ship: phase-05 evidence-ui-and-demo-dry-run (v1.0.5)

Squash merge of phase/05-evidence-ui-and-demo-dry-run; evidence-ui/index.html + run_demo.sh 4-act simulation + verify_phase05.sh; demo live at acdl-evidence raw URL.
This commit was merged in pull request #5.
This commit is contained in:
2026-07-21 13:53:54 +00:00
parent 1415c85d35
commit 0672edfc3f
9 changed files with 910 additions and 62 deletions
+258
View File
@@ -0,0 +1,258 @@
#!/usr/bin/env bash
# scripts/run_demo.sh — Phase 05 dry-run simulation of the 4 demo acts (T-5.2).
#
# Simulates the full 4-act demo locally (no act_runner) by calling the core
# scripts in sequence and writing hash-chained evidence events to audit.json,
# then optionally uploads audit.json + evidence-ui/index.html to acdl-evidence
# main via finalize_evidence.py (D-031, D-033).
#
# Usage: scripts/run_demo.sh [--no-upload]
# --no-upload skip the Gitea API calls (useful for testing without a token)
set -uo pipefail
# -----------------------------------------------------------------------------
# Parse args
# -----------------------------------------------------------------------------
UPLOAD=1
for arg in "$@"; do
case "$arg" in
--no-upload)
UPLOAD=0
;;
*)
echo "run_demo.sh: unknown argument: $arg" >&2
echo "usage: scripts/run_demo.sh [--no-upload]" >&2
exit 2
;;
esac
done
# -----------------------------------------------------------------------------
# Paths
# -----------------------------------------------------------------------------
# Repo root = location of this script's parent dir.
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
WORKDIR="/tmp/acdl_demo_run"
AUDIT="$WORKDIR/audit.json"
CONTRACTS="$WORKDIR/contracts"
# Track failures so we can return non-zero at the end (we do NOT use set -e
# because policy_checker intentionally exits 1 on Act 4).
FAIL=0
# -----------------------------------------------------------------------------
# Helpers
# -----------------------------------------------------------------------------
# Write one evidence event. Args: <stage> <event-text>
ev() {
local stage="$1"
local text="$2"
if ! python3 "$SCRIPT_DIR/evidence_writer.py" --stage "$stage" --event "$text" --audit "$AUDIT"; then
echo "run_demo.sh: evidence_writer failed for stage=$stage text=$text" >&2
FAIL=1
fi
}
# Run a contract through the Act 2/3 pipeline (policy -> confidence -> executor).
# Assumes the contract already passed policy (caller verifies). Writes the
# standard 4-event sequence. Args: <act-label> <dev-applied-event-text>
run_passing_pipeline() {
local dev_event="$1"
ev dev "$dev_event"
ev qa "qa approved"
ev prod "prod approved"
ev finalize "finalize: audit.json committed to acdl-evidence"
}
# -----------------------------------------------------------------------------
# Setup working directory
# -----------------------------------------------------------------------------
mkdir -p "$CONTRACTS"
rm -f "$AUDIT"
# -----------------------------------------------------------------------------
# Initialize audit (genesis)
# -----------------------------------------------------------------------------
echo "== run_demo.sh: initializing audit at $AUDIT =="
ev genesis "audit log initialized"
# -----------------------------------------------------------------------------
# Act 1 — Friction
# -----------------------------------------------------------------------------
echo "== Act 1 — Friction =="
ev dev "Act 1 Friction: manual 2-week deployment (legacy process)"
# -----------------------------------------------------------------------------
# Act 2 — Developer Self-Service
# -----------------------------------------------------------------------------
echo "== Act 2 — Developer Self-Service =="
cat > "$CONTRACTS/act2.yaml" <<'YAML'
stack: l2-commodity-price-feed
inputs:
environment: dev
owner: platform-team
public-ingress: false
YAML
ACT2_POLICY="$(python3 "$SCRIPT_DIR/policy_checker.py" "$CONTRACTS/act2.yaml")"
ACT2_POLICY_RC=$?
