agent build

Makefile

@@ -41,6 +41,19 @@ MIGRATE = migrate -path $(MIGRATIONS_DIR) -database "$(DB_URL)"
 
 PSQL = psql -h $(DATABASE_HOST) -p $(DATABASE_PORT) -U $(DATABASE_USER) -d "$(DATABASE_NAME)"
 
+# VERSION identifies a build. It defaults to the current commit (with -dirty if
+# the tree has uncommitted changes), so a stamped build is the default rather
+# than something to remember. Override for a release tag: VERSION=v1.2.0.
+VERSION ?= $(shell git rev-parse --short HEAD 2>/dev/null || echo dev)$(shell git diff --quiet 2>/dev/null || echo -dirty)
+IMAGE   ?= doormile/krowbackend:latest
+
+# Exported, not just defined: docker-compose.yml reads ${VERSION} and ${IMAGE}
+# from the environment, and a make variable is not in a recipe's environment
+# unless it is exported. Without this the compose build arg falls back to "dev"
+# and every image reports the same version.
+export VERSION
+export IMAGE
+
 .PHONY: help
 help: ## Show this help
 	@grep -hE '^[a-zA-Z_-]+:.*?## ' $(MAKEFILE_LIST) | awk 'BEGIN{FS=":.*?## "}{printf "  \033[36m%-18s\033[0m %s\n", $$1, $$2}'
@@ -53,7 +66,7 @@ run: ## Run the API against the local database
 
 .PHONY: build
 build: ## Compile the API to go-api/bin/api
-	cd go-api && go build -o bin/api ./cmd/api
+	cd go-api && go build -ldflags="-X main.version=$(VERSION)" -o bin/api ./cmd/api
 
 .PHONY: tidy
 tidy: ## go mod tidy
@@ -71,6 +84,44 @@ vet: ## go vet the module
 test: ## Run the Go tests
 	cd go-api && go test ./...
 
+.PHONY: eval
+eval: ## Run the agent eval suites (§9 — run this on every loop, retrieval or prompt change)
+	cd go-api && go test ./internal/evals/... -run "Suite|Detector" -v -count=1
+
+.PHONY: import-agents
+import-agents: ## Publish the specs in agents/ into a tenant: make import-agents ORG=<slug>
+	@test -n "$(ORG)" || { echo "usage: make import-agents ORG=<slug>"; exit 1; }
+	cd go-api && go run ./cmd/importagents --dir ../agents --skills ../skills --org "$(ORG)"
+
+.PHONY: check-agents
+check-agents: ## Parse every spec in agents/ and report, writing nothing
+	cd go-api && go run ./cmd/importagents --dir ../agents --skills ../skills --org check --dry-run
+
+.PHONY: eval-live
+eval-live: ## Run the eval suites against the REAL model (needs ANTHROPIC_API_KEY, costs tokens)
+	@test -n "$$ANTHROPIC_API_KEY" || { \
+	  echo "eval-live needs ANTHROPIC_API_KEY — it calls the real model and costs tokens."; \
+	  echo "The scripted suites (make eval) are the gate; this is the confirmation."; exit 1; }
+	cd go-api && go test ./internal/evals/ -run "TestLive" -v -count=1 -timeout 10m
+
+.PHONY: ingest
+ingest: ## Ingest knowledge/ into a tenant: make ingest ORG=<slug>
+	@test -n "$(ORG)" || { echo "usage: make ingest ORG=<slug>"; exit 1; }
+	cd go-api && go run ./cmd/ingest --dir ../knowledge --org "$(ORG)"
+
+.PHONY: reembed
+reembed: ## Re-embed a tenant's corpus with the current model: make reembed ORG=<slug>
+	@test -n "$(ORG)" || { echo "usage: make reembed ORG=<slug>"; exit 1; }
+	cd go-api && go run ./cmd/reembed --org "$(ORG)"
+
+.PHONY: knowledge
+knowledge: ## Run the retrieval layer's permission tests
+	cd go-api && go test ./internal/knowledge/ -v -count=1
+
+.PHONY: tools
+tools: ## Show what every agent tool returns against the seeded data
+	cd go-api && go test ./internal/tools/ -run TestDumpToolOutput -v
+
 .PHONY: check
 check: fmt vet test ## Format, vet and test
 
@@ -88,13 +139,36 @@ db-create: ## Create the database if it does not exist (never drops anything)
 
 .PHONY: seed
 seed: ## Load the frontend demo dataset (idempotent upsert in one transaction)
-	cd go-api && SEED_FIXTURE_PATH=$(CURDIR)/seed/fixtures/seed.json go run ./cmd/seed
+	cd go-api && SEED_FIXTURE_PATH="$(CURDIR)/seed/fixtures/seed.json" go run ./cmd/seed
+
+# seed/fixtures/seed.json is GENERATED from krow-demo/src/api/seed.js. Edit the
+# seed module, not the fixture. These two targets are the only supported way to
+# change it; both need the frontend repo checked out beside this one.
+.PHONY: seed-fixture
+seed-fixture: ## Regenerate seed.json from the frontend seed module
+	cd "$(CURDIR)/../krow-demo" && npm run seed:fixture
+
+.PHONY: seed-fixture-check
+seed-fixture-check: ## Fail if seed.json no longer matches the frontend seed module
+	cd "$(CURDIR)/../krow-demo" && npm run seed:check
 
 .PHONY: gen-resources
 gen-resources: ## Regenerate domain descriptors from the live schema
 	python3 scripts/gen_resources.py > go-api/internal/domain/resources_gen.go
 	cd go-api && gofmt -w ./internal/domain
 
+# Auth runs before routing, so an unauthenticated probe answers 401 for every
+# path — including ones that do not exist. Verifying a deployment therefore
+# needs a session, and the credentials come from the environment so they never
+# reach argv or shell history:
+#
+#   KROW_EMAIL=... KROW_PASSWORD=... make verify-deploy BASE=https://your-host
+#
+# Read-only. Add ARGS=--write to exercise the write paths as well.
+.PHONY: verify-deploy
+verify-deploy: ## Check every endpoint on a deployment: make verify-deploy BASE=<url>
+	@python3 scripts/verify-deploy.py "$(or $(BASE),http://127.0.0.1:8080)" $(ARGS)
+
 .PHONY: db-health
 db-health: ## Ask the running API for its database health
 	@curl -fsS http://$(HTTP_HOST):$(HTTP_PORT)/health | python3 -m json.tool