Native reader labs + Brain v4: exhaustive device evidence and repair loop #648
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Niakvio provider pipeline | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| mode: | |
| description: Validation depth | |
| required: true | |
| default: quick | |
| type: choice | |
| options: | |
| - quick | |
| - deep | |
| pull_request: | |
| branches: | |
| - main | |
| paths: | |
| - '.github/workflows/sync.yml' | |
| - 'provider_catalog.json' | |
| - 'engine_v2/**' | |
| - 'scripts/run_adaptive_quick_repair.py' | |
| - 'scripts/run_adaptive_deep_repair.py' | |
| - 'scripts/promote_refresh_candidates.py' | |
| - 'scripts/promote_candidates.py' | |
| - 'scripts/runtime_repair.py' | |
| - 'scripts/adaptive_runtime/runtime_repair.py' | |
| - 'scripts/provider_engine_normalizer.py' | |
| - 'scripts/provider_evidence_model.py' | |
| - 'scripts/release_evidence_fence.py' | |
| - 'scripts/sync_release_versions.py' | |
| - 'scripts/nuvio_client_activation_ids.py' | |
| - 'tests/quick_refresh_policy_test.py' | |
| - 'tests/release_auto_bump_test.py' | |
| - 'tests/release_version_sync_test.py' | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - '.github/triggers/deep-provider-repair' | |
| - '.github/workflows/sync.yml' | |
| - 'provider_catalog.json' | |
| - 'engine_v2/src/**' | |
| - 'engine_v2/scripts/**' | |
| - 'scripts/run_adaptive_quick_repair.py' | |
| - 'scripts/run_adaptive_deep_repair.py' | |
| - 'scripts/promote_refresh_candidates.py' | |
| - 'scripts/promote_candidates.py' | |
| - 'scripts/runtime_repair.py' | |
| - 'scripts/adaptive_runtime/runtime_repair.py' | |
| - 'scripts/provider_engine_normalizer.py' | |
| - 'scripts/provider_evidence_model.py' | |
| - 'scripts/release_evidence_fence.py' | |
| - 'scripts/sync_release_versions.py' | |
| - 'scripts/nuvio_client_activation_ids.py' | |
| schedule: | |
| - cron: '17 5 * * 0,1,3,4,6' | |
| - cron: '47 4 * * 2,5' | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: nuvio-provider-publish-${{ github.event.pull_request.number || 'main' }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| stage-and-test: | |
| name: Discover, repair and validate providers | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 90 | |
| permissions: | |
| contents: read | |
| outputs: | |
| validation_mode: ${{ steps.resolve-mode.outputs.validation_mode }} | |
| steps: | |
| - name: Checkout without persisted credentials | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| with: | |
| fetch-depth: 2 | |
| persist-credentials: false | |
| - name: Resolve validation mode | |
| id: resolve-mode | |
| shell: bash | |
| run: | | |
| MODE=quick | |
| if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then | |
| MODE="${{ github.event.inputs.mode }}" | |
| elif [ "${{ github.event.schedule }}" = "47 4 * * 2,5" ]; then | |
| MODE=deep | |
| elif [ "${{ github.event_name }}" = "push" ]; then | |
| BEFORE="${{ github.event.before }}" | |
| AFTER="${{ github.sha }}" | |
| if [ -n "$BEFORE" ] && git cat-file -e "$BEFORE^{commit}" 2>/dev/null; then | |
| if git diff --name-only "$BEFORE" "$AFTER" | grep -Fxq '.github/triggers/deep-provider-repair'; then | |
| MODE=deep | |
| fi | |
| fi | |
| fi | |
| echo "validation_mode=${MODE}" >> "$GITHUB_OUTPUT" | |
| echo "Resolved validation mode: ${MODE}" | |
| - name: Set up Python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 | |
| with: | |
| python-version: '3.12' | |
| - name: Set up Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 | |
| with: | |
| node-version: '24' | |
| package-manager-cache: false | |
| - name: Install pinned runtime dependencies | |
| run: | | |
| if [ -f package-lock.json ]; then | |
| npm ci --ignore-scripts --no-audit --no-fund | |
| else | |
| npm install --ignore-scripts --no-audit --no-fund --package-lock=false | |
| fi | |
| - name: Validate ARCHI2 control plane | |
