aweb/Makefile at main · awebai/aweb

Repository navigation

History

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

401

402

403

404

405

406

407

408

409

410

411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428

429

430

431

432

433

434

435

436

437

438

439

440

441

442

443

444

445

446

447

448

449

450

451

452

453

454

455

456

457

458

459

460

461

462

463

464

465

466

467

468

469

470

471

472

473

474

475

476

477

478

479

480

481

482

483

484

485

486

487

488

489

490

491

492

493

494

495

496

497

498

499

500

501

502

503

504

505

506

507

508

509

510

511

512

513

514

515

516

517

518

519

520

521

522

523

524

525

526

527

528

529

530

531

532

533

534

535

536

537

538

539

540

541

542

543

544

545

546

547

548

549

550

551

552

553

554

555

556

557

558

559

560

561

562

563

564

565

566

567

568

569

570

571

572

573

574

575

576

577

578

579

580

581

582

583

584

585

586

587

588

589

590

591

592

593

594

595

596

597

598

599

600

601

602

603

604

605

606

607

608

609

610

611

612

613

614

615

616

617

618

619

620

621

622

623

624

625

626

627

628

629

630

631

632

633

634

635

636

637

638

639

640

641

642

643

644

645

646

647

648

649

650

651

652

653

654

655

656

657

658

659

660

661

662

663

664

665

666

667

668

669

670

671

672

673

674

675

676

677

678

679

680

681

682

683

684

685

686

687

688

689

690

691

692

693

694

695

696

697

698

699

700

701

702

703

704

705

706

707

708

709

710

711

712

713

714

715

716

717

718

719

720

721

722

723

724

725

726

727

728

729

730

731

732

733

734

735

736

737

738

# Only the internal-network Docker runner clears this prefix. Native suites use

# the proxy; the hard runner instead preserves DNS/connection error semantics.

TEST_EGRESS_RUNNER ?= python3 $(abspath scripts/test-egress/native.py) --

.PHONY: help clean test test-shipping test-server naapp-sync lint-naapp test-naapp test-awid test-awid-pooler test-cli test-cli-auth-v2 test-node-deps test-channel test-channel-name-live-contract test-channel-core test-wake-channel-core-bundle test-channel-core-process-guard test-pi-extension candidate-gate test-candidate-ledger release-candidate release-publish test-sot-source-inventories test-vector-provenance test-federation-error-reference regenerate-federation-error-reference test-cli-reference regenerate-cli-reference test-mcp-tools-reference prepare-oats-test-root check-oats-launch-environment-contract check-oats-pi-launch-order test-oats test-oats-proof-helpers test-tmux-guard test-a2a test-e2e test-federation-harness test-federation-e2e test-a2a-gateway-e2e check-a2a-copy-guardrails check-extension-docs build \

freshness check-go-vulnerability-audit check-node-audit check-exception-deadlines test-go-vulnerability-audit \

selfhost-up selfhost-down selfhost-logs awid-up awid-down awid-logs \

e2e-library-stack e2e-library-stack-up e2e-library-stack-seed e2e-library-stack-down \

awid-prod-verify awid-prod-dump awid-prod-restore awid-prod-migrate \

check-aw-commit-repo-stamp check-cli-go-tidy check-cli-release-vcs-stamps check-server-locked-suite \

check-awid-locked-suite \

test-release-cli-version \

test-channel-integration \

sync-doc-copies sync-skill-copies list-awid-site-docs sync-awid-site-docs check-awid-site-docs verify-site deploy-site \

test-npm-exact-publish test-pypi-exact-publish test-oci-exact-publish \

cli-e2e _candidate-gate-docker-boundaries _candidate-channel-version _candidate-node-deps \

_candidate-unit-channel _candidate-unit-channel-core _candidate-unit-pi _candidate-oats _candidate-oats-proof-helpers \

_candidate-artifact-server _candidate-artifact-awid-package _candidate-artifact-awid-image \

_candidate-artifact-naapp-package check-naapp-lib-package \

_candidate-artifact-channel _candidate-artifact-pi _candidate-artifact-skills _candidate-artifact-a2a-image

SERVER_VERSION := $(shell sed -n 's/^version = "$.*$"/\1/p' server/pyproject.toml | head -n 1)

AWID_VERSION := $(shell sed -n 's/^version = "$.*$"/\1/p' awid/pyproject.toml | head -n 1)

NAAPP_LIB_VERSION := $(shell sed -n 's/^version = "$.*$"/\1/p' naapp-lib/pyproject.toml 2>/dev/null | head -n 1)

CHANNEL_VERSION := $(shell node -p "require('./channel/package.json').version" 2>/dev/null)

CHANNEL_PLUGIN_VERSION := $(shell node -p "require('./channel/.claude-plugin/plugin.json').version" 2>/dev/null)

# aw CLI releases have independent semver. Derive the next patch from the

# published aw-v* history; the release guard below rejects stale overrides.

CLI_VERSION ?= $(shell ./scripts/cli-release-version.sh next)

# The gateway is a Go artifact with independent patch history.

A2A_GATEWAY_VERSION ?= $(shell python3 scripts/next_tag_version.py a2a-gw-v)

