autonomous-agent-architecture 0.3.1__tar.gz

autonomous_agent_architecture-0.3.1/.deepeval/.deepeval_telemetry.txt

@@ -0,0 +1,2 @@
+DEEPEVAL_ID=be87251b-1d9b-4163-b8ce-b7fd06ac3aa4
+DEEPEVAL_STATUS=new

autonomous_agent_architecture-0.3.1/.dockerignore

@@ -0,0 +1,8 @@
+.git
+.venv
+site
+dist
+**/__pycache__
+tests
+docs
+*.db

autonomous_agent_architecture-0.3.1/.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

autonomous_agent_architecture-0.3.1/.github/workflows/ci.yml

@@ -0,0 +1,406 @@
+name: ci
+
+# Lint + type-check, then the full test suite against REAL Postgres and Redis, on Python 3.11 and 3.12.
+# (Docs have their own workflow, docs.yml, which also runs the docs tests before publishing.)
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 5 * * 1" # weekly: do the memory libraries' newest releases still match our adapters?
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - run: uv sync --frozen
+      - name: ruff (lint)
+        run: uv run ruff check .
+      - name: ruff (format)
+        run: uv run ruff format --check .
+      - name: pyright (src, examples, scripts)
+        run: uv run pyright
+
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.11", "3.12", "3.13"]
+    services:
+      postgres:
+        image: pgvector/pgvector:pg16
+        env:
+          POSTGRES_PASSWORD: aaa
+        ports: ["5432:5432"]
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+      redis:
+        image: redis:7
+        ports: ["6379:6379"]
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    env:
+      # The suite creates a throwaway database per test and isolates Redis by key prefix.
+      AAA_TEST_POSTGRES_URL: postgresql://postgres:aaa@localhost:5432/postgres
+      AAA_TEST_REDIS_URL: redis://localhost:6379/0
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+          python-version: ${{ matrix.python }}
+      - run: uv sync --frozen
+      - name: tests
+        # -v names every test, and a test stuck for 2 minutes dumps all thread stacks, so a hang is
+        # diagnosable from the log instead of just a cancelled job.
+        run: uv run pytest -v -p no:cacheprovider -o faulthandler_timeout=120
+
+  eval-adapters:
+    # DeepEval, Ragas and Inspect AI are large and pin clashing dependencies, so each gets its own environment. Their metrics run
+    # their REAL flows here against a fake judge model (tests/unit/test_eval_adapters.py).
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - lib: autoevals
+            packages: "autoevals openai"
+            keyword: Autoevals
+          - lib: deepeval
+            packages: "deepeval"
+            keyword: DeepEval
+          - lib: ragas
+            # ragas 0.4.x does not import against langchain 1.x (langchain_community.chat_models.vertexai, ContextOverflowError)
+            packages: "ragas 'langchain-community<0.4' 'langchain-core<1' 'langchain-openai<1'"
+            keyword: Ragas
+          - lib: inspect-ai
+            packages: "inspect-ai"
+            keyword: Inspect
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - run: uv sync --frozen
+      - name: Install ${{ matrix.lib }}
+        run: uv pip install ${{ matrix.packages }}
+      - name: Adapter tests
+        run: uv run --no-sync pytest -v -p no:cacheprovider tests/unit/test_eval_adapters.py -k ${{ matrix.keyword }}
+
+  guard-adapters:
+    # Presidio runs for real (with a small spaCy model); the OpenAI SDK validates the shape of the moderation replies we parse.
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - run: uv sync --frozen
+      - name: Install Presidio, its spaCy model, and the OpenAI SDK
+        run: |
+          uv pip install presidio-analyzer presidio-anonymizer openai pip
+          uv run --no-sync python -m spacy download en_core_web_sm
+      - name: Adapter tests
+        run: uv run --no-sync pytest -v -p no:cacheprovider tests/unit/test_guard.py tests/unit/test_guard_adapters.py tests/unit/test_multimodal.py
+
+  vector-adapters:
+    # pgvector (real PostgreSQL with the extension) and Qdrant (its in-process mode) run the shared contract suite.
+    # AAA_REQUIRE_PGVECTOR turns "extension not available" from a skip into a failure, so this job cannot go green by skipping.
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    services:
