active-rpc 2.0.0

Active RPC — capability-based, promise-pipelined, multi-lane RPC for Active Infinity payloads and multi-agent systems
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  gates:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
      - name: Format
        run: cargo fmt --all -- --check
      - name: Clippy (all targets)
        run: cargo clippy --locked --all-targets --all-features -- -D warnings
      - name: Clippy (no default features)
        run: cargo clippy --locked --all-targets --no-default-features -- -D warnings
      - name: Tests
        run: cargo test --locked --all-features
      - name: Tests (no default features)
        run: cargo test --locked --no-default-features
      - name: Documentation
        env:
          # A broken intra-doc link is a documentation defect, not a warning.
          RUSTDOCFLAGS: -D warnings
        run: cargo doc --locked --no-deps --all-features
      - name: Benchmarks compile
        run: cargo bench --locked --bench transport --no-run

  msrv:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@1.88.0
      # 1.88 is the floor because the patched `time` (RUSTSEC-2026-0009) and
      # `proptest` 1.12 both require it; see docs/adr/0007-msrv.md.
      - name: MSRV check (every feature, every target)
        run: cargo check --locked --all-targets --all-features
      - name: MSRV check (no default features)
        run: cargo check --locked --all-targets --no-default-features

  package:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Package (the tarball must build on its own)
        run: cargo package --locked

  hardening-status:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      # A stale row, a missing test, or a critical invariant without a
      # negative-control plan fails the build.
      - name: Validate the hardening matrix
        run: python3 scripts/hardening_status.py --check

  negative-controls:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      # A security test that still passes on a broken build proves nothing.
      - name: Every security-critical check must fail on a broken build
        run: python3 scripts/negative_controls.py --check

  fuzz:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      # A rolling nightly is deliberate: libFuzzer fixes and sanitizer support
      # land there first. The crate graph is pinned by the committed
      # fuzz/Cargo.lock, which cargo-fuzz uses as-is.
      - uses: dtolnay/rust-toolchain@nightly
      - name: Install clang (libFuzzer runtime)
        run: sudo apt-get update && sudo apt-get install -y clang
      - name: Install cargo-fuzz
        run: cargo install cargo-fuzz --locked
      # The corpus is committed under fuzz/corpus/<target>/. A short campaign
      # per target on every push and pull request; main and nightly run longer.
      - name: Bounded fuzz campaign (every target)
        run: |
          for target in \
            fuzz_arp1_frame \
            fuzz_capability_lifecycle \
            fuzz_promise_graph \
            fuzz_budget_matrix \
            fuzz_tool_mcp \
            fuzz_tool_http \
            fuzz_tool_process \
            fuzz_channel_cap_transfer \
            fuzz_transport_framing; do
            echo "== $target =="
            cargo fuzz run "$target" -- -runs=2000
          done

  supply-chain:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Install audit tools
        run: cargo install cargo-audit cargo-deny --locked
      - name: Advisory audit
        run: cargo audit
      - name: Dependency policy
        run: cargo deny check

  sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Generate and verify the SBOM
        run: |
          mkdir -p dist
          python3 scripts/sbom.py --output dist/active-rpc.cdx.json
          python3 scripts/sbom.py --check dist/active-rpc.cdx.json
      - uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: dist/*.cdx.json

  api-surface:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@nightly
      # The authoritative check: the resolved public API, not a text scan.
      - name: Generate rustdoc JSON
        run: cargo +nightly rustdoc --locked --lib --all-features -- -Zunstable-options --output-format json
      - name: No public secret or raw capability accessor
        run: python3 scripts/api_surface.py target/doc/active_rpc.json