# OATS seam tests default to an immutable reviewed upstream commit materialized

# under this repository's ignored cache. That makes local and CI runs consume the

# same clean input instead of a colleague's mutable sibling checkout. Deliberate

# early integration remains opt-in: OATS_TEST_ROOT=/path/to/local/oats make test-oats.

OATS_PIN_FILE := $(CURDIR)/oats/upstream-test-pin.json

OATS_PINNED_ROOT := $(CURDIR)/.cache/oats-pinned

OATS_TEST_ROOT ?= $(OATS_PINNED_ROOT)

# Canonical docs generated into the public AWID site before builds/deploys.

# The sync step and publication-context link checks consume the same list.

AWID_SITE_DOC_NAMES := identity-guide.md trust-model.md hosted-global-bootstrap.md

AWID_SITE_DOC_SOURCE_DIR ?= docs

AWID_SITE_DOC_MIRROR_DIR ?= awid/site/static

AWID_SITE_DOC_MIRRORS := $(addprefix $(AWID_SITE_DOC_MIRROR_DIR)/,$(AWID_SITE_DOC_NAMES))

SITE_DEPLOY_BRANCH ?= deploy-awid-landing

help:

@echo "Targets:"

@echo " build Build the aw CLI binary"

@echo " test Run all tests (server + CLI + channel + awid)"

@echo " test-server Run server tests"

@echo " test-awid Run awid service tests"

@echo " test-cli Run CLI tests"

@echo " test-channel Run channel tests"

@echo " test-channel-core Run channel-core tests"

@echo " test-channel-core-process-guard Run the multi-process DeliveryStore guard (release path)"

@echo " test-pi-extension Run pi-extension tests"

@echo " test-sot-source-inventories Verify canonical SOT tables and REST routers against source"

@echo " test-vector-provenance Enforce root-only public conformance vectors and consumer paths"

@echo " test-federation-error-reference Verify generated stable error/status/retryability reference"

@echo " regenerate-federation-error-reference Regenerate the stable federation error reference"

@echo " test-cli-reference Verify generated CLI help and root-command completeness"

@echo " regenerate-cli-reference Regenerate the CLI reference from live Cobra help"

@echo " test-mcp-tools-reference Verify the generated MCP inventory against live registration"

@echo " regenerate-mcp-tools-reference Regenerate the MCP inventory from live registration"

@echo " prepare-oats-test-root Materialize the clean committed OATS test pin"

@echo " check-oats-launch-environment-contract Verify the pinned OATS seam dependency"

@echo " check-oats-pi-launch-order Prove pinned Pi command construction; real execution is opt-in"

@echo " real execution: OATS_RUN_REAL_PI_LAUNCH_ORDER=1 make test-oats"

@echo " opt-in local OATS: make test-oats OATS_TEST_ROOT=/path/to/local/oats"

@echo " freshness Regenerate committed artifacts and fail on drift"

@echo " sync-doc-copies Generate Codex/OATS skills and AWID site docs from their sources"

@echo " check-node-audit Audit Node dependencies for known vulnerabilities"

@echo " check-go-vulnerability-audit Audit Go dependencies (pinned toolchain)"

@echo " test-a2a Run A2A conformance, gateway, AWID lookup, and CLI command gates"

@echo " test-oats-proof-helpers Run attached-principal proof filesystem guard tests"

@echo " test-tmux-guard Run the guarded tmux migration and PATH-alias regressions"

@echo " test-e2e Run the end-to-end user journey and its mutation guard (requires Docker)"

@echo " test-federation-harness Validate the 51-row direct-core historical inventory and mutations"

@echo " test-federation-e2e Run the direct/non-ingress historical topology and OSS federation journeys (requires Docker)"

@echo " test-a2a-gateway-e2e Run the A2A gateway Docker journey against real aweb+awid"

@echo " check-a2a-copy-guardrails Block premature A2A trust/E2EE copy"

@echo " check-extension-docs Verify extension docs, source events, vectors, and authority map"

@echo " selfhost-up / -down / -logs Manage the OSS docker-compose stack (aweb + awid)"

@echo " awid-up / -down / -logs Manage the standalone awid docker-compose stack"

@echo " e2e-library-stack Bring up awid+aweb+Library, seed aweb.team, verify, tear down (requires Docker + ../library + ../blueprints)"

@echo " e2e-library-stack-up / -seed / -down Drive the combined stack step by step"

@echo ""

@echo " awid-prod-verify Print awid prod table row counts"

@echo " awid-prod-dump Dump awid prod data to /tmp (--column-inserts)"

@echo " awid-prod-restore Restore a dump into awid prod (DUMP=path)"

@echo " awid-prod-migrate Apply pending migrations to awid prod"

@echo ""

@echo " RELEASING - test locally, then push the exact local tags:"

@echo " make release-candidate TAGS='server-vX.Y.Z awid-service-vX.Y.Z ...'"

@echo " git push origin refs/tags/<tag> [...]"

@echo " make release-publish TAG=<tag> # runnerless registry publisher"

@echo " docs/release.md is the authoritative specification."