+      postgres:
+        image: pgvector/pgvector:pg16
+        env:
+          POSTGRES_PASSWORD: aaa
+        ports: ["5432:5432"]
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    env:
+      AAA_TEST_POSTGRES_URL: postgresql://postgres:aaa@localhost:5432/postgres
+      AAA_REQUIRE_PGVECTOR: "1"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - run: uv sync --frozen --extra qdrant --extra pdf
+      - name: Vector store tests
+        run: uv run pytest -v -p no:cacheprovider tests/unit/test_ingest.py tests/unit/test_vector.py tests/unit/test_vector_contract.py tests/unit/test_vector_backends.py tests/unit/test_vector_hybrid.py
+      - name: Newest releases (scheduled and manual runs only)
+        if: github.event_name != 'pull_request' && github.event_name != 'push'
+        run: |
+          uv pip install --upgrade qdrant-client asyncpg
+          uv run --no-sync pytest -v -p no:cacheprovider tests/unit/test_vector_contract.py tests/unit/test_vector_backends.py
+
+  embedded-vector:
+    # Embedded vector stores run the shared contract suite for real, one library per leg (Chroma is large).
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        lib: [sqlite-vec, lancedb, chromadb]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - run: uv sync --frozen
+      - name: Install ${{ matrix.lib }}
+        run: |
+          uv pip install ${{ matrix.lib }}
+          uv run --no-sync python -c "import ${{ matrix.lib == 'sqlite-vec' && 'sqlite_vec' || matrix.lib }}"
+      - name: Vector store tests
+        run: uv run --no-sync pytest -v -p no:cacheprovider tests/unit/test_vector_contract.py tests/unit/test_vector_backends.py tests/unit/test_vector_hybrid.py tests/unit/test_ingest.py -k "not pgvector and not postgres"
+      - name: Newest release (scheduled and manual runs only)
+        if: github.event_name != 'pull_request' && github.event_name != 'push'
+        run: |
+          uv pip install --upgrade ${{ matrix.lib }}
+          uv run --no-sync pytest -v -p no:cacheprovider tests/unit/test_vector_contract.py tests/unit/test_vector_backends.py tests/unit/test_vector_hybrid.py tests/unit/test_ingest.py -k "not pgvector and not postgres"
+
+  pinecone-local:
+    # The official Pinecone Local emulator (data plane), against the newest SDK and the previous major. Not a live Pinecone account.
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        sdk: ["pinecone", "'pinecone[asyncio]<8'"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - run: uv sync --frozen
+      - name: Start Pinecone Local and create an index
+        run: |
+          docker run -d --name pinecone-local -e PORT=5080 -e PINECONE_HOST=localhost -p 5080-5090:5080-5090 --platform linux/amd64 ghcr.io/pinecone-io/pinecone-local:latest
+          for i in $(seq 1 30); do curl -sf localhost:5080/indexes && break; sleep 2; done
+          host=$(curl -s -X POST localhost:5080/indexes -H 'Content-Type: application/json' -H 'Api-Key: pclocal' -H 'X-Pinecone-API-Version: 2025-04' \
+            -d '{"name":"contract","dimension":4,"metric":"cosine","spec":{"serverless":{"cloud":"aws","region":"us-east-1"}}}' | python3 -c "import sys,json; print(json.load(sys.stdin)['host'])")
+          echo "AAA_TEST_PINECONE_HOST=http://$host" >> "$GITHUB_ENV"
+      - name: Install the SDK
+        run: uv pip install ${{ matrix.sdk }}
+      - name: Pinecone tests
+        run: uv run --no-sync pytest -v -p no:cacheprovider tests/unit/test_vector_contract.py tests/unit/test_vector_backends.py tests/unit/test_ingest.py -k "pinecone or Pinecone or each_real"
+
+  guard-adapters-more:
+    # Bedrock (botocore validates request and response against the service model), Guardrails AI and NeMo Guardrails (real flows).
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - lib: boto3
+            packages: "boto3"
+            keyword: Bedrock
+          - lib: guardrails-ai
+            packages: "guardrails-ai"
+            keyword: GuardrailsAI
+          - lib: nemoguardrails
+            packages: "nemoguardrails"
+            keyword: NeMo
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - run: uv sync --frozen
+      - name: Install ${{ matrix.lib }}
+        run: uv pip install ${{ matrix.packages }}
