awebai/aweb

Review signals: 2 download and execute, 99 hardcoded secret, 98 known vulnerability, 1 outside write. 137 static matches retained as context.

Source contains download and execute; review its purpose. cli/go/install.sh 2 findings.

Gitleaks found a possible hardcoded secret; value withheld. 17 distinct locations. 98 findings.

OSV reports a known vulnerability in this dependency version. 20 distinct locations. 98 findings.

Repository processes attempted these writes outside documented output/cache paths. 3 distinct locations. 1 attributed processes.

PID 2056: /usr/local/bin/node · npm lifecycle

136 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Only 200 of 2570 findings are stored; the summary counts all of them.

Full safety evidence →

• Mail sent by Alice is delivered to Bob and readable in the conversation: Real input produced the expected result: Please review this branch and reply in the same conversation.

  Source: Please review this branch and reply in the same conversation.

  Input: alice's review request in the shared conversation

  Expected: conversation shows the message body

  Command: aw mail show --conversation-id b9d8dceb-33fd-41c9-ad53-d22c65c07ff9

  Observed: …Please review this branch and reply in the same conversation. - local/alice — cycle check: wake test - local/alice — wake probe: wake probe body - local/alice — cycle check: wake test - local/alice — cycle check: wake test - local/alice — cycle check: wake test

• A healthy setup reports Doctor ok: Real input produced the expected result: Doctor: ok

  Source: `Doctor: ok`.

  Input: aw check in alice workspace

  Expected: Doctor: ok

  Command: aw check

  Observed: Doctor: ok Mode: auto Note: 21 online check(s) were skipped and do not affect the verdict; run `aw check --online` to include them. Path: ~/agents/alice Checks: [info] doctor.contract.v1 — Doctor output contract is available. [ok] local.workspace_yaml.exists — Local workspace binding file is present. [ok] local.workspace_yaml.parse — Local workspace binding parsed successfully. [ok] local.workspace.aweb_url_syntax — Workspace aweb_url is present and syntactically valid. [ok] local.teams.active_team — teams.yaml active_team is present. [ok] local.workspace.active_membership —

• Bob receives an actionable_mail wake event for new mail from Alice: Real input produced the expected result: actionable_mail

  Source: Bob receives an `actionable_mail` event containing a `message_id`.

  Input: alice sends fresh mail via wrapper, bob runs aw events stream

  Expected: actionable_mail event

  Command: <guest-path>

  Observed: …actionable_mail","raw":{"type":"actionable_mail","message_id":"103e0bc3-7502-4acb-912d-016ad3fef038","conversation_id":"b9d8dceb-33fd-41c9-ad53-d22c65c07ff9","from_alias":"alice","from_did":"did:key:z6MkmWQx7LE72bY6fvXA8ANPtVbR4hKUNBNLCPUQDUeUx7tr","from_stable_id":"","from_address":"local/alice","subject":"wake probe","priority":"normal","content_mode":"legacy_plaintext_v1","message_version":1,"encrypted":false,"unread_count":5,"wake_mode":"idle","created_at":"2026-10-28T02:08:56.533879+00:00"},"wake_mode":"idle","channel":"mail","message_id":"103e0bc3-7502-4acb-912d-016ad3fef038","conversati

Examples

• Bob fetches the durable message content by message id: command completed successfully

  Source: README.md

  Input: message id of alice's review request

  Expected: message body shown

  Command: aw mail show --message-id 25e83edf-d615-47c1-976a-25534187ab37

  Observed: Mail conversation b9d8dceb-33fd-41c9-ad53-d22c65c07ff9 (1 messages): - local/alice — review requested: Please review this branch and reply in the same conversation.

