Live smokes

Every venue's *_smoke.rs lives under crates/bridges/<venue>/tests/ and is the only tier that can catch a venue changing its wire. It is also the only tier that reaches an account, and the ones that do are gated twice over; none of them runs by accident.

The double gate

#[ignore] — an ordinary cargo test never runs one. It must be named with --ignored.

Credentials — a smoke that reaches an account self-skips unless demo credentials are present in the project credential store. A skip is a tracing::warn! and an early return, not a failure, because an absent store is the ordinary unconfigured state. The keyless ones — public streams and REST, or a local accepting client — reach no account and have nothing to gate on, so #[ignore] is their whole gate; Polymarket's Gamma catalog smoke gates on the explicit string POLY_GAMMA_SMOKE=1 instead.

Some smokes add a third gate. The capture arms are triple-gated: #[ignore], plus credentials, plus the exact environment string VIKE_CAPTURE_FIXTURES=1 — so a plain --ignored run self-skips and the committed fixture files can never be rewritten by accident.

Read-only and order-placing smokes are kept in separate tests. Binance's reconcile smoke is the pattern: two read-only fetch tests that build the real reconcile client in both its spot and perp modes and call all four report methods, and one clearly separated order-lifecycle test that rests a far-from-market limit order — at half the live mark, sized to clear the minimum notional, so it can never fill — then proves it appears through the report fetch, cancels it, and proves it is gone.

The two CI lanes, and why neither is scheduled

A subset runs in CI through one workflow with two lanes: a read-only lane (every wired venue's reconcile fetch smoke plus the credential-less public market-data smokes) and an order-lifecycle lane (the leave-flat trio — rest a far-from-market demo limit order and cancel it; one also amends first). Both are dispatched by hand and fire on no schedule and on no push, deliberately, because one of them submits orders.

An empty lane can never read green. Because a store-absent run makes every credential-gated smoke self-skip, a skip-honesty step fails the run by name for every required venue that skipped: a lane that proved nothing for a venue must not report success for it.

The credential refusal

Both lanes run one shared guard over the store before anything is linked, and it exists as a file because it was once written twice and the two copies disagreed.

The rule had been upgraded in the read-only lane from a venue list to a property — and the order-placing lane kept the old by-name test. For that window a live or mainnet key sitting in the smoke store was refused by the lane that only reads and waved through by the lane that submits orders. The read-only lane's own comment described that hole as belonging to "an earlier version", a hundred lines above the lane that still had it. As the script's header puts it: a law spelled twice is a law that drifts.

The rule is a property, not a venue list: any key naming a live or mainnet environment, whatever venue it belongs to, plus two by-name families whose demo spelling is still a real account.

Two of its behaviours are worth carrying:

• an absent store exits clean — refusing there would fail every run on a box that simply has no store, and the credential-gated smokes self-skip anyway;
• a store that exists and cannot be read is refused outright. That was measured against an unreadable file holding a live key: grep exits 2 on a permission error, the status was swallowed, and the guard printed "no live/mainnet credential family present" and exited zero. That is a guard reporting safe when it does not know, which is the one answer a guard must never give.

The gate that runs the guard

crates/vike-ops/tests/smoke_guard_gate.rs holds the guard to one spelling — and it does so by executing it, which is the second defect it was written for. Everything it originally asserted was a text scan, and a mutation campaign measured the cost: deleting the single line exit 1 from the script left all four checks green. Nothing constructed a process and nothing examined an exit status, so the one property the guard exists to have — it fails the step — was asserted nowhere. With that line gone the script falls through to its closing message and exits zero: the lane prints a red error annotation, links the store anyway, and the order-placing lane goes on to submit orders.

The gate now runs the real script against both a dirty store and a clean one, checks that the refusal names the key and never the value, asserts both lanes call the one guard and that no lane re-inlines the pattern, and asserts neither guard step can be defeated by its lane. Its header also declares the mutants that still pass — step ordering is not checked, and a hypothetical third lane is not required to carry a guard — because a declared limit is a finding and an undeclared one is the defect the file was written about.

Related: test doubles for what a capture smoke writes, and the venues tree.