@echo ""

@echo " verify-site Verify the awid.ai Hugo site without deploying"

@echo " deploy-site Advance the verified origin/main commit to $(SITE_DEPLOY_BRANCH)"

@echo " release-candidate TAGS='...' complete missing Docker stages, then create local tags"

@echo " release-publish TAG=<tag> publish one local tag without GitHub Actions"

@echo " clean Remove all build artifacts and caches"

.PHONY: e2e-naapp e2e-folio-wakes naapp-e2e-packages

# A new package joins the integration gate by joining this list.

NAAPP_E2E_PACKAGES := naapp/folio naapp/library

naapp-e2e-packages:

@printf '%s\n' $(NAAPP_E2E_PACKAGES)

e2e-naapp: export PATH := $(CURDIR)/cli/go:$(PATH)

e2e-naapp:

bash scripts/check-naapp-e2e-aw.sh

@set -eu; for package in $(NAAPP_E2E_PACKAGES); do \

if [ -n "$${NAAPP_E2E_ALLOCATIONS:-}" ]; then \

allocation=$$(printf '%s\n' "$$NAAPP_E2E_ALLOCATIONS" | awk -v package="$$package" '$$1 == package { print $$2, $$3, $$4 }'); \

[ -n "$$allocation" ] || { echo "missing allocation for $$package" >&2; exit 1; }; \

set -- $$allocation; \

NAAPP_E2E_PROJECT="$$1" NAAPP_E2E_AWID_PORT="$$2" NAAPP_E2E_POSTGRES_PORT="$$3" \

NAAPP_E2E_HOST="$${AWEB_DOCKER_PUBLISHED_HOST:-127.0.0.1}" \

$(MAKE) -C "$$package" e2e; \

else \

$(MAKE) -C "$$package" e2e; \

fi; \

done

e2e-folio-wakes:

bash scripts/e2e-folio-wakes.sh

build: sync-doc-copies

cd cli/go && $(MAKE) build

# ORDER IS LOAD-BEARING FOR THE FIRST FOUR - do not sort this list.

# These cheap committed-source controls run first on every ordinary test run.

# The expensive complete release proof is owned by the clean local-Docker gate.

test: test-egress-controls check-aw-commit-repo-stamp check-cli-go-tidy test-identity-primitives test-python-locks test-sot-source-inventories test-vector-provenance test-federation-error-reference test-federation-authority-mutations test-federation-harness test-cli-reference test-mcp-tools-reference test-server test-awid test-cli test-channel test-channel-name-live-contract test-channel-core test-wake-channel-core-bundle test-pi-extension test-oats test-oats-proof-helpers test-tmux-guard test-release-cli-version test-npm-exact-publish test-pypi-exact-publish test-oci-exact-publish test-go-vulnerability-audit

test-shipping:

python3 scripts/test_fixture_repo.py

python3 scripts/test_shipping.py

python3 scripts/test_aw_npm_publication.py

python3 scripts/test_candidate_cleanup.py

python3 scripts/test_candidate_disk_floor.py

python3 scripts/test_candidate_ports.py

python3 scripts/test_folio_wakes_gate.py

python3 scripts/test_user_paths_gate.py

python3 scripts/test_fetch_released_aw.py

# AWID metadata is repeated in every committed Python lock that takes the in-repo

# awid (awid, server, naapp-lib and each naapp). Check them all without repair,

# then prove stale and missing dependent-lock entries are rejected.

test-python-locks:

bash scripts/check-python-locks.sh

bash scripts/check-python-locks.sh --self-test

# Canonical implementation SOT inventories are derived from ordered migrations

# and FastAPI mounts. The unit suite includes source-addition and stale-doc

# negative controls so this gate proves it can fail rather than only matching

# today's tree.

test-sot-source-inventories:

python3 scripts/check_sot_source_inventories.py

python3 -m unittest discover -s scripts -p "test_check_sot_source_inventories.py" -v

.PHONY: test-identity-primitives

test-identity-primitives:

python3 scripts/check_identity_python_inventory.py

python3 -m unittest discover -s scripts -p "test_check_identity_python_inventory.py" -v

cd cli/go && GOTOOLCHAIN=local go run ./internal/identityinventory ../..

cd cli/go && GOTOOLCHAIN=local go test ./internal/identityinventory

cd channel-core && npm ci --ignore-scripts --no-audit --no-fund

node scripts/check_identity_ts_inventory.mjs

node --test scripts/test_check_identity_ts_inventory.mjs

# Public protocol vectors have one repository-root authority. The checker also

# inventories explicitly local fixture directories and proves each failure mode.

test-vector-provenance:

python3 scripts/check_vector_provenance.py

python3 scripts/check_vector_provenance.py --self-test

# The public support/error table is generated from the canonical code source and

# cross-checked against the selected-policy vector. The focused suite proves

# additions, duplicate reasons, Retry-After drift, and stale output fail closed.

test-federation-error-reference:

python3 scripts/generate_federation_error_reference.py --check

python3 -m unittest discover -s scripts -p "test_generate_federation_error_reference.py" -v

regenerate-federation-error-reference:

python3 scripts/generate_federation_error_reference.py

# The strict authority vector readers must kill the two concrete security

# weakenings found during the independent core review.

test-federation-authority-mutations:

python3 scripts/test_federation_aut 10BC8 hority_mutations.py

# The direct-core historical harness inventories all 51 contract rows without

# claiming ingress coverage and kills topology/provenance weakening mutations.

test-federation-harness:

cd server && UV_CACHE_DIR=/tmp/uv-cache uv sync --frozen

python3 scripts/check_federation_harness.py

python3 scripts/check_federation_harness.py --self-test

cd server && UV_CACHE_DIR=/tmp/uv-cache PYTHONPYCACHEPREFIX=/tmp/pycache $(TEST_EGRESS_RUNNER) uv run --offline --no-sync pytest -q tests/test_federation_preactivation_harness.py

