build/
  run.py                  << single entrypoint
  README.md
  common/                 shared helpers (paths, pyproject, verify)
  wheel/                  SDK .whl (Nuitka + manylinux Docker)
  release/                local release gate (preflight / audit)
  gui/
    common/               shared PyInstaller driver
    ory_finger/           ORY-FINGER dashboard
    ory_mini/             ORY-MINI internal GUI (scaffold)
    ory_box/              ORY-BOX internal GUI (scaffold)

Commands

SDK wheel

python build/run.py wheel-win
python build/run.py wheel-manylinux

# Single Version
python build/run.py wheel
# Inside Docker
python build/run.py wheel --target pypi-linux --verify

Direct module paths (same behavior):

python build/wheel/build.py
build\wheel\win.bat
.\build\wheel\docker\run.ps1 -SkipImageBuild   # reuse the image when only sources changed

The image bakes in per-ABI build tooling and a per-ABI wheelhouse of the runtime deps, so the entrypoint no longer re-resolves them over the network. See docs/publishing.md §6 for build-time details, why -SkipImageBuild matters, and what to change before attempting to parallelize the per-ABI builds.

Release gate

Local only: never publishes, and makes no network call unless --check-pypi is passed. See docs/publishing.md for the full flow.

python build/run.py release preflight --version <version>
python build/run.py release preflight --all-wheel-pythons --check-pypi
python build/run.py release audit SDK\<version>\orisys-<version>-cp312-cp312-win_amd64.whl

preflight runs: repo state → version consistency → version-string scan → duplicate guard (fails only when the version is already released: a local git tag, or PyPI with --check-pypi) → pytest → bundle precheck → per-wheel static content/metadata assertions → isolated runtime verification in one venv per wheel (imports + bundled assets + real frames, no camera). A populated SDK/<version>/ is the expected input, so build first:

python build/run.py wheel-win
python build/run.py release preflight --all-wheel-pythons --check-pypi

Reports land in build/release/reports/<version>/.

Publish

Both default to a dry run; --apply is required for anything irreversible.

python build/run.py release github --version <version>            # preview
python build/run.py release github --version <version> --apply    # sync + tag + push + Release
python build/run.py release pypi   --version <version> --apply                  # TestPyPI only
python build/run.py release pypi   --version <version> --confirm-pypi --apply   # + PyPI

Both refuse to act unless release preflight passed on a clean commit with no waived options, and every wheel still hashes to what that report recorded. See docs/publishing.md §3.

GUI

python build/run.py gui finger
python build/run.py gui mini    # scaffold / NotImplemented
python build/run.py gui box     # scaffold / NotImplemented

Verify

python build/run.py verify path\to\orisys.whl
python build/run.py verify path\to\orisys.whl --contents --assets --runtime
python build/run.py verify --gui-dist --product ory_finger

Outputs

Wheels: SDK/<version>/, dist/repaired/
Preflight reports: build/release/reports/<version>/
Finger GUI: dist/OrisysDashboard/
Future mini/box: dist/OryMini/, dist/OryBox/

Generated work files under build/nuitka/, build/release/reports/ and build/pyinstaller_work/ are gitignored.