+      - name: Adapter tests
+        run: uv run --no-sync pytest -v -p no:cacheprovider tests/unit/test_guard_adapters.py -k ${{ matrix.keyword }}
+      - name: Newest release (scheduled and manual runs only)
+        if: github.event_name != 'pull_request' && github.event_name != 'push'
+        run: |
+          uv pip install --upgrade ${{ matrix.packages }}
+          uv run --no-sync pytest -v -p no:cacheprovider tests/unit/test_guard_adapters.py -k ${{ matrix.keyword }}
+
+  native-providers:
+    # The Anthropic and Gemini clients speak the vendors' HTTP APIs without their SDKs; here the SDKs' own types validate the
+    # requests, replies and stream events we build and parse (and the weekly run catches the vendors changing them).
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        sdk: [anthropic, google-genai]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - run: uv sync --frozen
+      - name: Install ${{ matrix.sdk }}
+        run: uv pip install ${{ matrix.sdk }}
+      - name: Provider tests
+        run: uv run --no-sync pytest -v -p no:cacheprovider tests/unit/test_native_providers.py
+      - name: Newest release (scheduled and manual runs only)
+        if: github.event_name != 'pull_request' && github.event_name != 'push'
+        run: |
+          uv pip install --upgrade ${{ matrix.sdk }}
+          uv run --no-sync pytest -v -p no:cacheprovider tests/unit/test_native_providers.py
+
+  builtin-tools:
+    # The sandbox runs against real Docker (network denied, memory/pid/timeout/output limits) and the search provider against a real SearXNG.
+    # AAA_REQUIRE_DOCKER turns "no Docker" into a failure, so this job cannot go green by skipping.
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      AAA_REQUIRE_DOCKER: "1"
+      AAA_TEST_SEARXNG_URL: http://localhost:8888
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - run: uv sync --frozen
+      - name: Start SearXNG with JSON output enabled
+        run: |
+          mkdir -p searx && printf 'use_default_settings: true\nserver:\n  secret_key: "ci-only-secret"\n  limiter: false\nsearch:\n  formats:\n    - html\n    - json\n' > searx/settings.yml
+          docker run -d --name searxng -p 8888:8080 -v "$PWD/searx/settings.yml:/etc/searxng/settings.yml:ro" searxng/searxng:latest
+          for i in $(seq 1 40); do curl -sf "http://localhost:8888/search?q=test&format=json" >/dev/null && break; sleep 3; done
+      - name: Built-in tool and sandbox tests
+        run: uv run pytest -v -p no:cacheprovider tests/unit/test_builtin_tools.py tests/unit/test_sandbox.py
+
+  server:
+    # aaa-server against a real Redis (the shared rate limiter) and as a built, installed package (the console script works from a clean venv).
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    services:
+      redis:
+        image: redis:7
+        ports: ["6379:6379"]
+        options: >-
+          --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 10
+    env:
+      AAA_TEST_REDIS_URL: redis://localhost:6379/0
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - run: uv sync --frozen
+      - name: Server tests (MCP and A2A tests skip without their SDKs)
+        run: uv run pytest -v -p no:cacheprovider tests/server
+      - name: MCP and A2A against the official SDK clients
+        run: |
+          uv pip install a2a-sdk "mcp>=1.12,<3"
+          uv run --no-sync pytest -v -p no:cacheprovider tests/server/test_a2a.py tests/server/test_mcp_http.py tests/unit/test_mcp_server.py
+      - name: Build both packages and check their metadata
+        run: |
+          uv build --all-packages
+          uvx twine check --strict dist/*
+      - name: The built wheels install together and the console scripts run
+        run: |
+          uv venv /tmp/smoke --python 3.12
+          uv pip install --python /tmp/smoke/bin/python dist/*.whl
+          /tmp/smoke/bin/aaa-server serve --help
+          /tmp/smoke/bin/aaa --help
+
+  score-backends:
+    # Scores delivered to a real Phoenix and a real Langfuse (2.x: one container plus Postgres). LangSmith is mock-only.
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      AAA_TEST_PHOENIX_URL: http://localhost:6006
+      AAA_TEST_LANGFUSE_URL: http://localhost:3100
