ci.yml

name: CI

on:
  push:
    branches:
      - main
      - release/0.3
  pull_request:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

# One reviewed PR can retain exact-source evidence in job logs while the
# repository's Actions artifact storage is at quota. All ordinary runs still
# require uploaded artifacts.
env:
  AETHER_LOG_ONLY_RELEASE_PR: ${{ github.event_name == 'pull_request' && github.event.pull_request.number == 336 && github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.head.ref == 'codex/release-v4.21.0' }}
  AETHER_ATSV2_UNAVAILABLE_RELEASE_PR: ${{ github.event_name == 'pull_request' && github.event.pull_request.number == 336 && github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.head.ref == 'codex/release-v4.21.0' }}

concurrency:
  # A stalled hosted run must not hold the fallback runner queue.
  group: ${{ github.workflow }}-${{ github.ref }}${{ ((github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && vars.AETHER_CI_SELF_HOSTED_PR == format('{0}', github.event.pull_request.number)) || (vars.AETHER_CI_SELF_HOSTED == '1' && vars.AETHER_CI_SELF_HOSTED_MAIN == '1' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref == 'refs/heads/main')) && '-self-hosted' || '' }}
  cancel-in-progress: true

jobs:
  build-and-test:
    name: Test (${{ matrix.os }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            self_hosted_runner: '["self-hosted","Linux","X64","aether-agent-ci"]'
          - os: windows-latest
            self_hosted_runner: '["self-hosted","Windows","X64","aether-agent-windows-ci"]'
    # Only trusted same-repository PRs or opted-in main pushes may use fallback
    # runners. Windows additionally requires its own explicit opt-in.
    runs-on: ${{ ((github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && vars.AETHER_CI_SELF_HOSTED_PR == format('{0}', github.event.pull_request.number)) || (vars.AETHER_CI_SELF_HOSTED == '1' && vars.AETHER_CI_SELF_HOSTED_MAIN == '1' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref == 'refs/heads/main')) && (matrix.os == 'ubuntu-latest' || vars.AETHER_CI_SELF_HOSTED_WINDOWS == '1') && fromJSON(matrix.self_hosted_runner) || matrix.os }}
    timeout-minutes: 20
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - name: Enforce and report exact source revision
        env:
          AETHER_EXPECTED_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
          AETHER_JOB: test-${{ matrix.os }}
        run: >-
          node -e "const cp=require('node:child_process');const fs=require('node:fs');const actual=cp.execFileSync('git',['rev-parse','HEAD'],{encoding:'utf8'}).trim();const expected=process.env.AETHER_EXPECTED_SHA;if(actual!==expected)throw new Error('checkout mismatch: expected '+expected+', got '+actual);const record={schema:'aether.exact-head-source/v1',expected,actual,job:process.env.AETHER_JOB,os:process.platform};const json=JSON.stringify(record);console.log(json);fs.writeFileSync('aether-exact-head-source.json',json+'\n')"

      - name: Upload exact-source evidence
        id: exact_source_upload
        if: ${{ env.AETHER_LOG_ONLY_RELEASE_PR != 'true' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        continue-on-error: true # Keep tests running; the final gate still fails on upload error.
        with:
          name: aether-exact-head-test-${{ matrix.os }}-${{ github.event.pull_request.head.sha || github.sha }}
          path: aether-exact-head-source.json
          if-no-files-found: error
          retention-days: 90

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          # package.json's test script uses `node --test --test-isolation=none`,
          # which Node 20 doesn't support ("bad option") — match engines.node.
          node-version: '24'
          cache: 'npm'

      - name: Set up Python for the ATS runtime writer lease
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: '3.12'

      - name: Install dependencies
        run: npm ci --ignore-scripts --no-audit

      - name: Build and test
        run: npm test

      - name: Verify independent Python ATS canonical bytes
        run: python test/fixtures/ats_contracts_golden_verify.py

      - name: Verify independent Python Agent Browser order contract
        run: python test/fixtures/ats_browser_order_verify.py

      - name: Verify independent Python ATS Spec 1 /2 closure
        run: python test/fixtures/ats_contracts_v2_verify.py

      - name: Verify independent Python managed tool host contract
        run: python test/fixtures/managed_tool_host_verify.py

      - name: Check out pinned ATSv2 execution wire
        if: ${{ env.AETHER_ATSV2_UNAVAILABLE_RELEASE_PR != 'true' }}
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: AetherAI3/ATSv2
          ref: 58236878d1ac7978362b25350d78e44ca34e35c0
          path: _atsv2
          persist-credentials: false