| run: | | |
| node engine_v2/tests/provider-catalog.test.mjs | |
| node engine_v2/tests/contracts.test.mjs | |
| node engine_v2/tests/runtime-adapters.test.mjs | |
| node engine_v2/tests/media-validator.test.mjs | |
| node engine_v2/tests/resolver-core.test.mjs | |
| node engine_v2/tests/repair-brain.test.mjs | |
| node engine_v2/tests/recipe-memory.test.mjs | |
| node engine_v2/tests/decision-engine.test.mjs | |
| node engine_v2/tests/evidence.test.mjs | |
| - name: Validate compatibility execution primitives | |
| run: | | |
| python -m py_compile scripts/run_adaptive_quick_repair.py | |
| python -m py_compile scripts/run_adaptive_deep_repair.py | |
| python -m py_compile scripts/promote_refresh_candidates.py | |
| python -m py_compile scripts/promote_candidates.py | |
| python -m py_compile scripts/validate_automatic_repair_results.py | |
| python -m py_compile scripts/normalize_terminal_quarantine_stage.py | |
| python -m py_compile scripts/normalize_provider_activation_overrides.py | |
| python -m py_compile scripts/repair_profile_persistence.py | |
| python -m py_compile scripts/repair_identity_gate.py | |
| python -m py_compile scripts/sync_release_versions.py | |
| python tests/quick_refresh_policy_test.py | |
| python tests/quick_refresh_deep_authority_test.py | |
| python tests/quick_repair_probe_profile_test.py | |
| python tests/quick_repair_acceptance_policy_test.py | |
| python tests/healthy_sibling_resolution_test.py | |
| python tests/provider_activation_override_normalization_test.py | |
| python tests/repair_profile_persistence_test.py | |
| python tests/terminal_quarantine_stage_normalization_test.py | |
| python tests/refresh_manifest_finalization_test.py | |
| python tests/adaptive_runtime_repair_test.py | |
| python tests/global_final_wrapper_order_test.py | |
| python tests/release_auto_bump_test.py | |
| python tests/release_version_sync_test.py | |
| python tests/sync_atomic_publication_test.py | |
| - name: Run repository regression tests | |
| run: npm test | |
| - name: Release stale non-safety activation vetoes | |
| run: python scripts/normalize_provider_activation_overrides.py | |
| - name: Resolve official hubs and retain last-known-good routes | |
| run: | | |
| python scripts/resolve_provider_hubs.py \ | |
| --apply \ | |
| --mode "${{ steps.resolve-mode.outputs.validation_mode }}" \ | |
| --include-disabled \ | |
| --workers 8 \ | |
| --timeout 8 \ | |
| --output health-output/provider-hub-report.json | |
| - name: Discover all non-P2P candidates before triage | |
| run: python scripts/discover_candidates.py --require-all-upstreams | |
| - name: Enforce canonical catalog preservation | |
| run: node engine_v2/scripts/validate-stage-against-catalog.mjs --catalog provider_catalog.json --stage staging/candidates.json | |
| - name: Resolve DNS and validated domain migrations | |
| env: | |
| GLOBALPING_API_TOKEN: ${{ secrets.GLOBALPING_API_TOKEN }} | |
| run: | | |
| node scripts/provider_dns_preflight.mjs \ | |
| --stage staging \ | |
| --output health-output/dns-preflight-report.json | |
| python scripts/apply_dns_migration_overrides.py \ | |
| --stage staging \ | |
| --report health-output/dns-preflight-report.json | |
| - name: Apply known runtime profiles before repair | |
| run: | | |
| python scripts/build_provider_runtime_profiles.py | |
| python scripts/reapply_published_overrides.py | |
| python scripts/build_provider_runtime_profiles.py --stage staging --apply-stage | |
| python scripts/normalize_terminal_quarantine_stage.py --stage staging | |
| python scripts/validate_override_pipeline.py --stage staging | |
| - name: Repair unresolved provider structures | |
| env: | |
| NUVIO_DNS_PREFLIGHT_RESULTS: health-output/dns-preflight-report.json | |
| NUVIO_WORKER_MEMORY_MB: '1024' | |
| shell: bash | |
| run: | | |
| if [ "${{ steps.resolve-mode.outputs.validation_mode }}" = "deep" ]; then | |
