From 662fb9b286e0a30830885a0c6ff4706b2eb926af Mon Sep 17 00:00:00 2001
From: Evan Lezar <elezar@nvidia.com>
Date: Wed, 29 Jul 2026 17:21:24 +0200
Subject: [PATCH] ci(e2e): probe VM gateway readiness

Signed-off-by: Evan Lezar <elezar@nvidia.com>
---
 e2e/rust/e2e-vm.sh                       | 59 +++++++++++++++---------
 tasks/scripts/vm/smoke-orphan-cleanup.sh |  5 +-
 2 files changed, 39 insertions(+), 25 deletions(-)

diff --git a/e2e/rust/e2e-vm.sh b/e2e/rust/e2e-vm.sh
index 584c7b91cd..43b573f867 100755
--- a/e2e/rust/e2e-vm.sh
+++ b/e2e/rust/e2e-vm.sh
@@ -33,8 +33,8 @@
 #      `com.apple.security.hypervisor` entitlement).
 #   4. Writes a per-run gateway config with `[openshell.drivers.vm]`
 #      settings, starts the gateway with `--config <run-state>/gateway.toml`
-#      on a random free port, waits for `Server listening`, then runs the
-#      selected Rust e2e tests.
+#      on a random free port, waits for an authenticated gateway status
+#      request to succeed, then runs the selected Rust e2e tests.
 #   5. Tears the gateway down and (on failure) preserves the gateway
 #      log and every VM serial console log for post-mortem.
 #
@@ -280,45 +280,58 @@ e2e_write_gateway_args_file "${GATEWAY_ARGS_FILE}" "${GATEWAY_ARGS[@]}"
 GATEWAY_PID=$!
 printf '%s\n' "${GATEWAY_PID}" >"${GATEWAY_PID_FILE}"
 
+# Register the gateway before polling so readiness exercises the same mTLS
+# client path as the smoke tests.
+CLI_GATEWAY_ENDPOINT="https://127.0.0.1:${HOST_PORT}"
+e2e_register_mtls_gateway \
+  "${XDG_CONFIG_HOME}" \
+  "${GATEWAY_NAME}" \
+  "${CLI_GATEWAY_ENDPOINT}" \
+  "${HOST_PORT}" \
+  "${PKI_DIR}"
+export OPENSHELL_GATEWAY_ENDPOINT="${CLI_GATEWAY_ENDPOINT}"
+
 # ── Wait for gateway readiness ───────────────────────────────────────
 #
-# The gateway logs `INFO openshell_server: Server listening
-# address=0.0.0.0:<port>` after its tonic listener is up. That is the
-# only signal the smoke test needs — the VM driver is spawned eagerly
-# but sandboxes are created on demand, so "Server listening" is the
-# right gate here.
+# Poll the authenticated gRPC health path instead of coupling readiness to a
+# particular gateway log message. The VM driver is spawned eagerly, while
+# sandboxes are created on demand.
 
 echo "==> Waiting for gateway readiness (timeout ${GATEWAY_READY_TIMEOUT}s)"
 elapsed=0
-while ! grep -q 'Server listening' "${GATEWAY_LOG}" 2>/dev/null; do
+last_status_output=""
+while [ "${elapsed}" -lt "${GATEWAY_READY_TIMEOUT}" ]; do
   if ! kill -0 "${GATEWAY_PID}" 2>/dev/null; then
     echo "ERROR: openshell-gateway exited before becoming ready"
     exit 1
   fi
-  if [ "${elapsed}" -ge "${GATEWAY_READY_TIMEOUT}" ]; then
-    echo "ERROR: openshell-gateway did not become ready after ${GATEWAY_READY_TIMEOUT}s"
-    exit 1
+  if last_status_output="$("${CLI_BIN}" status --output json 2>&1)" &&
+    printf '%s\n' "${last_status_output}" |
+      grep -Eq '"status"[[:space:]]*:[[:space:]]*"connected"'; then
+    echo "==> Gateway ready after ${elapsed}s"
+    break
   fi
-  sleep 1
-  elapsed=$((elapsed + 1))
+  sleep 2
+  elapsed=$((elapsed + 2))
 done
 
-echo "==> Gateway ready after ${elapsed}s"
+if [ "${elapsed}" -ge "${GATEWAY_READY_TIMEOUT}" ]; then
+  echo "ERROR: openshell-gateway did not become ready after ${GATEWAY_READY_TIMEOUT}s"
+  echo "=== last openshell status output ==="
+  if [ -n "${last_status_output}" ]; then
+    printf '%s\n' "${last_status_output}"
+  else
+    echo "<no output>"
+  fi
+  echo "=== end openshell status output ==="
+  exit 1
+fi
 
 # ── Run the smoke test ───────────────────────────────────────────────
 #
 # The CLI uses the raw endpoint but still resolves matching metadata so it
 # can find the mTLS client bundle.
 
-CLI_GATEWAY_ENDPOINT="https://127.0.0.1:${HOST_PORT}"
-e2e_register_mtls_gateway \
-  "${XDG_CONFIG_HOME}" \
-  "${GATEWAY_NAME}" \
-  "${CLI_GATEWAY_ENDPOINT}" \
-  "${HOST_PORT}" \
-  "${PKI_DIR}"
-
-export OPENSHELL_GATEWAY_ENDPOINT="${CLI_GATEWAY_ENDPOINT}"
 export OPENSHELL_E2E_EXPECT_VM_OVERLAY=1
 export OPENSHELL_E2E_DRIVER="vm"
 export OPENSHELL_E2E_VM_STATE_DIR="${RUN_STATE_DIR}"
diff --git a/tasks/scripts/vm/smoke-orphan-cleanup.sh b/tasks/scripts/vm/smoke-orphan-cleanup.sh
index d520fc2305..6da48919d1 100755
--- a/tasks/scripts/vm/smoke-orphan-cleanup.sh
+++ b/tasks/scripts/vm/smoke-orphan-cleanup.sh
@@ -77,7 +77,8 @@ EOF
     echo "gateway pid=$GATEWAY_PID"
 
     for _ in $(seq 1 60); do
-        if grep -q "Server listening" "$LOG" 2>/dev/null; then
+        if curl -sf --connect-timeout 1 \
+            "http://127.0.0.1:${health_port}/healthz" >/dev/null 2>&1; then
             return 0
         fi
         if ! kill -0 "$GATEWAY_PID" 2>/dev/null; then
@@ -87,7 +88,7 @@ EOF
         fi
         sleep 1
     done
-    echo "!! gateway never reported ready"
+    echo "!! gateway health endpoint never became healthy"
     tail -40 "$LOG" >&2
     return 1
 }