Makefile

# Root Makefile — one entry point for both Go services.
#
# Contributors: `make test` runs every Go test in the repo. `make vet` is
# the same for static checks. Per the 2026-06-10 audit (DEVE-6 / DOCS-8):
# keep CI and local on the same targets. CI jobs use the per-service
# targets below to preserve parallel jobs and failure isolation.

.PHONY: test test-coordinator test-coordinator-billing-race test-coordinator test-coordinator-race-integration test-gateway test-integration test-dist test-relay-blind-parity \
        test-dist-catalog test-dist-python test-dist-release test-dist-deploy \
        test-byom-e2e test-byom-discovery-journey test-openai-wire test-local-chat-app-core \
        vet vet-coordinator vet-gateway \
        lint-coordinator \
        build-linux check check-exceptions fmt fmt-check verify-autotune-catalog

test: test-coordinator test-coordinator-billing-race test-gateway test-integration test-dist

# Opt-in Studio acceptance. The script requires a verified host, exclusive
# provider window and isolated no-join provider PID; it is not part of CI.
test-local-chat-app-core:
	bash scripts/test-local-chat-app-core.sh

# BYOM CLI onboarding process E2E. This is MANUAL macOS release evidence, not
# part of `make test` / required PR coverage: it builds the Swift macprovider-cli
# and drives the provider-visible offer/status/catalog-economics/withdraw path
# against a hermetic loopback fake coordinator. Run on macOS before promoting a
# BYOM-affecting provider CLI/app release. See test/e2e/byom/README.md.
test-byom-e2e:
	test/e2e/byom/run-cli-onboarding-e2e.py

test-openai-wire:
	bash scripts/test-openai-wire-compat.sh

# Hermetic JOURNEY-PROVIDER-BYOM-DISCOVERY gate (#1453 slice 1). Runs the
# ten-step discovery-journey driver, then capture. While SPEC-046-R001..R008
# are pending, it also builds and preflights an unsigned payload. After signed
# promotion it validates the landed envelope instead of attempting a second
# promotion. Signing stays an operator step. See
# docs/runbooks/byom-journey-evidence.md.
test-byom-discovery-journey:
	bash scripts/test-byom-discovery-journey.sh

verify-autotune-catalog:
	python3 scripts/catalog-release.py verify

# Required gate: native speed, no race detector. Race-detector runs are
# advisory (test-coordinator-race, test-coordinator-billing-race): their
# timing-sensitive failures are reported and fixed in batches, never block a
# merge (#1996).
test-coordinator:
	cd phase4-coordinator && go test -timeout 30m ./...

# Advisory: every package except billing under the race detector.
test-coordinator-race:
	cd phase4-coordinator && go test -race -timeout 30m $$(go list ./... | grep -v '/internal/billing$$')

# -race turns on checkptr everywhere; in the transpiled modernc SQLite C
# code it was over half of billing's runtime (query planning). The race
# detector itself still instruments every package, modernc included.
# -timeout stays below the CI job's 26 minutes so a hang still dumps stacks.
test-coordinator-billing-race:
	cd phase4-coordinator && go test -race -gcflags='modernc.org/...=-d=checkptr=0' -timeout 24m ./internal/billing

# SPEC-017 Step 1 and provider-onboarding Postgres integration tests.
# Tagged with `integration` so
# `make test-coordinator` does NOT require a Docker daemon.
# CI runs this as a separate job that provides the daemon.
# Each stats case owns an isolated Postgres container; keep the package
# deadline above the observed hosted-runner setup/teardown envelope.
test-coordinator-integration:
	cd phase4-coordinator && go test -tags=integration -timeout 10m ./internal/stats/... ./internal/onboarding/... ./internal/rewards/... ./cmd/coordinator/...

