as ./scripts/deploy.sh verify — composes the tools that already tell the truth, selected by the deployment contract. expected_stacks() says what this configuration promises; each promised stack maps to its existing check:

In the footprint	Check
gateway	test_gateway.py (MCP tools/list + tools/call)
memory	test_memory.py (event write/read, 5 tests)
observability	check_observability.py
networking	check_network.py (runtimes really placed in the VPC)
runtime-orchestrator	invoke.py live invoke (--agui for agui-* patterns)
A2A sub-agents	invoke.py --a2a <component> per agent

Configuration flows from platform.yaml with env-var precedence, same as everywhere else; in a federation the account decides the footprint. Any failed check → exit 1.

Verified live, both directions

• Green: against a deployed environment, 4 checks matched the footprint (gateway list+call, memory 5/5, observability deliveries, live orchestrator invoke) — exit 0.
• Red: a config promising a VPC the environment does not have → FAILED (1/5): networking, exit 1. The predecessor printed success on exactly this class of mismatch.

Tests

checks_for() is a pure function; tests/test_verify.py pins the selection: core-only default, a2a/networking additions, --agui switching, every selected check maps to a real file — and scripts/test.py staying dead is itself a test.

Review notes

• README, participant guide, troubleshooting, and the identity note now point at verify. docs/ARCHITECTURE.md still names test.py in two places — it carries unrelated in-flight edits, so it's deliberately left for that pass.
• 133 tests, both shell self-check suites green, ruff and shellcheck clean.

[github-actions]

Commit: 74db5ae | Updated: 2026-08-25 12:39:44 UTC

Security Scan Results

Scanner	S	C	H	M	L	I	Time	Action	Result	Thresh
bandit	0	0	0	0	8	0	402ms	0	PASSED	MED (g)
cdk-nag	0	0	0	0	0	0	7.7s	0	PASSED	MED (g)
cfn-nag	0	0	0	0	0	0	6ms	0	PASSED	MED (g)
checkov	0	0	0	0	0	0	4.7s	0	PASSED	MED (g)
detect-secrets	0	0	0	0	0	0	951ms	0	PASSED	MED (g)
grype	0	0	0	0	0	0	1m 1s	0	PASSED	MED (g)
npm-audit	0	0	0	0	0	0	187ms	0	PASSED	MED (g)
opengrep	0	0	0	0	0	0	17.9s	0	PASSED	MED (g)
semgrep	0	0	0	0	0	0	<1ms	0	MISSING	MED (g)
syft	0	0	0	0	0	0	2.0s	0	PASSED	MED (g)