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - run: uv sync --frozen --extra otel
+      - name: Start Phoenix and Langfuse
+        run: |
+          docker run -d --name phx -p 6006:6006 arizephoenix/phoenix:latest
+          docker network create lfnet
+          docker run -d --name lfpg --network lfnet -e POSTGRES_PASSWORD=pg -e POSTGRES_DB=lf postgres:16
+          sleep 6
+          docker run -d --name lf --network lfnet -p 3100:3000 -e DATABASE_URL=postgresql://postgres:pg@lfpg:5432/lf -e NEXTAUTH_SECRET=s -e SALT=s -e NEXTAUTH_URL=http://localhost:3100 -e TELEMETRY_ENABLED=false -e LANGFUSE_INIT_ORG_ID=o -e LANGFUSE_INIT_PROJECT_ID=p -e LANGFUSE_INIT_PROJECT_PUBLIC_KEY=pk-lf-test -e LANGFUSE_INIT_PROJECT_SECRET_KEY=sk-lf-test -e LANGFUSE_INIT_USER_EMAIL=a@b.co -e LANGFUSE_INIT_USER_PASSWORD=password123 -e LANGFUSE_INIT_USER_NAME=a langfuse/langfuse:2
+          for i in $(seq 1 40); do curl -sf localhost:6006/healthz && curl -sf localhost:3100/api/public/health && break; sleep 3; done
+          sleep 5; docker restart lf; for i in $(seq 1 30); do curl -sf localhost:3100/api/public/health && break; sleep 2; done; sleep 5
+      - name: Score delivery tests
+        run: uv run pytest -v -p no:cacheprovider tests/unit/test_eval_m9.py
+
+  container:
+    # The image builds, runs as a non-root user next to Postgres, and serves an authenticated run end to end.
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - name: Start the stack
+        run: |
+          export AAA_API_KEY=ci-key-$(openssl rand -hex 8)
+          echo "AAA_API_KEY=$AAA_API_KEY" >> "$GITHUB_ENV"
+          docker compose up -d --build
+          for i in $(seq 1 40); do curl -sf localhost:8000/healthz && break; sleep 3; done
+      - name: A run completes and unauthenticated calls are refused
+        run: |
+          set -e
+          R=$(curl -sf -X POST localhost:8000/v1/runs -H "Authorization: Bearer $AAA_API_KEY" -H 'Content-Type: application/json' -d '{"algo":"agent","input":{"task":"hi"}}' | python3 -c "import json,sys; print(json.load(sys.stdin)['run_id'])")
+          sleep 3
+          curl -sf localhost:8000/v1/runs/$R -H "Authorization: Bearer $AAA_API_KEY" | grep -q '"status":"completed"'
+          test "$(curl -s -o /dev/null -w '%{http_code}' localhost:8000/v1/runs)" = 401
+          test "$(docker compose exec -T server id -u)" = 10001
+      - if: failure()
+        run: docker compose logs
+      - run: docker compose down -v
+
+  adapters:
+    # The memory adapters are tested against stand-ins; this job replays their calls against the REAL
+    # Mem0, Graphiti and LangGraph signatures (tests/unit/test_memory_signatures.py), which are skipped
+    # in the main job because those libraries are not dev dependencies.
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - name: Locked versions
+        run: |
+          uv sync --frozen --extra mem0 --extra graphiti --extra langgraph --extra langmem --extra mcp --extra otel
+          uv run pytest -v -p no:cacheprovider tests/unit/test_otel.py tests/unit/test_memory_signatures.py tests/unit/test_memory_adapters.py tests/unit/test_memory_contract.py tests/unit/test_mcp.py tests/unit/test_mcp_server.py tests/server/test_mcp_http.py tests/unit/test_examples.py -k "not cluster"
+      - name: OpenAI SDK types (conformance of the Responses client; not a runtime dependency)
+        run: |
+          uv pip install openai
+          uv run --no-sync pytest -v -p no:cacheprovider tests/unit/test_openai_conformance.py
+      - name: MCP SDK 1.x (the lock resolves 2.x; both are supported)
+        run: |
+          uv pip install "mcp<2"
+          uv run --no-sync pytest -v -p no:cacheprovider tests/unit/test_mcp.py tests/unit/test_mcp_server.py
+      - name: Newest releases (scheduled and manual runs only)
+        if: github.event_name != 'pull_request' && github.event_name != 'push'
+        run: |
+          uv pip install --upgrade mem0ai graphiti-core langgraph langmem mcp openai opentelemetry-sdk opentelemetry-exporter-otlp-proto-http opentelemetry-semantic-conventions
+          uv run --no-sync pytest -v -p no:cacheprovider tests/unit/test_otel.py tests/unit/test_memory_signatures.py tests/unit/test_mcp.py tests/unit/test_openai_conformance.py

