validate-stack.yml

name: Repo Validation

on:
  push:
    branches:
      - main
  pull_request:

concurrency:
  group: repo-validation-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  release_audit:
    name: Repo Validation
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

      - name: Check repo-local KAG index family
        uses: 8Dionysus/aoa-kag/.github/actions/repo-local-kag-index@14ee1e33e43749d23c557b3ef526eca7edb36196
        with:
          history-ref: ${{ github.event.pull_request.base.sha || (github.ref == 'refs/heads/main' && github.event.before) || '' }}
          event-history-ref: ${{ github.event.pull_request.base.sha || (github.ref == 'refs/heads/main' && github.event.before) || '' }}

      - name: Checkout canonical aoa-sdk outside the source tree
        run: |
          git init "$RUNNER_TEMP/aoa-sdk-source"
          git -C "$RUNNER_TEMP/aoa-sdk-source" remote add origin https://github.com/8Dionysus/aoa-sdk
          git -C "$RUNNER_TEMP/aoa-sdk-source" fetch --depth 1 origin 9540358c9443c2b7ef78dd9d1d8a0bc7b50ef240
          git -C "$RUNNER_TEMP/aoa-sdk-source" checkout --detach FETCH_HEAD

      - name: Checkout canonical aoa-agents outside the source tree
        run: |
          git init "$RUNNER_TEMP/aoa-agents-source"
          git -C "$RUNNER_TEMP/aoa-agents-source" remote add origin https://github.com/8Dionysus/aoa-agents
          git -C "$RUNNER_TEMP/aoa-agents-source" fetch --depth 1 origin 5f3936e4bfd67ad33ea608a7d1d1b71a2092da79
          git -C "$RUNNER_TEMP/aoa-agents-source" checkout --detach FETCH_HEAD

      - name: Checkout canonical aoa-skills outside the source tree
        run: |
          git init "$RUNNER_TEMP/aoa-skills-source"
          git -C "$RUNNER_TEMP/aoa-skills-source" remote add origin https://github.com/8Dionysus/aoa-skills
          git -C "$RUNNER_TEMP/aoa-skills-source" fetch --depth 1 origin 909e59f9d168077d9dc3656bb5afbeb66bfa9c6b
          git -C "$RUNNER_TEMP/aoa-skills-source" checkout --detach FETCH_HEAD

      - name: Clone abyss-machine verifier
        run: git clone --depth 1 https://github.com/8Dionysus/abyss-machine "$RUNNER_TEMP/abyss-machine-verifier"

      - name: Checkout aoa-stats contract owner
        run: |
          git init "$RUNNER_TEMP/aoa-stats-validator"
          git -C "$RUNNER_TEMP/aoa-stats-validator" remote add origin https://github.com/8Dionysus/aoa-stats
          git -C "$RUNNER_TEMP/aoa-stats-validator" fetch --depth 1 origin 85a686a8d6bbcb1b28e8f26ab3d92f946bf8152f
          git -C "$RUNNER_TEMP/aoa-stats-validator" checkout --detach FETCH_HEAD

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
        with:
          python-version: "3.12"

      - name: Install test dependencies
        run: |
          # The repo-local KAG action runs before setup-python and may satisfy
          # packages from the runner user site. Reinstall into this interpreter
          # because governed subprocesses intentionally use -s/-I.
          python -m pip install --ignore-installed -r requirements-dev.txt
          python -m pip install "$RUNNER_TEMP/aoa-sdk-source"
          python -I -c "import aoa_sdk, jsonschema, pydantic, yaml"

      - name: Install bubblewrap, ripgrep, shellcheck, rsync, zsh, podman and podman-compose
        run: |
          sudo apt-get update
          sudo apt-get install -y bubblewrap ripgrep shellcheck rsync zsh podman podman-compose
          # Ubuntu hosted runners restrict unprivileged user namespaces through
          # AppArmor. Keep bubblewrap unprivileged and enable that kernel path
          # only for this disposable CI machine rather than using setuid mode.
          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0

      - name: Run release audit including routing canary contract
        env:
          ABYSS_MACHINE_REPO_ROOT: ${{ runner.temp }}/abyss-machine-verifier
          AOA_AGENTS_SOURCE_ROOT: ${{ runner.temp }}/aoa-agents-source
          AOA_SDK_SOURCE_ROOT: ${{ runner.temp }}/aoa-sdk-source
          AOA_SKILLS_SOURCE_ROOT: ${{ runner.temp }}/aoa-skills-source
          AOA_STATS_ROOT: ${{ runner.temp }}/aoa-stats-validator
          PYTHONPATH: ${{ runner.temp }}/aoa-sdk-source/src
          TMPDIR: ${{ runner.temp }}
        run: python scripts/ci_gate.py --mode release