Cycles

• Bob's event stream wakes on mail delivered by Alice: Triggered one cycle by hand (run-once wrapper <guest-path> alice aw mail send then bob aw events stream --json --timeout 6 (no source edits; local SSE only); normal trigger: event-stream connection; no cron, no loop in the product): Sent mail in conversation b9d8dceb-33fd-41c9-ad53-d22c65c07ff9 (message_id=bde2d4e4-cd77-47b7-9977-e361e0a1fbed) {"type":"connected","raw":{"agent_id":"5ce895f9-d829-4c1f-9ad6-a1e57822309d","team_id":"default:local"},"agent_id":"5ce895f9-d829-4c1f-9ad6-a1e57822309d","team_id":"default:local"} {"type":"actionable_mail","raw":{"type":"actionable_mail","message_id":"103e0bc3-7502-4acb-912d-016ad3fef038","conversation_id":"b9d8dceb-33fd-41c9-ad53-d22c65c07ff9","from_alias":"alice","from_did":"did:key:z6MkmWQx7LE72bY6fvXA8ANPtVbR4hKUNBNLCPUQDUeUx7tr","from_stable_id":"","from_address":"local/alice","subject":"wake probe","priority":"normal","content_mode":"legacy_plaintext_v1","message_version":1,"encrypted":false,"unread_count":6,"wake_mode":"idle","created_at":"2026-10-28T02:08:56.533879+00:00"},"wake_mode":"idle","channel":"mail","message_id":"103e0bc3-7502-4acb-912d-016ad3fef038","conversation_id":"b9d8dceb-33fd-41c9-ad53-d22c65c07ff9","from_alias":"alice","from_did":"did:key:z6MkmWQx7LE72bY6fvXA8ANPtVbR4hKUNBNLCPUQDUeUx7tr","from_address":"local/alice","subject":"wake probe","content_mode":"legacy_plaintext_v1","message_version":1,"unread_count":6} {"type":"actionable_mail","raw":{"type":"actionable_mail","message_id":"9ae7133c-4ca0-400b-af9d-1c776d89ed06","conversation_id":"b9d8dceb-33fd-41c9-ad53-d22c65c07ff9","from_alias":"alice","from_did":"did:key:z6MkmWQx7LE72bY6fvXA8ANPtVbR4hKUNBNLCPUQDUeUx7tr","from_stable_id":"","from_address":"local/alice","subject":"cycle check","priority":"normal","content_mode":"legacy_plaintext_v1","message_version":1,"encrypted":false,"unread_count":6,"wake_mode":"idle","created_at":"2026-10-28T02:09:06.212380+00:00"},"wake_mode":"idle","channel":"mail","message_id":"9ae7133c-4ca0-400b-af9d-1c776d89ed06","conversation_id":"b9d8dceb-33fd-41c9-ad53-d22c65c07ff9","from_alias":"alice","from_did":"did:key:z6MkmWQx7LE72bY6fvXA8ANPtVbR4hKUNBNLCPUQDUeUx7tr","from_address":"local/alice","subject":"cycle check","content_mode":"legacy_plaintext_v1","message_version":1,"unread_count":6} {"type":"actionable_mail","raw":{"type":"actionable_mail","message_id":"d3032407-da3d-4955-99b9-a14d7bb900a5","conversation_id":"b9d8dceb-33fd-41c9-ad53-d22c65c07ff9","from_alias":"alice","from_did":"did:key:z6MkmWQx7LE72bY6fvXA8ANPtVbR4hKUNBNLCPUQDUeUx7tr","from_stable_id":"","from_address":"local/alice","subject":"cycle check","priority":"normal","content_mode":"legacy_plaintext_v1","message_version":1,"encrypted":false,"unread_count":6,"wake_mode":"idle","created_at":"2026-10-28T02:09:22.757282+00:00"},"wake_mode":"idle","channel":"mail","message_id":"d3032407-da3d-4955-99b9-a14d7bb900a5","conversation_id":"b9d8dceb-33fd-41c9-ad53-d22c65c07ff9","from_alias":"alice","from_did":"did:key:z6MkmWQx7LE72bY6fvXA8ANPtVbR4hKUNBNLCPUQDUeUx7tr","from_address":"local/alice","subject":"cycle