# The public CLI inventory comes from live Cobra help. Root completion is an

# independent exact-set control so grouped and Additional Commands cannot vanish

# while freshness stays green; the self-test also proves add/remove/stale paths.

test-cli-reference:

bash scripts/regenerate-cli-reference.sh --self-test

regenerate-cli-reference:

bash scripts/regenerate-cli-reference.sh

# The public MCP inventory comes from an offline FastMCP registration. The

# explicit category map must cover the live tool set exactly, and the unit suite

# proves that both newly registered and removed tools fail closed.

test-mcp-tools-reference:

cd server && UV_CACHE_DIR=/tmp/uv-cache PYTHONPYCACHEPREFIX=/tmp/pycache uv run --frozen python ../scripts/regenerate_mcp_reference.py --check

cd server && UV_CACHE_DIR=/tmp/uv-cache PYTHONPYCACHEPREFIX=/tmp/pycache uv run --frozen python -m unittest discover -s ../scripts -p "test_regenerate_mcp_reference.py" -v

regenerate-mcp-tools-reference:

cd server && UV_CACHE_DIR=/tmp/uv-cache PYTHONPYCACHEPREFIX=/tmp/pycache uv run --frozen python ../scripts/regenerate_mcp_reference.py

# Keep private application paths out of every candidate before it can land.

.PHONY: check-private-boundary

check-private-boundary:

python3 scripts/check-private-boundary.py

python3 scripts/check-private-boundary.py --self-test

# Regenerate every committed generated artifact (uv locks, cli reference,

# reserved-app-ids, resource packs, and the claude-channel + pi bundles) and

# fail on drift. The clean local release gate runs it before publication.

freshness:

bash scripts/check-freshness.sh

# The Go audit runs in candidate checks under the exact pinned toolchain and

# consults the live advisory database. Keep it outside deterministic `make test`;

# its fixture-based checker tests remain there. Candidate checks must run both.

check-go-vulnerability-audit:

bash scripts/check-go-vulnerability-audit.sh

# The deadline half of the audit above, split out because it is the only part

# that can run without the pinned toolchain, a govulncheck scan or the advisory

# database. It reads .github/go-vulnerability-exceptions.json and compares dates,

# so it is deterministic and cheap.

# It is separate because a deferral lapses on a DATE, not on a commit. The audit

# runs at release; if no release happens across a deadline, the deferral simply

# stops being deferred and nothing says so. This target is what the scheduled

# workflow runs daily. Candidate checks additionally run the full Go audit.

# The audit's own unit suite. It belongs in `make test` where the audit itself

# does not: it runs against fixtures and the checked-in exceptions file, with no

# toolchain, no scanner and no advisory database, and none of its assertions

# depend on today's date. Before this it was invoked by nothing, so the audit's

# ability to fail was asserted in a comment and tested nowhere.

test-go-vulnerability-audit:

python3 -m unittest discover -s scripts -p "test_check_go_vulnerability_audit.py" -v

check-exception-deadlines:

python3 scripts/check_go_vulnerability_audit.py \

--deadlines-only \

--exceptions .github/go-vulnerability-exceptions.json

check-node-audit:

bash scripts/check-node-audit.sh

# Runtime copies ship in Git for source-based plugin/capability installs. Edit

# skills/ and docs/, then sync; normal builds regenerate these copies too.

sync-doc-copies: sync-skill-copies sync-awid-site-docs

sync-skill-copies:

bash scripts/sync-skill-copies.sh

list-awid-site-docs:

@for name in $(AWID_SITE_DOC_NAMES); do printf '%s\n' "$$name"; done

sync-awid-site-docs:

@mkdir -p "$(AWID_SITE_DOC_MIRROR_DIR)"

@set -e; for name in $(AWID_SITE_DOC_NAMES); do \

cp "$(AWID_SITE_DOC_SOURCE_DIR)/$$name" "$(AWID_SITE_DOC_MIRROR_DIR)/$$name"; \

done

check-awid-site-docs: sync-awid-site-docs

python3 scripts/check-awid-site-doc-links.py $(AWID_SITE_DOC_MIRRORS)

verify-site: check-awid-site-docs

cd awid/site && hugo --minify --cleanDestinationDir

test-server:

cd server && UV_CACHE_DIR=/tmp/uv-cache uv sync --frozen

set -eu; cd server; build_dir=$$(mktemp -d); trap 'rm -rf "$$build_dir"' EXIT; \

UV_CACHE_DIR=/tmp/uv-cache uv build --out-dir "$$build_dir"

cd server && UV_CACHE_DIR=/tmp/uv-cache UV_OFFLINE=1 PYTHONPYCACHEPREFIX=/tmp/pycache $(TEST_EGRESS_RUNNER) uv run --offline --no-sync pytest -q

