Harden MCP decision and session access planes #550
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Repo Validation | |
| on: | |
| push: | |
| pull_request: | |
| jobs: | |
| release_audit: | |
| name: Repo Validation | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| - name: Set up Python | |
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 | |
| with: | |
| python-version: "3.12" | |
| - name: Install test dependencies | |
| run: python -m pip install -r requirements-dev.txt | |
| - name: Install shellcheck, rsync, podman and podman-compose | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y shellcheck rsync podman podman-compose | |
| - name: Run release audit | |
| run: python scripts/ci_gate.py --mode release | |
| - name: Shellcheck scripts | |
| run: python scripts/ci_gate.py --mode shellcheck | |
| - name: Rehearse bootstrap flow | |
| run: | | |
| export AOA_STACK_ROOT="$RUNNER_TEMP/abyss-stack" | |
| export AOA_CONFIGS_ROOT="$AOA_STACK_ROOT/Configs" | |
| export AOA_VAULT_ROOT="$RUNNER_TEMP/abyss-vault" | |
| mkdir -p "$AOA_VAULT_ROOT" | |
| scripts/aoa-first-run --strict | |
| cp env/stack.env.example "$AOA_STACK_ROOT/Secrets/Configs/stack.env" | |
| ln -sfn "$AOA_STACK_ROOT/Secrets/Configs/stack.env" "$AOA_STACK_ROOT/Configs/stack.env" | |
| cp env/langchain-api.env.example "$AOA_STACK_ROOT/Secrets/Configs/langchain-api.env" | |
| cp env/ovms-api.env.example "$AOA_STACK_ROOT/Secrets/Configs/ovms-api.env" | |
| printf '%s\n' 'TEST_KEY' > "$AOA_STACK_ROOT/Secrets/Configs/ovms_api_key.txt" | |
| chmod 600 \ | |
| "$AOA_STACK_ROOT/Secrets/Configs/stack.env" \ | |
| "$AOA_STACK_ROOT/Secrets/Configs/langchain-api.env" \ | |
| "$AOA_STACK_ROOT/Secrets/Configs/ovms-api.env" \ | |
| "$AOA_STACK_ROOT/Secrets/Configs/ovms_api_key.txt" | |
| scripts/aoa-check-layout --strict --profile substrate | |
| scripts/aoa-check-layout --strict --profile workflows | |
| scripts/aoa-check-layout --strict --profile local-worker | |
| scripts/aoa-check-layout --strict --profile intel-worker | |
| scripts/aoa-check-layout --strict --profile fallback-gateway | |
| scripts/aoa-check-layout --strict --profile core | |
| scripts/aoa-check-layout --strict --profile agentic | |
| scripts/aoa-check-layout --strict --profile intel | |
| scripts/aoa-doctor --preset agent-full | |
| scripts/aoa-doctor --preset intel-full | |
| scripts/aoa-preset-profiles --preset agent-full --paths | |
| scripts/aoa-preset-profiles --preset agent-federation --paths | |
| scripts/aoa-preset-profiles --preset intel-federation --paths | |
| scripts/aoa-profile-modules --profile substrate --paths | |
| scripts/aoa-profile-endpoints --profile substrate | |
| scripts/aoa-profile-modules --profile workflows --paths | |
| scripts/aoa-profile-endpoints --profile workflows | |
| scripts/aoa-profile-modules --profile local-worker --paths | |
| scripts/aoa-profile-endpoints --profile local-worker | |
| scripts/aoa-profile-modules --profile intel-worker --paths | |
| scripts/aoa-profile-endpoints --profile intel-worker | |
| scripts/aoa-profile-modules --profile fallback-gateway --paths | |
| scripts/aoa-profile-endpoints --profile fallback-gateway | |
| scripts/aoa-profile-modules --profile substrate --profile local-worker --paths | |
| scripts/aoa-profile-endpoints --profile substrate --profile local-worker | |
| scripts/aoa-profile-modules --profile substrate --profile workflows --paths | |
| scripts/aoa-profile-endpoints --profile substrate --profile workflows | |
| scripts/aoa-profile-modules --profile substrate --profile intel-worker --paths | |
| scripts/aoa-profile-endpoints --profile substrate --profile intel-worker | |
| scripts/aoa-profile-modules --profile substrate --profile fallback-gateway --paths | |
| scripts/aoa-profile-endpoints --profile substrate --profile fallback-gateway | |
| scripts/aoa-profile-modules --profile core --paths | |
| scripts/aoa-profile-endpoints --profile core | |
