chore: initialize go-sip repository

2026-09-21 08:56:04 +08:00
commit 643b11b21f
309 changed files with 40521 additions and 0 deletions
@@ -0,0 +1,23 @@
+#!/bin/sh
+set -eu
+
+root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+cd "$root"
+
+./scripts/check-contracts.sh
+go mod verify
+go test -race ./...
+go vet ./...
+go build -trimpath -buildvcs=false -o dist/sip-go-agent ./cmd/sip-go-agent
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+./dist/sip-go-agent agent --mode mock --spool "$tmp/spool" >/dev/null
+./dist/sip-go-agent dispatcher --mode mock --db "$tmp/dispatcher.db" >/dev/null
+
+if ./dist/sip-go-agent dispatcher --mode real --db "$tmp/real.db" >/dev/null 2>&1; then
+    echo "real mode unexpectedly started without broker credentials" >&2
+    exit 1
+fi
+
+echo "local P1 acceptance passed for the current single-node/Cell/tenant scope; external production gates are intentionally deferred to phase two"
@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
+OUT_INPUT=${1:-"$ROOT/dist/release"}
+OUT=$(realpath -m -- "$OUT_INPUT")
+VERSION=${RELEASE_VERSION:-local-development}
+
+case "$OUT" in
+  "$ROOT"/*) ;;
+  *)
+    echo "release output must stay below project root: $OUT" >&2
+    exit 1
+    ;;
+esac
+
+rm -rf -- "$OUT"
+mkdir -p -- "$OUT"
+
+cd -- "$ROOT"
+go mod verify
+go build -trimpath -buildvcs=false -o "$OUT/sip-go-agent" ./cmd/sip-go-agent
+cp -- go.mod go.sum "$OUT/"
+(
+  cd -- "$OUT"
+  sha256sum sip-go-agent go.mod go.sum > SHA256SUMS
+)
+
+source_ref=$(git -C "$ROOT" rev-parse HEAD 2>/dev/null || printf 'unavailable')
+source_dirty=false
+if [[ -n "$(git -C "$ROOT" status --porcelain --untracked-files=all -- . 2>/dev/null)" ]]; then
+  source_dirty=true
+fi
+
+go_version=$(go version)
+python3 - "$OUT/manifest.json" "$VERSION" "$source_ref" "$source_dirty" "$go_version" "$OUT" <<'PY'
+import hashlib
+import json
+import pathlib
+import sys
+
+manifest_path, version, source_ref, source_dirty, go_version, out = sys.argv[1:]
+root = pathlib.Path(out)
+def sha256(name):
+    return hashlib.sha256((root / name).read_bytes()).hexdigest()
+
+manifest = {
+    "manifest_version": 1,
+    "scope": "local-development",
+    "version": version,
+    "source_ref": source_ref,
+    "source_dirty": source_dirty == "true",
+    "go_version": go_version,
+    "binary": {"path": "sip-go-agent", "sha256": sha256("sip-go-agent")},
+    "module_files": {
+        "go.mod": sha256("go.mod"),
+        "go.sum": sha256("go.sum"),
+    },
+    "security": {
+        "credentials_embedded": False,
+        "production_approval": False,
+    },
+}
+pathlib.Path(manifest_path).write_text(json.dumps(manifest, indent=2, sort_keys=True) + "\n")
+PY
+
+printf 'release manifest: %s\n' "$OUT/manifest.json"
@@ -0,0 +1,13 @@
+#!/bin/sh
+set -eu
+
+root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+manifest="$root/contracts/upstream/manifest.txt"
+[ -f "$manifest" ] || { echo "missing contract manifest" >&2; exit 1; }
+bundle=$(sed -n 's/^active_bundle=//p' "$manifest")
+[ -n "$bundle" ] || { echo "missing active contract bundle" >&2; exit 1; }
+[ -d "$root/contracts/upstream/$bundle" ] || { echo "missing pinned contract directory: $bundle" >&2; exit 1; }
+
+cd "$root"
+grep '^sha256=' "$manifest" | sed 's/^sha256=//' | sha256sum -c -
+go test ./contracts ./internal/contract ./internal/ai
@@ -0,0 +1,27 @@
+#!/bin/sh
+set -eu
+
+root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+cd "$root"
+
+buf lint
+buf build --error-format=json >/dev/null
+buf generate
+go test ./gen/agent/v1
+
+python3 - <<'PY'
+from hashlib import sha256
+from pathlib import Path
+import json
+
+root = Path('.')
+manifest = json.loads((root / 'proto/manifest.json').read_text())
+for entry in manifest.get('files', []):
+    path = root / entry['path']
+    if not path.is_file():
+        raise SystemExit(f'missing Proto manifest file: {entry["path"]}')
+    digest = sha256(path.read_bytes()).hexdigest()
+    if digest != entry['sha256']:
+        raise SystemExit(f'Proto manifest hash mismatch: {entry["path"]}')
+print(f'proto manifest verified: {len(manifest.get("files", []))} files')
+PY
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
+cd -- "$ROOT"
+IMAGE=${RABBITMQ_IMAGE:-rabbitmq:4.1-management-alpine}
+NAME="sip-go-agent-rabbit-poc-${$}"
+PORT=""
+RABBIT_USER=${RABBITMQ_TEST_USER:-agent_call_integration}
+RABBIT_PASSWORD=${RABBITMQ_TEST_PASSWORD:-$(openssl rand -hex 16)}
+RABBIT_UID=$(docker run --rm "$IMAGE" id -u rabbitmq)
+RABBIT_GID=$(docker run --rm "$IMAGE" id -g rabbitmq)
+
+cleanup() {
+  docker rm -f "$NAME" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+
+docker run -d --name "$NAME" --user "${RABBIT_UID}:${RABBIT_GID}" -e RABBITMQ_DEFAULT_USER="$RABBIT_USER" -e RABBITMQ_DEFAULT_PASS="$RABBIT_PASSWORD" -p 0:5672 "$IMAGE" >/dev/null
+ready=false
+for _ in $(seq 1 90); do
+  if docker exec "$NAME" rabbitmq-diagnostics -q check_running >/dev/null 2>&1; then
+    ready=true
+    break
+  fi
+  sleep 1
+done
+if [[ "$ready" != true ]]; then
+  docker logs "$NAME" >&2 || true
+  echo "RabbitMQ did not become ready" >&2
+  exit 1
+fi
+PORT=$(docker port "$NAME" 5672/tcp | head -1 | sed -E 's/.*:([0-9]+)$/\1/')
+if [[ -z "$PORT" ]]; then
+  echo "could not determine RabbitMQ host port" >&2
+  exit 1
+fi
+IMAGE_ID=$(docker image inspect --format '{{.Id}}' "$IMAGE")
+printf 'local RabbitMQ image=%s id=%s uid=%s gid=%s port=%s\n' "$IMAGE" "$IMAGE_ID" "$RABBIT_UID" "$RABBIT_GID" "$PORT"
+RABBITMQ_URL="amqp://${RABBIT_USER}:${RABBIT_PASSWORD}@127.0.0.1:${PORT}/" go test -tags=integration ./internal/mq ./internal/dispatcher