Istari Deploy Agent

Run ID	Type	Outcome	Started	Duration	Chart	Phases	Logs
Loading...

What does the deploy agent test?

Before every platform release ships to customers, the deploy agent runs two full deployment cycles on the CS sandbox (AWS account 669640508343). Each cycle exercises the complete Istari infrastructure and application stack.

Fresh Install

Tears down everything and rebuilds from scratch: EKS cluster, RDS, ALB, DNS, Zitadel, platform helm chart, SCS, MCP, SpiceDB. Validates the full "day one" customer experience.

Upgrade Path

Deploys the previous release, then upgrades to the new one. Tests helm upgrade, database migrations, subchart activation, and verifies existing data survives.

Smoke Tests

API tests (httpx + PAT auth) and browser tests (Playwright) run against the live deployment. Login, create system, upload file, verify workflows.

Report

Results posted to Slack, logs archived in S3, artifacts committed to git. Both a fresh install and upgrade must pass before the release ships.

What each phase validates

Phase	Name	What it tests
01	Teardown	Clean destruction of previous deployment (terraform destroy, namespace wipe)
02	Env Setup	VPC discovery, subnet validation, AWS provider configuration, existing resource detection
03	EKS Apply	EKS cluster creation in BYOVPC, node groups, OIDC provider (fresh install only)
04	Pull Secret	JFrog registry pull secret creation, image pull verification
05	Full Apply	Complete terraform: RDS PostgreSQL, S3 buckets, IAM roles, security groups, KMS (fresh only)
06	ALB+DNS	Application Load Balancer, ACM certificate, Route53 DNS records (fresh only)
07	Configurator	Zitadel identity: organization, admin user, OIDC clients for frontend/registry/MCP
08	Secrets	Kubernetes secrets for frontend, registry service, fileservice, OIDC credentials
08u	SCS	Secure Connection Service: S3 inbox/outbox, database schema, Zitadel client, secrets
09	Platform	Helm install/upgrade of the platform chart with all subcharts enabled
10	Verify	All pods running, readiness probes passing, no crash loops, resource utilization normal
11	MCP	MCP service enablement, health endpoint, AI chat connectivity
12	SpiceDB	Connection pool hardening, dispatch authority, permission resolution latency
13	Validate	HTTPS endpoints responding, TLS certificates valid, authentication flow working
14	Smoke	API smoke tests (PAT auth, CRUD ops) + browser tests (Playwright login, upload, workflow)

How a run works

An engineer runs /release-test-coverage <name> in Claude Code. The skill queries JFrog for the latest gated chart versions, creates a plan JSON, pushes to git, uploads to S3, and starts the EC2 instance. The agent picks up the plan on boot and runs through all phases autonomously (8-10 hours for fresh, 6-8 for upgrade). An independent Opus 4.7 advisor reviews every terraform apply and helm upgrade before execution. Results go to Slack, S3, and this dashboard.