| scripts/aoa-profile-modules --profile agentic --paths | |
| scripts/aoa-profile-endpoints --profile agentic | |
| scripts/aoa-profile-modules --profile intel --paths | |
| scripts/aoa-profile-endpoints --profile intel | |
| scripts/aoa-profile-endpoints --profile tools | |
| scripts/aoa-profile-endpoints --profile observability | |
| scripts/aoa-profile-modules --profile substrate --profile local-worker --profile tools --profile observability --paths | |
| scripts/aoa-profile-endpoints --profile substrate,local-worker,tools,observability | |
| scripts/aoa-profile-modules --preset agent-full --paths | |
| scripts/aoa-profile-endpoints --preset agent-full | |
| scripts/aoa-profile-modules --preset agent-federation --paths | |
| scripts/aoa-profile-endpoints --preset agent-federation | |
| scripts/aoa-profile-modules --preset intel-full --paths | |
| scripts/aoa-profile-endpoints --preset intel-full | |
| scripts/aoa-profile-modules --preset intel-federation --paths | |
| scripts/aoa-profile-endpoints --preset intel-federation | |
| scripts/aoa-render-services --profile substrate | |
| scripts/aoa-render-services --profile workflows | |
| scripts/aoa-render-services --profile local-worker | |
| scripts/aoa-render-services --profile intel-worker | |
| scripts/aoa-render-services --profile fallback-gateway | |
| scripts/aoa-render-services --profile substrate,local-worker | |
| scripts/aoa-render-services --profile substrate,workflows | |
| scripts/aoa-render-services --profile substrate,intel-worker | |
| scripts/aoa-render-services --profile substrate,fallback-gateway | |
| scripts/aoa-render-services --profile core | |
| scripts/aoa-render-services --profile agentic | |
| scripts/aoa-render-services --profile intel | |
| scripts/aoa-render-services --profile substrate,local-worker,tools,observability | |
| scripts/aoa-render-services --preset agent-full | |
| scripts/aoa-render-services --preset agent-federation | |
| scripts/aoa-render-services --preset intel-full | |
| scripts/aoa-render-services --preset intel-federation | |
| scripts/aoa-render-config --profile substrate >/dev/null | |
| scripts/aoa-render-config --profile workflows >/dev/null | |
| scripts/aoa-render-config --profile local-worker >/dev/null | |
| scripts/aoa-render-config --profile intel-worker >/dev/null | |
| scripts/aoa-render-config --profile fallback-gateway >/dev/null | |
| scripts/aoa-render-config --profile substrate,local-worker >/dev/null | |
| scripts/aoa-render-config --profile substrate,workflows >/dev/null | |
| scripts/aoa-render-config --profile substrate,intel-worker >/dev/null | |
| scripts/aoa-render-config --profile substrate,fallback-gateway >/dev/null | |
| scripts/aoa-render-config --profile core >/dev/null | |
| python scripts/aoa-rpg-runtime-projection --stack-root "$AOA_STACK_ROOT" --check | |
| python scripts/aoa-rpg-runtime-projection --stack-root "$AOA_STACK_ROOT" | |
| scripts/aoa-render-config --profile substrate --profile local-worker --write "$RUNNER_TEMP/abyss-local-worker.rendered.yml" | |
| grep -q "return-policy.yaml" "$RUNNER_TEMP/abyss-local-worker.rendered.yml" | |
| grep -q "/app/logs/returns" "$RUNNER_TEMP/abyss-local-worker.rendered.yml" | |
| test -f "$AOA_STACK_ROOT/Configs/agent-api/governed-execution-policy.yaml" | |
| python scripts/aoa-governed-run prepare-request --write "$RUNNER_TEMP/governed-request.json" | |
| test -s "$RUNNER_TEMP/governed-request.json" | |
| scripts/aoa-render-config --profile intel >/dev/null | |
| scripts/aoa-render-config --profile substrate,local-worker,tools,observability >/dev/null | |
| scripts/aoa-render-config --preset agent-full >/dev/null | |
| scripts/aoa-render-config --preset agent-federation >/dev/null | |
| scripts/aoa-render-config --preset intel-full >/dev/null | |
| scripts/aoa-render-config --preset intel-federation >/dev/null | |
