Release v0.21.3

.github/attest-mirror/hub-llm-probe.js

@@ -0,0 +1,76 @@
+#!/usr/bin/env node
+'use strict'
+
+// Copyright (c) 2025-2026 Dankest, LLC
+// Based on XChain Platform by Dankest, LLC - https://dankest.llc
+//
+// SPDX-License-Identifier: AGPL-3.0-or-later
+//
+// This file is part of XChain Platform. Licensed under the GNU Affero
+// General Public License v3.0 or later; see LICENSE.md. A commercial
+// license (without AGPL source-disclosure terms) is available -
+// contact legal@dankest.llc.
+
+// One `--print` turn with the argv and credential env a venue hub's spawn
+// transport uses, printing the CLI's verdict so a provider_error on the leg
+// has a named cause. The hub logs only stderr, while the CLI reports auth and
+// vendor failures as JSON on stdout. Never prints the credential.
+
+const { spawnSync } = require('child_process')
+const os = require('os')
+
+const PROBE_MODEL = 'claude-sonnet-4-6'
+const CREDENTIAL_KEYS = ['CLAUDE_CONFIG_DIR', 'CLAUDE_CODE_OAUTH_TOKEN', 'ANTHROPIC_API_KEY']
+
+// The hub's buildCliArgs (xchain-hub src/providers/llm/claude_spawn.js) for a turn with no system prompt.
+function probeArgs (model) {
+    return ['--print', '--output-format', 'json', '--model', model, '--tools', '',
+        '--no-session-persistence', '--setting-sources', '']
+}
+
+// The hub's childEnv over the hub_token resolution: ambient credentials out, the hub's pair in.
+function probeEnv (env) {
+    const out = Object.assign({}, env)
+    for (const key of CREDENTIAL_KEYS) delete out[key]
+    out.CLAUDE_CODE_OAUTH_TOKEN = env.HUB_CLAUDE_CODE_OAUTH_TOKEN
+    out.CLAUDE_CONFIG_DIR = env.HUB_CLAUDE_CONFIG_DIR
+    return out
+}
+
+function redact (text, secret) {
+    const s = String(text || '')
+    return secret ? s.split(secret).join('***') : s
+}
+
+// The verdict line: exit code, the envelope's error fields and the first 300 characters of its text.
+function describe (result, secret) {
+    let json = null
+    try { json = JSON.parse(result.stdout) } catch (_) { json = null }
+    const fields = json ? {
+        is_error: json.is_error, subtype: json.subtype, api_error_status: json.api_error_status,
+        result: redact(json.result, secret).slice(0, 300),
+    } : { stdout: redact(result.stdout, secret).slice(0, 300) }
+    return 'hub llm probe: exit ' + result.status + ' ' + JSON.stringify(fields) +
+        (result.stderr ? ' stderr: ' + redact(result.stderr, secret).trim().slice(0, 300) : '')
+}
+
+function main (env) {
+    const secret = env.HUB_CLAUDE_CODE_OAUTH_TOKEN
+    if (!secret || !env.HUB_CLAUDE_CONFIG_DIR) {
+        console.log('hub llm probe: skipped, no hub credential on this leg')
+        return 0
+    }
+    console.log('hub llm probe: credential length ' + secret.length +
+        ', oauth-token form ' + /^sk-ant-oat/.test(secret))
+    const result = spawnSync(env.CLAUDE_BIN || 'claude', probeArgs(PROBE_MODEL), {
+        input: 'Reply with the single word: ok', env: probeEnv(env), cwd: os.tmpdir(),
+        encoding: 'utf8', timeout: 90000,
+    })
+    if (result.error) console.log('hub llm probe: spawn failed: ' + result.error.message)
+    else console.log(describe(result, secret))
+    return result.status === 0 ? 0 : 1
+}
+
+if (require.main === module) process.exitCode = main(process.env)
+
+module.exports = { probeArgs, probeEnv, describe, main }

