From a498ba7e860a35265ef116cf823540bf5729f114 Mon Sep 17 00:00:00 2001
From: mdheller <21163552+mdheller@users.noreply.github.com>
Date: Sat, 18 Apr 2026 11:03:59 -0400
Subject: [PATCH 1/3] test(source-os): add meshd bootstrap smoke test

---
 tests/meshd-bootstrap-smoke.nix | 87 +++++++++++++++++++++++++++++++++
 1 file changed, 87 insertions(+)
 create mode 100644 tests/meshd-bootstrap-smoke.nix

diff --git a/tests/meshd-bootstrap-smoke.nix b/tests/meshd-bootstrap-smoke.nix
new file mode 100644
index 0000000..8536d85
--- /dev/null
+++ b/tests/meshd-bootstrap-smoke.nix
@@ -0,0 +1,87 @@
+{ pkgs ? import <nixpkgs> {}, self, system }:
+pkgs.runCommand "meshd-bootstrap-smoke" {
+  nativeBuildInputs = [ pkgs.python3 self.packages.${system}.meshd ];
+} ''
+  workdir="$TMPDIR/meshd-bootstrap"
+  mkdir -p "$workdir" "$out"
+
+  manifest="$workdir/manifest.json"
+  config="$workdir/meshd.toml"
+  socket="$workdir/meshd.sock"
+  link_socket="$workdir/linkd.sock"
+
+  cat > "$manifest" <<'JSON'
+{"version":"capability-manifest/v0","node_id":"node-test","roles":["peer"],"transports":["wireguard"],"path_templates":["P0-direct"]}
+JSON
+
+  cat > "$config" <<EOF
+[identity]
+role = "peer"
+manager = "networkd"
+interface = "mesh0"
+
+[paths]
+manifest = "$manifest"
+control_socket = "unix:$socket"
+link_socket = "unix:$link_socket"
+
+[routing]
+private_fwmark = "0x110"
+exit_fwmark = "0x120"
+private_route_table = 110
+exit_route_table = 120
+onion_route_table = 130
+mix_route_table = 140
+EOF
+
+  meshd --config "$config" --listen "unix:$socket" &
+  pid=$!
+  trap 'kill "$pid" 2>/dev/null || true' EXIT
+
+  python3 - "$socket" <<'PY'
+import json
+import os
+import socket
+import sys
+import time
+
+sock = sys.argv[1]
+for _ in range(100):
+    if os.path.exists(sock):
+        break
+    time.sleep(0.1)
+else:
+    raise SystemExit("meshd socket never appeared")
+
+def call(op: str):
+    conn = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+    conn.connect(sock)
+    conn.sendall((json.dumps({"op": op}) + "\n").encode("utf-8"))
+    data = b""
+    while True:
+        chunk = conn.recv(65536)
+        if not chunk:
+            break
+        data += chunk
+        if b"\n" in chunk:
+            break
+    conn.close()
+    return json.loads(data.decode("utf-8").strip())
+
+ping = call("ping")
+assert ping["ok"] is True and ping["service"] == "meshd"
+status = call("status")
+assert status["identity"]["role"] == "peer"
+assert status["routing"]["exit_route_table"] == 120
+manifest = call("get-manifest")
+assert manifest["exists"] is True
+assert manifest["payload"]["node_id"] == "node-test"
+plan = call("render-link-plan")
+assert plan["plan"]["interface"] == "mesh0"
+assert plan["plan"]["role"] == "peer"
+PY
+
+  kill "$pid"
+  wait "$pid" || true
+  echo validated > "$out/result.txt"
+''

From 8aafd8de9e7c5c89f3756cc1c4e584caf603365f Mon Sep 17 00:00:00 2001
From: mdheller <21163552+mdheller@users.noreply.github.com>
Date: Sat, 18 Apr 2026 12:25:12 -0400
Subject: [PATCH 2/3] test(source-os): add meshd plus linkd bootstrap smoke
 test

---
 tests/meshd-linkd-bootstrap-smoke.nix | 90 +++++++++++++++++++++++++++
 1 file changed, 90 insertions(+)
 create mode 100644 tests/meshd-linkd-bootstrap-smoke.nix