echo " policy_checker: $ACT2_POLICY (rc=$ACT2_POLICY_RC)"
if [ "$ACT2_POLICY" != "POLICY_PASS" ]; then
echo "run_demo.sh: Act 2 expected POLICY_PASS, got '$ACT2_POLICY'" >&2
FAIL=1
fi
ACT2_CONF="$(python3 "$SCRIPT_DIR/confidence_signal.py" "$CONTRACTS/act2.yaml")"
echo " confidence_signal: $ACT2_CONF"
# Expected: {"score": 0.90, "reason": "POLICY_PASS"}
# mock_executor.sh resolves modules/l2/<stack>/manifest.yaml relative to its
# cwd, so it must run from the repo root. It writes state.json to its cwd;
# clean it up from the repo root afterward so no stray file is left there.
(
cd "$REPO_ROOT" && bash "$SCRIPT_DIR/mock_executor.sh" "$CONTRACTS/act2.yaml"
)
MOCK_RC=$?
rm -f "$REPO_ROOT/state.json"
if [ "$MOCK_RC" -ne 0 ]; then
echo "run_demo.sh: Act 2 mock_executor failed (rc=$MOCK_RC)" >&2
FAIL=1
fi
run_passing_pipeline "dev applied: l2-commodity-price-feed"
# -----------------------------------------------------------------------------
# Act 3 — Citizen Developer
# -----------------------------------------------------------------------------
echo "== Act 3 — Citizen Developer =="
ISSUE_BODY="We need to ingest natural gas prices from Platts and report on compliance for the trading desk."
if ! python3 "$SCRIPT_DIR/l3b_agent_stub.py" "$ISSUE_BODY" -o "$CONTRACTS/act3.yaml"; then
echo "run_demo.sh: l3b_agent_stub failed for Act 3" >&2
FAIL=1
fi
# Confirm the generated contract's stack (D-008: gas/price matches first).
ACT3_STACK="$(python3 -c "import yaml,sys; print(yaml.safe_load(open('$CONTRACTS/act3.yaml'))['stack'])" 2>/dev/null || echo "")"
echo " l3b generated stack: $ACT3_STACK"
if [ "$ACT3_STACK" != "l2-commodity-price-feed" ]; then
echo "run_demo.sh: WARNING Act 3 expected stack l2-commodity-price-feed, got '$ACT3_STACK'" >&2
# Continue anyway per the task spec.
fi
ACT3_POLICY="$(python3 "$SCRIPT_DIR/policy_checker.py" "$CONTRACTS/act3.yaml")"
ACT3_POLICY_RC=$?
echo " policy_checker: $ACT3_POLICY (rc=$ACT3_POLICY_RC)"
if [ "$ACT3_POLICY" != "POLICY_PASS" ]; then
echo "run_demo.sh: Act 3 expected POLICY_PASS, got '$ACT3_POLICY'" >&2
FAIL=1
fi
ACT3_CONF="$(python3 "$SCRIPT_DIR/confidence_signal.py" "$CONTRACTS/act3.yaml")"
echo " confidence_signal: $ACT3_CONF"
(
cd "$REPO_ROOT" && bash "$SCRIPT_DIR/mock_executor.sh" "$CONTRACTS/act3.yaml"
)
MOCK_RC=$?
rm -f "$REPO_ROOT/state.json"
if [ "$MOCK_RC" -ne 0 ]; then
echo "run_demo.sh: Act 3 mock_executor failed (rc=$MOCK_RC)" >&2
FAIL=1
fi
run_passing_pipeline "dev applied: l2-commodity-price-feed (Act 3 from issue)"
# -----------------------------------------------------------------------------
# Act 4 — Safety Net
# -----------------------------------------------------------------------------
echo "== Act 4 — Safety Net =="
cat > "$CONTRACTS/act4.yaml" <<'YAML'
stack: l2-regulatory-reporting
inputs:
