lookmanrays
diff --git a/‎.env.example‎
Lines changed: 4 additions & 2 deletions b/‎.env.example‎
Lines changed: 4 additions & 2 deletions
diff --git a/‎.github/workflows/public-testability-macos.yml‎
Lines changed: 20 additions & 7 deletions b/‎.github/workflows/public-testability-macos.yml‎
Lines changed: 20 additions & 7 deletions
diff --git a/‎.github/workflows/public-testability-windows.yml‎
Lines changed: 5 additions & 0 deletions b/‎.github/workflows/public-testability-windows.yml‎
Lines changed: 5 additions & 0 deletions
diff --git a/‎.github/workflows/public-testability.yml‎
Lines changed: 50 additions & 3 deletions b/‎.github/workflows/public-testability.yml‎
Lines changed: 50 additions & 3 deletions
diff --git a/‎.github/workflows/release-please.yml‎
Lines changed: 209 additions & 0 deletions b/‎.github/workflows/release-please.yml‎
Lines changed: 209 additions & 0 deletions
@@ -5,8 +5,10 @@
 ALL_ADAPTERS_SIMULATION_MODE=1
 
 # --- Tactical Agents (Real Mode) ---
-# Path to the Codex agent binary (requires npm install -g @lookman/codex-agent)
-CODEX_BINARY=codex-agent
+# Path to the Codex CLI. Codencer invokes `codex exec` by default.
+CODEX_BINARY=codex
+# Set CODEX_ADAPTER_MODE=legacy-agent only for the older codex-agent wrapper.
+# CODEX_ADAPTER_MODE=legacy-agent
 # Set to 1 to stub only the Codex agent
 CODEX_SIMULATION_MODE=0
 
 
@@ -7,9 +7,14 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: public-testability-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   verify-macos:
     runs-on: macos-latest
+    timeout-minutes: 45
 
     steps:
       - name: Check out repository
@@ -20,6 +25,13 @@ jobs:
         with:
           go-version-file: go.mod
 
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: web/gateway-console/package-lock.json
+
       - name: Cache Go build and module directories
         uses: actions/cache@v4
         with:
@@ -31,15 +43,16 @@ jobs:
             ${{ runner.os }}-go-
 
       - name: Install macOS verification prerequisites
+        run: brew install jq
+
+      - name: Install Gateway Console browser
+        working-directory: web/gateway-console
         run: |
-          brew update
-          brew install jq docker docker-compose
-          mkdir -p ~/.docker/cli-plugins
-          ln -sf "$(brew --prefix docker-compose)/bin/docker-compose" ~/.docker/cli-plugins/docker-compose
-          docker compose version
+          npm ci
+          npx playwright install chromium
 
-      - name: Build supported beta-track binaries
+      - name: Build supported public binaries
         run: make build-supported
 
       - name: Run supported public verification
-        run: make verify-beta
+        run: make verify-public-selfhost-release TARGETS=host REQUIRE_TARGETS=host
@@ -7,9 +7,14 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: public-testability-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   verify-windows-broker:
     runs-on: windows-latest
+    timeout-minutes: 20
 
     steps:
       - name: Check out repository
 
@@ -7,9 +7,14 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: public-testability-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   verify:
     runs-on: ubuntu-latest
+    timeout-minutes: 90
 
     steps:
       - name: Check out repository
@@ -20,13 +25,55 @@ jobs:
         with:
           go-version-file: go.mod
 
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: web/gateway-console/package-lock.json
+
       - name: Install CGO build prerequisites
         run: |
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends build-essential
 
-      - name: Build supported beta-track binaries
+      - name: Install Gateway Console browser
+        working-directory: web/gateway-console
+        run: |
+          npm ci
+          npx playwright install --with-deps chromium
+
+      - name: Build supported public binaries
         run: make build-supported
 
