test(ske/starterkit): smoke test the deployed SKE StarterKit - #11

Smoke tests the SKE StarterKit as this foundation has published it: an ephemeral building block
ordered against the deployed definition, asserting the run SUCCEEDED and that both app endpoints
answer HTTP 200 over a valid, cert-manager-issued certificate.

The precedent is likvid-cloudfoundation; the companion PR there is
likvid-bank/likvid-cloudfoundation#215.

Builds on meshcloud/meshstack-hub#304, now merged — the hub ref pinned here is 247a4a6a on
hub main, so this PR stands on its own.

Why the StarterKit

It is what trial users actually try, and the chain behind it is long: two meshProjects, two SKE
tenants, a Forgejo repository, a pipeline run, and a cert-manager certificate. A hub-side test
proves a fresh deployment works. Nothing proved that the definition this foundation has
deployed still produces an app that serves traffic.

What

Five commits, smallest first:

1. refactor — move the hub coordinates out of terragrunt.hcl into hub.hcl, so the deployment
   and the e2e unit share one ref. No behaviour change.
2. chore — bump that ref to the hub commit that makes ske/ske-starterkit/e2e dual-mode. This
   redeploys the three BBDs at the newer hub ref.
3. test — add starterkit/e2e/ and the e2e output it reads.
4. docs — add AGENTS.md (+ CLAUDE.md symlink). See below.
5. test — drop that output again, and the state dependency behind it. See below.

Running it needs the meshStack API key and nothing else

Commits 3 and 4 are worth reading as a pair. The e2e unit originally took bbd_version_ref from
dependency.deployment.outputs.e2e, and terragrunt has to evaluate the deployment unit to read
that — dragging in its STACKIT credentials, its state backend and the whole dependency graph for one
uuid. Reading that state is also more access than a smoke test should have: it holds the SKE
kubeconfig and the Forgejo and Harbor secrets.

The hub's foundation mode now finds the published definition through the meshStack API itself, so
the unit only spells out static facts: workspace, bbd_draft and a fresh name suffix. No
dependency, no state, no cloud credential.

export MESHSTACK_STARTER_KIT_API_KEY_ID=... MESHSTACK_STARTER_KIT_API_KEY_SECRET=...
cd foundations/meshstack-trial/platforms/ske/starterkit/e2e && terragrunt test

python3 must be on PATH for the endpoint probe.

AGENTS.md, and why it earns its place in this PR

This repo had no agent instructions at all, which is how the e2e units ended up explaining the hub
e2e protocol to themselves in comments. AGENTS.md links the public
likvid-cloudfoundation for the shared
conventions and states only what actually differs here — a different meshStack, its own Vault
secret, no CI. CLAUDE.md is a symlink to it, matching likvid. The e2e comments are then trimmed to
pointers.

It also records a credential quirk worth knowing: setup-env.sh exports every key in
concourse/meshstack-dev/trial-cloudfoundation, and the ske units read the meshStack API key
id from MESHSTACK_STARTER_KIT_API_KEY_ID rather than committing it. The rest of this repo (and
all of likvid) commits the id and takes only the secret from the environment. A key id is not a
secret, so this is inconsistency rather than intent — worth aligning one day, but not while it is
load-bearing for three units.

Frequency

This repo has no CI, so the test is run on demand — but that is now a much smaller gap than it was:
foundations/meshstack-trial/smoke.hcl holds the shared scaffolding and is the marker
likvid-cloudfoundation's .github/workflows/smoke-test.yml discovers smoke tests by, so cloning
that workflow when this repo gets CI is the whole job, with no per-case wiring.

Keeping it on demand for now is also deliberate: each run consumes a Let's Encrypt certificate for a
fresh hostname, a rate-limited quota — the same reason this case is nightly-only rather than hourly
in meshcloud/meshstack-smoke-test.

Verification

Config-only. terragrunt hcl fmt --check and tofu fmt -check pass, and terragrunt render on the
e2e unit reports dependencies: null with
{"mode":"foundation","workspace":"meshcloud","bbd_draft":false,"name_suffix":…} — resolved with no
credentials beyond two dummy env vars. terragrunt init at the pinned hub ref installs
modes/foundation only. The live run is still outstanding — it needs the real API key pair.

🤖 Generated with Claude Code