check","content_mode":"legacy_plaintext_v1","message_version":1,"unread_count":6} {"type":"actionable_mail","raw":{"type":"actionable_mail","message_id":"bde160b9-e613-420e-a205-8533f29c6ca7","conversation_id":"b9d8dceb-33fd-41c9-ad53-d22c65c07ff9","from_alias":"alice","from_did":"did:key:z6MkmWQx7LE72bY6fvXA8ANPtVbR4hKUNBNLCPUQDUeUx7tr","from_stable_id":"","from_address":"local/alice","subject":"cycle check","priority":"normal","content_mode":"legacy_plaintext_v1","message_version":1,"encrypted":false,"unread_count":6,"wake_mode":"idle","created_at":"2026-10-28T02:09:29.102758+00:00"},"wake_mode":"idle","channel":"mail","message_id":"bde160b9-e613-420e-a205-8533f29c6ca7","conversation_id":"b9d8dceb-33fd-41c9-ad53-d22c65c07ff9","from_alias":"alice","from_did":"did:key:z6MkmWQx7LE72bY6fvXA8ANPtVbR4hKUNBNLCPUQDUeUx7tr","from_address":"local/alice","subject":"cycle check","content_mode":"legacy_plaintext_v1","message_version":1,"unread_count":6} {"type":"actionable_mail","raw":{"type":"actionable_mail","message_id":"013f80c2-7d39-4fa5-badc-8248465a4d8d","conversation_id":"b9d8dceb-33fd-41c9-ad53-d22c65c07ff9","from_alias":"alice","from_did":"did:key:z6MkmWQx7LE72bY6fvXA8ANPtVbR4hKUNBNLCPUQDUeUx7tr","from_stable_id":"","from_address":"local/alice","subject":"cycle check","priority":"normal","content_mode":"legacy_plaintext_v1","message_version":1,"encrypted":false,"unread_count":6,"wake_mode":"idle","created_at":"2026-10-28T02:09:54.983442+00:00"},"wake_mode":"idle","channel":"mail","message_id":"013f80c2-7d39-4fa5-badc-8248465a4d8d","conversation_id":"b9d8dceb-33fd-41c9-ad53-d22c65c07ff9","from_alias":"alice","from_did":"did:key:z6MkmWQx7LE72bY6fvXA8ANPtVbR4hKUNBNLCPUQDUeUx7tr","from_address":"local/alice","subject":"cycle check","content_mode":"legacy_plaintext_v1","message_version":1,"unread_count":6} {"type":"actionable_mail","raw":{"type":"actionable_mail","message_id":"bde2d4e4-cd77-47b7-9977-e361e0a1fbed","conversation_id":"b9d8dceb-33fd-41c9-ad53-d22c65c07ff9","from_alias":"alice","from_did":"did:key:z6MkmWQx7LE72bY6fvXA8ANPtVbR4hKUNBNLCPUQDUeUx7tr","from_stable_id":"","from_address":"local/alice","subject":"cycle check","priority":"normal","content_mode":"legacy_plaintext_v1","message_version":1,"encrypted":false,"unread_count":6,"wake_mode":"idle","created_at":"2026-10-28T02:10:01.296320+00:00"},"wake_mode":"idle","channel":"mail","message_id":"bde2d4e4-cd77-47b7-9977-e361e0a1fbed","conversation_id":"b9d8dceb-33fd-41c9-ad53-d22c65c07ff9","from_alias":"alice","from_did":"did:key:z6MkmWQx7LE72bY6fvXA8ANPtVbR4hKUNBNLCPUQDUeUx7tr","from_address":"local/alice","subject":"cycle check","content_mode":"legacy_plaintext_v1","message_version":1,"unread_count":6}