      - name: Shellcheck scripts
        run: python scripts/ci_gate.py --mode shellcheck

      - name: Compile governed external-agent bridges
        run: >-
          python -m py_compile
          scripts/aoa-agent-os-runtime
          mechanics/governed-execution/parts/agent-os-adapter/aoa_agent_os_runtime.py
          scripts/aoa-external-codex-agent
          scripts/aoa-external-actor-bind
          scripts/aoa-external-codex-incarnation
          scripts/aoa-external-codex-stasis
          mechanics/governed-execution/parts/external-codex-agent/bind_external_actor_launch.py
          mechanics/governed-execution/parts/external-codex-agent/external_codex_agent.py
          mechanics/governed-execution/parts/external-codex-agent/external_codex_responsibility_movement.py
          mechanics/governed-execution/parts/external-codex-agent/external_codex_supervisor.py
          mechanics/governed-execution/parts/external-codex-agent/prepare_landing_study.py
          mechanics/governed-execution/parts/external-codex-agent/visible_incarnation_home.py

      - name: Rehearse bootstrap flow
        run: |
          export AOA_STACK_ROOT="$RUNNER_TEMP/abyss-stack"
          export AOA_CONFIGS_ROOT="$AOA_STACK_ROOT/Configs"
          export AOA_VAULT_ROOT="$RUNNER_TEMP/abyss-vault"
          mkdir -p "$AOA_VAULT_ROOT"

          scripts/aoa-first-run --strict

          cp env/stack.env.example "$AOA_STACK_ROOT/Secrets/Configs/stack.env"
          ln -sfn "$AOA_STACK_ROOT/Secrets/Configs/stack.env" "$AOA_STACK_ROOT/Configs/stack.env"
          cp env/langchain-api.env.example "$AOA_STACK_ROOT/Secrets/Configs/langchain-api.env"
          printf '%s\n' 'CI_ONLY_OVMS_API_KEY_0123456789012345678901234567890123456789' > "$AOA_STACK_ROOT/Secrets/Configs/ovms_api_key.txt"
          chmod 600 \
            "$AOA_STACK_ROOT/Secrets/Configs/stack.env" \
            "$AOA_STACK_ROOT/Secrets/Configs/langchain-api.env" \
            "$AOA_STACK_ROOT/Secrets/Configs/ovms_api_key.txt"
          scripts/aoa-install-systemd --provision-ovms-auth