-      - name: Run supported public verification
-        run: ./scripts/verify_beta.sh
+      - name: Run full Go test suite
+        timeout-minutes: 15
+        run: go test ./...
+
+      - name: Create public self-host release snapshot
+        timeout-minutes: 10
+        run: make release-snapshot VERSION=v0.3.0-selfhost-verify TARGETS=host REQUIRE_TARGETS=host
+
+      - name: Verify release artifact self-host proof
+        timeout-minutes: 20
+        run: make verify-release-artifact-selfhost VERSION=v0.3.0-selfhost-artifact-verify TARGETS=host REQUIRE_TARGETS=host
+
+      - name: Verify public self-host config and client artifacts
+        timeout-minutes: 10
+        run: ./scripts/verify_public_selfhost_release.sh
+
+      - name: Verify Gateway MCP and routing
+        timeout-minutes: 15
+        run: make verify-gateway
+
+      - name: Verify Gateway Console
+        timeout-minutes: 25
+        run: make verify-gateway-console
+
+      - name: Verify Gateway Console live path
+        timeout-minutes: 20
+        run: make verify-gateway-console-live
+
+      - name: Verify public release boundary
+        timeout-minutes: 10
+        run: make verify-public-release
@@ -0,0 +1,209 @@
+name: Release Please
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  pull-requests: write
+  issues: write
+  actions: read
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+      version: ${{ steps.release.outputs.version }}
+      sha: ${{ steps.release.outputs.sha }}
+      upload_url: ${{ steps.release.outputs.upload_url }}
+
+    steps:
+      - name: Run Release Please
+        id: release
+        uses: googleapis/release-please-action@v4
+        with:
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN || github.token }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+
+  build-linux-amd64:
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    env:
+      TAG_NAME: ${{ needs.release-please.outputs.tag_name }}
+      RELEASE_SHA: ${{ needs.release-please.outputs.sha }}
+
+    steps:
+      - name: Check out release SHA
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.RELEASE_SHA }}
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Install Linux build prerequisites
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends build-essential
+
+      - name: Build linux/amd64 release snapshot
+        run: make release-snapshot VERSION="${TAG_NAME}" TARGETS=linux/amd64 REQUIRE_TARGETS=linux/amd64
+
+      - name: Verify linux/amd64 self-host artifact
+        run: make verify-release-artifact-selfhost VERSION="${TAG_NAME}" TARGETS=linux/amd64 REQUIRE_TARGETS=linux/amd64
+
+      - name: Upload linux/amd64 artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: codencer-linux-amd64
+          path: dist/codencer_${{ env.TAG_NAME }}_linux_amd64.tar.gz
+          if-no-files-found: error
+
+  build-macos-host:
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    runs-on: macos-latest
+    timeout-minutes: 45
+    env:
+      TAG_NAME: ${{ needs.release-please.outputs.tag_name }}
+      RELEASE_SHA: ${{ needs.release-please.outputs.sha }}
+
+    steps:
+      - name: Check out release SHA
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.RELEASE_SHA }}
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Build macOS host release snapshot
+        run: make release-snapshot VERSION="${TAG_NAME}" TARGETS=host REQUIRE_TARGETS=host
+
+      - name: Verify macOS host self-host artifact
+        run: make verify-release-artifact-selfhost VERSION="${TAG_NAME}" TARGETS=host REQUIRE_TARGETS=host
+
+      - name: Upload macOS host artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: codencer-macos-host
+          path: dist/codencer_${{ env.TAG_NAME }}_darwin_*.tar.gz
+          if-no-files-found: error
+
+  publish-assets:
+    needs:
+      - release-please
+      - build-linux-amd64
+      - build-macos-host
+    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      TAG_NAME: ${{ needs.release-please.outputs.tag_name }}
+      RELEASE_SHA: ${{ needs.release-please.outputs.sha }}
+      GH_TOKEN: ${{ github.token }}
+
+    steps:
+      - name: Download release artifacts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: codencer-*
+          path: release-assets
+          merge-multiple: true
+
+      - name: Generate checksums and manifest
+        run: |
+          python3 <<'PY'
+          import hashlib
+          import json
+          import os
+          import re
+          from datetime import datetime, timezone
+          from pathlib import Path
+
+          root = Path("release-assets")
+          tag = os.environ["TAG_NAME"]
+          release_sha = os.environ["RELEASE_SHA"]
+          archives = sorted(root.glob("codencer_*.tar.gz"))
+          linux_name = f"codencer_{tag}_linux_amd64.tar.gz"
+          linux = [path for path in archives if path.name == linux_name]
+          darwin = [path for path in archives if re.fullmatch(rf"codencer_{re.escape(tag)}_darwin_[A-Za-z0-9]+\.tar\.gz", path.name)]
+
+          if len(linux) != 1:
+              raise SystemExit(f"expected exactly one linux/amd64 archive named {linux_name}, got {len(linux)}")
+          if len(darwin) != 1:
+              raise SystemExit(f"expected exactly one darwin host archive for {tag}, got {len(darwin)}")
+
+          assets = []
+          checksum_lines = []
+          for path in linux + darwin:
+              match = re.fullmatch(rf"codencer_{re.escape(tag)}_(linux|darwin)_([A-Za-z0-9]+)\.tar\.gz", path.name)
+              if not match:
+                  raise SystemExit(f"unexpected archive name: {path.name}")
+              data = path.read_bytes()
+              digest = hashlib.sha256(data).hexdigest()
+              os_name, arch = match.groups()
+              runner = "ubuntu-latest" if os_name == "linux" else "macos-latest"
+              checksum_lines.append(f"{digest}  {path.name}")
+              assets.append({
+                  "filename": path.name,
+                  "sha256": digest,
+                  "os": os_name,
+                  "arch": arch,
+                  "runner": runner,
+              })
+
+          (root / "checksums.txt").write_text("\n".join(checksum_lines) + "\n")
+          manifest = {
+              "version": tag,
+              "tag_name": tag,
+              "release_sha": release_sha,
+              "built_at": datetime.now(timezone.utc).isoformat().replace("+00:00", "Z"),
+              "assets": assets,
+              "note": "Artifacts were built by GitHub Actions from the Release Please release workflow.",
+          }
+          (root / "manifest.json").write_text(json.dumps(manifest, indent=2) + "\n")
+          PY
+
+      - name: Fail if release assets already exist
+        run: |
+          existing="$(gh release view "$TAG_NAME" --json assets -q '.assets[].name')"
+          for file in release-assets/*; do
+            name="$(basename "$file")"
+            if printf '%s\n' "$existing" | grep -Fxq "$name"; then
+              echo "Release asset already exists and will not be overwritten: $name" >&2
+              exit 1
+            fi
+          done
+
+      - name: Upload release assets
+        run: gh release upload "$TAG_NAME" release-assets/*
+
+      - name: Append release asset note
+        run: |
+          gh release view "$TAG_NAME" --json body -q '.body' > release-body.md
+          cat >> release-body.md <<'EOF'
+
+          ## Codencer self-host release assets
+
+          - Public self-host release.
+          - Codex real executor proof: passed.
+          - Claude Code real executor proof: passed.
+          - Antigravity: optional/deferred, not release-proven.
+          - Cloud/official connector: out of scope for this public self-host release.
+          - Checksums are attached in `checksums.txt`.
+          - Machine-readable artifact metadata is attached in `manifest.json`.
+          EOF
+          gh release edit "$TAG_NAME" --notes-file release-body.md