Require diagnostic provisioning in both installation paths

deploys/README.md

@@ -34,9 +34,13 @@ tar -xzf sip-go-agent-<version>-linux-amd64.tar.gz
 ./install.sh
 ```
 
-The package contains only the two Go services, their systemd units, production
-environment templates, the endpoint inventory, the version lock and the
-installer. Credentials, certificates, broker URLs and the approved static Cell
+The package contains the two Go services, their systemd units, production
+environment templates, the endpoint inventory, the version lock, the installer,
+and `cell/install-diagnostics.sh`. Both production and test host installation
+always provision `tcpdump` and `tshark` through system packages, verify command
+versions and SIP/RTP decoders, and fail on errors. Tools being installed does
+not enable capture: `--debug/-D` remains explicit. No capture capabilities,
+user-group membership or sudo rules are added by this helper. Credentials, certificates, broker URLs and the approved static Cell
 artifact are injected separately. Asterisk is built or installed with the
 scripts under [`cell/`](cell/), and its management-owned configuration is never
 overwritten.

deploys/build-package.sh

@@ -19,13 +19,14 @@ RELEASE_VERSION="$VERSION" "$ROOT/scripts/build-release.sh" "$RELEASE_DIR"
 mkdir -p -- "$(dirname -- "$ARCHIVE")"
 mkdir -- "$STAGE"
 cp -a "$RELEASE_DIR/." "$STAGE/"
-mkdir -p "$STAGE/systemd" "$STAGE/env" "$STAGE/config"
+mkdir -p "$STAGE/systemd" "$STAGE/env" "$STAGE/config" "$STAGE/cell"
 cp "$ROOT/deploys/install.sh" "$STAGE/install.sh"
+cp "$ROOT/deploys/cell/install-diagnostics.sh" "$STAGE/cell/install-diagnostics.sh"
 cp "$ROOT/deploys/systemd/"*.service "$STAGE/systemd/"
 cp "$ROOT/deploys/env/agent.env.example" "$ROOT/deploys/env/dispatcher.env.example" "$STAGE/env/"
 cp "$ROOT/deploys/config/agent-endpoints.example.json" "$STAGE/config/"
 cp "$LOCK" "$STAGE/versions.lock.json"
-chmod 0755 "$STAGE/install.sh"
+chmod 0755 "$STAGE/install.sh" "$STAGE/cell/install-diagnostics.sh"
 chmod 0644 "$STAGE/systemd/"*.service "$STAGE/env/"*.env.example "$STAGE/config/agent-endpoints.example.json" "$STAGE/versions.lock.json"
 (
   cd "$STAGE"

deploys/cell/README.md

@@ -14,8 +14,15 @@ The pinned source input is:
 
 `build-asterisk-native.sh` reproduces the stage from the pinned source and
 local dependency cache; the build selects no downloaded core sounds/MOH.
-The native package includes its `build-platform` marker and
-`install-asterisk-user.sh`. Run that installer as `rogee`, never as root;
+The native package includes its `build-platform` marker,
+`install-asterisk-user.sh`, and checksum-verified `install-diagnostics.sh`.
+Every production/test installation provisions `tcpdump` and `tshark` using the
+same root package helper; there is no environment switch or skip option.
+The native user installer invokes this helper through existing `sudo -n`
+administrative access after preflight validation and before changing Asterisk.
+The helper checks versions and SIP/RTP decoders, does not activate capture,
+and does not change capture permissions or user-group membership.
+Run the native installer as `rogee`, never as root;
 it verifies the stage hash and required libraries, installs into `~/.local/opt/`,
 sets up `~/.config/go-sip-asterisk/` without overwriting existing files, and
 installs `go-sip-asterisk.service` under `systemd --user`. Production requires

deploys/cell/build-asterisk-native.sh

@@ -42,10 +42,12 @@ rm -rf -- "$STAGE/etc/asterisk"
 tar -C "$STAGE" -cpf "$OUT/asterisk-$VERSION-native-stage.tar" .
 cp "$ROOT/deploys/cell/install-asterisk-user.sh" "$OUT/install-asterisk-user.sh"
 cp "$ROOT/deploys/cell/native-platform.sh" "$OUT/native-platform.sh"
+cp "$ROOT/deploys/cell/install-diagnostics.sh" "$OUT/install-diagnostics.sh"
 printf 'debian:%s:x86_64\n' "$OS_VERSION" > "$OUT/build-platform"
-chmod 0755 "$OUT/install-asterisk-user.sh"
+chmod 0755 "$OUT/install-asterisk-user.sh" "$OUT/install-diagnostics.sh"
 (
   cd "$OUT"
   sha256sum "asterisk-$VERSION-native-stage.tar" > "asterisk-$VERSION-native-stage.tar.sha256"
+  sha256sum install-diagnostics.sh > install-diagnostics.sh.sha256
 )
 printf 'native_stage=%s\nservice=%s\n' "$OUT/asterisk-$VERSION-native-stage.tar" "$OUT/asterisk.service"

deploys/cell/install-asterisk-user.sh

@@ -27,6 +27,10 @@ runtime="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/go-sip-asterisk"
 [[ ! -e $prefix && ! -e $unit && ! -e $config/asterisk.conf && ! -e $config/modules.conf ]] || { echo 'existing Asterisk installation or user configuration; refuse to overwrite' >&2; exit 1; }
 [[ $HOME != *[[:space:]]* ]] || { echo 'home path with whitespace is unsupported by the unit' >&2; exit 1; }
 
+# System tools are required for every environment, independently of --nonprod.