  Source: README.md

  Input: fresh mail from alice to bob

  Expected: actionable_mail event emitted with message_id

  Command: <guest-path>

  Observed: Sent mail in conversation b9d8dceb-33fd-41c9-ad53-d22c65c07ff9 (message_id=bde2d4e4-cd77-47b7-9977-e361e0a1fbed) {"type":"connected","raw":{"agent_id":"5ce895f9-d829-4c1f-9ad6-a1e57822309d","team_id":"default:local"},"agent_id":"5ce895f9-d829-4c1f-9ad6-a1e57822309d","team_id":"default:local"} {"type":"actionable_mail","raw":{"type":"actionable_mail","message_id":"103e0bc3-7502-4acb-912d-016ad3fef038","conversation_id":"b9d8dceb-33fd-41c9-ad53-d22c65c07ff9","from_alias":"alice","from_did":"did:key:z6MkmWQx7LE72bY6fvXA8ANPtVbR4hKUNBNLCPUQDUeUx7tr","from_stable_id":"","from_address":"local/alice","subject":"wake probe","priority":"normal","content_mode":"legacy_plaintext_v1","message_version":1,"encrypted":false,"unread_count":6,"wake_mode":"idle","created_at":"2026-10-28T02:08:56.533879+00:00"},"wake_mode":"idle","channel":"mail","message_id":"103e0bc3-7502-4acb-912d-016ad3fef038","conversation_id":"b9d8dceb-33fd-41c9-ad53-d22c65c07ff9","from_alias":"alice","from_did":"did:key:z6MkmWQx7LE72bY6fvXA8ANPtVbR4hKUNBNLCPUQDUeUx7tr","from_address":"local/alice","subject":"wake probe","content_mode":"legacy_plaintext_v1","message_version":1,"unread_count":6} {"type":"actionable_mail","raw":{"type":"actionable_mail","message_id":"9ae7133c-4ca0-400b-af9d-1c776d89ed06","conversation_id":"b9d8dceb-33fd-41c9-ad53-d22c65c07ff9","from_alias":"alice","from_did":"did:key:z6MkmWQx7LE72bY6fvXA8ANPtVbR4hKUNBNLCPUQDUeUx7tr","from_stable_id":"","from_address":"local/alice","subject":"cycle check","priority":"normal","content_mode":"legacy_plaintext_v1","message_version":1,"encrypted":false,"unread_count":6,"wake_mode":"idle","created_at":"2026-10-28T02:09:06.212380+00:00"},"wake_mode":"idle","channel":"mail","message_id":"9ae7133c-4ca0-400b-af9d-1c776d89ed06","conversation_id":"b9d8dceb-33fd-41c9-ad53-d22c65c07ff9","from_alias":"alice","from_did":"did:key:z6MkmWQx7LE72bY6fvXA8ANPtVbR4hKUNBNLCPUQDUeUx7tr","from_address":"local/alice","subject":"cycle check","content_mode":"legacy_plaintext_v1","message_version":1,"unread_count":6} {"type":"actionable_mail","raw":{"type":"actionable_mail","message_id":"d3032407-da3d-4955-99b9-a14d7bb900a5","conversation_id":"b9d8dceb-33fd-41c9-ad53-d22c65c07ff9","from_alias":"alice","from_did":"did:key:z6MkmWQx7LE72bY6fvXA8ANPtVbR4hKUNBNLCPUQDUeUx7tr","from_stable_id":"","from_address":"local/alice","subject":"cycle check","priority":"normal","content_mode":"legacy_plaintext_v1","message_version":1,"encrypted":false,"unread_count":6,"wake_mode":"idle","created_at":"2026-10-28T02:09:22.757282+00:00"},"wake_mode":"idle","channel":"mail","message_id":"d3032407-da3d-4955-99b9-a14d7bb900a5","conversation_id":"b9d8dceb-33fd-41c9-ad53-d22c65c07ff9","from_alias":"alice","from_did":"did:key:z6MkmWQx7LE72bY6fvXA8ANPtVbR4hKUNBNLCPUQDUeUx7tr","from_address":"local/alice","subject":"cycle check","content_mode":"legacy_plaintext_v1","message_version":1,"unread_count":6} {"type":"actionable_mail","raw":{"type":"actionable_mail","message_id":"bde160b9-e613-420e-a205-8533f29c6ca7","conversation_id":"b9d8dceb-33fd-41c9-ad53-d22c65c07ff9","from_alias":"alice","from_did":"did:key:z6MkmWQx7LE72bY6fvXA8ANPtVbR4hKUNBNLCPUQDUeUx7tr","from_stable_id":"","from_address":"local/alice","subject":"cycle check","priority":"normal","content_mode":"legacy_plaintext_v1","message_version":1,"encrypted":false,"unread_count":6,"wake_mode":"idle","created_at":"2026-10-28T02:09:29.102758+00:00"},"wake_mode":"idle","channel":"mail","message_id":"bde160b9-e613-420e-a205-8533f29c6ca7","conversation_id":"b9d8dceb-33fd-41c9-ad53-d22c65c07ff9","from_alias":"alice","from_did":"did:key:z6MkmWQx7LE72bY6fvXA8ANPtVbR4hKUNBNLCPUQDUeUx7tr","from_address":"local/alice","subject":"cycle check","content_mode":"legacy_plaintext_v1","message_version":1,"unread_count":6} {"type":"actionable_mail","raw":{"type":"actionable_mail","message_id":"013f80c2-7d39-4fa5-badc-8248465a4d8d","conversation_id":"b9d8dceb-33fd-41c9-ad53-d22c65c07ff9","from_alias":"alice","from_did":"did:key:z6MkmWQx7LE72bY6fvXA8ANPtVbR4hKUNBNLCPUQDUeUx7tr","from_stable_id":"","from_address":"local/alice","subject":"cycle check","priority":"normal","content_mode":"legacy_plaintext_v1","message_version":1,"encrypted":false,"unread_count":6,"wake_mode":"idle","created_at":"2026-10-28T02:09:54.983442+00:00"},"wake_mode":"idle","channel":"mail","message_id":"013f80c2-7d39-4fa5-badc-8248465a4d8d","conversation_id":"b9d8dceb-33fd-41c9-ad53-d22c65c07ff9","from_alias":"alice","from_did":"did:key:z6MkmWQx7LE72bY6fvXA8ANPtVbR4hKUNBNLCPUQDUeUx7tr","from_address":"local/alice","subject":"cycle check","content_mode":"legacy_plaintext_v1","message_version":1,"unread_count":6} {"type":"actionable_mail","raw":{"type":"actionable_mail","message_id":"bde2d4e4-cd77-47b7-9977-e361e0a1fbed","conversation_id":"b9d8dceb-33fd-41c9-ad53-d22c65c07ff9","from_alias":"alice","from_did":"did:key:z6MkmWQx7LE72bY6fvXA8ANPtVbR4hKUNBNLCPUQDUeUx7tr","from_stable_id":"","from_address":"local/alice","subject":"cycle check","priority":"normal","content_mode":"legacy_plaintext_v1","message_version":1,"encrypted":false,"unread_count":6,"wake_mode":"idle","created_at":"2026-10-28T02:10:01.296320+00:00"},"wake_mode":"idle","channel":"mail","message_id":"bde2d4e4-cd77-47b7-9977-e361e0a1fbed","conversation_id":"b9d8dceb-33fd-41c9-ad53-d22c65c07ff9","from_alias":"alice","from_did":"did:key:z6MkmWQx7LE72bY6fvXA8ANPtVbR4hKUNBNLCPUQDUeUx7tr","from_address":"local/alice","subject":"cycle check","content_mode":"legacy_plaintext_v1","message_version":1,"unread_count":6}