| python scripts/run_adaptive_deep_repair.py \ | |
| --stage staging \ | |
| --output health-output \ | |
| --mode deep | |
| else | |
| python scripts/run_adaptive_quick_repair.py \ | |
| --stage staging \ | |
| --output health-output \ | |
| --max-rounds 1 | |
| fi | |
| python scripts/validate_automatic_repair_results.py \ | |
| --stage staging \ | |
| --health health-output/health-results.json \ | |
| --repairs health-output/repair-report.json | |
| python scripts/normalize_terminal_quarantine_stage.py --stage staging | |
| python scripts/validate_override_pipeline.py --stage staging | |
| - name: Validate deep evidence integrity | |
| if: steps.resolve-mode.outputs.validation_mode == 'deep' | |
| run: | | |
| python scripts/validate_deep_health_integrity.py \ | |
| --health health-output/health-results.json \ | |
| --repairs health-output/repair-report.json | |
| - name: Generate diagnostics after repair | |
| run: | | |
| python scripts/generate_diagnostics.py \ | |
| --results health-output/health-results.json \ | |
| --output health-output | |
| python scripts/validate_route_overrides.py \ | |
| --results health-output/health-results.json \ | |
| --report health-output/route-regressions.json | |
| - name: Upload validated staging transaction | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a | |
| with: | |
| name: nuvio-validation-stage-${{ github.run_id }} | |
| path: | | |
| staging/ | |
| health-output/ | |
| provider-overrides.json | |
| provider-domain-history.json | |
| retention-days: 2 | |
| if-no-files-found: error | |
| publish: | |
| name: Publish validated provider transaction | |
| needs: stage-and-test | |
| if: github.event_name != 'pull_request' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 90 | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout current published repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Capture published manifest baseline | |
| shell: bash | |
| run: | | |
| NUVIO_PUBLISHED_MANIFEST_BASELINE="$RUNNER_TEMP/published-manifest.json" | |
| echo "NUVIO_PUBLISHED_MANIFEST_BASELINE=$NUVIO_PUBLISHED_MANIFEST_BASELINE" >> "$GITHUB_ENV" | |
| git show HEAD:manifest.json > "$NUVIO_PUBLISHED_MANIFEST_BASELINE" | |
| - name: Set up Python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 | |
| with: | |
| python-version: '3.12' | |
| - name: Set up Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 | |
| with: | |
| node-version: '24' | |
| package-manager-cache: false | |
| - name: Install pinned runtime dependencies | |
| run: | | |
| if [ -f package-lock.json ]; then | |
| npm ci --ignore-scripts --no-audit --no-fund | |
| else | |
| npm install --ignore-scripts --no-audit --no-fund --package-lock=false | |
| fi | |
| - name: Download validated staging transaction | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c | |
| with: | |
| name: nuvio-validation-stage-${{ github.run_id }} | |
| path: checked-artifact | |
| - name: Restore validated routing state | |
| run: | | |
| cp checked-artifact/provider-overrides.json provider-overrides.json | |
| cp checked-artifact/provider-domain-history.json provider-domain-history.json | |
| python scripts/build_provider_runtime_profiles.py | |
| python scripts/reapply_published_overrides.py | |
| - name: Promote only proven candidates | |
| env: | |
| NUVIO_STAGE: checked-artifact/staging | |
| NUVIO_HEALTH_RESULTS: checked-artifact/health-output/health-results.json | |
| shell: bash | |
| run: | | |
| if [ "${{ needs.stage-and-test.outputs.validation_mode }}" = "quick" ]; then | |
| python scripts/promote_refresh_candidates.py | |
| else | |
| python scripts/promote_candidates.py | |
| fi | |
| - name: Finalize upstream last-known-good snapshots | |
| run: | | |
| test -f checked-artifact/staging/upstream-lkg-pending.json | |
| python scripts/finalize_upstream_lkg.py \ | |
| --pending checked-artifact/staging/upstream-lkg-pending.json \ | |