# The naapp packages the candidate gate covers. Each provides `make lint` and

# `make test`: the checks stage lints them, and the isolated unit stage runs

# their suites against its Postgres. A package joins by being added here.

# UV_FROZEN keeps the gate on each committed lock, a lock the run changed fails

# it, and the suites run offline.

NAAPP_PACKAGES := naapp-lib naapp/folio naapp/library naapp/secrets naapp/logs

# Installs each package's locked dependencies, for a runner that then goes offline.

naapp-sync:

set -e; for package in $(NAAPP_PACKAGES); do \

UV_CACHE_DIR=/tmp/uv-cache uv sync --frozen --project $$package; \

done

lint-naapp:

set -e; for package in $(NAAPP_PACKAGES); do \

echo "=== lint $$package ==="; \

UV_CACHE_DIR=/tmp/uv-cache UV_FROZEN=1 $(MAKE) -C $$package lint; \

git diff --exit-code -- $$package/uv.lock; \

done

test-naapp:

set -e; for package in $(NAAPP_PACKAGES); do \

echo "=== test $$package ==="; \

UV_CACHE_DIR=/tmp/uv-cache uv sync --frozen --project $$package; \

UV_CACHE_DIR=/tmp/uv-cache UV_FROZEN=1 UV_OFFLINE=1 PYTHONPYCACHEPREFIX=/tmp/pycache \

NAAPP_REQUIRE_TEST_DATABASE=1 LIBRARY_REQUIRE_TEST_DATABASE=1 $(TEST_EGRESS_RUNNER) $(MAKE) -C $$package test; \

git diff --exit-code -- $$package/uv.lock; \

done

test-awid:

cd awid && UV_CACHE_DIR=/tmp/uv-cache uv sync --frozen

cd awid && UV_CACHE_DIR=/tmp/uv-cache PYTHONPYCACHEPREFIX=/tmp/pycache $(TEST_EGRESS_RUNNER) uv run --offline --no-sync pytest -q

# awid's database session tests through a real transaction-mode PgBouncer.

test-awid-pooler:

set -e; \

trap 'docker compose -p awid-pooler -f $(CURDIR)/awid/tests/pooler/docker-compose.yml down -v --remove-orphans' EXIT; \

docker compose -p awid-pooler -f $(CURDIR)/awid/tests/pooler/docker-compose.yml up -d --wait; \

cd awid; \

UV_CACHE_DIR=/tmp/uv-cache uv sync --frozen; \

AWID_TEST_POOLER_URL=postgresql://postgres:postgres@localhost:$${AWID_TEST_POOLER_PORT:-56433}/postgres \

UV_CACHE_DIR=/tmp/uv-cache PYTHONPYCACHEPREFIX=/tmp/pycache $(TEST_EGRESS_RUNNER) uv run --offline --no-sync pytest -q tests/test_database_session_settings.py

test-cli:

cd cli/go && go mod download

cd awid && UV_CACHE_DIR=/tmp/uv-cache uv sync --frozen

# A short, canonical temp root avoids macOS /var symlinks and socket limits.

cd cli/go && TMPDIR="$$(python3 -c 'import os; print(os.path.realpath("/tmp"))')" \

GOCACHE=/tmp/go-build $(TEST_EGRESS_RUNNER) go test ./... -count=1

# Exercise current SDK/CLI request auth against actual aweb/AWID/PG/Redis.

test-cli-auth-v2:

cd server && UV_CACHE_DIR=/tmp/uv-cache uv sync --frozen

cd server && PYTHONPATH=tests UV_CACHE_DIR=/tmp/uv-cache UV_OFFLINE=1 PYTHONPYCACHEPREFIX=/tmp/pycache $(TEST_EGRESS_RUNNER) uv run --offline --no-sync pytest -q ../cli/tests/test_request_auth_v2_stack.py

# The Node suites have separate lockfiles and a local file: dependency from the

# host adapters to channel-core. Install all three before any Node test target

# so both `make test` and focused Node targets work from a clean checkout.

test-node-deps:

cd channel-core && npm ci --no-audit --no-fund

cd channel && npm ci --no-audit --no-fund

cd pi-extension && npm ci --no-audit --no-fund

test-channel test-channel-core test-pi-extension test-wake-channel-core-bundle: test-node-deps