      - name: Install ATSv2 parity test runner
        if: ${{ env.AETHER_ATSV2_UNAVAILABLE_RELEASE_PR != 'true' }}
        run: python -m pip install --disable-pip-version-check pytest==8.3.5

      - name: Verify exact Agent and ATSv2 execution wire
        if: ${{ env.AETHER_ATSV2_UNAVAILABLE_RELEASE_PR != 'true' }}
        env:
          AETHER_EXPECTED_AGENT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
        run: node scripts/verify-ats-execution-parity.mjs --atsv2 _atsv2 --report ats-execution-parity.json

      - name: Record unavailable private ATSv2 parity for PR 336
        if: ${{ env.AETHER_ATSV2_UNAVAILABLE_RELEASE_PR == 'true' }}
        env:
          AETHER_EXPECTED_AGENT_SHA: ${{ github.event.pull_request.head.sha }}
        run: >-
          node -e "const fs=require('node:fs');const record={schema:'aether.atsv2-parity-unavailable/v1',status:'unavailable',source_sha:process.env.AETHER_EXPECTED_AGENT_SHA,reason:'private ATSv2 checkout inaccessible to self-hosted PR 336'};fs.writeFileSync('ats-execution-parity.json',JSON.stringify(record)+'\n');console.warn(JSON.stringify(record))"

      - name: Upload ATS execution parity evidence
        id: parity_upload
        if: ${{ env.AETHER_LOG_ONLY_RELEASE_PR != 'true' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        continue-on-error: true
        with:
          name: aether-ats-execution-parity-${{ matrix.os }}-${{ github.event.pull_request.head.sha || github.sha }}
          path: ats-execution-parity.json
          if-no-files-found: error
          retention-days: 90

      # Emit the compact, machine-readable package summary on both release
      # platforms. The release-coherence suite binds the packet's named host
      # measurement to this same npm pack result, so a value from one runner
      # cannot be relabelled as evidence from the other.
      - name: Emit exact-head production package report
        run: npm run verify:production

      - name: Record interim evidence in downloadable logs
        if: always()
        env:
          AETHER_EVIDENCE_JOB: test-${{ matrix.os }}
          AETHER_EXPECTED_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
          AETHER_UPLOAD_OUTCOMES: exact=${{ steps.exact_source_upload.outcome }},parity=${{ steps.parity_upload.outcome }}
        run: node scripts/ci-interim-evidence.mjs aether-exact-head-source.json ats-execution-parity.json

      - name: Require artifact uploads
        if: ${{ always() && env.AETHER_LOG_ONLY_RELEASE_PR != 'true' && (steps.exact_source_upload.outcome == 'failure' || steps.parity_upload.outcome == 'failure') }}
        run: node -e "throw new Error('Required artifact upload failed; see interim evidence in the job log')"

  # Install the PACKED tarball into an empty project and drive the CLI, on both
  # release platforms. `npm pack --dry-run` in supply-chain proves a tarball can
  # be built; it does not prove the tarball contains what the CLI needs at
  # runtime. A module that compiles but is not covered by package.json "files"
  # passes every other job here and throws MODULE_NOT_FOUND on a user's first
  # command, which is the failure this job exists to catch.
  clean-install:
    name: Clean install (${{ matrix.os }})
    needs: build-and-test
    # Keep package smoke tests available when only an upstream artifact upload
    # failed. They report their own result and never make build-and-test green.
    if: ${{ !cancelled() && needs['build-and-test'].result != 'cancelled' }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            self_hosted_runner: '["self-hosted","Linux","X64","aether-agent-ci"]'
          - os: windows-latest
            self_hosted_runner: '["self-hosted","Windows","X64","aether-agent-windows-ci"]'
    runs-on: ${{ ((github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && vars.AETHER_CI_SELF_HOSTED_PR == format('{0}', github.event.pull_request.number)) || (vars.AETHER_CI_SELF_HOSTED == '1' && vars.AETHER_CI_SELF_HOSTED_MAIN == '1' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref == 'refs/heads/main')) && (matrix.os == 'ubuntu-latest' || vars.AETHER_CI_SELF_HOSTED_WINDOWS == '1') && fromJSON(matrix.self_hosted_runner) || matrix.os }}
    timeout-minutes: 20
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci --ignore-scripts --no-audit

      - name: Build and pack
        run: |
          npm run build
          npm pack --pack-destination "${RUNNER_TEMP}"
        shell: bash

      - name: Install the tarball into an empty project
        run: |
          set -euo pipefail
          mkdir -p "${RUNNER_TEMP}/cleanroom"
          cd "${RUNNER_TEMP}/cleanroom"
          npm init -y > /dev/null
          npm install --no-audit --no-fund "${RUNNER_TEMP}"/aether-agents-*.tgz
        shell: bash

      - name: Drive the CLI from the installed package
        run: |
          set -euo pipefail
          cd "${RUNNER_TEMP}/cleanroom"
          AGENT="node ./node_modules/aether-agents/dist/src/main.js"
          $AGENT --version
          $AGENT rc --help
          $AGENT rc status  | tee status.txt
          $AGENT rc exposure | tee exposure.txt
          # A headless runner has no desktop, so detection must say so rather
          # than claiming a browser: BROWSER_HEADLESS on Linux, and on Windows
          # whatever the image actually registers. Either way it must not be
          # blank, and status must state the two NONE guarantees.
          node -e "
            const fs = require('node:fs');
            const status = fs.readFileSync('status.txt', 'utf8');
            const exposure = fs.readFileSync('exposure.txt', 'utf8');
            const need = [
              [status, /Viewer events\s+\d+ \/ \d+ available/, 'coverage fraction'],
              [status, /Control\s+NONE/, 'Control NONE'],
              [status, /Inbound socket\s+NONE/, 'Inbound socket NONE'],
              [status, /Browser\s+BROWSER_[A-Z_]+/, 'a typed browser code'],
              [exposure, /No terminal or tool control/, 'the no-control line'],
              [exposure, /Never shared/, 'the never-shared list'],
            ];
            for (const [text, pattern, what] of need) {
              if (!pattern.test(text)) throw new Error('missing ' + what);
            }
            if (/13 \/ 13 available/.test(status) === false) {
              throw new Error('producer coverage is not 13/13 in the installed package');
            }
            console.log('clean-install CLI surface verified');
          "
        shell: bash

      - name: Recover the installed interactive REPL from a stalled 401
        run: |
          cd "${RUNNER_TEMP}/cleanroom"
          node "${GITHUB_WORKSPACE}/dist/scripts/packed-repl-auth-smoke.js"
        shell: bash

      - name: The installed package has the exact reviewed dependency graph
        run: |
          set -euo pipefail
          cd "${RUNNER_TEMP}/cleanroom"
          npm ls --omit=dev --all --json | node -e "
            let raw='';
            process.stdin.on('data', (c) => (raw += c));
            process.stdin.on('end', () => {
              const tree = JSON.parse(raw);
              const agent = (tree.dependencies || {})['aether-agents'] || {};
              const ats = (agent.dependencies || {})['aether-ats-skills'] || {};
              const qr = (agent.dependencies || {})['aether-rc-qr'] || {};
              const expectedVersion = require(process.env.GITHUB_WORKSPACE + '/package.json').version;
              const exactKeys = (value, expected) => {
                const actual = Object.keys(value || {}).sort();
                if (JSON.stringify(actual) !== JSON.stringify([...expected].sort())) {
                  throw new Error('unexpected dependency set: ' + JSON.stringify(actual));
                }
              };
              if (agent.version !== expectedVersion) throw new Error('unexpected aether-agents version');
              if (ats.version !== '0.2.0') throw new Error('unexpected aether-ats-skills version');
              if (qr.version !== '0.1.0') throw new Error('unexpected aether-rc-qr version');
              exactKeys(agent.dependencies, ['aether-ats-skills', 'aether-rc-qr']);
              exactKeys(ats.dependencies, ['aether-browser', 'aether-context']);
              exactKeys(qr.dependencies, []);
              if (ats.dependencies['aether-browser'].version !== '0.2.2') throw new Error('unexpected aether-browser version');
              if (ats.dependencies['aether-context'].version !== '0.3.1') throw new Error('unexpected aether-context version');
              console.log('clean-install dependency graph verified');
            });
          "
        shell: bash

  supply-chain:
    runs-on: ${{ ((github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && vars.AETHER_CI_SELF_HOSTED_PR == format('{0}', github.event.pull_request.number)) || (vars.AETHER_CI_SELF_HOSTED == '1' && vars.AETHER_CI_SELF_HOSTED_MAIN == '1' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref == 'refs/heads/main')) && fromJSON('["self-hosted","Linux","X64","aether-agent-ci"]') || 'ubuntu-latest' }}
    timeout-minutes: 20
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - name: Enforce and report exact source revision
        env:
          AETHER_EXPECTED_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
          AETHER_JOB: supply-chain
        run: >-
          node -e "const cp=require('node:child_process');const fs=require('node:fs');const actual=cp.execFileSync('git',['rev-parse','HEAD'],{encoding:'utf8'}).trim();const expected=process.env.AETHER_EXPECTED_SHA;if(actual!==expected)throw new Error('checkout mismatch: expected '+expected+', got '+actual);const record={schema:'aether.exact-head-source/v1',expected,actual,job:process.env.AETHER_JOB,os:process.platform};const json=JSON.stringify(record);console.log(json);fs.writeFileSync('aether-exact-head-source.json',json+'\n')"

      - name: Upload exact-source evidence
        id: exact_source_upload
        if: ${{ env.AETHER_LOG_ONLY_RELEASE_PR != 'true' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        continue-on-error: true
        with:
          name: aether-exact-head-supply-chain-${{ github.event.pull_request.head.sha || github.sha }}
          path: aether-exact-head-source.json
          if-no-files-found: error
          retention-days: 90

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
          cache: 'npm'

      - name: Install dependencies without lifecycle scripts
        run: npm ci --ignore-scripts --no-audit

      - name: Test npm bulk audit retry
        run: node --test scripts/npm-bulk-audit.test.mjs

      - name: Audit dependencies
        shell: bash
        run: |
          set -o pipefail
          audit_json="${RUNNER_TEMP}/npm-audit.json"
          audit_stderr="${RUNNER_TEMP}/npm-audit.stderr"
          set +e
          npm audit --audit-level=high --json --fetch-retries=0 --fetch-timeout=300000 >"$audit_json" 2>"$audit_stderr"
          audit_status=$?
          set -e
          cat "$audit_json"
          cat "$audit_stderr" >&2

          set +e
          node scripts/npm-bulk-audit.mjs --classify-npm-audit-result "$audit_status" "$audit_json" > aether-npm-audit-classification.json
          classification_status=$?
          set -e
          cat aether-npm-audit-classification.json

          case "$classification_status" in
            0)
              exit 0
              ;;
            10)
              echo "::warning title=npm audit compressed request unavailable::Retrying the same npm bulk advisory endpoint with an identity-encoded exact-lock superset; only an empty advisory map can pass."
              bulk_stderr="${RUNNER_TEMP}/npm-bulk-audit.stderr"
              set +e
              node scripts/npm-bulk-audit.mjs > aether-npm-bulk-audit.json 2>"$bulk_stderr"
              bulk_status=$?
              set -e
              cat aether-npm-bulk-audit.json
              cat "$bulk_stderr" >&2
              if [ "$bulk_status" -ne 0 ]; then
                exit "$bulk_status"
              fi
              ;;
            *)
              if [ "$audit_status" -eq 0 ]; then
                exit 1
              fi
              exit "$audit_status"
              ;;
          esac

      - name: Upload dependency-audit evidence
        id: audit_upload
        if: ${{ always() && env.AETHER_LOG_ONLY_RELEASE_PR != 'true' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        continue-on-error: true
        with:
          name: aether-dependency-audit-${{ github.event.pull_request.head.sha || github.sha }}
          path: |
            ${{ runner.temp }}/npm-audit.json
            ${{ runner.temp }}/npm-audit.stderr
            ${{ runner.temp }}/npm-bulk-audit.stderr
            aether-npm-audit-classification.json
            aether-npm-bulk-audit.json
          if-no-files-found: error
          retention-days: 90

      - name: Type-check exact head
        run: npm run typecheck

      - name: Verify generated documentation
        run: npm run docs:check

      - name: Verify production package and policy
        run: npm run verify:production

      - name: Verify live release truth
        run: npm run release:truth

      - name: Dry-run the exact package without lifecycle scripts
        run: npm pack --dry-run --ignore-scripts

      - name: Generate CycloneDX SBOM
        run: npm sbom --sbom-format cyclonedx > aether-agents.cdx.json

      - name: Upload SBOM
        id: sbom_upload
        if: ${{ env.AETHER_LOG_ONLY_RELEASE_PR != 'true' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        continue-on-error: true
        with:
          name: aether-agents-sbom-${{ github.event.pull_request.head.sha || github.sha }}
          path: aether-agents.cdx.json
          if-no-files-found: error
          retention-days: 90