# SPEC-017 AC-16 — golangci-lint with depguard + forbidigo.
# Pinned version so the target is hermetic on a fresh checkout.
lint-coordinator:
	@command -v golangci-lint >/dev/null 2>&1 || { \
		echo "golangci-lint not found; install: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2"; \
		exit 1; \
	}
	cd phase4-coordinator && golangci-lint run --config=.golangci.yml ./...

test-gateway:
	cd phase5-gateway && go test ./...

# Cross-service integration harness (M2-9 / M3-11 / TEST-6 close-out).
# Builds the coordinator + gateway binaries and drives the real
# gateway↔coordinator boundary; the within-gateway integration_test.go
# mocks the coordinator via httptest, so this is the only suite that
# can catch a regression in the sticky-header forwarding contract or
# the M3-2 internalBearerAuthorized dual-credential gate.
test-integration:
	cd test/integration && go test -race -count=1 -timeout 5m ./...

# Deploy-tooling tests (bash + python3, no Go build). Guards the fail-closed
# pre-deploy gate in phase4-coordinator/dist/check-deploy-config.sh — notably
# that an env:NAME-indirected secret is deferred to runtime rather than
# false-failing the gate (the 2026-06-17 regression that forced SKIP_C2_CHECK=1).
# Deploy/release tooling tests (bash + python3 + node, no service build), split
# into shards CI runs in parallel with fail-fast off so each reports its own
# failures (#1920). `make test-dist` is the union for local use. Guards the
# fail-closed pre-deploy gate in phase4-coordinator/dist/check-deploy-config.sh,
# among others. check_nginx_stats_test.sh is not here: CI runs it in its own
# docker-backed job (coordinator-nginx-integration).
TEST_DIST_SHARDS := catalog python release deploy

test-dist: $(addprefix test-dist-,$(TEST_DIST_SHARDS))

# Catalog and autotune content release (the single slowest suite).
test-dist-catalog:
	python3 scripts/decode_path_digest.py --check
	bash scripts/test-catalog-content-release.sh
	bash -n scripts/catalog-content-release.sh
	bash -n scripts/lib/catalog-canary-token.sh
	bash phase3-binary/dist/test/check_baked_static_feed_sync.test.sh
	bash scripts/test-catalog-release.sh
	python3 scripts/catalog-pricing-preflight.py
	bash scripts/test-autotune-gate-matrix.sh

# Every scripts/tests/test_*.py module via discovery, the ops Python suites,
# and the check that no test file is left unwired.
test-dist-python:
	python3 scripts/check-test-wiring.py
	PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s scripts/tests -t . -p 'test_*.py'
	PYTHONDONTWRITEBYTECODE=1 python3 -m unittest -v ops/pearl-updater/test_pearl_updater.py
	PYTHONDONTWRITEBYTECODE=1 python3 -m unittest -v ops/pearl-updater/test_tier2_enforcement_watchdog.py
	PYTHONDONTWRITEBYTECODE=1 python3 -m unittest -v ops/pearl/config/test_pearl_config_reconcile.py
	PYTHONDONTWRITEBYTECODE=1 python3 test/e2e/aead-rekey-oneshot/test_aead_rekey_oneshot.py