          scripts/aoa-check-layout --strict --profile substrate
          scripts/aoa-check-layout --strict --profile workflows
          scripts/aoa-check-layout --strict --profile local-worker
          scripts/aoa-check-layout --strict --profile intel-worker
          scripts/aoa-check-layout --strict --profile fallback-gateway
          scripts/aoa-check-layout --strict --profile core
          scripts/aoa-check-layout --strict --profile agentic
          scripts/aoa-check-layout --strict --profile intel
          scripts/aoa-doctor --preset agent-full
          scripts/aoa-doctor --preset intel-full
          scripts/aoa-preset-profiles --preset agent-full --paths
          scripts/aoa-preset-profiles --preset agent-federation --paths
          scripts/aoa-preset-profiles --preset intel-federation --paths
          scripts/aoa-profile-modules --profile substrate --paths
          scripts/aoa-profile-endpoints --profile substrate
          scripts/aoa-profile-modules --profile workflows --paths
          scripts/aoa-profile-endpoints --profile workflows
          scripts/aoa-profile-modules --profile local-worker --paths
          scripts/aoa-profile-endpoints --profile local-worker
          scripts/aoa-profile-modules --profile intel-worker --paths
          scripts/aoa-profile-endpoints --profile intel-worker
          scripts/aoa-profile-modules --profile fallback-gateway --paths
          scripts/aoa-profile-endpoints --profile fallback-gateway
          scripts/aoa-profile-modules --profile substrate --profile local-worker --paths
          scripts/aoa-profile-endpoints --profile substrate --profile local-worker
          scripts/aoa-profile-modules --profile substrate --profile workflows --paths
          scripts/aoa-profile-endpoints --profile substrate --profile workflows
          scripts/aoa-profile-modules --profile substrate --profile intel-worker --paths
          scripts/aoa-profile-endpoints --profile substrate --profile intel-worker
          scripts/aoa-profile-modules --profile substrate --profile fallback-gateway --paths
          scripts/aoa-profile-endpoints --profile substrate --profile fallback-gateway
          scripts/aoa-profile-modules --profile core --paths
          scripts/aoa-profile-endpoints --profile core
          scripts/aoa-profile-modules --profile agentic --paths
          scripts/aoa-profile-endpoints --profile agentic
          scripts/aoa-profile-modules --profile intel --paths
          scripts/aoa-profile-endpoints --profile intel
          scripts/aoa-profile-endpoints --profile tools
          scripts/aoa-profile-endpoints --profile observability
          scripts/aoa-profile-modules --profile substrate --profile local-worker --profile tools --profile observability --paths
          scripts/aoa-profile-endpoints --profile substrate,local-worker,tools,observability
          scripts/aoa-profile-modules --preset agent-full --paths
          scripts/aoa-profile-endpoints --preset agent-full
          scripts/aoa-profile-modules --preset agent-federation --paths
          scripts/aoa-profile-endpoints --preset agent-federation
          scripts/aoa-profile-modules --preset intel-full --paths
          scripts/aoa-profile-endpoints --preset intel-full
          scripts/aoa-profile-modules --preset intel-federation --paths
          scripts/aoa-profile-endpoints --preset intel-federation
          scripts/aoa-render-services --profile substrate
          scripts/aoa-render-services --profile workflows
          scripts/aoa-render-services --profile local-worker
          scripts/aoa-render-services --profile intel-worker
          scripts/aoa-render-services --profile fallback-gateway
          scripts/aoa-render-services --profile substrate,local-worker
          scripts/aoa-render-services --profile substrate,workflows
          scripts/aoa-render-services --profile substrate,intel-worker
          scripts/aoa-render-services --profile substrate,fallback-gateway
          scripts/aoa-render-services --profile core
          scripts/aoa-render-services --profile agentic
          scripts/aoa-render-services --profile intel
          scripts/aoa-render-services --profile substrate,local-worker,tools,observability
          scripts/aoa-render-services --preset agent-full
          scripts/aoa-render-services --preset agent-federation
          scripts/aoa-render-services --preset intel-full
          scripts/aoa-render-services --preset intel-federation
          scripts/aoa-render-config --profile substrate >/dev/null
          scripts/aoa-render-config --profile workflows >/dev/null
          scripts/aoa-render-config --profile local-worker >/dev/null
          scripts/aoa-render-config --profile intel-worker >/dev/null
          scripts/aoa-render-config --profile fallback-gateway >/dev/null
          scripts/aoa-render-config --profile substrate,local-worker >/dev/null
          scripts/aoa-render-config --profile substrate,workflows >/dev/null
          scripts/aoa-render-config --profile substrate,intel-worker >/dev/null
          scripts/aoa-render-config --profile substrate,fallback-gateway >/dev/null
          scripts/aoa-render-config --profile core >/dev/null
          scripts/aoa-tos-graph --help >/dev/null
          scripts/tos-up --help >/dev/null
          scripts/aoa-kag-runtime-family --help >/dev/null
          python scripts/aoa-rpg-runtime-projection --stack-root "$AOA_STACK_ROOT" --check
          python scripts/aoa-rpg-runtime-projection --stack-root "$AOA_STACK_ROOT"
          scripts/aoa-render-config --profile substrate --profile local-worker --write "$RUNNER_TEMP/abyss-local-worker.rendered.yml"
          grep -q "return-policy.yaml" "$RUNNER_TEMP/abyss-local-worker.rendered.yml"
          grep -q "/app/logs/returns" "$RUNNER_TEMP/abyss-local-worker.rendered.yml"
          test -f "$AOA_STACK_ROOT/Configs/agent-api/governed-execution-policy.yaml"
          python scripts/aoa-governed-run prepare-request --write "$RUNNER_TEMP/governed-request.json"
          test -s "$RUNNER_TEMP/governed-request.json"
          scripts/aoa-render-config --profile intel >/dev/null
          scripts/aoa-render-config --profile substrate,local-worker,tools,observability >/dev/null
          scripts/aoa-render-config --preset agent-full >/dev/null
          scripts/aoa-render-config --preset agent-federation >/dev/null
          scripts/aoa-render-config --preset intel-full >/dev/null
          scripts/aoa-render-config --preset intel-federation >/dev/null
          scripts/aoa-render-config --profile substrate,local-worker,tools,observability --write "$RUNNER_TEMP/abyss-combined.rendered.yml"
          test -s "$RUNNER_TEMP/abyss-combined.rendered.yml"

