name: ci

on:
  pull_request:
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  PYTHON_VERSION: "3.11"
  CI: "1"
  LEOCLEAN_RUNTIME_POSTGRES_IMAGE: "postgres@sha256:eb4759788a2182f08257135e61a34f2cfc3c2914079f3465d64ee62350f4d081"

jobs:
  lint:
    name: Focused lint
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: Install
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e ".[dev]"
      - name: Ruff focused surface
        run: |
          python -m ruff check \
            lib/agent_routing.py \
            lib/config.py \
            lib/db.py \
            lib/evaluate.py \
            lib/llm.py \
            lib/post_extract.py \
            docker/leoclean-nosend/entrypoint.py \
            ops/apply_gcp_iam_split.py \
            ops/attest_gcp_reasoning_compute.py \
            ops/capture_vps_canonical_postgres_snapshot.py \
            ops/check_gcp_leoclean_nosend_preflight.py \
            ops/check_gcp_infra_readiness.py \
            ops/run_gcp_infra_execute_canary.py \
            ops/apply_gcp_runtime_baseline.py \
            ops/check_gcp_service_communications.py \
            ops/derive_leoclean_runtime_query_contract.py \
            ops/gcp_leoclean_nosend_package.py \
            ops/plan_gcp_iam_split.py \
            ops/private_receipt_io.py \
            ops/run_local_canonical_postgres_rebuild.py \
            ops/redact_sqlite_postgres_restore_canary.py \
            ops/restore_gcp_generated_postgres_snapshot.py \
            ops/sqlite_to_postgres_dump.py \
            ops/verify_gcp_cloudsql_restore_readback.py \
            ops/verify_gcp_leoclean_runtime_permissions.py \
            ops/verify_gcp_leoclean_service_environment.py \
            ops/verify_gcp_canonical_lifecycle.py \
            ops/verify_postgres_parity_manifest.py \
            ops/verify_vps_canonical_snapshot_delta.py \
            telegram/approvals.py \
            hermes-agent/patches/enforce_leoclean_learning_policy.py \
            hermes-agent/leoclean-bin/kb_tool.py \
            hermes-agent/leoclean-bin/cloudsql_memory_tool.py \
            hermes-agent/runtime/leoclean-nosend/bootstrap.py \
            hermes-agent/runtime/leoclean-nosend/profile-sources/cloudsql_memory_runtime.py \
            hermes-agent/runtime/leoclean-nosend/profile-sources/leo_db_context.py \
            hermes-agent/runtime/leoclean-nosend/profile-sources/operational_contracts.py \
            scripts/check_crabbox_ci_contract.py \
            scripts/check_llm_refinement_contract.py \
            scripts/build_working_leo_m3taversal_outcome_sandbox.py \
            scripts/leo_behavior_manifest.py \
            scripts/leo_identity_manifest.py \
            scripts/leo_tool_trace.py \
            scripts/compile_leoclean_nosend_runtime.py \
            scripts/replay_decision_engine_eval.py \
            scripts/prove_phase1b_local.py \
            scripts/run_gcp_generated_db_direct_claim_suite.py \
            scripts/run_gcp_generated_db_working_leo_suite.py \
            scripts/run_gcp_generated_db_blind_claim_canary.py \
            scripts/run_leo_direct_claim_handler_suite.py \
            scripts/run_leo_m3taversal_oos_handler_suite.py \
            scripts/verify_leo_db_first_oos_canary.py \
            scripts/run_leo_clone_bound_handler_checkpoint.py \
            scripts/run_gcp_leoclean_nosend_oci_smoke.py \