# Release, discovery, signed-journey workflow, alarm, Tier-2 and ops tooling.
test-dist-release:
	bash scripts/test-openai-wire-compat.sh
	node --test phase3-binary/app/Tests/MalibuTests/payout-signer-chain.test.mjs
	node --test scripts/tests/test_malibu_qwen_system.mjs
	bash scripts/test-production-exceptions.sh
	bash phase5-gateway/dist/test/gateway_deploy_inflight.test.sh
	bash test/e2e-1690/tools/no-credential-argv.test.sh
	bash scripts/test-coordinator-advertised-version-test.sh
	bash scripts/test-cli-se-entitlements.sh
	bash scripts/test-malibu-independent-release.sh
	bash scripts/test-release-tag-target.sh
	bash scripts/test-pearl-runtime-release.sh
	bash scripts/test-live-coordinator-release-gate.sh
	bash scripts/test-release-security-posture.sh
	bash scripts/test-h1-undercredit-probe.sh
	bash scripts/test-malibu-bootstrap-bridge.sh
	bash scripts/test-recover-malibu-publication.sh
	bash scripts/test-acceptance-candidate-security.sh
	bash scripts/test-swift-package-lock.sh
	bash scripts/test-signed-payout-journey-workflow.sh
	bash scripts/test-signed-provider-prebeta-journey-workflow.sh
	bash scripts/test-signed-byom-discovery-journey-workflow.sh
	bash scripts/test-signed-network-model-admission-journey-workflow.sh
	bash scripts/test-signed-buyer-paid-path-journey-workflow.sh
	bash scripts/test-signed-buyer-crash-recovery-journey-workflow.sh
	bash scripts/test-signed-buyer-enforce-journey-workflow.sh
	bash scripts/test-signed-local-consumer-endpoint-journey-workflow.sh
	bash scripts/test-signed-trusted-pool-creator-mvp-journey-workflow.sh
	bash scripts/test-signed-trusted-pool-layer2-journey-workflow.sh
	bash scripts/test-signed-trusted-pool-external-runtime-journey-workflow.sh
	bash scripts/test-signed-trusted-pool-model-journey-workflow.sh
	bash scripts/test-signed-privacy-class-beta-journey-workflow.sh
	bash scripts/test-signed-pool-promotion-transition-workflow.sh
	bash scripts/test-spec043-production-release-key-provision.sh
	bash scripts/test-acceptance-candidate-metadata.sh
	bash scripts/test-acceptance-promotion.sh
	bash scripts/test-release-toolchain.sh
	bash scripts/test-release-publication-provenance.sh
	bash scripts/test-compatibility-set-manifest.sh
	bash scripts/test-compatibility-artifact-index.sh
	bash scripts/test-agent-onboarding-skill.sh
	bash scripts/test-agent-onboarding-publication.sh
	bash scripts/test-release-discovery-head.sh
	bash scripts/test-release-discovery-transport.sh
	bash scripts/test-select-public-discovery-transport.sh
	bash scripts/test-resolve-discovery-renewal-target.sh
	bash scripts/test-select-discovery-renewal-base.sh
	bash scripts/test-renew-release-discovery-head.sh
	bash scripts/test-ops-alarm.sh
	bash -n scripts/renew-autotune-static-feed.sh
	bash scripts/test-renew-autotune-static-feed.sh
	bash scripts/test-autotune-activate.sh
	bash scripts/test-autotune-install-helpers.sh
	bash -n scripts/lib/autotune-activate.sh
	bash scripts/test-tier2-provider-artifact.sh
	bash scripts/test-tier2-provider-release.sh
	bash scripts/test-mlx-metallib-kernels.sh
	bash scripts/test-tier2-activation-safety.sh
	bash scripts/test-tier2-attestation-safety.sh
	bash scripts/test-tier2-behavioral-safety.sh
	bash scripts/test-tier2-encrypted-leg-safety.sh
	bash scripts/test-tier2-live-verifier.sh
	bash scripts/test-tier2-mda-artifact.sh
	bash scripts/test-tier2-enforcement-safety.sh
	bash ops/pearl-updater/test_transaction_gate_systemd.sh
	node --test test/e2e/canary-buyer/probe.test.mjs test/e2e/canary-buyer/safety.test.mjs
	node --test frontdoor/provider-portal/mining-health.test.mjs
	bash test/e2e/canary-buyer/run-canary.test.sh
	bash scripts/test-relay-blind-parity.sh
	bash scripts/ops/test-ops-guard.sh
	bash scripts/ops/test-live-lock.sh
	bash scripts/ops/test-runbook-commands.sh
	bash scripts/ops/test-entrypoints.sh
	bash scripts/ops/test-canary-swap.sh
	bash scripts/ops/test-studio-owner-pin.sh
	bash scripts/ops/test-studio-owner-pin-provenance.sh
	bash scripts/ops/test-studio-lab-window-controller.sh