+(cd "$package" && sha256sum -c install-diagnostics.sh.sha256)
+sudo -n -- bash "$package/install-diagnostics.sh"
+
 mkdir -p "$(dirname "$prefix")"
 staged=$(mktemp -d "$(dirname "$prefix")/.staged.XXXXXXXX")
 trap 'rm -rf "$staged"' EXIT

deploys/cell/install-diagnostics.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Required on every host: tool availability does not enable packet capture.
+set -euo pipefail
+[[ $# == 0 ]] || { echo 'usage: install-diagnostics.sh (no environment switches)' >&2; exit 2; }
+[[ $EUID == 0 ]] || { echo 'diagnostic package installation requires root' >&2; exit 1; }
+for command in apt-get awk; do
+  command -v "$command" >/dev/null || { echo "required installer command missing: $command" >&2; exit 1; }
+done
+# Noninteractive package defaults do not add users to the wireshark group or
+# grant capture capabilities. Existing operator capture permissions are retained.
+export DEBIAN_FRONTEND=noninteractive
+apt-get update
+apt-get install -y --no-install-recommends tcpdump tshark
+for command in tcpdump tshark; do
+  command -v "$command" >/dev/null || { echo "installed diagnostic command missing: $command" >&2; exit 1; }
+done
+tcpdump_version=$(tcpdump --version)
+tshark_version=$(tshark --version)
+printf '%s\n%s\n' "${tcpdump_version%%$'\n'*}" "${tshark_version%%$'\n'*}"
+protocols=$(tshark -G protocols)
+if ! awk -F '\t' '$3 == "sip" {sip=1} $3 == "rtp" {rtp=1} END {exit !(sip && rtp)}' <<< "$protocols"; then
+  echo 'installed tshark lacks SIP/RTP dissectors' >&2
+  exit 1
+fi
+printf 'tcpdump and tshark installed; SIP/RTP decoders verified; capture remains opt-in\n'

deploys/install.sh

@@ -37,6 +37,8 @@ LOCK_VERSION=$(awk -F'"' '/"version"[[:space:]]*:/ {print $4; exit}' versions.lo
 [[ "$VERSION" =~ ^[0-9A-Za-z][0-9A-Za-z.+_-]*$ ]] || { echo 'invalid release version' >&2; exit 1; }
 [[ "$VERSION" == "$LOCK_VERSION" ]] || { echo 'release/version lock mismatch' >&2; exit 1; }
 
+bash "$PACKAGE_DIR/cell/install-diagnostics.sh"
+
 id -u rogee >/dev/null 2>&1 || useradd --create-home --shell /bin/bash rogee
 install -d -m 0755 /opt/sip-go-agent/releases \
   /etc/sip-go-agent/pki /etc/sip-go-agent/artifacts

deploys/physical-deployment.md

@@ -31,9 +31,15 @@ before installation. Without lingering, non-production start is session-scoped
 and reboot persistence must be reported as unverified.
 
 The Go installer creates `/opt/sip-go-agent`, `/etc/sip-go-agent` and
-`/var/lib/sip-go-agent`, installs the two Go units, and enables them. It does
-not install test tooling, Docker, a broker, provider SDK credentials or AI
-snapshots. Start services only after the injected environment, mTLS identity,
+`/var/lib/sip-go-agent`, installs the two Go units, and enables them. It
+always installs `tcpdump` and `tshark` through the shared
+[`cell/install-diagnostics.sh`](cell/install-diagnostics.sh), for production and
+test hosts alike. The native Asterisk installer invokes the same helper with
+existing `sudo -n` administrative access before changing the installation.
+Versions and SIP/RTP dissectors are checked; package or validation failures
+abort installation. Capture still requires explicit `--debug/-D` and existing
+operator privileges. These tools are not business services. The installer does
+not install Docker, a broker, provider SDK credentials or AI snapshots. Start services only after the injected environment, mTLS identity,
 broker ACL and static Cell artifact have been reviewed.
 
 For local or isolated testing, use the Docker-backed RabbitMQ target