awdk 3.6.0__tar.gz

awdk-3.6.0/.dockerignore

@@ -0,0 +1,20 @@
+# Moat boundary (audit 2026-06-12 P1-5): premium identities must never enter the
+# docker build context — they would land in image layers even if the installed
+# package excludes them. Only the free-tier aither.yaml ships.
+adk/identities/*
+!adk/identities/aither.yaml
+
+# Never ship credentials or build junk into the context
+.env
+.env.*
+*.env
+!*.env.example
+*.key
+*.pem
+.git
+dist
+build
+*.egg-info
+__pycache__
+tests
+.pytest_cache

awdk-3.6.0/.env.example

@@ -0,0 +1,61 @@
+# AitherADK Environment Configuration
+# Copy to .env and customize for your installation
+
+# ────────────────────────────────────────────────────────────────────────────
+# Room Service Configuration
+# ────────────────────────────────────────────────────────────────────────────
+
+# Room launch target — controls how `adk up` starts the Room service.
+#
+# Supported values:
+#   - Unset (default): Consumer SKU behavior
+#     * Check for aither-room package (installed)
+#     * Check for aither-room repo (dev checkout)
+#     * Fall back to binary download from GitHub Releases (room_launcher.py)
+#
+#   - "apps.AitherRoom.room_service:app" (development unlock)
+#     * Runs the Room service from AitherOS repo checkout
+#     * Requires AITHER_ROOM_LAUNCH_TARGET to be set explicitly
+#     * Uvicorn hot-reloads on code changes
+#
+# Consumer default (binary): ~1MB, runs standalone on env vars
+# Dev default (Python module): Full AitherOS runtime
+#
+# AITHER_ROOM_LAUNCH_TARGET="apps.AitherRoom.room_service:app"
+
+# ────────────────────────────────────────────────────────────────────────────
+# Shell Service Configuration
+# ────────────────────────────────────────────────────────────────────────────
+
+# Backend selection for AitherShell
+# Supported: auto, ollama, openai, anthropic, gateway
+# AITHER_SHELL_BACKEND=auto
+
+# API key for Anthropic or OpenAI (if using cloud backend)
+# AITHER_API_KEY=sk-...
+
+# Reasoning backend (if using a reasoning model)
+# AITHER_REASONING_BACKEND=openai
+# AITHER_REASONING_API_KEY=sk-...
+
+# Custom inference URL (if running local vLLM or Ollama on non-standard port)
+# AITHER_INFERENCE_URL=http://localhost:8000
+
+# ────────────────────────────────────────────────────────────────────────────
+# Validation & Security
+# ────────────────────────────────────────────────────────────────────────────
+
+# Require SHA256 checksum verification for downloaded binaries
+# Supported: 1, true, yes (or unset for optional)
+# AITHER_SHELL_REQUIRE_CHECKSUM=1
+# AITHER_ROOM_REQUIRE_CHECKSUM=1
+
+# ────────────────────────────────────────────────────────────────────────────
+# Server Configuration
+# ────────────────────────────────────────────────────────────────────────────
+
+# Uncomment to run the ADK workspace server on a custom port
+# ADK_SERVER_PORT=8080
+
+# Enable hotreload (development only)
+# ADK_SERVER_RELOAD=1

awdk-3.6.0/.github/workflows/docker-publish.yml

@@ -0,0 +1,61 @@
+name: Publish Docker Image
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: aitherium/adk-node
+
+jobs:
+  # Audit 2026-06-12 P1-5: the image build had NO moat gate — a Dockerfile or
+  # build-config change could ship premium identities / nanogpt in image layers.
+  # Same hard gate as pypi-publish.yml: nothing publishes unless the built wheel
+  # AND sdist are clean.
+  moat-guard:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Build artifacts
+        run: |
+          python -m pip install --upgrade pip build
+          python -m build
+      - name: Moat boundary check (wheel + sdist)
+        run: python scripts/check_moat_boundary.py
+
+  build-and-push:
+    needs: moat-guard
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: docker/metadata-action@v5
+        id: meta
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

