feat(test): validate private SaaS snapshots before host startup

deploys/test/nonprod-call-evidence.sh

@@ -18,6 +18,7 @@ Options:
   --rtp-end PORT           RTP range end (default: 10800).
   --preflight-only         Start/stop capture and diagnostics without a call; do not require packets.
   --attempt-ledger FILE     Daily trunk/number attempt ledger (default: /var/lib/sip-go-agent/state/real-call-attempts.tsv).
+  --proof-root DIR          Live capture arm directory (default: /run/sip-go-agent/nonprod-armed).
 EOF
   exit 2
 }
@@ -68,7 +69,7 @@ while (($#)); do
 done
 
 case "$environment" in
-  development|mock|mixed|real) ;;
+  development|mock|mixed|real|nonprod-real) ;;
   production) echo 'production requires the separate production gate' >&2; exit 1 ;;
   *) echo 'invalid non-production environment' >&2; exit 1 ;;
 esac

deploys/test/saas-mock/README.md

@@ -1,6 +1,6 @@
 # SaaS 侧测试模拟服务（非生产）
 
-仅替代当前缺失的 SaaS，不改 Dispatcher 的正式 HTTP 配置接口或 MQ 归属。默认只提供静态配置和预建队列；另有**显式单次** `call.execute` 投递命令，绝不自动拨号或产生业务结果。 虚构的合同示例不能充当真实 AI、线路或任务授权。
+仅替代当前缺失的 SaaS，不改 Dispatcher 的正式 HTTP 配置接口或 MQ 归属。默认只提供静态配置和预建队列；另有**显式单次** `call.execute` 投递命令，绝不自动拨号或产生业务结果。虚构的合同示例不能充当真实 AI、线路或任务授权。
 
 ## 数据
 
@@ -8,6 +8,7 @@
 
 ## 运行
 
+- 可先以 `go run ./deploys/test/saas-mock --validate-only --data <私有目录> --dispatcher-id <UUID>` 离线校验快照；不连接 RabbitMQ/HTTPS。
 - 事先建立专用空 RabbitMQ vhost，名称以 `saas-mock-` 开头；模拟服务只创建现行 durable 交换机、控制队列、每任务队列与结果队列并做精确绑定，不自动清理/覆盖已有消息。Dispatcher 自身仍只被动核验拓扑。
 - 准备测试 HTTPS 证书与私钥；将 `SAAS_MOCK_DISPATCHER_SECRET` 和含凭据的 `SAAS_MOCK_RABBITMQ_URL` 放在受限环境文件，不在命令行、仓库或聊天中传输。
 - 启动：`go run ./deploys/test/saas-mock --data <私有目录> --dispatcher-id <UUID> --listen <地址:端口> --tls-cert <证书文件> --tls-key <私钥文件>`。

deploys/test/saas-mock/main.go

@@ -18,12 +18,24 @@ func main() {
 	listen := flag.String("listen", "", "explicit HTTPS listen address")
 	cert := flag.String("tls-cert", "", "HTTPS certificate file")
 	key := flag.String("tls-key", "", "HTTPS private key file")
+	validateOnly := flag.Bool("validate-only", false, "validate private snapshots offline without MQ or HTTPS")
 	publishID := flag.String("publish-event-id", "", "one-shot MQ event ID matching capture --call-id")
 	publishTask := flag.String("publish-task-id", "", "one approved single-trunk task")
 	publishCallee := flag.String("publish-callee", "", "one original allowlisted callee")
 	flag.Parse()
 	secret := os.Getenv("SAAS_MOCK_DISPATCHER_SECRET")
 	brokerURL := os.Getenv("SAAS_MOCK_RABBITMQ_URL")
+	if *validateOnly {
+		if *dataDir == "" || *dispatcherID == "" || *publishID != "" || *publishTask != "" || *publishCallee != "" || flag.NArg() != 0 {
+			log.Fatal("offline validation requires only a private data directory and bound Dispatcher ID")
+		}
+		data, err := loadDataset(*dataDir, *dispatcherID)
+		if err != nil {
+			log.Fatal(err)
+		}
+		log.Printf("private SaaS snapshots validated: task_count=%d", len(data.tasks))
+		return
+	}
 	if *publishID != "" || *publishTask != "" || *publishCallee != "" {
 		if *dataDir == "" || *dispatcherID == "" || brokerURL == "" || *publishID == "" || *publishTask == "" || *publishCallee == "" || flag.NArg() != 0 {
 			log.Fatal("one-shot publish requires private data, dispatcher ID, MQ environment and explicit event/task/callee")