.github/workflows/attest-mirror-leg.yml

@@ -1,7 +1,7 @@
 name: Attest-mirror leg (regtest)
 
 run-name: >-
-  Attest-mirror legs @ e2e ${{ inputs.e2e_ref || 'develop' }} ${{ inputs.legs || '(all)' }}
+  Attest-mirror legs @ e2e ${{ inputs.e2e_ref || 'develop' }} ${{ inputs.legs || '(all)' }}${{ inputs.hub_llm && ' +llm' || '' }}
 
 # Runs L004-ACC's attest-mirror legs (`BF_STAMP_AHEAD_S=900 npm run test:attest-mirror`
 # in xchain-e2e-test) on GitHub-hosted runners, ONE leg per job, all in parallel,
@@ -36,6 +36,10 @@ on:
         description: 'Ref the service images and source roots are built at'
         type: string
         default: develop
+      hub_llm:
+        description: 'Give the venue hubs the HUB_CLAUDE_CODE_OAUTH_TOKEN secret so llm attestation cases run (regtest rail only)'
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -199,11 +203,40 @@ jobs:
           echo "L004_LOG_DIR=$RUNNER_TEMP/am-logs" >> "$GITHUB_ENV"
           mkdir -p "$RUNNER_TEMP/am-logs"
 
+      # The llm attestation provider on the venue hubs, ONLY when the dispatch asks
+      # for it (hub_llm, off by default and off on the schedule). A validator on
+      # testnet or mainnet answers ATTEST with its own LLM setup, which the hub
+      # resolves through xchain-hub src/lib/hub_credentials.js: a HUB_CLAUDE_CONFIG_DIR
+      # the hub owns, and on this rail the session's HUB_CLAUDE_CODE_OAUTH_TOKEN
+      # paired with it. The venue refuses an llm case unless all three of its
+      # needs are on the box (attestMirrorVenue assertLlmAvailable): the directory,
+      # a credential the hub's resolver accepts, and `claude` on the PATH the hub
+      # children inherit, pinned to the hub image's CLI version (xchain-hub Dockerfile).
+      # The directory sits outside am-logs, so the uploaded artifact never holds
+      # what the CLI writes there.
+      - name: Install the hub llm CLI (hub_llm only)
+        if: inputs.hub_llm == true
+        run: |
+          npm install -g --no-audit --no-fund @anthropic-ai/claude-code@2.1.266
+          command -v claude
+          mkdir -m 700 -p "$RUNNER_TEMP/hub-claude"
+
+      # The token rides this step's env and nothing else: the image builds and the
+      # standing stacks above never see it, and the leg forwards it only to its
+      # venue hub children (at5 forwardedHubCredentialEnv). It is masked before any
+      # leg output and never printed. With the credential on, one probe turn with
+      # the hub's own argv names the CLI's verdict first, because the hub logs only
+      # stderr and the CLI reports an auth or vendor failure on stdout.
       - name: Run ${{ matrix.leg }}
         working-directory: ${{ env.RAIL_ROOT }}/xchain-e2e-test
         env:
           LEG: ${{ matrix.leg }}
+          HUB_CLAUDE_CONFIG_DIR: ${{ inputs.hub_llm == true && format('{0}/hub-claude', runner.temp) || '' }}
+          HUB_CLAUDE_CODE_OAUTH_TOKEN: ${{ inputs.hub_llm == true && secrets.HUB_CLAUDE_CODE_OAUTH_TOKEN || '' }}
         run: |
+          if [ -n "$HUB_CLAUDE_CODE_OAUTH_TOKEN" ]; then echo "::add-mask::$HUB_CLAUDE_CODE_OAUTH_TOKEN"; fi
+          node "$GITHUB_WORKSPACE/.github/attest-mirror/hub-llm-probe.js" | tee "$L004_LOG_DIR/hub-llm-probe.log" ||
+            echo "::warning::hub llm probe failed; llm cases on this leg will answer provider_error"
           set +e
           env L004_VENUE_ROOT="$RAIL_ROOT" ATTEST_MIRROR_CONCURRENCY=1 ATTEST_MIRROR_READY_TIMEOUT_MS=1200000 \
             ATTEST_MIRROR_STACK_ROOT="$AM_ROOT" ATTEST_MIRROR_STACK_PREFIX=xca7 \