environment: dev
owner: platform-team
public-ingress: true
YAML
# policy_checker exits 1 on violation; capture without failing the script.
ACT4_POLICY="$(python3 "$SCRIPT_DIR/policy_checker.py" "$CONTRACTS/act4.yaml" 2>&1 || true)"
echo " policy_checker: $ACT4_POLICY"
if [ "$ACT4_POLICY" != "POLICY_VIOLATION:PUBLIC_INGRESS" ]; then
echo "run_demo.sh: Act 4 expected POLICY_VIOLATION:PUBLIC_INGRESS, got '$ACT4_POLICY'" >&2
FAIL=1
fi
ACT4_CONF="$(python3 "$SCRIPT_DIR/confidence_signal.py" "$CONTRACTS/act4.yaml")"
echo " confidence_signal: $ACT4_CONF"
# Expected: {"score": 0.40, "reason": "POLICY_VIOLATION:PUBLIC_INGRESS"}
# Score < 0.50 -> dev rejects. Do NOT run mock_executor, do NOT write qa/prod/finalize.
ev dev "dev rejected: POLICY_VIOLATION:PUBLIC_INGRESS (confidence 0.40 < 0.50)"
# -----------------------------------------------------------------------------
# Summary
# -----------------------------------------------------------------------------
echo "== Summary =="
python3 - "$AUDIT" <<'PY'
import json, sys
audit = json.load(open(sys.argv[1]))
for e in audit:
print(f"{e['seq']} | {e['stage']} | {e['event']} | {e['hash'][:12]}")
print(f"total events: {len(audit)}")
PY
EVENT_COUNT="$(python3 -c "import json; print(len(json.load(open('$AUDIT'))))")"
echo "event count: $EVENT_COUNT"
if [ "$EVENT_COUNT" -lt 11 ]; then
echo "run_demo.sh: expected >= 11 events, got $EVENT_COUNT" >&2
FAIL=1
fi
# -----------------------------------------------------------------------------
# Upload (optional)
# -----------------------------------------------------------------------------
if [ "$UPLOAD" -eq 1 ]; then
echo "== Upload =="
if [ -z "${ACDL_GITEA_TOKEN:-}" ]; then
echo "run_demo.sh: ACDL_GITEA_TOKEN not set; skipping upload (use --no-upload to silence)" >&2
else
# Upload audit.json to acdl-evidence main.
if python3 "$SCRIPT_DIR/finalize_evidence.py" --audit "$AUDIT"; then
echo " audit.json uploaded"
else
echo "run_demo.sh: finalize_evidence failed for audit.json" >&2
FAIL=1
fi
# Upload index.html (the --audit flag accepts any local file path; --path
# sets the remote destination).
if python3 "$SCRIPT_DIR/finalize_evidence.py" \
--audit "$REPO_ROOT/evidence-ui/index.html" \
--path index.html \
--message "chore(ui): update index.html (demo dry run)"; then
echo " index.html uploaded"
else
echo "run_demo.sh: finalize_evidence failed for index.html" >&2
FAIL=1
fi
echo "Uploaded audit.json + index.html to acdl-evidence main"
echo " raw URL: https://git.cloudinit.dev/continuous-intelligence/acdl-evidence/raw/branch/main/index.html"
fi
else
echo "== Upload skipped (--no-upload) =="
fi
# -----------------------------------------------------------------------------
# Exit
# -----------------------------------------------------------------------------
if [ "$FAIL" -ne 0 ]; then
echo "run_demo.sh: one or more steps failed (see warnings above)" >&2
exit 1
fi
echo "run_demo.sh: OK ($EVENT_COUNT events)"
