fix: harden phase 2 self-healing smoke CI (#549)

.gitea/workflows/self-healing-smoke.yml

@@ -20,15 +20,17 @@ jobs:
           bash -n scripts/fleet_health_probe.sh
           bash -n scripts/auto_restart_agent.sh
           bash -n scripts/backup_pipeline.sh
+          bash -n scripts/restore_backup.sh
 
       - name: Python compile checks
         run: |
           python3 -m py_compile uni-wizard/daemons/health_daemon.py
           python3 -m py_compile scripts/fleet_milestones.py
           python3 -m py_compile scripts/sovereign_health_report.py
+          python3 -m py_compile tests/test_backup_pipeline.py
           python3 -m py_compile tests/docs/test_self_healing_infrastructure.py
           python3 -m py_compile tests/docs/test_self_healing_ci.py
 
-      - name: Phase-2 doc tests
+      - name: Phase-2 smoke tests
         run: |
-          pytest -q tests/docs/test_self_healing_infrastructure.py tests/docs/test_self_healing_ci.py
+          pytest -q tests/test_backup_pipeline.py tests/docs/test_self_healing_infrastructure.py tests/docs/test_self_healing_ci.py

tests/docs/test_self_healing_ci.py

@@ -23,7 +23,8 @@ def test_self_healing_workflow_checks_phase2_artifacts() -> None:
     assert "bash -n scripts/fleet_health_probe.sh" in content
     assert "bash -n scripts/auto_restart_agent.sh" in content
     assert "bash -n scripts/backup_pipeline.sh" in content
+    assert "bash -n scripts/restore_backup.sh" in content
     assert "python3 -m py_compile uni-wizard/daemons/health_daemon.py" in content
     assert "python3 -m py_compile scripts/fleet_milestones.py" in content
     assert "python3 -m py_compile scripts/sovereign_health_report.py" in content
-    assert "pytest -q tests/docs/test_self_healing_infrastructure.py tests/docs/test_self_healing_ci.py" in content
+    assert "pytest -q tests/test_backup_pipeline.py tests/docs/test_self_healing_infrastructure.py tests/docs/test_self_healing_ci.py" in content

tests/docs/test_self_healing_infrastructure.py

@@ -27,10 +27,15 @@ def test_auto_restart_agent_has_retry_cap_and_escalation() -> None:
 
 def test_backup_pipeline_has_offsite_sync_and_retention() -> None:
     content = BACKUP_PIPELINE.read_text()
-    assert 'OFFSITE_TARGET="${OFFSITE_TARGET:-}"' in content
-    assert 'rsync -az --delete' in content
-    assert 'find "$BACKUP_ROOT" -mindepth 1 -maxdepth 1 -type d -mtime +7 -exec rm -rf {} +' in content
-    assert 'send_telegram "✅ Daily backup completed: ${DATESTAMP}"' in content
+    assert 'BACKUP_S3_URI="${BACKUP_S3_URI:-}"' in content
+    assert 'BACKUP_NAS_TARGET="${BACKUP_NAS_TARGET:-}"' in content
+    assert 'openssl enc -aes-256-cbc -salt -pbkdf2 -iter 200000' in content
+    assert 'write_manifest()' in content
+    assert 'upload_to_nas()' in content
+    assert 'upload_to_s3()' in content
+    assert 'Set BACKUP_NAS_TARGET or BACKUP_S3_URI for remote backup storage.' in content
+    assert 'BACKUP_RETENTION_DAYS="${BACKUP_RETENTION_DAYS:-14}"' in content
+    assert 'find "$BACKUP_ROOT" -mindepth 1 -maxdepth 1 -type d -name ' in content
 
 
 def test_self_healing_services_restart_automatically() -> None: