mirror of
https://github.com/luxfi/aml.git
synced 2026-09-24 00:25:20 +00:00
zeekayandHanzo Dev
f9b25476ee
The white-label hardening changed two things the CI and release smokes did not account for, and both were failing every run: - amld now refuses to start without AML_CLIENT_ID (it is the audience every token is pinned to; a plane that cannot check the audience authenticates any first-party token). Both smokes started it without that env, so it exited before answering. Both now set it. - ingest now requires a brand-issued IAM bearer, so the release smoke's "a header-only $100 payment comes back allow" assertion can no longer hold — CI cannot mint an IAM token. That check moves to the engine's own tests, where a token can be signed; the smokes now exercise only what needs no token: the process serves /v1/aml/health, and an unauthenticated read of /v1/aml/cases is refused 401. Also: the CI build dropped -tags embedui. The embedded operator surface needs ui/dist, which the Dockerfile's UI stage builds and which is not committed, so the tagged CI build failed on a missing embed pattern. CI proves the Go code compiles and runs; the release image proves the embedded UI. Verified locally against the hardened binary: health 200, unauthenticated cases 401. Co-authored-by: Hanzo Dev <[email protected]>