diff --git a/tests/meshd-linkd-bootstrap-smoke.nix b/tests/meshd-linkd-bootstrap-smoke.nix
new file mode 100644
index 0000000..2082bb6
--- /dev/null
+++ b/tests/meshd-linkd-bootstrap-smoke.nix
@@ -0,0 +1,90 @@
+{ pkgs ? import <nixpkgs> {}, self, system }:
+pkgs.runCommand "meshd-linkd-bootstrap-smoke" {
+  nativeBuildInputs = [ pkgs.python3 self.packages.${system}.meshd self.packages.${system}.meshd-linkd ];
+} ''
+  workdir="$TMPDIR/meshd-linkd-bootstrap"
+  mkdir -p "$workdir" "$out"
+
+  manifest="$workdir/manifest.json"
+  config="$workdir/meshd.toml"
+  control_socket="$workdir/meshd.sock"
+  rpc_socket="$workdir/linkd.sock"
+
+  cat > "$manifest" <<'JSON'
+{"version":"capability-manifest/v0","node_id":"node-linkd","roles":["relay"],"transports":["wireguard"],"path_templates":["P0-direct","P1-relay"]}
+JSON
+
+  cat > "$config" <<EOF
+[identity]
+role = "relay"
+manager = "networkd"
+interface = "mesh0"
+
+[paths]
+manifest = "$manifest"
+control_socket = "unix:$control_socket"
+link_socket = "unix:$rpc_socket"
+
+[routing]
+private_fwmark = "0x110"
+exit_fwmark = "0x120"
+private_route_table = 110
+exit_route_table = 120
+onion_route_table = 130
+mix_route_table = 140
+EOF
+
+  meshd --config "$config" --listen "unix:$control_socket" &
+  meshd_pid=$!
+  meshd-linkd --rpc "unix:$rpc_socket" --control "unix:$control_socket" &
+  linkd_pid=$!
+  trap 'kill "$linkd_pid" "$meshd_pid" 2>/dev/null || true' EXIT
+
+  python3 - "$rpc_socket" <<'PY'
+import json
+import os
+import socket
+import sys
+import time
+
+sock = sys.argv[1]
+for _ in range(100):
+    if os.path.exists(sock):
+        break
+    time.sleep(0.1)
+else:
+    raise SystemExit("meshd-linkd socket never appeared")
+
+def call(op: str):
+    conn = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+    conn.connect(sock)
+    conn.sendall((json.dumps({"op": op}) + "\n").encode("utf-8"))
+    data = b""
+    while True:
+        chunk = conn.recv(65536)
+        if not chunk:
+            break
+        data += chunk
+        if b"\n" in chunk:
+            break
+    conn.close()
+    return json.loads(data.decode("utf-8").strip())
+
+ping = call("ping")
+assert ping["ok"] is True and ping["service"] == "meshd-linkd"
+status = call("status")
+assert status["registration"]["registered"] == "linkd"
+assert status["upstream"]["identity"]["role"] == "relay"
+plan = call("get-link-plan")
+assert plan["plan"]["role"] == "relay"
+manifest = call("get-manifest")
+assert manifest["payload"]["node_id"] == "node-linkd"
+refresh = call("refresh-registration")
+assert refresh["registration"]["registered"] == "linkd"
+PY
+
+  kill "$linkd_pid" "$meshd_pid"
+  wait "$linkd_pid" || true
+  wait "$meshd_pid" || true
+  echo validated > "$out/result.txt"
+''

From d9953d48d36e35fc873a0791daf6e7d775fb8f27 Mon Sep 17 00:00:00 2001
From: mdheller <21163552+mdheller@users.noreply.github.com>
Date: Sat, 18 Apr 2026 22:10:59 -0400
Subject: [PATCH 3/3] test(source-os): add meshd-exitd bootstrap smoke test

---
 tests/meshd-exitd-bootstrap-smoke.nix | 45 +++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 tests/meshd-exitd-bootstrap-smoke.nix

diff --git a/tests/meshd-exitd-bootstrap-smoke.nix b/tests/meshd-exitd-bootstrap-smoke.nix
new file mode 100644
index 0000000..87de006
--- /dev/null
+++ b/tests/meshd-exitd-bootstrap-smoke.nix
@@ -0,0 +1,45 @@
+{ pkgs ? import <nixpkgs> {}, self, system }:
+pkgs.runCommand "meshd-exitd-bootstrap-smoke" {
+  nativeBuildInputs = [ pkgs.python3 self.packages.${system}.meshd-exitd ];
+} ''
+  workdir="$TMPDIR/meshd-exitd-bootstrap"
+  mkdir -p "$workdir" "$out"
+
+  config="$workdir/exits.toml"
+  nft="$workdir/mesh-exit.nft"
+
+  cat > "$config" <<EOF
+[exit]
+interface = "mesh0"
+nft_policy = "$nft"
+allow_full_tunnel = true
+
+[routing]
+exit_fwmark = "0x120"
+exit_route_table = 120
+EOF
+
+  cat > "$nft" <<'NFT'
+table inet mesh_exit {
+  chain postrouting {
+    type nat hook postrouting priority srcnat; policy accept;
+  }
+}
+NFT
+
+  meshd-exitd --config "$config" --nft "$nft" &
+  pid=$!
+  trap 'kill "$pid" 2>/dev/null || true' EXIT
+
+  sleep 2
+  kill -0 "$pid"
+
+  echo '# reload probe' >> "$nft"
+  touch "$config"
+  sleep 6
+  kill -0 "$pid"
+
+  kill "$pid"
+  wait "$pid" || true
+  echo validated > "$out/result.txt"
+''