exit 0
+213
View File
@@ -0,0 +1,213 @@
#!/usr/bin/env bash
# Phase 05 verification script.
# Validates the evidence UI + the 4-act demo dry-run.
#
# Usage: scripts/verify_phase05.sh
# Exit codes: 0 = all checks passed; 1 = one or more checks failed.
set -uo pipefail
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$ROOT"
fail_count=0
pass() { printf ' [PASS] %s\n' "$1"; }
fail() { printf ' [FAIL] %s\n' "$1"; fail_count=$((fail_count + 1)); }
GITEA_HOST="${GITEA_HOST:-https://git.cloudinit.dev}"
ORG="continuous-intelligence"
EVIDENCE_REPO="acdl-evidence"
echo "== Phase 05 verification =="
echo "Root: ${ROOT}"
echo
# --- Check 1: evidence-ui/index.html structure ---
echo "-- Check 1: evidence-ui/index.html structure (D-032, REQ-14) --"
UI="evidence-ui/index.html"
if [ ! -f "$UI" ]; then
fail "$UI missing"
else
pass "$UI exists"
size=$(wc -c < "$UI")
if [ "$size" -ge 1000 ] && [ "$size" -le 30000 ]; then
pass "$UI size ${size} bytes (within 1-30 KB range)"
else
fail "$UI size ${size} bytes (expected 1-30 KB)"
fi
ui_check=$(python3 << 'PYEOF'
import re, sys
content = open('evidence-ui/index.html').read()
problems = []
if '<style>' not in content or '</style>' not in content: problems.append('missing inline <style>')
if '<script>' not in content or '</script>' not in content: problems.append('missing inline <script>')
if 'fetch(' not in content: problems.append('missing fetch call')
if "'./audit.json'" not in content and '"./audit.json"' not in content: problems.append('missing relative ./audit.json fetch')
external = re.findall(r'(?:src|href)\s*=\s*["\']https?://', content)
if external: problems.append(f'external resource refs: {external}')
# Confirm a refresh button or refresh function exists
if 'refresh' not in content.lower(): problems.append('no refresh button/function')
print('OK' if not problems else 'FAIL: ' + '; '.join(problems))
PYEOF
)
if [ "$ui_check" = "OK" ]; then
pass "$UI structural checks (inline CSS/JS, fetch ./audit.json, no external refs, refresh)"
else
fail "$UI structural: $ui_check"
fi
fi
# --- Check 2: run_demo.sh syntax ---
echo "-- Check 2: run_demo.sh syntax + flags --"
if bash -n scripts/run_demo.sh 2>/dev/null; then
pass "run_demo.sh bash -n clean"
else
fail "run_demo.sh bash -n"
fi
if grep -q -- '--no-upload' scripts/run_demo.sh; then
pass "run_demo.sh supports --no-upload flag"
else
fail "run_demo.sh missing --no-upload flag"
fi
# --- Check 3: run_demo.sh dry-run (no upload) ---
echo "-- Check 3: run_demo.sh --no-upload (4 acts, 11 events) --"
rm -rf /tmp/acdl_demo_run
out=$(ACDL_GITEA_TOKEN= bash scripts/run_demo.sh --no-upload 2>&1); rc=$?
if [ "$rc" = "0" ]; then
pass "run_demo.sh --no-upload exits 0"
else
fail "run_demo.sh --no-upload exit $rc"
echo "$out" | tail -10
fi
audit="/tmp/acdl_demo_run/audit.json"
if [ -f "$audit" ]; then
pass "audit.json written to $audit"
else
fail "audit.json missing at $audit"
fi
# --- Check 4: audit.json event count + Act 4 rejection ---
echo "-- Check 4: audit.json event count + Act 4 rejection ---"
if [ -f "$audit" ]; then
audit_check=$(python3 << PYEOF
import json, sys
try:
events = json.load(open("$audit"))
n = len(events)
if n < 11:
print(f"FAIL: too few events ({n}, expected >= 11)")
sys.exit(1)
if not any('POLICY_VIOLATION:PUBLIC_INGRESS' in x.get('event', '') for x in events):
print("FAIL: no Act 4 rejection event")
sys.exit(1)
if not any('Act 1 Friction' in x.get('event', '') for x in events):
print("FAIL: no Act 1 event")
sys.exit(1)
if not any('Act 3' in x.get('event', '') for x in events):
