chore: add ai-dev-runtime validation entrypoint (#72)

[geeen-jp]

AGENT:
Implemented through the multi-agent pipeline (Claude Sonnet 5.5 medium design/review/triage, OpenAI GPT-6 Luna max implementation, OpenAI GPT-6.1 Sol high audit). Validation on this host: sdk_validate with CLAUDE_CODE_OAUTH_TOKEN and CLAUDE_AUTH_CODE unset (2547 passed); make validate with both variables exported in the parent shell (rc 0, 16m52s, git status --porcelain empty, TestACPEnvConflictSuppression passed); the same make validate from a fresh local clone with no .venv (rc 0, 17m25s, porcelain empty).

Why

The ai-dev runtime VERIFY step trusts only the baseline SHA's .aidw/validation.json. Without it, VERIFY runs go test / go vet. The workflow environment exports CLAUDE_CODE_OAUTH_TOKEN and CLAUDE_AUTH_CODE, which fail TestACPEnvConflictSuppression unless they are unset. The merge coordinator's default required check name is the Actions job name validate, which this repo did not have.

Summary

• .aidw/validation.json declares schema aidw.repository-validation.v1 with the only command make validate (executable make only; no -C / --directory).
• make validate unsets CLAUDE_CODE_OAUTH_TOKEN and CLAUDE_AUTH_CODE first, then uv sync --dev --frozen, the tests.yml unit suites (sdk, agent_server, workspace, cross, tools), pyright, pre-commit, git diff --check, and git diff --exit-code.
• .github/workflows/validate.yml adds a pull_request job whose name is exactly validate and runs make validate. Existing jobs, including sdk-tests, are unchanged.
• uv.lock, ACP version pins, and agent-server startup are unchanged.

Issue Number

Closes #72

How to Test

With both OAuth variables exported in the parent shell:

make validate then git status --porcelain

On this host that was rc 0 in 16m52s with an empty porcelain. A fresh clone of this branch with no .venv finished in 17m25s (limit 31 min), also with an empty porcelain. TestACPEnvConflictSuppression passed while the parent environment still had both variables set.

Type

• Bug fix
• Feature
• Refactor
• Docs / chore

Notes

tests/examples and tests/integration stay out of make validate (they need a live LLM; they are not in the tests.yml unit jobs). tests/cross deselects test_openai_chat_completions_gateway_over_real_server because it needs DNS that the implementation sandbox did not have; AGENTS.md records that exclusion. The orchestrator host does have DNS.

[github-actions]

📁 PR Artifacts Notice

This PR contains a .pr/ directory with temporary PR-specific documents. The directory will be automatically removed when the PR is approved.

[github-actions]

Python API breakage checks — ✅ PASSED

Result: ✅ PASSED

Action log

[github-actions]

Endpoint audit

⚠️ 18 actionable Agent Server contract divergence(s) · report-only

Contract: pinned release artifact

Category	Count
Actionable client-only calls	0
Actionable server-only operations	18
Documented non-divergences	13
Agent Server contract operations	129
Audited handwritten client endpoints	119

Actionable client-only calls (0)

none

Actionable server-only operations (18)

• DELETE /api/canvas-extensions/installed/{}
• DELETE /api/llm/provider-connections/{}
• GET /api/canvas-extensions/installed
• GET /api/canvas-extensions/installed/{}
• GET /api/canvas-extensions/installed/{}/bundle
• GET /api/conversations/{}/events
• GET /api/file/archive
• GET /api/git/commits
• GET /api/git/commits/{}/changes
• GET /api/init
• GET /api/llm/provider-connections
• PATCH /api/canvas-extensions/installed/{}
• PATCH /api/llm/provider-connections/{}
• POST /api/canvas-extensions/install
• POST /api/conversations/{}/load_plugin
• POST /api/file/create_directory
• POST /api/init
• POST /api/llm/provider-connections

Documented non-divergences (13)

Client calls intentionally absent from the filtered contract (11)

• GET /
• GET /alive
• GET /health
• GET /ready
• GET /server_info

Reason: Operational Agent Server endpoints intentionally excluded from the filtered public release artifact.
Owner: OpenHands runtime maintainers

• DELETE /api/meta-profiles/{}
• GET /api/meta-profiles
• GET /api/meta-profiles/{}
• POST /api/meta-profiles/{}
• POST /api/meta-profiles/{}/activate

Reason: Client-ahead API stacked on the pending Agent Server meta-profiles implementation.
Owner: OpenHands SDK maintainers
Tracking: OpenHands#3744

• POST /api/profiles/{}/validate

Reason: Client-ahead API stacked on the pending Agent Server pre-flight LLM validation endpoint.
Owner: OpenHands TypeScript client maintainers
Tracking: OpenHands#4422

Server operations covered by an exposed browser URL (2)

• GET /api/conversations/{}/workspace
• GET /api/conversations/{}/workspace/{}

Reason: RemoteWorkspace.startWorkspaceSession exposes these authenticated URLs for browser iframe and file requests; they are not HttpClient method calls.
Owner: OpenHands TypeScript client maintainers

[github-actions]

REST API breakage checks (OpenAPI) — ✅ PASSED

Result: ✅ PASSED

Action log