feat(python): gtm phase 2 pyo3 bindings for awp-core

.github/workflows/python-wheels.yml

@@ -0,0 +1,148 @@
+name: Python wheels (awp-core-py)
+
+# Builds wheels for the PyO3 bindings under `crates/awp-python/` across
+# macOS / Linux / Windows for Python 3.9–3.13 (abi3 collapses to one
+# wheel per platform). Publish to TestPyPI is gated by manual
+# `workflow_dispatch` per the GTM Phase 2 plan — the real-PyPI promote
+# is a separate decision tied to the design-partner close.
+
+on:
+  push:
+    tags:
+      - "v*"
+    paths:
+      - "crates/awp-python/**"
+      - "crates/awp-core/**"
+      - ".github/workflows/python-wheels.yml"
+  pull_request:
+    paths:
+      - "crates/awp-python/**"
+      - "crates/awp-core/**"
+      - ".github/workflows/python-wheels.yml"
+  workflow_dispatch:
+    inputs:
+      publish_testpypi:
+        description: "Publish built wheels to TestPyPI"
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: build (${{ matrix.os }}, ${{ matrix.target }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-latest
+            target: aarch64-apple-darwin
+            manylinux: ""
+          - os: macos-13
+            target: x86_64-apple-darwin
+            manylinux: ""
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+            manylinux: "2_28"
+          - os: ubuntu-latest
+            target: aarch64-unknown-linux-gnu
+            manylinux: "2_28"
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+            manylinux: ""
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Build wheels
+        uses: PyO3/maturin-action@v1
+        with:
+          target: ${{ matrix.target }}
+          args: --release --out dist --manifest-path crates/awp-python/Cargo.toml
+          manylinux: ${{ matrix.manylinux }}
+          sccache: "true"
+
+      - name: Upload wheels
+        uses: actions/upload-artifact@v4
+        with:
+          name: wheels-${{ matrix.target }}
+          path: dist/*.whl
+          if-no-files-found: error
+
+  sdist:
+    name: sdist
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Build sdist
+        uses: PyO3/maturin-action@v1
+        with:
+          command: sdist
+          args: --out dist --manifest-path crates/awp-python/Cargo.toml
+      - name: Upload sdist
+        uses: actions/upload-artifact@v4
+        with:
+          name: sdist
+          path: dist/*.tar.gz
+          if-no-files-found: error
+
+  test:
+    name: pytest (${{ matrix.os }}, py${{ matrix.python-version }})
+    needs: build
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        python-version: ["3.9", "3.12"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Build awp-verify (cross-language test dependency)
+        run: cargo build -p awp-core --bin awp-verify --release
+
+      - name: Install maturin + pytest
+        run: pip install maturin pytest
+
+      - name: Build extension in place
+        working-directory: crates/awp-python
+        run: maturin develop --release
+
+      - name: Run Python tests
+        run: pytest crates/awp-python/tests -v
+
+  publish-testpypi:
+    name: Publish to TestPyPI
+    needs: [build, sdist, test]
+    if: github.event_name == 'workflow_dispatch' && inputs.publish_testpypi
+    runs-on: ubuntu-latest
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/project/awp-core-py/
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          path: dist
+          merge-multiple: true
+      - name: Publish to TestPyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          packages-dir: dist/
+          skip-existing: true

.gitignore

@@ -3,3 +3,15 @@ data/*
 !data/.gitkeep
 attestations.json
 executions.json
+
+# Python tooling
+.venv/
+__pycache__/
+*.pyc
+.pytest_cache/
+crates/awp-python/dist/
+crates/awp-python/*.egg-info/
+# PyO3 extension built in place by `maturin develop`
+crates/awp-python/python/awp/_native.*.so
+crates/awp-python/python/awp/_native.*.pyd
+crates/awp-python/python/awp/_native.*.dylib

Cargo.toml

@@ -4,6 +4,7 @@ members = [
     "crates/awp-core",
     "crates/awp-agents",
     "crates/awp-examples",
+    "crates/awp-python",
 ]
 
 [workspace.package]

Makefile

@@ -1,19 +1,44 @@
-.PHONY: check lint test test-unit test-int fix
+.PHONY: check lint test test-unit test-int fix check-python python-build python-test
 
-check: lint test
+# Python venv used for the awp-python tests. Override with PY_VENV=... at
+# the call site if you want to point at an existing interpreter. The
+# `python-build` target creates it on first use.
+PY_VENV ?= .venv
+PY_VENV_BIN := $(PY_VENV)/bin
+
+check: lint test check-python
 
 lint:
 	cargo fmt --all -- --check
 	cargo clippy --workspace --all-targets -- -D warnings
 
+# `awp-python` is excluded from `cargo test` because its `cdylib` target
+# triggers a libpython link error on platforms where the Python
+# framework's rpath is not on the linker's default search path. The
+# Python-side tests under `crates/awp-python/tests/` cover that crate's
+# surface via pytest (run by `check-python`).
 test:
-	cargo test --workspace
+	cargo test --workspace --exclude awp-python
 
 test-unit:
-	cargo test --workspace --lib
+	cargo test --workspace --exclude awp-python --lib
 
 test-int:
-	cargo test --workspace --tests
+	cargo test --workspace --exclude awp-python --tests
+
+# Build the Python wheel + run pytest. Builds the `awp-verify` binary
+# first so `tests/cross_language.py` can pipe attestations through it.
+check-python: python-build python-test
+
+python-build:
+	@test -d $(PY_VENV) || python3 -m venv $(PY_VENV)
+	$(PY_VENV_BIN)/pip install --quiet --upgrade pip
+	$(PY_VENV_BIN)/pip install --quiet maturin pytest
+	cargo build -p awp-core --bin awp-verify --release
+	cd crates/awp-python && ../../$(PY_VENV_BIN)/maturin develop --release --quiet
+
+python-test:
+	$(PY_VENV_BIN)/python -m pytest crates/awp-python/tests -v
 
 fix:
 	cargo fmt --all

crates/awp-core/Cargo.toml

@@ -6,6 +6,10 @@ license.workspace = true
 repository.workspace = true
 description = "Core data structures, signing, and storage for the Agent Work Protocol"
 
+[[bin]]
+name = "awp-verify"
+path = "src/bin/awp_verify.rs"
+
 [dependencies]
 ed25519-dalek = { workspace = true }
 sha2 = { workspace = true }