| --keep-generations 2 | |
| - name: Prune stale bundles and validate overrides | |
| run: | | |
| python scripts/prune_unreferenced_providers.py | |
| python scripts/validate_published_overrides.py | |
| - name: Restore validated reports | |
| shell: bash | |
| run: | | |
| git config user.name 'github-actions[bot]' | |
| git config user.email '41898282+github-actions[bot]@users.noreply.github.com' | |
| cp checked-artifact/health-output/dns-preflight-report.json dns-preflight-report.json | |
| cp checked-artifact/health-output/provider-hub-report.json provider-hub-report.json | |
| cp checked-artifact/health-output/diagnostics-report.json diagnostics-report.json | |
| cp checked-artifact/health-output/diagnostics-report.html diagnostics-report.html | |
| cp checked-artifact/health-output/route-regressions.json route-regressions.json | |
| cp checked-artifact/health-output/repair-report.json repair-report.json | |
| - name: Build canonical publication transaction | |
| shell: bash | |
| run: | | |
| test -f manifest.next.json | |
| mv manifest.next.json manifest.json | |
| python scripts/build_provider_runtime_profiles.py | |
| python scripts/reapply_published_overrides.py | |
| python scripts/generate_language_manifests.py | |
| python scripts/prune_unreferenced_providers.py | |
| # First pass catches promoter/repair changes before content audit. | |
| python scripts/sync_release_versions.py \ | |
| --manifest manifest.json \ | |
| --previous "$NUVIO_PUBLISHED_MANIFEST_BASELINE" | |
| python scripts/validate_activation_preservation.py | |
| python scripts/validate_language_projection.py | |
| # Compatibility promoters emit a candidate manifest. ARCHI2 imports | |
| # that transaction into the canonical catalog, then manifests are | |
| # rendered back from the catalog before publication. | |
| node engine_v2/scripts/bootstrap-provider-catalog.mjs \ | |
| --general manifest.json \ | |
| --vf vf/manifest.json \ | |
| --output provider_catalog.json | |
| node engine_v2/scripts/render-manifests-from-catalog.mjs \ | |
| --catalog provider_catalog.json \ | |
| --general manifest.json \ | |
| --vf vf/manifest.json | |
| node engine_v2/tests/provider-catalog.test.mjs | |
| python scripts/release_evidence_fence.py fingerprint \ | |
| --manifest manifest.json \ | |
| --root . \ | |
| --output /tmp/release-generation.json | |
| - name: Audit content identity and media | |
| env: | |
| NUVIO_CATALOGUE_AUDIT_OUTPUT: /tmp/catalogue-media-audit.json | |
| NUVIO_CATALOGUE_AUDIT_WORKERS: '8' | |
| NUVIO_CATALOGUE_AUDIT_TIMEOUT: '60' | |
| shell: bash | |
| run: | | |
| if [ "${{ needs.stage-and-test.outputs.validation_mode }}" = "deep" ]; then | |
| python scripts/audit_catalogue_identity_media.py | |
| else | |
| set +e | |
| python scripts/audit_catalogue_identity_media.py | |
| audit_status=$? | |
| set -e | |
| if [ "$audit_status" -ne 0 ]; then | |
| python scripts/quarantine_catalogue_audit_failures.py \ | |
| --audit /tmp/catalogue-media-audit.json \ | |
| --evidence /tmp/release-generation.json \ | |
| --workflow-run-id "${{ github.run_id }}" \ | |
| --tested-commit-sha "${{ github.sha }}" | |
| fi | |
| fi | |
| # The audit is allowed to mutate activation state. Re-run the same | |
| # idempotent finalizer against the original published generation so | |
| # late quarantine/metadata changes cannot escape provider/global cache | |
| # invalidation, and cannot double-bump earlier changes. | |
| python scripts/generate_language_manifests.py | |
| python scripts/sync_release_versions.py \ | |
| --manifest manifest.json \ | |
| --previous "$NUVIO_PUBLISHED_MANIFEST_BASELINE" | |
| python scripts/validate_activation_preservation.py | |
| python scripts/validate_language_projection.py | |
| node engine_v2/scripts/bootstrap-provider-catalog.mjs \ | |
| --general manifest.json \ | |
| --vf vf/manifest.json \ | |
| --output provider_catalog.json | |