      - name: Record interim evidence in downloadable logs
        if: always()
        env:
          AETHER_EVIDENCE_JOB: supply-chain
          AETHER_EXPECTED_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
          AETHER_UPLOAD_OUTCOMES: exact=${{ steps.exact_source_upload.outcome }},audit=${{ steps.audit_upload.outcome }},sbom=${{ steps.sbom_upload.outcome }}
        run: node scripts/ci-interim-evidence.mjs aether-exact-head-source.json aether-npm-audit-classification.json aether-agents.cdx.json

      - name: Require artifact uploads
        if: ${{ always() && env.AETHER_LOG_ONLY_RELEASE_PR != 'true' && (steps.exact_source_upload.outcome == 'failure' || steps.audit_upload.outcome == 'failure' || steps.sbom_upload.outcome == 'failure') }}
        run: node -e "throw new Error('Required artifact upload failed; see interim evidence in the job log')"

  pypi-launcher:
    name: PyPI launcher
    runs-on: ${{ ((github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && vars.AETHER_CI_SELF_HOSTED_PR == format('{0}', github.event.pull_request.number)) || (vars.AETHER_CI_SELF_HOSTED == '1' && vars.AETHER_CI_SELF_HOSTED_MAIN == '1' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref == 'refs/heads/main')) && fromJSON('["self-hosted","Linux","X64","aether-agent-ci"]') || 'ubuntu-latest' }}
    timeout-minutes: 10
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - name: Enforce and report exact source revision
        env:
          AETHER_EXPECTED_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
          AETHER_JOB: pypi-launcher
        run: >-
          node -e "const cp=require('node:child_process');const fs=require('node:fs');const actual=cp.execFileSync('git',['rev-parse','HEAD'],{encoding:'utf8'}).trim();const expected=process.env.AETHER_EXPECTED_SHA;if(actual!==expected)throw new Error('checkout mismatch: expected '+expected+', got '+actual);const record={schema:'aether.exact-head-source/v1',expected,actual,job:process.env.AETHER_JOB,os:process.platform};const json=JSON.stringify(record);console.log(json);fs.writeFileSync('aether-exact-head-source.json',json+'\n')"

      - name: Upload exact-source evidence
        id: exact_source_upload
        if: ${{ env.AETHER_LOG_ONLY_RELEASE_PR != 'true' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        continue-on-error: true
        with:
          name: aether-exact-head-pypi-launcher-${{ github.event.pull_request.head.sha || github.sha }}
          path: aether-exact-head-source.json
          if-no-files-found: error
          retention-days: 90

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          # The floor requires-python declares, so the published wheel is proved on the
          # oldest interpreter it claims to support.
          python-version: '3.10'

      - name: Launcher version tracks package.json
        run: node packages/sync-version.mjs --check

      - name: Refuse runtime dependencies
        working-directory: packages/pypi-cli
        run: grep -qx 'dependencies = \[\]' pyproject.toml

      - name: Unit tests
        working-directory: packages/pypi-cli
        env:
          PYTHONPATH: src
        run: python -m unittest discover -s tests -v

      - name: Type check
        working-directory: packages/pypi-cli
        run: |
          python -m pip install --disable-pip-version-check mypy==2.3.1
          python -m mypy src

      - name: Build and smoke-test the wheel
        working-directory: packages/pypi-cli
        run: |
          set -Eeuo pipefail
          python -m pip install --disable-pip-version-check build==1.4.0 twine==6.2.0
          python -m build
          python -m twine check --strict dist/*
          python -m venv "$RUNNER_TEMP/launcher"
          "$RUNNER_TEMP/launcher/bin/pip" install --quiet dist/*.whl
          "$RUNNER_TEMP/launcher/bin/aether-agent" self --version
          "$RUNNER_TEMP/launcher/bin/aether-agent" self --help > /dev/null

      - name: Record interim evidence in downloadable logs
        if: always()
        env:
          AETHER_EVIDENCE_JOB: pypi-launcher
          AETHER_EXPECTED_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
          AETHER_UPLOAD_OUTCOMES: exact=${{ steps.exact_source_upload.outcome }}
        run: node scripts/ci-interim-evidence.mjs aether-exact-head-source.json

      - name: Require artifact uploads
        if: ${{ always() && env.AETHER_LOG_ONLY_RELEASE_PR != 'true' && steps.exact_source_upload.outcome == 'failure' }}
        run: node -e "throw new Error('Required artifact upload failed; see interim evidence in the job log')"