# Installer, watchdog, and coordinator/gateway deploy scripts.
test-dist-deploy:
	bash scripts/test-install-sh-consumer-health-alarm.sh
	bash phase3-binary/dist/test/install_python3_clt_guard.test.sh
	bash phase3-binary/dist/test/install_1286_fresh_mac_e2e.test.sh
	bash phase3-binary/dist/test/install_config_path_escape.test.sh
	bash phase3-binary/dist/test/install_stapler_validate.test.sh
	bash -n phase4-coordinator/dist/deploy-pearl-vps.sh
	bash -n phase4-coordinator/dist/deploy-malibu-emission-pearl.sh
	bash -n phase4-coordinator/dist/deploy-opoi-v0-pearl.sh
	bash -n phase5-gateway/dist/deploy-pearl-vps.sh
	bash phase4-coordinator/dist/test/check_deploy_config_test.sh
	bash phase4-coordinator/dist/test/c2_timer_config_migration_test.sh
	bash phase4-coordinator/dist/test/autotune_rate_card_config_migration_test.sh
	bash phase4-coordinator/dist/test/coord_deploy_c2_precheck.test.sh
	bash phase4-coordinator/dist/test/check_nginx_receipt_buffers_test.sh
	bash phase4-coordinator/dist/test/check_nginx_api_perf_tuning_test.sh
	bash phase4-coordinator/dist/test/check_nginx_catalog_routes_test.sh
	bash phase4-coordinator/dist/test/check_nginx_mdm_enroll_routes_test.sh
	bash phase4-coordinator/dist/test/check_nginx_model_admission_routes_test.sh
	bash phase4-coordinator/dist/test/check_nginx_referral_routes_test.sh
	bash phase4-coordinator/dist/test/check_stats_inventory_deploy_test.sh
	bash phase4-coordinator/dist/test/check_stats_billing_mirror_deploy_test.sh
	bash phase4-coordinator/dist/test/coord_deploy_config_mode_test.sh
	bash phase4-coordinator/dist/test/coordinator_release_tag_guard.test.sh
	bash phase4-coordinator/dist/test/check_deploy_static_feed_access.test.sh
	bash phase4-coordinator/dist/test/deploy_catalog_verifier_closure.test.sh
	bash phase4-coordinator/dist/test/deploy_catalog_compare_live.test.sh
	bash phase4-coordinator/dist/test/deploy_catalog_window_coverage.test.sh
	bash phase4-coordinator/dist/test/coord_deploy_restart_readiness.test.sh
	bash phase4-coordinator/dist/test/coordinator_deploy_recovery.test.sh
	bash phase4-coordinator/dist/test/coordinator_pricing_recover.test.sh
	bash phase4-coordinator/dist/test/deploy_pricing_runtime_floor.test.sh
	bash phase4-coordinator/dist/test/deploy_canary_live_catalog_proof.test.sh
	bash phase4-coordinator/dist/test/coordinator_archive_rotate.test.sh
	bash phase4-coordinator/dist/test/coordinator_sqlite_relief.test.sh
	bash phase4-coordinator/dist/test/coord_deploy_smoke_probe.test.sh
	bash phase4-coordinator/dist/test/coord_deploy_drift_redact.test.sh
	bash phase4-coordinator/dist/test/coord_deploy_tier2_migration_gate.test.sh
	bash phase4-coordinator/dist/test/check_monitor_email_mute_test.sh
	bash phase4-coordinator/dist/test/check_monitor_sandbox_test.sh
	bash phase4-coordinator/dist/test/check_pearl_tls_test.sh
	bash phase4-coordinator/dist/test/check_pearl_tcp_test.sh
	SPEC015_NGINX_LIVE_OPTIONAL=$${SPEC015_NGINX_LIVE_OPTIONAL:-1} bash phase4-coordinator/dist/test/check_nginx_receipt_header_live_test.sh
	MACPROVIDER_HTTP2_LIVE_OPTIONAL=$${MACPROVIDER_HTTP2_LIVE_OPTIONAL:-1} bash phase4-coordinator/dist/test/check_nginx_http2_live_test.sh
