175 lines
4.6 KiB
Markdown
175 lines
4.6 KiB
Markdown
# NODE.DC Local Testing System
|
||
|
||
Цель: тестировать новые функции на локально запущенных репозиториях без переписывания адресов перед деплоем и без случайных обращений в production-приложения.
|
||
|
||
## Canon
|
||
|
||
Локальный профиль:
|
||
|
||
```text
|
||
NODEDC_ENV=local
|
||
```
|
||
|
||
В `local` все product apps являются локальными:
|
||
|
||
```text
|
||
Launcher/Auth/HUB UI -> local
|
||
Engine -> local
|
||
Ops/Gateway/Tasker -> local
|
||
AI Workspace Assistant -> local
|
||
DB/fixtures -> local
|
||
```
|
||
|
||
Единственное разрешенное deployed-звено в этом профиле:
|
||
|
||
```text
|
||
AI Hub relay -> https://ai-hub.nodedc.ru
|
||
```
|
||
|
||
Этот Hub используется только как транспорт для удаленного Codex worker. Он не должен быть downstream app, не должен владеть доступами пользователя и не должен сам читать/писать Launcher, Engine или Ops.
|
||
|
||
## Remote Worker Local Flow
|
||
|
||
```text
|
||
local Engine / local Ops UI
|
||
-> local AI Workspace Assistant
|
||
-> deployed AI Hub relay
|
||
-> remote Codex worker
|
||
-> deployed AI Hub assistant action relay
|
||
-> local AI Workspace Assistant
|
||
-> local Launcher / local Engine / local Ops
|
||
```
|
||
|
||
Worker получает только relay URL и scoped run profile. Product app URL остаются на стороне локального Assistant.
|
||
|
||
## Required Local Guardrails
|
||
|
||
Local Platform env:
|
||
|
||
```text
|
||
NODEDC_ENV=local
|
||
AI_WORKSPACE_HUB_PUBLIC_URL=wss://ai-hub.nodedc.ru/api/ai-workspace/hub
|
||
AI_WORKSPACE_HUB_INTERNAL_URL=https://ai-hub.nodedc.ru
|
||
AI_WORKSPACE_ASSISTANT_ACTION_RELAY_ENABLED=true
|
||
AI_WORKSPACE_ASSISTANT_ACTION_RELAY_ID=local-dev
|
||
```
|
||
|
||
Local Engine env:
|
||
|
||
```text
|
||
NODEDC_ENV=local
|
||
NODEDC_AI_WORKSPACE_ASSISTANT_URL=http://127.0.0.1:18082
|
||
NODEDC_LAUNCHER_INTERNAL_URL=http://127.0.0.1:5173
|
||
NODEDC_LAUNCHER_ORIGIN=http://launcher.local.nodedc
|
||
AUTHENTIK_PUBLIC_BASE_URL=http://auth.local.nodedc
|
||
```
|
||
|
||
Production app URLs are forbidden in local config:
|
||
|
||
```text
|
||
https://hub.nodedc.ru
|
||
https://engine.nodedc.ru
|
||
https://ops.nodedc.ru
|
||
https://id.nodedc.ru
|
||
https://ops-agents.nodedc.ru
|
||
```
|
||
|
||
Tunnel/private URLs are also forbidden in `local`. If Tailscale/ngrok is deliberately needed, switch to:
|
||
|
||
```text
|
||
NODEDC_ENV=tunnel-local-e2e
|
||
```
|
||
|
||
## Standard Check
|
||
|
||
Run this before UI testing and before deploy preparation:
|
||
|
||
```sh
|
||
cd /Users/dcconstructions/Downloads/mnt/NODEDC/platform
|
||
sh infra/scripts/check-local-test-system.sh
|
||
```
|
||
|
||
This command:
|
||
|
||
- checks Node and shell syntax;
|
||
- checks local env safety;
|
||
- checks AI Workspace config contract;
|
||
- renders local Docker Compose config without starting containers;
|
||
- checks that local Compose does not inject the full `.env` into every service;
|
||
- runs run-profile and ontology assistant caller smoke tests;
|
||
- classifies the current runtime topology;
|
||
- checks diff whitespace hygiene.
|
||
|
||
It does not deploy, restart containers, mutate databases, or write production config.
|
||
|
||
## Runtime Modes
|
||
|
||
`contract-only`
|
||
|
||
Static contracts are testable, but no runtime path is proven.
|
||
|
||
`local-ui-only`
|
||
|
||
Some local UI/backend endpoints respond, but AI write path is not proven.
|
||
|
||
`local-ops-vertical`
|
||
|
||
Local Ops/Gateway/Tasker vertical path is reachable, but remote worker action path is not proven.
|
||
|
||
`local-remote-worker-relay`
|
||
|
||
Expected current target for this workstation:
|
||
|
||
```text
|
||
local product apps + local Assistant + deployed AI Hub relay + remote Codex worker
|
||
```
|
||
|
||
This is valid only when Assistant action relay is configured. A successful UI request must show that `assistant_action_call` routes through the relay back to local Assistant.
|
||
|
||
`true-local-e2e`
|
||
|
||
Everything, including Hub and worker reachability, is local.
|
||
|
||
`tunnel-local-e2e`
|
||
|
||
Explicit Tailscale/ngrok profile. This must never happen by accidental URL fallback.
|
||
|
||
## Strict Runtime Checks
|
||
|
||
Require a live local/relay runtime:
|
||
|
||
```sh
|
||
REQUIRE_RUNTIME=1 sh infra/scripts/check-local-test-system.sh
|
||
```
|
||
|
||
Require specifically the remote-worker relay mode:
|
||
|
||
```sh
|
||
REQUIRE_REMOTE_WORKER_RELAY=1 sh infra/scripts/check-local-test-system.sh
|
||
```
|
||
|
||
## Deploy Rule
|
||
|
||
Deploy is allowed only after:
|
||
|
||
```sh
|
||
sh infra/scripts/check-local-test-system.sh
|
||
sh infra/scripts/check-ai-workspace-release-gates.sh
|
||
```
|
||
|
||
Runtime bugs must be fixed in the local profile first. Do not deploy product app changes just to test whether the local AI Workspace path works.
|
||
|
||
## Audit And Test Map
|
||
|
||
Current audit report:
|
||
|
||
```text
|
||
docs/AI_WORKSPACE_SECURITY_AUDIT_2026-06-20.md
|
||
```
|
||
|
||
Current horizontal, vertical, and security test matrix:
|
||
|
||
```text
|
||
docs/AI_WORKSPACE_TEST_MATRIX.md
|
||
```
|