awdk-3.6.0/.github/workflows/pypi-publish.yml

@@ -0,0 +1,57 @@
+name: Publish to PyPI
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+
+jobs:
+  moat-guard:
+    # Hard gate: never publish a wheel that leaks the internal moat or fails
+    # the fail-closed licensing contract. `publish` depends on this passing.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install build + test deps
+        run: pip install build pytest pytest-asyncio pytest-timeout cryptography
+
+      - name: Build wheel
+        run: python -m build
+
+      - name: Inspect wheel for moat leaks
+        run: python scripts/check_moat_boundary.py
+
+      - name: Run moat + licensing tests offline
+        env:
+          AITHER_GENESIS_URL: ""
+          AITHER_CHRONICLE_URL: ""
+          AITHER_PORTAL_URL: ""
+        run: python -m pytest tests/test_licensing.py tests/test_moat_boundary.py -q
+
+  publish:
+    needs: moat-guard
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write  # trusted publishing
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Build package
+        run: |
+          pip install build
+          python -m build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          skip-existing: true

awdk-3.6.0/.github/workflows/release-shell-cli.yml

@@ -0,0 +1,238 @@
+name: Build & Release AitherShell CLI
+
+on:
+  push:
+    tags: ["shell-cli-v*"]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version tag (e.g. shell-cli-v1.2.3)"
+        required: true
+
+permissions:
+  contents: write  # For creating GitHub releases and updating tags
+
+jobs:
+  build-python-shell:
+    name: Build AitherShell (Python) - ${{ matrix.platform }}
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      matrix:
+        include:
+          - runner: windows-latest
+            platform: win-x64
+            binary_name: aither-shell-win64.exe
+            entry_point: adk/cli.py
+
+          - runner: ubuntu-latest
+            platform: linux-x64
+            binary_name: aither-shell-linux-x64
+            entry_point: adk/cli.py
+
+          - runner: macos-latest
+            platform: mac-x64
+            binary_name: aither-shell-macos-x64
+            entry_point: adk/cli.py
+
+          - runner: macos-latest-xlarge
+            platform: mac-arm64
+            binary_name: aither-shell-macos-arm64
+            entry_point: adk/cli.py
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install build dependencies
+        run: pip install PyInstaller
+
+      - name: Install package dependencies
+        run: pip install -e .
+
+      - name: Build executable
+        run: python packaging/build_executable.py
+
+      - name: Copy binary to staging
+        shell: bash
+        run: |
+          mkdir -p staging
+          if [ "${{ runner.os }}" = "Windows" ]; then
+            cp dist/aither.exe staging/${{ matrix.binary_name }}
+          else
+            cp dist/aither staging/${{ matrix.binary_name }}
+          fi
+          ls -lh staging/
+
+      - name: Moat scan on built binary
+        # Audit 2026-06-12 P1-5: the binary is built from the full source tree
+        # (pip install -e .), which contains premium identities — verify none of
+        # the moat got bundled into the PyInstaller artifact.
+        shell: bash
+        run: |
+          python - <<'PYEOF'
+          import pathlib
+          import sys
+          binp = pathlib.Path("staging") / "${{ matrix.binary_name }}"
+          data = binp.read_bytes()
+          markers = [
+              b"adk/nanogpt", b"nanogpt.py",
+              b"identities/hydra", b"identities/apollo", b"identities/athena",
+              b"identities/demiurge", b"identities/morgana", b"identities/prometheus",
+          ]
+          bad = [m.decode() for m in markers if m in data]
+          if bad:
+              print(f"MOAT LEAK in {binp.name}: {bad}", file=sys.stderr)
+              sys.exit(1)
+          print(f"binary moat scan OK ({binp.name}, {len(data)} bytes)")
+          PYEOF
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: shell-cli-${{ matrix.platform }}
+          path: staging/${{ matrix.binary_name }}
+          retention-days: 1
+
+  # TODO: External TypeScript Shell Build
+  # The TypeScript shell-cli binaries (high-perf compiled variant)
+  # are built from a separate Aitherium/shell-cli repository.
+  # Wire this job when the external build is available:
+  #
+  # build-typescript-shell:
+  #   name: Build AitherShell (TypeScript) - ${{ matrix.platform }}
+  #   runs-on: ${{ matrix.runner }}
+  #   # Would build from Aitherium/shell-cli repo and produce the
+  #   # same binary naming (aither-shell-{win64,linux-x64,macos-arm64,macos-x64})
+  #   # For now, Python PyInstaller binaries are used.
+
+  create-checksums:
+    name: Generate SHA256 Checksums
+    needs: build-python-shell
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: all-binaries
+
+      - name: List artifacts
+        run: |
+          find all-binaries -type f
+          ls -lhR all-binaries
+
+      - name: Generate checksums.sha256
+        run: |
+          cd all-binaries
+          find . -type f | while read f; do
+            sha256sum "$f"
+          done | sed 's|./shell-cli-[^/]*/||' | sort > ../checksums.sha256
+          cat ../checksums.sha256
+
+      - name: Upload checksums
+        uses: actions/upload-artifact@v4
+        with:
+          name: checksums
+          path: checksums.sha256
+          retention-days: 1
+
+  publish-release:
+    name: Create GitHub Release
+    needs: [build-python-shell, create-checksums]
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Determine version
+        id: version
+        run: |
+          if [ "${{ github.event_name }}" = "push" ]; then
+            VERSION="${{ github.ref }}"
+            VERSION="${VERSION##*/}"
+          else
+            VERSION="${{ github.event.inputs.version }}"
+          fi
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+          echo "Version: ${VERSION}"
+
+      - name: Download all build artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: release-assets
+
+      - name: Collect release binaries
+        run: |
+          mkdir -p release-files
+          find release-assets -type f -name "aither-shell-*" | while read f; do
+            basename="$(basename "$f")"
+            cp "$f" "release-files/${basename}"
+          done
+          cp release-assets/checksums/checksums.sha256 release-files/ || true
+          ls -lh release-files/
+
+      - name: Create Release
+        uses: softprops/action-gh-release@v1
+        with:
+          tag_name: ${{ steps.version.outputs.version }}
+          name: AitherShell ${{ steps.version.outputs.version }}
+          draft: false
+          prerelease: false
+          files: release-files/*
+
+  embed-binaries-in-package:
+    name: Embed Binaries in Python Package
+    needs: [build-python-shell, create-checksums]
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download all build artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: release-assets
+
+      - name: Populate shell_binaries directory
+        run: |
+          mkdir -p adk/shell_binaries/{win-x64,linux-x64,mac-arm64,mac-x64}
+          cp release-assets/shell-cli-win-x64/aither-shell-win64.exe \
+             adk/shell_binaries/win-x64/ || true
+          cp release-assets/shell-cli-linux-x64/aither-shell-linux-x64 \
+             adk/shell_binaries/linux-x64/ || true
+          cp release-assets/shell-cli-mac-arm64/aither-shell-macos-arm64 \
+             adk/shell_binaries/mac-arm64/ || true
+          cp release-assets/shell-cli-mac-x64/aither-shell-macos-x64 \
+             adk/shell_binaries/mac-x64/ || true
+          find adk/shell_binaries -type f -ls
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Build wheel with embedded binaries
+        run: |
+          pip install build
+          python -m build
+
+      - name: Upload wheel
+        uses: actions/upload-artifact@v4
+        with:
+          name: awdk-wheel
+          path: dist/aither_adk-*.whl
+          retention-days: 7
+
+  # NOTE: The wheel with embedded binaries is NOT published to PyPI
+  # automatically (to avoid binary bloat on every release). Instead:
+  # - GitHub Release has downloadable binaries + checksums.sha256
+  # - The main awdk wheel is published to PyPI (PyPI publish
+  #   workflow triggers on v* tags, not shell-cli-v* tags)
+  # - Consumers can either:
+  #   a. Use `adk shell` which downloads from GitHub on first run
+  #   b. Use `adk shell --install` to download and cache
+  #   c. Install the wheel with embedded binaries locally from the GH Release

awdk-3.6.0/.gitignore

@@ -0,0 +1,14 @@
+__pycache__/
+*.pyc
+*.pyo
+.pytest_cache/
+*.egg-info/
+dist/
+build/
+.eggs/
+*.egg
+.env
+.adk/
+
+# Stray pytest output — was committed once and published with a username in it
+test_results.txt