autonomous_agent_architecture-0.3.1/.github/workflows/docs.yml

@@ -0,0 +1,64 @@
+name: docs
+
+# Builds the documentation (strictly) and publishes it to GitHub Pages on every push to master that
+# touches the docs, the examples they embed, the source their API reference is generated from, or
+# this workflow. A broken example or an invalid fragment blocks publishing.
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - "docs/**"
+      - "examples/**"
+      - "src/**"
+      - "packages/**"
+      - "mkdocs.yml"
+      - "pyproject.toml"
+      - "uv.lock"
+      - "LICENSE"
+      - ".github/workflows/docs.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      - name: Install (docs extra + dev group)
+        run: uv sync --extra docs --frozen
+
+      - name: Every embedded example runs, and every inline fragment is valid Python
+        run: uv run pytest -q -p no:cacheprovider tests/unit/test_examples.py tests/unit/test_docs_snippets.py
+
+      - name: "Build (strict - warnings fail the build)"
+        run: uv run mkdocs build --strict
+
+      - uses: actions/configure-pages@v5
+
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: site
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@v4

autonomous_agent_architecture-0.3.1/.github/workflows/release-server.yml

@@ -0,0 +1,92 @@
+name: release-server
+
+# Publishes `aaa-server` to PyPI when a GitHub Release tagged server-vX.Y.Z is published (Trusted Publishing, no token stored).
+# aaa-server is versioned and released independently of the library (release.yml handles v* tags).
+# One-time setup: create the `aaa-server` project on PyPI with a pending trusted publisher for this repository,
+# workflow `release-server.yml`, environment `pypi-server`.
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    if: github.event_name != 'release' || startsWith(github.event.release.tag_name, 'server-v')
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    outputs:
+      already_published: ${{ steps.exists.outputs.published }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      - name: Tag, version and dependency floor agree
+        run: |
+          uv run --no-project python - <<'PY'
+          import os, tomllib
+          meta = tomllib.load(open("packages/aaa-server/pyproject.toml", "rb"))["project"]
+          tag = os.environ.get("GITHUB_REF_NAME", "")
+          if os.environ.get("GITHUB_EVENT_NAME") == "release" and tag != "server-v" + meta["version"]:
+              raise SystemExit(f"release tag {tag!r} does not match aaa-server version {meta['version']!r}")
+          core = [d for d in meta["dependencies"] if d.startswith("autonomous-agent-architecture")]
+          if any("dev" in d for d in core):
+              raise SystemExit(f"the dependency on the library is still a development floor: {core}")
+          PY
+      - name: Is this version already on PyPI?
+        id: exists
+        run: |
+          version="$(uv run --no-project python -c "import tomllib; print(tomllib.load(open('packages/aaa-server/pyproject.toml','rb'))['project']['version'])")"
+          code="$(curl -s -o /dev/null -w '%{http_code}' "https://pypi.org/pypi/aaa-server/${version}/json")"
+          if [ "$code" = "200" ]; then echo "published=true" >> "$GITHUB_OUTPUT"; else echo "published=false" >> "$GITHUB_OUTPUT"; fi
+      - run: uv build --package aaa-server
+      - run: uvx twine check --strict dist/*
+      - name: The built wheel installs from PyPI's library and runs
+        run: |
+          uv venv /tmp/smoke --python 3.12
+          uv pip install --python /tmp/smoke/bin/python dist/*.whl
+          /tmp/smoke/bin/aaa-server serve --help
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+
+  test:
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    services:
+      redis:
+        image: redis:7
+        ports: ["6379:6379"]
+        options: >-
+          --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 10
+    env:
+      AAA_TEST_REDIS_URL: redis://localhost:6379/0
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - run: uv sync --frozen
+      - run: uv run ruff check . && uv run ruff format --check . && uv run pyright
+      - run: uv run pytest -v -p no:cacheprovider tests/server
+
+  publish-pypi:
+    if: github.event_name == 'release' && needs.build.outputs.already_published != 'true'
+    needs: [build, test]
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi-server
+      url: https://pypi.org/p/aaa-server
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1