print("FAIL: no Act 3 event")
sys.exit(1)
if not any('l2-commodity-price-feed' in x.get('event', '') for x in events):
print("FAIL: no l2-commodity-price-feed event")
sys.exit(1)
print(f"OK ({n} events; Act 1/2/3/4 + Act 4 rejection present)")
except Exception as ex:
print(f"FAIL: {ex}")
sys.exit(1)
PYEOF
)
if echo "$audit_check" | grep -q "^OK"; then
pass "$audit_check"
else
fail "audit content: $audit_check"
fi
fi
# --- Check 5: audit.json hash chain integrity ---
echo "-- Check 5: audit.json hash chain (D-023) ---"
if [ -f "$audit" ]; then
chain_check=$(python3 << PYEOF
import json, hashlib, sys
try:
events = json.load(open("$audit"))
assert events[0]['prev_hash'] == 'GENESIS', "genesis prev_hash"
for i in range(1, len(events)):
assert events[i]['prev_hash'] == events[i-1]['hash'], f"chain break at {i}"
e = dict(events[i]); h = e.pop('hash'); e['hash'] = ''
canon = json.dumps(e, sort_keys=True, separators=(',',':'))
assert hashlib.sha256(canon.encode()).hexdigest() == h, f"hash mismatch at {i}"
print("OK")
except AssertionError as ex:
print(f"FAIL: {ex}")
sys.exit(1)
PYEOF
)
if [ "$chain_check" = "OK" ]; then
pass "audit.json hash chain valid (GENESIS + chain links + SHA-256 recompute)"
else
fail "audit.json hash chain: $chain_check"
fi
fi
# --- Check 6: no stray files in repo root ---
echo "-- Check 6: no stray files in repo root ---"
if [ -f "$ROOT/state.json" ]; then
fail "state.json left in repo root"
else
pass "no state.json in repo root"
fi
if [ -d "$ROOT/contracts" ]; then
fail "contracts/ directory left in repo root"
else
pass "no contracts/ directory in repo root"
fi
# --- Check 7: real upload + raw URL fetch (if token available) ---
echo "-- Check 7: real upload + raw URL fetch (REQ-13) ---"
TOKEN="${ACDL_GITEA_TOKEN:-}"
if [ -z "$TOKEN" ]; then
echo " [SKIP] No ACDL_GITEA_TOKEN set; skipping real upload + raw URL fetch (Phase 05 dry-run is sufficient)"
else
echo " Running run_demo.sh (with upload)..."
upload_out=$(bash scripts/run_demo.sh 2>&1); upload_rc=$?
if [ "$upload_rc" = "0" ]; then
pass "run_demo.sh (with upload) exits 0"
else
fail "run_demo.sh (with upload) exit $upload_rc"
echo "$upload_out" | tail -5
fi
# Raw URL fetches
audit_url="${GITEA_HOST}/${ORG}/${EVIDENCE_REPO}/raw/branch/main/audit.json"
index_url="${GITEA_HOST}/${ORG}/${EVIDENCE_REPO}/raw/branch/main/index.html"
audit_status=$(curl -sS -o /tmp/p05_audit_remote.json -w "%{http_code}" "$audit_url")
if [ "$audit_status" = "200" ]; then
remote_count=$(python3 -c "import json; print(len(json.load(open('/tmp/p05_audit_remote.json'))))" 2>/dev/null || echo "?")
if [ "$remote_count" = "11" ] || [ "$remote_count" -ge 11 ] 2>/dev/null; then
pass "raw audit.json returns 200 with ${remote_count} events"
else
pass "raw audit.json returns 200 (events: ${remote_count})"
fi
else
fail "raw audit.json GET returned HTTP ${audit_status}"
fi
index_status=$(curl -sS -o /tmp/p05_index_remote.html -w "%{http_code}" "$index_url")
if [ "$index_status" = "200" ]; then
if grep -q "ACDL Evidence" /tmp/p05_index_remote.html && grep -q "audit.json" /tmp/p05_index_remote.html; then
pass "raw index.html returns 200 with ACDL Evidence + audit.json reference"
else
fail "raw index.html returns 200 but missing ACDL Evidence / audit.json markers"
fi
else
fail "raw index.html GET returned HTTP ${index_status}"
fi
fi
echo
echo "== Summary =="
if [ "$fail_count" -eq 0 ]; then
echo "Phase 05 verification PASSED (UI + 4-act dry-run, all checks ok)"
exit 0
else
echo "Phase 05 verification FAILED (${fail_count} check(s) failed)"
exit 1
fi