            scripts/working_leo_m3taversal_oos_benchmark.py \
            scripts/working_leo_open_ended_benchmark.py \
            scripts/verify_leoclean_nosend_runtime.py \
            tests/test_agent_routing.py \
            tests/test_attest_gcp_reasoning_compute.py \
            tests/test_assemble_telegram_visible_direct_claim_capture_receipt.py \
            tests/test_build_working_leo_m3taversal_outcome_sandbox.py \
            tests/test_decision_engine_replay.py \
            tests/test_evaluate_agent_routing.py \
            tests/test_gcp_artifact_workflow.py \
            tests/test_capture_vps_canonical_postgres_snapshot.py \
            tests/test_gcp_infra_execute_canary.py \
            tests/test_gcp_infra_readiness_checker.py \
            tests/test_gcp_leoclean_nosend_preflight.py \
            tests/test_gcp_leoclean_runtime_permissions.py \
            tests/test_gcp_leoclean_nosend_package.py \
            tests/test_gcp_leoclean_nosend_oci_smoke.py \
            tests/test_gcp_leoclean_service_environment.py \
            tests/test_gcp_runtime_baseline_apply.py \
            tests/test_gcp_service_communications.py \
            tests/test_gcp_cloudsql_restore_drill.py \
            tests/test_gcp_cloudsql_restore_readback.py \
            tests/test_gcp_iam_split_apply.py \
            tests/test_gcp_iam_split_plan.py \
            tests/test_gcp_readiness_workflow.py \
            tests/test_gcp_generated_db_direct_claim_suite.py \
            tests/test_gcp_generated_db_working_leo_suite.py \
            tests/test_gcp_generated_db_blind_claim_canary.py \
            tests/test_hermes_leoclean_kb_bridge_source.py \
            tests/test_hermes_leoclean_db_context_plugin.py \
            tests/test_hermes_leoclean_skill_surfaces.py \
            tests/test_leoclean_nosend_runtime.py \
            tests/test_leo_behavior_manifest.py \
            tests/test_leo_tool_trace.py \
            tests/test_verify_leo_db_first_oos_canary.py \
            tests/test_compile_kb_source_packet.py \
            tests/test_verify_postgres_parity_manifest.py \
            tests/test_verify_gcp_canonical_lifecycle.py \
            tests/test_verify_vps_canonical_snapshot_delta.py \
            tests/test_working_leo_m3taversal_oos_benchmark.py \
            tests/test_working_leo_open_ended_benchmark.py \
            tests/test_phase1b_end_to_end.py \
            tests/test_private_receipt_io.py \
            tests/test_restore_gcp_generated_postgres_snapshot.py \
            tests/test_run_local_canonical_postgres_rebuild.py \
            tests/test_run_local_genesis_ledger_rebuild.py \
            tests/test_sqlite_to_postgres_dump.py \
            tests/test_sqlite_postgres_restore_canary_capsule.py \
            tests/test_teleo_agent_systemd.py \
            tests/test_eval_parse.py \
            tests/test_contributor.py \
            tests/test_search.py
      - name: Shell syntax
        run: |
          bash -n \
            deploy/sync-gcp-leoclean-runtime.sh \
            hermes-agent/leoclean-bin/teleo-kb \
            hermes-agent/leoclean-bin/teleo-kb-gcp \
            ops/backup_vps_sqlite_kb.sh \
            ops/provision_gcp_leoclean_runtime_role.sh \
            ops/run_gcp_cloudsql_restore_drill.sh \
            ops/run_sqlite_postgres_restore_canary.sh \
            scripts/run_leoclean_nosend_runtime_canary.sh

