ci: require full base-demo validation in E2E

.ai-context/WORKFLOWS.md

@@ -91,11 +91,15 @@ repository. Source-checkout tests resolve it from `BASE_CLI_SOURCE_DIR`, a
 sibling `../base-cli/lib/python` checkout, or the installed `base-cli`
 development dependency; Base no longer provides an in-tree copy.
 
-The scheduled/manual `Base Demo E2E` workflow runs the macOS setup, check, test,
-and non-interactive demo loop against the external `basefoundry/base-demo`
-repository. Keep its failure ownership visible: `Base bug` covers Base
-dispatch/runtime failures, while `base-demo manifest needs updating` covers
-manifest, artifact, or declared-command drift.
+The scheduled/manual `Base Demo E2E` workflow runs the macOS 14 setup, check,
+test, and non-interactive demo loop against the external
+`basefoundry/base-demo` repository. It enables the demo's full-validation mode,
+provisions Go and OpenJDK 17, and asserts live HTTP markers for the Go, Python,
+Gradle, and Maven fixtures. The workflow prints the immutable Base, demo,
+`base-cli`, and `base-bash-libs` commits used for each run. Keep its failure
+ownership visible: `Base bug` covers Base dispatch/runtime failures, while
+`base-demo manifest needs updating` covers manifest, artifact, or declared
+command drift.
 
 Integration tests live under `tests/integration/` and run against temporary
 homes, workspaces, and fake projects. Add integration coverage for

.github/workflows/base-demo-e2e.yml

@@ -29,6 +29,7 @@ jobs:
       BASE_CLI_SOURCE_DIR: ${{ github.workspace }}/.dependencies/base-cli/lib/python
       BASE_SETUP_NOTIFY: "false"
       BASE_DEMO_ENV: baseline
+      BASE_DEMO_FULL_VALIDATION: "1"
       PIP_DISABLE_PIP_VERSION_CHECK: "1"
 
     steps:
@@ -72,6 +73,32 @@ jobs:
       - name: Install Bash and BATS
         run: brew install bash bats-core
 
+      - name: Install full-validation Go and Java toolchains
+        run: |
+          brew install go openjdk@17
+          echo "$(brew --prefix openjdk@17)/bin" >> "$GITHUB_PATH"
+          export PATH="$(brew --prefix openjdk@17)/bin:$PATH"
+          command -v go
+          command -v java
+          command -v javac
+          go version
+          java -version
+          javac -version
+
+      - name: Record immutable E2E revisions
+        env:
+          BASE_DEMO_REF: ${{ inputs.base_demo_ref || 'main' }}
+        run: |
+          printf 'supported_os=macos-14\n'
+          printf 'base_ref=%s\n' "$GITHUB_SHA"
+          printf 'base_commit=%s\n' "$(git rev-parse HEAD)"
+          printf 'base_demo_ref=%s\n' "$BASE_DEMO_REF"
+          printf 'base_demo_commit=%s\n' "$(git -C "$GITHUB_WORKSPACE/../base-demo" rev-parse HEAD)"
+          printf 'base_cli_ref=v0.4.3\n'
+          printf 'base_cli_commit=%s\n' "$(git -C "$GITHUB_WORKSPACE/.dependencies/base-cli" rev-parse HEAD)"
+          printf 'base_bash_libs_ref=36fec50c446dcea8c521a1ba3e7fee2394f169c0\n'
+          printf 'base_bash_libs_commit=%s\n' "$(git -C "$GITHUB_WORKSPACE/.dependencies/base-bash-libs" rev-parse HEAD)"
+
       - name: Set up Base
         run: ./bin/basectl setup --ci base --format json
 
@@ -145,6 +172,19 @@ jobs:
             "basectl test base-demo" \
             ./bin/basectl test base-demo --workspace "$BASE_DEMO_WORKSPACE"
 
+          test_log="$log_dir/basectl-test-base-demo.log"
+          for marker in \
+            "go-api: live HTTP contract passed" \
+            "python-api: live HTTP contract passed" \
+            "java-gradle-api: live HTTP contract passed" \
+            "java-maven-api: live HTTP contract passed"; do
+            grep -Fq "$marker" "$test_log" || {
+              printf '::error title=Full validation marker missing::%s was not emitted by basectl test base-demo. Log: %s\n' \
+                "$marker" "$test_log"
+              exit 1
+            }
+          done
+
           run_base_demo_command \
             "basectl demo base-demo" \
             ./bin/basectl demo base-demo --workspace "$BASE_DEMO_WORKSPACE" -- --non-interactive

docs/testing.md

@@ -238,8 +238,12 @@ The [Base Demo E2E workflow](../.github/workflows/base-demo-e2e.yml) runs the
 macOS product loop against the real `basefoundry/base-demo` repository on a
 nightly schedule and through `workflow_dispatch`. It sets up and checks the
 demo, approves its reviewed manifest, then runs the declared test and
-non-interactive demo commands. Use the workflow input to validate a specific
-`base-demo` branch, tag, or commit.
+non-interactive demo commands. The job provisions Go and OpenJDK 17, sets
+`BASE_DEMO_FULL_VALIDATION=1`, and requires the Go, Python, Gradle, and Maven
+live HTTP markers from the demo test log. Use the workflow input to validate a
+specific `base-demo` branch, tag, or commit; the log records the exact Base,
+demo, `base-cli`, and `base-bash-libs` commits used on the supported macOS 14
+runner.
 
 This job is intentionally separate from Base's own test matrix because it
 validates an external manifest and project contract. Its grouped CI output

tests/test_github_workflows.py

@@ -272,6 +272,7 @@ def test_base_demo_e2e_workflow_covers_the_external_project_loop() -> None:
     assert job["runs-on"] == "macos-14"
     assert job["timeout-minutes"] == 45
     assert job["env"]["BASE_DEMO_ENV"] == "baseline"
+    assert job["env"]["BASE_DEMO_FULL_VALIDATION"] == "1"
     assert job["env"]["BASE_CLI_SOURCE_DIR"].endswith(".dependencies/base-cli/lib/python")
 
     checkout_repositories = [
@@ -292,6 +293,16 @@ def test_base_demo_e2e_workflow_covers_the_external_project_loop() -> None:
         "basectl check --ci base-demo",
         "basectl test base-demo",
         "basectl demo base-demo",
+        "brew install go openjdk@17",
+        "go version",
+        "javac -version",
+        "base_demo_commit=",
+        "base_cli_commit=",
+        "base_bash_libs_commit=",
+        "go-api: live HTTP contract passed",
+        "python-api: live HTTP contract passed",
+        "java-gradle-api: live HTTP contract passed",
+        "java-maven-api: live HTTP contract passed",
     ):
         assert command in run_commands
     assert "basefoundry/base-demo.git" in run_commands