Repository navigation
agentdid: add encrypted custody, purpose-bound signing and v1 identity documents #8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Agent identity acceptance | |
| on: | |
| pull_request: | |
| branches: [app/v3] | |
| paths: | |
| - internal/agentdid/** | |
| - internal/session/agent_identity*.go | |
| - internal/session/place.go | |
| - internal/session/session.go | |
| - internal/session/approvalposture.go | |
| - internal/session/effort.go | |
| - cmd/codeaf/syncdrive_test.go | |
| - cmd/codeaf/heldchat_drive_test.go | |
| - cmd/codeaf/app_agent_identity_e2e_test.go | |
| - .github/workflows/agent-identity.yml | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: agent-identity-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| jobs: | |
| binary-e2e: | |
| name: Binary user-flow QA | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Build the actual app binary | |
| run: make build | |
| - name: Exercise the app as a desktop client | |
| run: go test ./cmd/codeaf -run '^TestAppAgentIdentityBinaryE2E$' -count=1 -v -timeout 5m | |
| - name: Check that custody preserves existing sync behavior | |
| run: go test ./cmd/codeaf -run '^TestAQuitAtTheMoveQuestionLeavesTheOtherWindowsChatSendable$|^TestTheFreshChatBesideAHeldOneWorksOnItsOwnSeat$|^TestDriveSideDoorPublishesAndReleases$|^TestDriveSideStartsWhenAPairingMakesTheIdentity$|^TestAChatMovedBackGetsADriveSideOfItsOwn$|^TestAChatTakenAndTakenBackGetsADriveSideOfItsOwn$|^TestDriveSideStartsWhenTheSoloMarkerEnds$|^TestAppOrdinaryClientIDSurvivesABackendRestart$|^TestC6AppSendWithoutAViewerStaysLocal$|^TestC27NewChatByDefaultStaysQuiet$' -count=1 -v -timeout 5m | |
| - name: Repeat sealed history portability | |
| run: go test ./internal/session -run '^TestSealedTreeCarriesTaskHistory$' -count=20 -v -timeout 5m | |
| race: | |
| name: Custody race checks | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Race-check custody and lifecycle | |
| run: go test -race ./internal/agentdid ./internal/session -run 'TestCredentials|TestCustody|TestOnlyTheRecipient|TestUnknownDocument|TestAgentIdentity|TestAgentDID|TestToolCommandsSeeTheAgentDID|TestTaskWorker.*DID' -count=1 -timeout 15m | |
| repository: | |
| name: Repository gates | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Build with the pinned engine | |
| run: make build | |
| - name: Run the repository PR gates against app/v3 | |
| env: | |
| BASE: ${{ github.event.pull_request.base.sha }} | |
| run: make pr-ready | |
| - name: Run touched packages even if an existing light gate fails | |
| if: ${{ !cancelled() }} | |
| env: | |
| BASE: ${{ github.event.pull_request.base.sha }} | |
| run: make test-touched | |
| baseline: | |
| name: Compare existing failures on the untouched base | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.pull_request.base.sha }} | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Build the untouched base | |
| run: make build | |
| - name: Probe command failures on the base | |
| run: go test ./cmd/codeaf -run '^(TestAppChatRowsR2SavedTurnTime|TestAppChatStartupR3QuietRelease|TestAppTakeC1bSavedModelTravelsBack|TestC1AppViewerAcceptsRealPendingConsent|TestC1C2AppViewerRefusesWorkBeforeSubmission|TestRecipeDoorWritesTheWorktreeWhenOnlyTheCheckoutIsHeld|TestAQuitAtTheMoveQuestionLeavesTheOtherWindowsChatSendable|TestTheFreshChatBesideAHeldOneWorksOnItsOwnSeat|TestHostedTakeBackReachesAcquireWithoutSharedUploadsOrReleaseDelay|TestDriveSideDoorPublishesAndReleases|TestDriveSideStartsWhenAPairingMakesTheIdentity|TestAChatMovedBackGetsADriveSideOfItsOwn|TestAChatTakenAndTakenBackGetsADriveSideOfItsOwn)$' -count=1 -v -timeout 5m | |
| - name: Probe session failures on the base | |
| if: ${{ !cancelled() }} | |
| run: go test ./internal/session -run '^TestTheFixedPrefixStaysUnderItsBudget$|^TestTheLeanPrefixStaysUnderItsBudget$|^TestATurnThatMustReportRequiresTheVerbOnItsFirstRequestOnly$|^TestALandStartsNoAutomaticMaintenance$|^TestBashBeltTruncationCapFollowsTheWindow$|^TestTheStageVerbsCostOnlyTheStageAndStayUnderTheirBudget$|^TestBashBeltTruncationWritesHeadTailAndPath$|^TestProgramHoldClassifiesEveryRegisteredChatTool$|^TestNoRoadInTheMemoryEngineHasMoreEndingsThanTheCeiling$|^TestNoRoadInTheTaskEngineHasMoreEndingsThanItsLedgerRow$' -count=1 -v -timeout 5m | |
| - name: Compare the intermittent takeover assertion on the base | |
| if: ${{ !cancelled() }} | |
| run: go test ./internal/session -run '^TestAWithdrawnOrStaleTakeoverIsIgnored$' -count=100 -v -timeout 5m |