      - name: Rehearse extra compose overlay flow
        run: |
          export AOA_STACK_ROOT="$RUNNER_TEMP/abyss-stack-overlay"
          export AOA_CONFIGS_ROOT="$AOA_STACK_ROOT/Configs"
          export AOA_VAULT_ROOT="$RUNNER_TEMP/abyss-vault-overlay"
          mkdir -p "$AOA_VAULT_ROOT"

          scripts/aoa-first-run --strict
          cp env/stack.env.example "$AOA_STACK_ROOT/Secrets/Configs/stack.env"
          ln -sfn "$AOA_STACK_ROOT/Secrets/Configs/stack.env" "$AOA_STACK_ROOT/Configs/stack.env"
          cp env/langchain-api.env.example "$AOA_STACK_ROOT/Secrets/Configs/langchain-api.env"
          printf '%s\n' 'CI_ONLY_OVMS_API_KEY_0123456789012345678901234567890123456789' > "$AOA_STACK_ROOT/Secrets/Configs/ovms_api_key.txt"
          chmod 600 \
            "$AOA_STACK_ROOT/Secrets/Configs/stack.env" \
            "$AOA_STACK_ROOT/Secrets/Configs/langchain-api.env" \
            "$AOA_STACK_ROOT/Secrets/Configs/ovms_api_key.txt"
          scripts/aoa-install-systemd --provision-ovms-auth

          export AOA_EXTRA_COMPOSE_FILES="compose/tuning/llamacpp.cpu.yml"
          scripts/aoa-render-config --profile substrate --profile local-worker >/dev/null

          printf 'GGUFTEST' > "$RUNNER_TEMP/qwen3.5-9b.gguf"
          export AOA_LLAMACPP_MODEL_HOST_PATH="$RUNNER_TEMP/qwen3.5-9b.gguf"
          export AOA_EXTRA_COMPOSE_FILES="compose/modules/32-llamacpp-inference.yml,compose/modules/44-llamacpp-agent-sidecar.yml"
          scripts/aoa-render-config --preset intel-full >/dev/null

      - name: Capture host-facts artifacts
        run: |
          mkdir -p "$RUNNER_TEMP/host-facts"

          scripts/aoa-host-facts --mode public --write "$RUNNER_TEMP/host-facts/reference-host.public.json"
          scripts/aoa-host-facts --mode private --write "$RUNNER_TEMP/host-facts/latest.private.json"

          python - \
            "$RUNNER_TEMP/host-facts/reference-host.public.json" \
            "$RUNNER_TEMP/host-facts/latest.private.json" <<'PY'
          import json
          import sys
          from pathlib import Path

          public = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
          private = json.loads(Path(sys.argv[2]).read_text(encoding="utf-8"))

          assert public["artifact_kind"] == "aoa.host-facts"
          assert public["capture_mode"] == "public"
          assert public["captured_by"] == "scripts/aoa-host-facts"
          assert private["artifact_kind"] == "aoa.host-facts"
          assert private["capture_mode"] == "private"
          assert private["captured_by"] == "scripts/aoa-host-facts"
          PY

  validate-windows-host-bridge:
    runs-on: windows-latest

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
        with:
          python-version: "3.12"

      - name: Install validation dependencies
        shell: pwsh
        run: python -m pip install PyYAML jsonschema

      - name: Validate stack structure
        shell: pwsh
        run: python scripts/validate_stack.py

      - name: Parse PowerShell bridge scripts
        shell: pwsh
        run: |
          $files = @(
            "scripts/aoa.ps1",
            "scripts/aoa-doctor-win.ps1",
            "scripts/aoa-bootstrap-wsl.ps1",
            "mechanics/machine-fit/parts/windows-bridge/aoa_windows_bridge.ps1",
            "mechanics/machine-fit/parts/windows-bridge/aoa_doctor_win.ps1",
            "mechanics/machine-fit/parts/windows-bridge/aoa_bootstrap_wsl.ps1"
          )

          foreach ($file in $files) {
            $tokens = $null
            $parseErrors = $null
            $resolvedPath = (Resolve-Path $file).Path

            [void][System.Management.Automation.Language.Parser]::ParseFile(
              $resolvedPath,
              [ref]$tokens,
              [ref]$parseErrors
            )

            $errorList = @($parseErrors)
            if ($errorList.Count -gt 0) {
              $errorList | ForEach-Object {
                Write-Error ("{0}: {1}" -f $file, $_.Message)
              }
              exit 1
            }
          }