---
id: w1/m19/t011
title: Test coverage — scripted substrate assertions (verify-substrate.sh)
worker: worker1
status: todo
estimate: 30m
depends_on: [w1/m19/t007, w1/m19/t008]
---

## Objective

Make t009's acceptance repeatable: a script asserting the substrate invariants so regressions fail loudly, in the m13 style (asserting, non-tautological).

## Context

- Candidate checks: hcloudNetwork enabled + machines' private IPs present; CP count==3 and tainted; platform pods' node placement; CSR event scan; public port scan (nc against node IP); LB target privateness (hcloud API); KCP Available; scheduler --config flag. verify-elastic.sh already covers the elastic behaviors - do not duplicate.

## Steps

1. ~~Write scripts/verify-substrate.sh~~ _done: shipped by m19.1 t008, green on prod._ 2. REWRITE scripts/verify-elastic.sh for the self-managed world (dependency flipped 2026-07-11: this now gates t009, not the reverse): drop MGMT_CTX/mgmt-pair preflight, select the MachineDeployment by name/label (`bex-tenant-0`) instead of `head -1` (which now picks the tainted platform pool), count nodes by pool label, and document the `scale-down-disabled` guard for the app-bearing node.

## Files

- scripts/verify-substrate.sh

## Acceptance criteria

- [ ] Script exits 0 on the rebuilt prod, non-zero with a named failing invariant when any check is broken.

## Out of scope

- CI scheduling of the script (candidate follow-up note).