Local or hosted: both

Run the local aweb OSS stack from the README and exchange a durable mail round trip between two agents (alice and bob) through the aw CLI, including a wake-up event.

cd <guest-path> && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat README.md 2>/dev/null | head -c 6000
echo $CDP_URL; curl -s -m 10 -i $CDP_URL/json/version; echo; echo EXIT=$?
cd <guest-path> && tail -c +6000 README.md | head -c 9500
for c in node npm docker openssl go curl git; do printf "%s: " $c; command -v $c || echo MISSING; done; node -v 2>&1; npm -v 2>&1; docker --version 2>&1; docker compose version 2>&1; sudo -n true && echo SUDO_OK; cat /etc/os-release | head -2
export NODE_USE_ENV_PROXY=1; sudo npm install -g @awebai/aw 2>&1 | tail -5; command -v aw && aw version 2>&1 | head -3
sudo apt-get -o DPkg::Lock::Timeout=300 update 2>&1 | tail -2; sudo apt-get -o DPkg::Lock::Timeout=300 install -y docker.io docker-compose-v2 2>&1 | tail -5; docker --version 2>&1; docker compose version 2>&1
sudo systemctl start docker 2>&1 | tail -2; sleep 3; sudo docker info 2>&1 | head -5 || true; sudo docker ps 2>&1 | head -3
cd <guest-path> && cp .env.example .env && echo "AWID_SERVICE_TOKEN=$(openssl rand -hex 32)" >> .env && grep -c . .env && ls ../docker-compose.e2e.yml && cd <guest-path> && sed -n 1,80p docker-compose.e2e.yml | head -c 1500; ls server; grep -n "ports" -A3 docker-compose.e2e.yml | head
cd <guest-path> && timeout 900 sudo docker compose up --build -d > /tmp/compose_up.log 2>&1; echo EXIT=$?; tail -15 /tmp/compose_up.log
sleep 5; curl -s -m 10 -w " HTTP=%{http_code}\n" http://localhost:8000/health; curl -s -m 10 -w " HTTP=%{http_code}\n" http://localhost:8010/health
mkdir -p <guest-path> && cd <guest-path> && export AWEB_URL=http://localhost:8000 AWID_REGISTRY_URL=http://localhost:8010 && aw init --new-team --name alice 2>&1 | tail -20; echo "EXIT=$?"; aw check 2>&1 | tail -10
cd <guest-path> && export AWEB_URL=http://localhost:8000 AWID_REGISTRY_URL=http://localhost:8010 && aw check 2>&1 | head -40; echo; ls -la .aw 2>&1 | head
cd <guest-path> && export AWEB_URL=http://localhost:8000 AWID_REGISTRY_URL=http://localhost:8010 && aw check --online 2>&1 | grep -E "Doctor|server\.|messaging\.server|skipped|fail" | head -30; echo ---; aw team invite 2>&1 | tail -15
mkdir -p <guest-path> && cd <guest-path> && export AWEB_URL=http://localhost:8000 AWID_REGISTRY_URL=http://localhost:8010 && aw team join eyJpIjoiNzllZDFhYjEtMzBiNi00MmMwLThiOTYtNjBlZTQxMDFkMTJkIiwiZCI6ImxvY2FsIiwidCI6ImRlZmF1bHQiLCJzIjoiSURjZVlZVENKQmhFTS1tQWlEclhydjB6bWFvck53UmgiLCJyIjoiaHR0cDovL2xvY2FsaG9zdDo4MDEwIiwiYSI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODAwMCJ9 --name bob 2>&1 | tail -8; echo "EXIT=${PIPESTATUS[0]}"; aw check --online 2>&1 | head -3
export AWEB_URL=http://localhost:8000 AWID_REGISTRY_URL=http://localhost:8010; cd <guest-path> && aw mail send --to bob --subject "review requested" --body "Please review this branch and reply in the same conversation." 2>&1 | tail -8; echo "EXIT=${PIPESTATUS[0]}"; sleep 2; cd <guest-path> && aw mail inbox 2>&1 | tail -10; echo "EXIT=${PIPESTATUS[0]}"
cd <guest-path> && export AWEB_URL=http://localhost:8000 AWID_REGISTRY_URL=http://localhost:8010; aw events stream --help 2>&1 | head -30; echo ----; cd <guest-path> && cat CONTRIBUTING.md | head -c 1400
export AWEB_URL=http://localhost:8000 AWID_REGISTRY_URL=http://localhost:8010; cd <guest-path> && aw mail send --to bob --subject "cycle check" --body "wake test" 2>&1 | tail -2; cd <guest-path> && timeout 60 aw events stream --json --timeout 6 2>&1 | head -c 1500; echo; echo "EXIT=${PIPESTATUS[0]}"
cd <guest-path> && grep -nF 'Please review this branch and reply in the same conversation.' README.md; grep -nF '`Doctor: ok`.' README.md; grep -nF 'Bob receives an `actionable_mail` event containing a `message_id`.' README.md; export AWEB_URL=http://localhost:8000 AWID_REGISTRY_URL=http://localhost:8010; cd <guest-path> && aw mail show --message-id 25e83edf-d615-47c1-976a-25534187ab37 2>&1 | head -12
cd <guest-path> && ENVJ='{"AWEB_URL":"http://localhost:8000","AWID_REGISTRY_URL":"http://localhost:8010"}' && BOB=<guest-path> && ALICE=<guest-path> && cat > probe.json <<EOF
{"kind":"cli","argv":["aw","mail","inbox"],"cwd":"$BOB","env":$ENVJ,"expected_text":"Please review this branch and reply in the same conversation."}
EOF
cat > claims.json <<EOF
[
{"kind":"claim","claim":"Mail sent by Alice is delivered to Bob's inbox","source":"README.md","quote":"Please review this branch and reply in the same conversation.","source_quote":"--body \"Please review this branch and reply in the same conversation.\"","input":"alice sends mail; bob reads inbox","expected":"inbox lists the message body","probe_kind":"cli","argv":["aw","mail","inbox"],"env":$ENVJ,"expected_text":"Please review this branch and reply in the same conversation.","cwd":"$BOB"},
{"kind":"claim","claim":"Health of the local team check reports Doctor ok","source":"README.md","quote":"\`Doctor: ok\`.","input":"aw check in alice workspace","expected":"Doctor: ok","probe_kind":"cli","argv":["aw","check"],"env":$ENVJ,"expected_text":"Doctor: ok","cwd":"$ALICE"},
{"kind":"claim","claim":"Bob receives an actionable_mail wake event for unread mail","source":"README.md","quote":"Bob receives an \`actionable_mail\` event containing a \`message_id\`.","input":"aw events stream for bob with timeout","expected":"actionable_mail event","probe_kind":"cli","argv":["aw","events","stream","--json","--timeout","6"],"env":$ENVJ,"expected_text":"actionable_mail","cwd":"$BOB"}
]
EOF
python3 -I -c 'import json;[print(len(json.load(open(f)))) for f in ["probe.json","claims.json"]]' 2>&1; cat claims.json | head -c 600
ls <guest-path> 2>&1; grep -n "source_file\|\"source\"\|'source'\|\"quote\"\|source_quote" <guest-path> 2>/dev/null | head -20
cd <guest-path> && ENVJ='{"AWEB_URL":"http://localhost:8000","AWID_REGISTRY_URL":"http://localhost:8010"}' && BOB=<guest-path> && ALICE=<guest-path> && cat > claims.json <<EOF
[
{"kind":"claim","claim":"Mail sent by Alice is delivered to Bob's inbox","source":"Please review this branch and reply in the same conversation.","input":"alice sends mail; bob reads inbox","expected":"inbox lists the message body","probe_kind":"cli","argv":["aw","mail","inbox"],"env":$ENVJ,"expected_text":"Please review this branch and reply in the same conversation.","cwd":"$BOB"},
{"kind":"claim","claim":"A healthy setup reports Doctor ok","source":"\`Doctor: ok\`.","input":"aw check in alice workspace","expected":"Doctor: ok","probe_kind":"cli","argv":["aw","check"],"env":$ENVJ,"expected_text":"Doctor: ok","cwd":"$ALICE"},
{"kind":"claim","claim":"Bob receives an actionable_mail wake event for unread mail","source":"Bob receives an \`actionable_mail\` event containing a \`message_id\`.","input":"aw events stream for bob with timeout","expected":"actionable_mail event","probe_kind":"cli","argv":["aw","events","stream","--json","--timeout","6"],"env":$ENVJ,"expected_text":"actionable_mail","cwd":"$BOB"}
]
EOF
cat > cycles.json <<EOF
{"detected":true,"checks":[{"claim":"Bob's event stream wakes on unread mail delivered by Alice","source":"README.md","quote":"Bob receives an \`actionable_mail\` event containing a \`message_id\`.","schedule":"event-stream connection on each reconnect; no cron","method":"run-once: bounded aw events stream with --timeout 6 (no source edits; local SSE only)","input":"unread mail from alice to bob already on server","expected":"actionable_mail event emitted with message_id","kind":"cli","argv":["aw","events","stream","--json","--timeout","6"],"env":$ENVJ,"cwd":"$BOB","expected_text":"actionable_mail"}]}
EOF
cat > examples.json <<EOF
[{"kind":"example","claim":"Bob fetches the durable message content by message id","source":"README.md","input":"message id of alice's review request","expected":"message body shown","argv":["aw","mail","show","--message-id","25e83edf-d615-47c1-976a-25534187ab37"],"cwd":"$BOB","env":$ENVJ,"expected_text":"Please review this branch and reply in the same conversation."}]
EOF
for f in claims.json cycles.json examples.json probe.json; do python3 -I -m json.tool $f >/dev/null && echo "$f ok"; done
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > /tmp/coldpass_validate.out 2>&1; echo EXIT=$?; head -c 5000 /tmp/coldpass_validate.out
export AWEB_URL=http://localhost:8000 AWID_REGISTRY_URL=http://localhost:8010; cd <guest-path> && aw mail show --conversation-id b9d8dceb-33fd-41c9-ad53-d22c65c07ff9 2>&1 | head -8; echo ---; cd <guest-path> && aw mail send --to bob --subject "wake probe" --body "wake probe body" | tail -1; cd <guest-path> && timeout 30 aw events stream --json --timeout 4 2>&1 | grep -o '"type":"actionable_mail"' | head -2
mkdir -p <guest-path> && cat > <guest-path> <<'EOF'
#!/bin/bash
# Manual cycle: Alice sends fresh mail (README "aw mail send"), then Bob's
# documented wake consumer "aw events stream --json" runs bounded by --timeout.
set -e
export AWEB_URL=http://localhost:8000 AWID_REGISTRY_URL=http://localhost:8010
cd <guest-path>
aw mail send --to bob --subject "cycle check" --body "wake test"
cd <guest-path>
exec aw events stream --json --timeout 6
EOF
chmod +x <guest-path> && <guest-path> 2>&1 | grep -c actionable_mail; echo EXIT=${PIPESTATUS[0]}
cd <guest-path> && ENVJ='{"AWEB_URL":"http://localhost:8000","AWID_REGISTRY_URL":"http://localhost:8010"}' && BOB=<guest-path> && ALICE=<guest-path> && WAKE=<guest-path> && CID=b9d8dceb-33fd-41c9-ad53-d22c65c07ff9 && cat > probe.json <<EOF
{"kind":"cli","argv":["aw","mail","show","--conversation-id","$CID"],"cwd":"$BOB","env":$ENVJ,"expected_text":"Please review this branch and reply in the same conversation."}
EOF
cat > claims.json <<EOF
[
{"kind":"claim","claim":"Mail sent by Alice is delivered to Bob and readable in the conversation","source":"Please review this branch and reply in the same conversation.","input":"alice's review request in the shared conversation","expected":"conversation shows the message body","probe_kind":"cli","argv":["aw","mail","show","--conversation-id","$CID"],"env":$ENVJ,"expected_text":"Please review this branch and reply in the same conversation.","cwd":"$BOB"},
{"kind":"claim","claim":"A healthy setup reports Doctor ok","source":"\`Doctor: ok\`.","input":"aw check in alice workspace","expected":"Doctor: ok","probe_kind":"cli","argv":["aw","check"],"env":$ENVJ,"expected_text":"Doctor: ok","cwd":"$ALICE"},
{"kind":"claim","claim":"Bob receives an actionable_mail wake event for new mail from Alice","source":"Bob receives an \`actionable_mail\` event containing a \`message_id\`.","input":"alice sends fresh mail via wrapper, bob runs aw events stream","expected":"actionable_mail event","probe_kind":"cli","argv":["$WAKE"],"env":$ENVJ,"expected_text":"actionable_mail","cwd":"$BOB"}
]
EOF
cat > cycles.json <<EOF
{"detected":true,"checks":[{"claim":"Bob's event stream wakes on mail delivered by Alice","source":"README.md","quote":"Bob receives an \`actionable_mail\` event containing a \`message_id\`.","schedule":"event-stream connection; no cron, no loop in the product","method":"run-once wrapper <guest-path> alice aw mail send then bob aw events stream --json --timeout 6 (no source edits; local SSE only)","input":"fresh mail from alice to bob","expected":"actionable_mail event emitted with message_id","kind":"cli","argv":["$WAKE"],"env":$ENVJ,"cwd":"$BOB","expected_text":"actionable_mail"}]}
EOF
cat > examples.json <<EOF
[{"kind":"example","claim":"Bob fetches the durable message content by message id","source":"README.md","input":"message id of alice's review request","expected":"message body shown","argv":["aw","mail","show","--message-id","25e83edf-d615-47c1-976a-25534187ab37"],"cwd":"$BOB","env":$ENVJ,"expected_text":"Please review this branch and reply in the same conversation."}]
EOF
for f in claims.json cycles.json examples.json probe.json; do python3 -I -m json.tool $f >/dev/null && echo "$f ok"; done
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > /tmp/coldpass_validate.out 2>&1; echo EXIT=$?; python3 -I -c '
import json,sys
d=json.load(open("/tmp/coldpass_validate.out")) if False else None' ; tail -c 3000 /tmp/coldpass_validate.out
grep -o '"valid": [a-z]*' /tmp/coldpass_validate.out; grep -o '"problems": \[[^]]*\]' /tmp/coldpass_validate.out | head -c 600; echo; grep -o '"verdict\\\?": \\\?"[a-z]*' /tmp/coldpass_validate.out | sort | uniq -c
cd <guest-path> && cat > report.json <<'EOF'
{
  "outcome": "working",
  "fault_owner": null,
  "operation": "Run the local aweb OSS stack from the README and exchange a durable mail round trip between two agents (alice and bob) through the aw CLI, including a wake-up event.",
  "operation_scope": "Local OSS path only (README 'Local OSS stack'): docker compose stack for aweb (port 8000) and AWID (port 8010), local team 'default:local'. Hosted aweb.ai path, Claude Code/Pi channel plugins, and browser/CDP were not used. Node v22.23.4, Python 3.12.3, Docker 29.1.3, Compose 2.40.3.",
  "steps": [
    "npm install -g @awebai/aw",
    "aw version",
    "cd server && cp .env.example .env && echo \"AWID_SERVICE_TOKEN=$(openssl rand -hex 32)\" >> .env",
    "docker compose up --build -d",
    "curl http://localhost:8000/health ; curl http://localhost:8010/health",
    "export AWEB_URL=http://localhost:8000 AWID_REGISTRY_URL=http://localhost:8010; aw init --new-team --name alice",
    "aw check ; aw check --online",
    "aw team invite",
    "aw team join <invite-token> --name bob ; aw check",
    "aw mail send --to bob --subject \"review requested\" --body \"Please review this branch and reply in the same conversation.\"",
    "aw mail inbox ; aw mail show --message-id <id> ; aw mail show --conversation-id <id>",
    "aw events stream --json --timeout 6 (wake-up actionable_mail event)"
  ],
  "deviations": [
    "Docker was not installed in the guest. Ran: sudo apt-get -o DPkg::Lock::Timeout=300 install -y docker.io docker-compose-v2 (succeeded), then sudo systemctl start docker. Docker commands run with sudo because the ubuntu user is not in the docker group.",
    "npm global install ran with sudo (sudo npm install -g @awebai/aw) to place aw in /usr/local/bin.",
    "The workspace is not a git repository and no git fetch/reset was needed; the source snapshot was used as-is.",
    "Bob's team join used the invite token from alice's aw team invite on the local stack (no DNS, no hosted account).",
    "The validation run first failed on two claims because aw mail show marks mail as read, so inbox and the wake stream no longer returned the earlier message. Fixed by using the durable conversation view (aw mail show --conversation-id) for the delivery claim and a guest wrapper <guest-path> that sends fresh mail from alice and then runs bob's aw events stream --json --timeout 6. The wrapper only sequences the two documented aw commands; it is a substitute trigger, not a product scheduler.",
    "The compose stack (aweb, awid, postgres, redis) was left running until guest teardown, as required for the CLI probes."
  ],
  "stuck_step": null,
  "main_blocker": null,
  "plain_failure": null,
  "suggested_fix": "None for the working path. Note: aw mail show marks mail as read, which changes what aw mail inbox and aw events stream return later; tests that depend on unread state need fresh mail per run."
}
EOF
python3 -I -m json.tool report.json >/dev/null && echo REPORT_OK; ls -la <guest-path>; ls <guest-path> 2>&1