mirror of
https://github.com/Heretek-AI/heretek-rigs.git
synced 2026-11-07 10:55:57 -10:00
96 lines
4.6 KiB
Makefile
96 lines
4.6 KiB
Makefile
# Heretek-Rigs Operations & Verification Makefile
|
|
#
|
|
# Target Framework: OpenRig v0.7.5 (CLI binary: `rig`)
|
|
# Primary Harness: Pi Coding Agent v1.4.0 (`pi --mode rpc --no-approve`)
|
|
# Enforcement: @gotgenes/[email protected] ("*..*": "deny" guard)
|
|
# Primary Model: opencode-go/muse-spark-1.3-contributor:high (OpenCode Go)
|
|
|
|
-include .env
|
|
export
|
|
|
|
COMPOSE := docker compose
|
|
SIDECAR_PROFILES ?=
|
|
RIG_BIN := $(shell command -v rig 2>/dev/null || true)
|
|
|
|
.DEFAULT_GOAL := help
|
|
.PHONY: help generate idempotent verify live-health test bootstrap-seats seed gate guard-profiles sidecars-up sidecars-down bundle-check audit-loop audit-sessions topology manifest-closure policy-verifier reconcile generate-tracker
|
|
|
|
help: ## List all documented Heretek-Rigs targets.
|
|
@echo "Heretek-Rigs — 51-Agent OpenRig + Pi + OpenCode Go Fleet"
|
|
@echo ""
|
|
@grep -E '^[a-zA-Z0-9_-]+:.*?## ' $(MAKEFILE_LIST) | \
|
|
awk 'BEGIN {FS = ":.*?## "}; {printf " %-18s %s\n", $$1, $$2}'
|
|
|
|
generate: ## Deterministically generate all 51 AgentSpecs, 8 RigBundles, Roster, and Registry views from fleet/fleet.yaml.
|
|
python3 ./scripts/generate-rigs.py
|
|
|
|
idempotent: ## Regenerate twice and fail if any byte differs (HR-8.1 determinism gate for CI/audits).
|
|
python3 ./scripts/generate-rigs.py --check-idempotent
|
|
|
|
verify: ## Run the self-testing verification gate (schemas, digests, 51-role parity, DAGs, sidecars, unit tests).
|
|
bash ./scripts/verify-rigs.sh
|
|
python3 ./scripts/live-health.py
|
|
|
|
live-health: ## Warn-first live-fleet health gate (read-only; advisory exit 0, --strict to fail).
|
|
python3 ./scripts/live-health.py
|
|
|
|
test: ## Run the full unit suite (every tests/test_*.py via unittest discover).
|
|
python3 -m unittest discover -s tests -p 'test_*.py' -v
|
|
|
|
bootstrap-seats: ## Provision $OPENRIG_HOME/state/pi/<seat>/agent/ across all rigs.
|
|
bash ./scripts/bootstrap-pi-seats.sh --all
|
|
|
|
seed: ## Seed one rig before launch: make seed RIG=defensive-sec-and-red-team
|
|
python3 ./scripts/seed-rig.py rigs/$(RIG)/rig.yaml --allow-missing-secrets
|
|
|
|
gate: ## Gate-test one role against mock OpenAI + pi-permission-system: make gate ROLE=appsec-engineer
|
|
bash ./scripts/gate-role.sh $(ROLE)
|
|
|
|
audit-sessions: ## Detect misattributed denials + false delivery claims: make audit-sessions [WORKSPACE=/path/to/seat-workspace]
|
|
python3 ./scripts/audit_sessions.py $(if $(WORKSPACE),--workspace $(WORKSPACE))
|
|
|
|
topology: ## Render fleet wiring (graph.json, SVGs, matrix) + fail-closed referential gates: make topology OUT=/tmp/topo
|
|
python3 ./scripts/topology.py --out $(or $(OUT),/tmp/heretek-topology)
|
|
|
|
guard-profiles: ## Fail-closed guard: refuse co-scheduling --profile mobile with devsec or web-research.
|
|
@norm="$$(printf '%s' "$(SIDECAR_PROFILES)" | tr '\t\r\n\v\f,' ' ')"; \
|
|
case " $$norm " in \
|
|
*" mobile "* ) \
|
|
case " $$norm " in \
|
|
*" devsec "*|*" web-research "* ) \
|
|
echo "error: refusing to co-schedule --profile mobile with devsec/web-research (privileged /dev/kvm emulator must stay isolated)" >&2; \
|
|
exit 1;; \
|
|
esac;; \
|
|
esac
|
|
|
|
sidecars-up: guard-profiles ## Start sidecars: make sidecars-up SIDECAR_PROFILES="web-research"
|
|
$(COMPOSE) -f docker-compose.sidecars.yml $(foreach p,$(SIDECAR_PROFILES),--profile $(p)) up -d
|
|
|
|
sidecars-down: ## Stop sidecar containers while preserving named volumes.
|
|
$(COMPOSE) -f docker-compose.sidecars.yml down
|
|
|
|
bundle-check: verify ## Run `rig bundle check` across all 8 rigs when the OpenRig CLI (`rig`) is installed.
|
|
@if [ -n "$(RIG_BIN)" ]; then \
|
|
for r in rigs/*/; do \
|
|
echo "Checking $$r with $(RIG_BIN) bundle check..."; \
|
|
"$(RIG_BIN)" bundle check "$$r" --json; \
|
|
done; \
|
|
else \
|
|
echo "Note: 'rig' CLI binary not on PATH; offline bundle-check rules already verified via ./scripts/verify-rigs.sh."; \
|
|
fi
|
|
|
|
audit-loop: ## Run the automated OpenCode adversarial audit & remediation loop until 3 consecutive STATUS: NO_FINDINGS passes.
|
|
python3 ./scripts/audit_loop.py
|
|
|
|
manifest-closure: ## Run the stage-time manifest-closure lint over staged manifests (issue #40).
|
|
python3 ./scripts/manifest-closure.py --staged
|
|
|
|
policy-verifier: ## Run the stage-time policy-text verifier over staged policy files (issue #41).
|
|
python3 ./scripts/policy-verifier.py --staged
|
|
|
|
reconcile: ## Diff dispatch tracker(s) against live queue state (read-only, TPM approval): make reconcile TRACKER=path/to/tracker.md [OUT=file].
|
|
python3 ./scripts/reconcile.py --live --tracker $(TRACKER) $(if $(OUT),--out $(OUT))
|
|
|
|
generate-tracker: ## Emit a dispatch-tracker proposal from live queue state (read-only, TPM approval): make generate-tracker TRACKER=path/to/tracker.md OUT=file.
|
|
python3 ./scripts/generate_trackers.py --live --tracker $(TRACKER) $(if $(OUT),--out $(OUT))
|