1#!/bin/bash2# External acceptance (run from a machine OUTSIDE the node): DNS, TLS, UI, authenticated REST, MCP. Needs AKOS_TOKEN (+ optional AKOS_EMAIL/AKOS_PASSWORD for the login check).3set -u4URL="${AKOS_URL:-https://akos.spboucher.ai}"; H="${URL#https://}"; pass=0; fail=05ok(){ echo "PASS $1"; pass=$((pass+1)); }; ko(){ echo "FAIL $1 — $2"; fail=$((fail+1)); }6ip=$(dig +short "$H" A | head -1); [ "$ip" = "51.161.112.61" ] && ok "DNS $H → $ip (BHS64 gateway)" || ko "DNS" "$ip"7exp=$(echo | openssl s_client -connect "$H:443" -servername "$H" 2>/dev/null | openssl x509 -noout -issuer -enddate 2>/dev/null | tr '\n' ' '); echo "$exp" | grep -q "Let's Encrypt" && ok "TLS certificate ($exp)" || ko "TLS" "$exp"8c=$(curl -s -m 20 -o /dev/null -w "%{http_code}" "$URL/api/v1/health"); [ "$c" = 200 ] && ok "public health 200" || ko "health" "$c"9curl -s -m 20 -D /tmp/akos-h -o /tmp/akos-b "$URL/" >/dev/null; grep -qi "strict-transport-security" /tmp/akos-h && grep -q "AKOS" /tmp/akos-b && ok "UI index served with HSTS" || ko "UI" "$(head -3 /tmp/akos-h)"10c=$(curl -s -m 20 -o /dev/null -w "%{http_code}" "$URL/api/v1/overview"); [ "$c" = 401 ] && ok "REST unauthenticated → 401" || ko "REST anon" "$c"11c=$(curl -s -m 20 -o /dev/null -w "%{http_code}" "$URL/docs"); [ "$c" = 401 ] && ok "/docs protected → 401" || ko "/docs" "$c"12c=$(curl -s -m 20 -o /tmp/akos-ov -w "%{http_code}" -H "Authorization: Bearer $AKOS_TOKEN" "$URL/api/v1/overview"); [ "$c" = 200 ] && grep -q '"counts"' /tmp/akos-ov && ok "REST authenticated overview 200 ($(python3 -c "import json;d=json.load(open('/tmp/akos-ov'))['counts'];print('apis',d['apis'],'akps',d['packages'],'executions',d['executions'])"))" || ko "REST auth" "$c"13c=$(curl -s -m 20 -o /tmp/akos-mcp -w "%{http_code}" -H "Authorization: Bearer $AKOS_TOKEN" -H "Content-Type: application/json" -X POST "$URL/mcp" -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"acceptance","version":"1"}}}')14[ "$c" = 200 ] && grep -q '"akos"' /tmp/akos-mcp && ok "MCP initialize 200 (serverInfo akos)" || ko "MCP init" "$c $(head -c 200 /tmp/akos-mcp)"15n=$(curl -s -m 20 -H "Authorization: Bearer $AKOS_TOKEN" -H "Content-Type: application/json" -X POST "$URL/mcp" -d '{"jsonrpc":"2.0","id":2,"method":"tools/list"}' | python3 -c "import sys,json;print(len(json.load(sys.stdin)['result']['tools']))" 2>/dev/null); [ "${n:-0}" -ge 10 ] && ok "MCP tools/list → $n tools" || ko "MCP tools" "$n"16r=$(curl -s -m 30 -H "Authorization: Bearer $AKOS_TOKEN" -H "Content-Type: application/json" -X POST "$URL/mcp" -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"search_knowledge","arguments":{"query":"exchange rates"}}}' | python3 -c "import sys,json;d=json.load(sys.stdin)['result'];print('err' if d.get('isError') else len(json.loads(d['content'][0]['text'])['results']))" 2>/dev/null); [ "${r:-err}" != "err" ] && [ "$r" -ge 1 ] && ok "MCP tools/call search_knowledge → $r results" || ko "MCP call" "$r"17c=$(curl -s -m 20 -o /dev/null -w "%{http_code}" -X POST "$URL/mcp" -d '{}'); [ "$c" = 401 ] && ok "MCP unauthenticated → 401" || ko "MCP anon" "$c"18if [ -n "${AKOS_EMAIL:-}" ] && [ -n "${AKOS_PASSWORD:-}" ]; then19 curl -s -m 20 -D /tmp/akos-lh -o /dev/null -H "Content-Type: application/json" -X POST "$URL/api/v1/auth/login" -d "{\"email\":\"$AKOS_EMAIL\",\"password\":\"$AKOS_PASSWORD\"}"20 grep -qi "set-cookie: akos_session=.*HttpOnly" /tmp/akos-lh && grep -qi "Secure" /tmp/akos-lh && ok "login sets HttpOnly+Secure session cookie" || ko "login cookie" "$(grep -i set-cookie /tmp/akos-lh)"21fi22c=$(curl -s -m 10 -o /dev/null -w "%{http_code}" "http://$H/api/v1/health"); [ "$c" = 308 ] || [ "$c" = 301 ] && ok "http → https redirect ($c)" || ko "http redirect" "$c"23echo "== $pass PASS, $fail FAIL"; [ $fail = 0 ]24