| node engine_v2/scripts/render-manifests-from-catalog.mjs \ | |
| --catalog provider_catalog.json \ | |
| --general manifest.json \ | |
| --vf vf/manifest.json | |
| node engine_v2/tests/provider-catalog.test.mjs | |
| python scripts/release_evidence_fence.py fingerprint \ | |
| --manifest manifest.json \ | |
| --root . \ | |
| --output /tmp/release-generation.json | |
| - name: Upload catalogue/media audit | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a | |
| with: | |
| name: catalogue-media-audit-${{ github.run_id }} | |
| path: /tmp/catalogue-media-audit.json | |
| retention-days: 7 | |
| if-no-files-found: warn | |
| - name: Measure Interstellar real coverage | |
| continue-on-error: true | |
| run: | | |
| python scripts/interstellar_nuvio_matrix.py \ | |
| --workers 8 \ | |
| --timeout 90 \ | |
| --minimum-automatic 0 \ | |
| --output /tmp/interstellar-nuvio-matrix.json | |
| - name: Upload real coverage diagnostics | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a | |
| with: | |
| name: interstellar-real-coverage-${{ github.run_id }} | |
| path: /tmp/interstellar-nuvio-matrix.json | |
| retention-days: 7 | |
| if-no-files-found: warn | |
| - name: Publish atomic ARCHI2 transaction | |
| shell: bash | |
| run: | | |
| python scripts/release_evidence_fence.py validate \ | |
| --manifest manifest.json \ | |
| --root . \ | |
| --evidence /tmp/release-generation.json | |
| python scripts/generate_release_hashes.py | |
| python scripts/validate_release_integrity.py | |
| node engine_v2/tests/provider-catalog.test.mjs | |
| git add manifest.json vf/manifest.json provider_catalog.json \ | |
| package.json package-lock.json sources.json nuvio-client-id-state.json \ | |
| FILE-HASHES.json PATCH-SHA256SUMS.txt SHA256SUMS.json \ | |
| PROVENANCE.json provider-overrides.json provider-domain-history.json \ | |
| upstream-lkg.json upstream-lkg/ health-report.json health-history.json \ | |
| dns-preflight-report.json provider-hub-report.json diagnostics-report.json \ | |
| diagnostics-report.html route-regressions.json repair-report.json | |
| git add -A providers | |
| if git diff --cached --quiet; then | |
| echo 'No validated provider change.' | |
| exit 0 | |
| fi | |
| git commit -m "chore: publish validated ARCHI2 provider transaction" | |
| git reset --hard HEAD | |
| git clean -fdx | |
| git fetch origin main | |
| git rebase origin/main | |
| # The rebase can import concurrent README/config/cleanup changes after | |
| # the publication hashes were first generated. Rebuild the inventories | |
| # on the exact rebased tree so a provider transaction can never publish | |
| # stale checksums for files that were changed or removed concurrently. | |
| python scripts/generate_release_hashes.py | |
| python scripts/validate_release_integrity.py | |
| git add FILE-HASHES.json PATCH-SHA256SUMS.txt SHA256SUMS.json | |
| if ! git diff --cached --quiet; then | |
| git commit --amend --no-edit | |
| fi | |
| python scripts/release_evidence_fence.py validate \ | |
| --manifest manifest.json \ | |
| --root . \ | |
| --evidence /tmp/release-generation.json | |
| git push origin HEAD:main | |
| - name: Verify exact published main | |
| shell: bash | |
| run: | | |
| git fetch origin main | |
| git reset --hard origin/main | |
| git clean -fdx | |
| if [ -f package-lock.json ]; then | |
| npm ci --ignore-scripts --no-audit --no-fund | |
| else | |
| npm install --ignore-scripts --no-audit --no-fund --package-lock=false | |
| fi | |
| npm test | |
| node engine_v2/tests/provider-catalog.test.mjs | |
| python scripts/validate_activation_preservation.py | |
| python scripts/validate_language_projection.py | |
| python scripts/validate_release_integrity.py | |
| python scripts/release_evidence_fence.py validate \ | |
| --manifest manifest.json \ | |
| --root . \ | |
| --evidence /tmp/release-generation.json | |
| git diff --exit-code |