# aw wake embeds a committed channel-core build; it must match the source that

# the channel plugin and pi extension ship. The self-test proves it can fail.

test-wake-channel-core-bundle:

bash scripts/check-wake-channel-core-bundle.sh

bash scripts/check-wake-channel-core-bundle.sh --self-test

test-channel:

cd channel && $(TEST_EGRESS_RUNNER) npm test

test-channel-name-live-contract:

python3 scripts/e2e/test_channel_name_live_contract.py

# channel/package.json excludes test/integration.test.ts from `npm test`, so

# `make test` never ran the one test that drives Channel against a REAL aweb

# server. It was green by absence: the first time it ran it failed on a stale

# assertion that contradicted shipped acknowledgement behaviour. It needs Docker

# and Postgres, so it belongs with the other real-stack journeys rather than in

# `make test` - but it belongs somewhere, and this is somewhere.

# Deliberately NO AWEB_SKEW_DIRECTION. With a direction set the journey emits a

# skew observation, which requires the five exact-server inputs (wheel, wheel

# sha, version, constraints, constraints sha); ship supplies none of them, so a

# clean run would die on "skew observation lacks server runtime inventory"

# rather than exercise the journey. Ship builds the server from source and this

# target exercises Channel against THAT. Measuring against a PUBLISHED server is

# the skew harness's job, with the exact artifacts it resolves itself.

test-channel-integration:

cd channel && npm run test:integration

# channel-core holds the identity, trust, pinstore and signature-decode logic

# that channel and pi-extension are both built from, so its suite gates them.

test-channel-core:

cd channel-core && $(TEST_EGRESS_RUNNER) npm test

# The multi-process DeliveryStore guard spawns 16 real subprocesses, enough to

# blow unrelated timing deadlines elsewhere on a shared machine (default-aadj),

# and it leaks all 16 if its parent dies mid-run (default-aaod). So it is kept

# off `make test`, which agents run constantly and interrupt freely, and runs

# from the release path instead.

test-channel-core-process-guard:

cd channel-core && npm run test:process-guard

test-pi-extension:

cd pi-extension && $(TEST_EGRESS_RUNNER) npm test

prepare-oats-test-root:

@if [ "$(abspath $(OATS_TEST_ROOT))" = "$(abspath $(OATS_PINNED_ROOT))" ]; then \

node scripts/prepare-pinned-oats.mjs --pin-file "$(OATS_PIN_FILE)" --target "$(OATS_PINNED_ROOT)"; \

else \

echo "Using explicit OATS_TEST_ROOT override without modifying it: $(OATS_TEST_ROOT)" >&2; \

check-oats-launch-environment-contract: prepare-oats-test-root

@OATS_TEST_ROOT="$(OATS_TEST_ROOT)" node scripts/check-oats-launch-environment-contract.mjs

# Construction always runs. Real Pi execution is explicitly opt-in because it

# consumes network/model tokens; the script reports the omitted layer on stderr.

# Its runtime branch uses a named session on an isolated socket, with the tmux

# guard first on PATH for the entire child process tree.

check-oats-pi-launch-order: prepare-oats-test-root

@PATH="$(CURDIR)/scripts/guard-bin:$$PATH" OATS_TEST_ROOT="$(OATS_TEST_ROOT)" node scripts/check-oats-pi-launch-order.mjs

# The real spawn seam validates both the aweb capability command and its selected

# Pi runtime even with --no-launch. Use only tools built/locked by this checkout;

# ambient developer installs must not decide whether the release test passes.

test-oats: check-oats-launch-environment-contract check-oats-pi-launch-order build test-node-deps

PATH="$(CURDIR)/cli/go:$(CURDIR)/pi-extension/node_modules/.bin:$$PATH" OATS_TEST_ROOT="$(OATS_TEST_ROOT)" node --test oats/test/*.test.mjs

test-oats-proof-helpers: prepare-oats-test-root

OATS_TEST_ROOT="$(OATS_TEST_ROOT)" python3 scripts/e2e/test_oats_pinned_checkout.py

OATS_TEST_ROOT="$(OATS_TEST_ROOT)" python3 scripts/e2e/test_oats_tmux_safety.py

test-tmux-guard:

PATH="$(CURDIR)/scripts/guard-bin:$$PATH" ./scripts/test-migrate-agent-tmux.sh

test-a2a:

cd cli/go && GOCACHE=/tmp/go-build go test ./internal/conformance ./a2a ./a2agw ./awid ./tools/a2a-gateway-check-workspace -count=1

cd cli/go && GOCACHE=/tmp/go-build go test ./cmd/aw ./cmd/aweb-a2a-gw -run A2A -count=1

cd awid && uv run pytest tests/test_a2a_publication_route.py -q

./scripts/check-a2a-copy-guardrails.sh

test-e2e:

python3 scripts/test_controller_key_absence_guard.py

AWEB_TEST_DOCKER_PORTS=1 python3 scripts/test_oss_user_journey.py

./scripts/e2e-oss-user-journey.sh

./scripts/test-e2e-controller-key-absence-guard.sh

test-federation-e2e:

PATH="$(CURDIR)/scripts/guard-bin:$$PATH" ./scripts/e2e-federation-authority.sh

./scripts/e2e-oss-federation.sh

./scripts/e2e-cross-registry-messaging.sh

test-a2a-gateway-e2e:

./scripts/e2e-a2a-gateway-docker.sh

check-a2a-copy-guardrails:

./scripts/check-a2a-copy-guardrails.sh

check-extension-docs:

python3 scripts/check-extension-docs.py

python3 scripts/check-extension-docs.py --self-test

selfhost-up:

cd server && docker compose up --build -d

selfhost-down:

cd server && docker compose down

selfhost-logs:

cd server && docker compose logs -f aweb awid

awid-up:

cd awid && POSTGRES_PASSWORD=$${POSTGRES_PASSWORD:-change-me} docker compose up --build -d

awid-down:

cd awid && POSTGRES_PASSWORD=$${POSTGRES_PASSWORD:-change-me} docker compose down

awid-logs:

cd awid && POSTGRES_PASSWORD=$${POSTGRES_PASSWORD:-change-me} docker compose logs -f awid