	bash scripts/test-install-config-token-preserve.sh
	bash scripts/test-install-provider-id-preserve.sh
	bash scripts/test-install-launchd-enable.sh
	bash scripts/test-install-version-pin.sh
	bash scripts/test-publish-release-mirror.sh
	bash scripts/test-install-amfi-retry.sh
	bash scripts/test-install-autotune-recommend-config.sh
	bash phase3-binary/dist/test/install_referral_handoff.test.sh
	bash phase3-binary/dist/test/install_fresh_evidence.test.sh
	bash phase3-binary/dist/test/install_recommend_retry.test.sh
	bash phase3-binary/dist/test/install_upgrade_evidence_rollback.test.sh
	bash phase3-binary/dist/test/install_recovery_bootout_settle.test.sh
	bash phase3-binary/dist/test/install_launchd_migration.test.sh
	bash phase3-binary/dist/test/install_dangling_launchd_repair.test.sh
	bash phase3-binary/dist/test/install_lifecycle_state.test.sh
	bash phase3-binary/dist/test/install_transaction_lock.test.sh
	bash phase3-binary/dist/test/install_coordinator_admission.test.sh
	bash phase3-binary/dist/test/provider_upgrade_transaction.test.sh
	bash phase3-binary/dist/test/install_bundled_repair.test.sh
	bash phase3-binary/dist/test/install_headless_fleet.test.sh
	bash phase3-binary/dist/test/install_port_validation.test.sh
	bash phase3-binary/dist/test/install_coordinator_url.test.sh
	bash phase3-binary/dist/test/install_prefix.test.sh
	bash phase3-binary/dist/test/uninstall_path_safety.test.sh
	bash phase3-binary/dist/test/uninstall_residue.test.sh
	bash scripts/test-watchdog-inline-drift.sh
	bash phase3-binary/dist/test/watchdog_health_scope.test.sh
	bash phase3-binary/dist/test/watchdog_rollback_paths.test.sh
	bash phase3-binary/dist/test/watchdog_supervisor_beacon.test.sh
	bash phase3-binary/dist/test/install_recovery_bootstrap_retry.test.sh
	bash phase3-binary/dist/test/repair_1189_reproduction.test.sh
	bash ops/macprovider-watchdog/Scripts/test-ac-19-20-watchdog-recovery.sh
	bash phase5-gateway/dist/test/gateway_deploy_snapshot.test.sh
	bash phase5-gateway/dist/test/archive_rotate_test.sh

test-relay-blind-parity:
	bash scripts/test-relay-blind-parity.sh

vet: vet-coordinator vet-gateway vet-integration

vet-coordinator:
	cd phase4-coordinator && go vet ./...

vet-gateway:
	cd phase5-gateway && go vet ./...

vet-integration:
	cd test/integration && go vet ./...

build-linux:
	phase4-coordinator/scripts/build-linux.sh
	phase5-gateway/scripts/build-linux.sh

check-exceptions:
	python3 scripts/check-production-exceptions.py validate
	python3 scripts/check-production-exceptions.py report

check: check-exceptions
	phase4-coordinator/dist/check-deploy-config.sh \
		phase4-coordinator/dist/coordinator.yaml \
		phase5-gateway/dist/gateway.yaml

GO_MODULES := phase4-coordinator phase5-gateway phase7-verify test/integration

fmt:
	gofmt -w $(GO_MODULES)

# Fails when gofmt would rewrite any file in a Go module (CI coordinator-lint).
fmt-check:
	@unformatted="$$(gofmt -l $(GO_MODULES))"; \
	if [ -n "$$unformatted" ]; then \
		echo "gofmt would rewrite (run: make fmt):"; echo "$$unformatted"; exit 1; \
	fi