  test:
    name: Unit tests
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: Install
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e ".[dev]"
      - name: Pull digest-pinned PostgreSQL permission canary image
        run: docker pull "${LEOCLEAN_RUNTIME_POSTGRES_IMAGE}"
      - name: Pytest
        env:
          TELEO_RUN_LEOCLEAN_RUNTIME_POSTGRES_CANARY: "1"
        run: |
          mkdir -p .crabbox-results
          python -m pytest --junitxml=.crabbox-results/pytest.xml
      - name: Upload test artifact
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: teleo-infrastructure-pytest
          path: .crabbox-results/pytest.xml
          if-no-files-found: warn
      - name: Remove interrupted PostgreSQL permission canaries
        if: always()
        run: |
          mapfile -t containers < <(docker ps -aq --filter "label=livingip.r2.permission-canary")
          if ((${#containers[@]})); then
            docker rm --force "${containers[@]}"
          fi
          test -z "$(docker ps -aq --filter 'label=livingip.r2.permission-canary')"

  repo-contracts:
    name: Repo contracts
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: Install
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e ".[dev]"
      - name: Validate repo-owned contract
        run: |
          python scripts/check_crabbox_ci_contract.py \
            --output .crabbox-results/crabbox-ci-contract.json
          python scripts/check_llm_refinement_contract.py \
            --output .crabbox-results/llm-refinement-contract.json
          python scripts/replay_decision_engine_eval.py \
            --output .crabbox-results/decision-engine-eval.json
      - name: Upload contract artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: teleo-infrastructure-repo-contracts
          path: |
            .crabbox-results/crabbox-ci-contract.json
            .crabbox-results/llm-refinement-contract.json
            .crabbox-results/decision-engine-eval.json
          if-no-files-found: error

  leoclean-nosend-runtime:
    name: Leoclean no-send runtime
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11.9"
      - name: Install exact uv toolchain
        run: python -m pip install 'uv==0.9.30' 'PyYAML==6.0.3'
      - name: Pull digest-pinned OCI bases
        run: |
          docker pull --platform=linux/amd64 "ghcr.io/astral-sh/uv:0.9.30@sha256:538e0b39736e7feae937a65983e49d2ab75e1559d35041f9878b7b7e51de91e4"
          docker pull --platform=linux/amd64 "docker.io/library/python:3.11.9-slim-bookworm@sha256:8fb099199b9f2d70342674bd9dbccd3ed03a258f26bbd1d556822c6dfc60c317"
          docker pull --platform=linux/amd64 "docker.io/library/postgres:16.14-bookworm@sha256:92620daddcd947f8d5ab5ba66e848702fe443d87fed30c4cea8e389fd78dfc55"
      - name: Compile and exercise release artifact
        env:
          LEOCLEAN_NOSEND_ARTIFACT_OUTPUT: ${{ runner.temp }}/leoclean-nosend-artifact
        run: scripts/run_leoclean_nosend_runtime_canary.sh
      - name: Build and exercise one disposable OCI image
        run: |
          python scripts/run_gcp_leoclean_nosend_oci_smoke.py \
            --artifact "${RUNNER_TEMP}/leoclean-nosend-artifact" \
            --runtime-receipt .crabbox-results/leoclean-nosend-runtime.json \
            --output .crabbox-results/gcp-leoclean-nosend-oci-smoke.json
      - name: Upload no-send runtime receipt
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: teleo-infrastructure-leoclean-nosend-runtime
          path: |
            .crabbox-results/leoclean-nosend-runtime.json
            .crabbox-results/gcp-leoclean-nosend-oci-smoke.json
          if-no-files-found: error
      - name: Remove interrupted no-send OCI smokes
        if: always()
        run: |
          container_inventory="$(docker ps -aq --filter 'label=livingip.leoclean-nosend-smoke')"
          if [[ -n "${container_inventory}" ]]; then
            mapfile -t containers <<<"${container_inventory}"
            docker rm --force "${containers[@]}"
          fi
          image_inventory="$(docker images -q --filter 'label=livingip.leoclean-nosend-smoke')"
          if [[ -n "${image_inventory}" ]]; then
            mapfile -t images <<<"${image_inventory}"
            docker image rm --force "${images[@]}"
          fi
          remaining_containers="$(docker ps -aq --filter 'label=livingip.leoclean-nosend-smoke')"
          remaining_images="$(docker images -q --filter 'label=livingip.leoclean-nosend-smoke')"
          test -z "${remaining_containers}"
          test -z "${remaining_images}"

  phase1b-local-proof:
    name: Phase 1B local proof
    runs-on: ubuntu-latest
    needs:
      - lint
      - test
      - repo-contracts
    timeout-minutes: 20
    env:
      PHASE1B_AGENT_ROUTING_ENABLED: "true"
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: Install
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e ".[dev]"
      - name: Run proof wrapper
        run: |
          scripts/crabbox_phase1b_proof.sh
      - name: Upload proof artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: teleo-infrastructure-phase1b-proof
          path: |
            .crabbox-results/crabbox-ci-contract.json
            proof/phase1b-local-e2e-proof.json
            .crabbox-results/phase1b-pytest.xml
            .crabbox-results/phase1b-proof-summary.json
          if-no-files-found: warn