| scripts/aoa-render-config --profile substrate,local-worker,tools,observability --write "$RUNNER_TEMP/abyss-combined.rendered.yml" | |
| test -s "$RUNNER_TEMP/abyss-combined.rendered.yml" | |
| - name: Rehearse extra compose overlay flow | |
| run: | | |
| export AOA_STACK_ROOT="$RUNNER_TEMP/abyss-stack-overlay" | |
| export AOA_CONFIGS_ROOT="$AOA_STACK_ROOT/Configs" | |
| export AOA_VAULT_ROOT="$RUNNER_TEMP/abyss-vault-overlay" | |
| mkdir -p "$AOA_VAULT_ROOT" | |
| scripts/aoa-first-run --strict | |
| cp env/stack.env.example "$AOA_STACK_ROOT/Secrets/Configs/stack.env" | |
| ln -sfn "$AOA_STACK_ROOT/Secrets/Configs/stack.env" "$AOA_STACK_ROOT/Configs/stack.env" | |
| cp env/langchain-api.env.example "$AOA_STACK_ROOT/Secrets/Configs/langchain-api.env" | |
| cp env/ovms-api.env.example "$AOA_STACK_ROOT/Secrets/Configs/ovms-api.env" | |
| printf '%s\n' 'TEST_KEY' > "$AOA_STACK_ROOT/Secrets/Configs/ovms_api_key.txt" | |
| chmod 600 \ | |
| "$AOA_STACK_ROOT/Secrets/Configs/stack.env" \ | |
| "$AOA_STACK_ROOT/Secrets/Configs/langchain-api.env" \ | |
| "$AOA_STACK_ROOT/Secrets/Configs/ovms-api.env" \ | |
| "$AOA_STACK_ROOT/Secrets/Configs/ovms_api_key.txt" | |
| export AOA_EXTRA_COMPOSE_FILES="compose/tuning/llamacpp.cpu.yml" | |
| scripts/aoa-render-config --profile substrate --profile local-worker >/dev/null | |
| printf 'GGUFTEST' > "$RUNNER_TEMP/qwen3.5-9b.gguf" | |
| export AOA_LLAMACPP_MODEL_HOST_PATH="$RUNNER_TEMP/qwen3.5-9b.gguf" | |
| export AOA_EXTRA_COMPOSE_FILES="compose/modules/32-llamacpp-inference.yml,compose/modules/44-llamacpp-agent-sidecar.yml" | |
| scripts/aoa-render-config --preset intel-full >/dev/null | |
| - name: Capture host-facts artifacts | |
| run: | | |
| mkdir -p "$RUNNER_TEMP/host-facts" | |
| scripts/aoa-host-facts --mode public --write "$RUNNER_TEMP/host-facts/reference-host.public.json" | |
| scripts/aoa-host-facts --mode private --write "$RUNNER_TEMP/host-facts/latest.private.json" | |
| python - \ | |
| "$RUNNER_TEMP/host-facts/reference-host.public.json" \ | |
| "$RUNNER_TEMP/host-facts/latest.private.json" <<'PY' | |
| import json | |
| import sys | |
| from pathlib import Path | |
| public = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8")) | |
| private = json.loads(Path(sys.argv[2]).read_text(encoding="utf-8")) | |
| assert public["artifact_kind"] == "aoa.host-facts" | |
| assert public["capture_mode"] == "public" | |
| assert public["captured_by"] == "scripts/aoa-host-facts" | |
| assert private["artifact_kind"] == "aoa.host-facts" | |
| assert private["capture_mode"] == "private" | |
| assert private["captured_by"] == "scripts/aoa-host-facts" | |
| PY | |
| validate-windows-host-bridge: | |
| runs-on: windows-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| - name: Set up Python | |
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 | |
| with: | |
| python-version: "3.12" | |
| - name: Install PyYAML | |
| shell: pwsh | |
| run: python -m pip install PyYAML | |
| - name: Validate stack structure | |
| shell: pwsh | |
| run: python scripts/validate_stack.py | |
| - name: Parse PowerShell bridge scripts | |
| shell: pwsh | |
| run: | | |
| $files = @( | |
| "scripts/aoa.ps1", | |
| "scripts/aoa-doctor-win.ps1", | |
| "scripts/aoa-bootstrap-wsl.ps1", | |
| "mechanics/machine-fit/parts/windows-bridge/aoa_windows_bridge.ps1", | |
| "mechanics/machine-fit/parts/windows-bridge/aoa_doctor_win.ps1", | |
| "mechanics/machine-fit/parts/windows-bridge/aoa_bootstrap_wsl.ps1" | |
| ) | |
| foreach ($file in $files) { | |
| $tokens = $null | |
| $parseErrors = $null | |
| $resolvedPath = (Resolve-Path $file).Path | |
| [void][System.Management.Automation.Language.Parser]::ParseFile( | |
| $resolvedPath, | |
| [ref]$tokens, | |
| [ref]$parseErrors | |
| ) | |
| $errorList = @($parseErrors) | |
| if ($errorList.Count -gt 0) { | |
| $errorList | ForEach-Object { | |
| Write-Error ("{0}: {1}" -f $file, $_.Message) | |
| } | |
| exit 1 | |
| } | |
| } |