# ---- combined e2e stack: awid + aweb + Library, seeded ----------------------

# Requires Docker and sibling ../library + ../blueprints checkouts.

# See docs/e2e-library-stack.md.

e2e-library-stack:

./scripts/e2e-library-stack.sh all

e2e-library-stack-up:

./scripts/e2e-library-stack.sh up

e2e-library-stack-seed:

./scripts/e2e-library-stack.sh seed

e2e-library-stack-down:

./scripts/e2e-library-stack.sh down

# ---- awid production DB lifecycle (Neon) ------------------------------------

# All targets default to ./.env.awid-production. Override with ENV_FILE=...

# Override the dump destination with DUMP=... where applicable.

AWID_PROD_ENV_FILE ?= $(CURDIR)/.env.awid-production

awid-prod-verify:

cd awid && uv run python scripts/prod_db_reset.py verify --env-file $(AWID_PROD_ENV_FILE)

awid-prod-dump:

cd awid && uv run python scripts/prod_db_reset.py dump --env-file $(AWID_PROD_ENV_FILE) $(if $(DUMP),--output $(DUMP),)

awid-prod-restore:

@test -n "$(DUMP)" || (echo "DUMP=path/to/dump.sql is required"; exit 1)

cd awid && uv run python scripts/prod_db_reset.py restore --env-file $(AWID_PROD_ENV_FILE) --dump $(DUMP)

awid-prod-migrate:

cd awid && uv run python scripts/prod_db_reset.py migrate --env-file $(AWID_PROD_ENV_FILE)

# ── Release-shaped local-gate checks ────────────────────────────────

# Publishers are thin tag workflows. Their expensive suites and release-shaped

# builds run once in the complete local candidate gate.

# Deterministic, no network, no toolchain: it reads two checked-in files and compares

# them. Safe to run anywhere, which is why it is a target rather than only a release step.

check-aw-commit-repo-stamp:

./scripts/check-aw-commit-repo-stamp.sh

# goreleaser runs `go mod tidy` as a before hook, and hooks run AFTER its git-state

# validation - so an untidy manifest passes validation, the hook then rewrites go.mod

# and go.sum, and the build stamps vcs.modified=true on a tree goreleaser has already

# called clean. `-diff` asks the same question without writing: a gate that repaired

# the manifest would erase the condition it exists to report.

# This is the first target in `test:` to touch the Go module cache, so a module-resolution or

# network failure surfaces here rather than in test-cli - the message will name the tidy check

# for a problem that is not the tidy check's.

check-cli-go-tidy:

cd cli/go && go mod tidy -diff

# Reproduce GoReleaser's derived repository and pre-build dist/metadata.json,

# then inspect the complete two-product, six-platform artifact matrix. This also

# proves an unrelated unignored file still produces vcs.modified=true.

check-cli-release-vcs-stamps:

./scripts/check-cli-release-vcs-stamps.sh

check-server-locked-suite:

cd server && UV_CACHE_DIR=/tmp/uv-cache uv sync --frozen

cd server && uv lock --check

cd server && UV_CACHE_DIR=/tmp/uv-cache PYTHONPYCACHEPREFIX=/tmp/pycache $(TEST_EGRESS_RUNNER) uv run --offline --no-sync pytest -q

check-awid-locked-suite:

cd awid && UV_CACHE_DIR=/tmp/uv-cache uv sync --frozen

cd awid && uv lock --check

cd awid && UV_CACHE_DIR=/tmp/uv-cache PYTHONPYCACHEPREFIX=/tmp/pycache $(TEST_EGRESS_RUNNER) uv run --offline --no-sync pytest -q

# ── awid.ai static-site deployment ─────────────────────────────────

# Infrastructure acceptance for changes to the entry point (real Docker).

.PHONY: test-naapp-e2e

test-naapp-e2e:

$(MAKE) -C cli/go build

uv run --no-project python scripts/test_naapp_e2e.py

test-candidate-ledger:

bash scripts/candidate-docker-gate.sh --check-disk

$(MAKE) test-naapp-e2e

python3 scripts/test_candidate_make_environment.py

python3 scripts/test_candidate_gate_ledger.py

_candidate-unit-suites:

python3 scripts/test-egress/docker.py --evidence "$$CANDIDATE_LOG_DIR/test-egress" --command bash scripts/candidate-suite.sh --isolated-suites

# The gate's own ledger test runs first, on the host, so a gate change that

# breaks it stops every train and release candidate before any stage runs.

candidate-gate: test-candidate-ledger

bash scripts/candidate-docker-gate.sh

release-candidate: test-candidate-ledger

@test -n "$(TAGS)" || (echo "TAGS='server-vX.Y.Z ...' is required" >&2; exit 2)

python3 scripts/release_candidate.py $(if $(filter 1,$(STAGE_AW_FINAL)),--stage-aw-final,) $(TAGS)

release-publish:

@test -n "$(TAG)" || (echo "TAG=<artifact-vX.Y.Z> is required" >&2; exit 2)

python3 scripts/publish_release.py "$(TAG)"

deploy-site: verify-site

@set -eu; \

test -z "$$(git status --porcelain)" || { echo "Refusing to deploy a dirty checkout" >&2; exit 1; }; \

git fetch origin main "$(SITE_DEPLOY_BRANCH)"; \

source_sha=$$(git rev-parse HEAD); \

main_sha=$$(git rev-parse origin/main); \

test "$$source_sha" = "$$main_sha" || { echo "Refusing to deploy $$source_sha: origin/main is $$main_sha" >&2; exit 1; }; \

deployed_sha=$$(git rev-parse "origin/$(SITE_DEPLOY_BRANCH)"); \

git merge-base --is-ancestor "$$deployed_sha" "$$source_sha" || { echo "Refusing non-fast-forward site deployment: $(SITE_DEPLOY_BRANCH) is $$deployed_sha" >&2; exit 1; }; \

git push origin "$$source_sha:refs/heads/$(SITE_DEPLOY_BRANCH)"; \

observed_sha=$$(git ls-remote --heads origin "refs/heads/$(SITE_DEPLOY_BRANCH)" | awk '{print $$1}'); \

test "$$observed_sha" = "$$source_sha" || { echo "Deployment ref read-back mismatch: expected $$source_sha, observed $${observed_sha:-missing}" >&2; exit 1; }; \

echo "Advanced $(SITE_DEPLOY_BRANCH) to $$source_sha; verify the Render deploy and https://awid.ai"

test-npm-exact-publish:

bash scripts/e2e/test_npm_exact_publish.sh

test-pypi-exact-publish:

bash scripts/e2e/test_pypi_exact_publish.sh

test-oci-exact-publish:

bash scripts/e2e/test_oci_exact_publish.sh

test-release-cli-version:

bash scripts/check-cli-release-version-test.sh

# ── Unified release ──────────────────────────────────────────────────

# Internal steps consumed only by the complete local candidate map.

_candidate-gate-docker-boundaries:

@test -n "$(CANDIDATE_GATE_IMAGE)" || (echo "CANDIDATE_GATE_IMAGE is required"; exit 2)

python3 scripts/e2e/test_candidate_gate_docker_boundaries.py --image "$(CANDIDATE_GATE_IMAGE)"

_candidate-channel-version:

@test "$(CHANNEL_VERSION)" = "$(CHANNEL_PLUGIN_VERSION)" || \

(echo "channel package.json != plugin.json"; exit 1)

_candidate-node-deps:

cd channel-core && npm ci --no-audit --no-fund

cd channel && npm ci --no-audit --no-fund

cd pi-extension && npm ci --no-audit --no-fund

_candidate-unit-channel:

cd channel && $(TEST_EGRESS_RUNNER) npm test

_candidate-unit-channel-core:

cd channel-core && $(TEST_EGRESS_RUNNER) npm test

_candidate-unit-pi:

cd pi-extension && $(TEST_EGRESS_RUNNER) npm test

_candidate-oats: check-oats-launch-environment-contract check-oats-pi-launch-order

PATH="$(CURDIR)/cli/go:$(CURDIR)/pi-extension/node_modules/.bin:$$PATH" OATS_TEST_ROOT="$(OATS_TEST_ROOT)" node --test oats/test/*.test.mjs

_candidate-oats-proof-helpers:

OATS_TEST_ROOT="$(OATS_TEST_ROOT)" python3 scripts/e2e/test_oats_pinned_checkout.py

OATS_TEST_ROOT="$(OATS_TEST_ROOT)" python3 scripts/e2e/test_oats_tmux_safety.py

_candidate-artifact-server:

rm -rf server/dist

cd server && uv build

test -f server/dist/aweb-$(SERVER_VERSION).tar.gz

test -f server/dist/aweb-$(SERVER_VERSION)-py3-none-any.whl

_candidate-artifact-awid-package:

rm -rf awid/dist

cd awid && uv build

test -f awid/dist/awid_service-$(AWID_VERSION).tar.gz

test -f awid/dist/awid_service-$(AWID_VERSION)-py3-none-any.whl

_candidate-artifact-naapp-package: check-naapp-lib-package

rm -rf naapp-lib/dist

cd naapp-lib && uv build

test -f naapp-lib/dist/aweb_naapp-$(NAAPP_LIB_VERSION).tar.gz

test -f naapp-lib/dist/aweb_naapp-$(NAAPP_LIB_VERSION)-py3-none-any.whl

rm -rf naapp-lib/testing/dist

cd naapp-lib/testing && uv build

test -f naapp-lib/testing/dist/aweb_naapp_testing-$(NAAPP_LIB_VERSION).tar.gz

test -f naapp-lib/testing/dist/aweb_naapp_testing-$(NAAPP_LIB_VERSION)-py3-none-any.whl

# aweb-naapp's and aweb-naapp-testing's release artifacts as a consumer sees them:

# each wheel ships its package files, pins its dependencies, and installs and

# imports in a fresh environment.

check-naapp-lib-package:

python3 scripts/check-naapp-lib-package.py

_candidate-artifact-awid-image: