Test and debug locally

Inspect a saved run

rippflow inspect --report report.json --json
rippflow ui workflow.json --report report.json

In the terminal UI, use ↑/↓ to inspect phases, r to run and q to exit.

Check Lambda-image compatibility

rippflow doctor --handlers handlers.json
rippflow dev workflow.json --handlers handlers.json \
  --input input.json --docker --report docker-report.json

Docker needs a running daemon. Build Java JARs and Linux Rust binaries first; the CLI does not compile them for you.

Test per-phase IAM with Docker Testcontainers or STS AssumeRole

rippflow example s3-pipeline --lang python --dir s3-pipeline
# 1) Local S3/STS Testcontainer (rewrites localhost to host.docker.internal in --docker):
AWS_ENDPOINT_URL=http://127.0.0.1:4566 rippflow dev s3-pipeline/workflow.yaml \
  --handlers s3-pipeline/handlers.json --input s3-pipeline/input.json --shards a,b --docker
# 2) Live AWS STS AssumeRole using caller AWS_PROFILE (SSO/INI) or STS session:
AWS_PROFILE=my-dev-profile AWS_REGION=us-east-1 RIPPFLOW_ASSUME_PHASE_ROLES=1 \
  rippflow dev s3-pipeline/workflow.yaml --handlers s3-pipeline/handlers.json --input s3-pipeline/input.json --shards a,b --docker

• Fail-closed role assumption: phases with a role require STS AssumeRole via AWS_ENDPOINT_URL[_STS] or RIPPFLOW_ASSUME_PHASE_ROLES=1; the CLI never passes raw host credentials directly into a handler, and rejects unknown role aliases.
• Unroled phases & local boundary: handlers.json rejects reserved AWS_*/RIPPFLOW_* env keys, and unroled phases scrub AWS_* env vars and set AWS_SHARED_CREDENTIALS_FILE=/dev/null. Native host processes still retain local user filesystem access; use --docker to avoid mounting ~/.aws.

Know the local limits

Local runs do not reproduce cloud durability, queue delivery, regional failover or production retry timing.