macp-runtime 0.4.0

MACP reference runtime: a coordination kernel and gRPC server enforcing session boundaries, message validation, append-only history, modes, and governance policy.
Documentation
name: MACP Runtime CI

on:
  pull_request:
  push:
    branches: [ main ]

env:
  CARGO_TERM_COLOR: always
  RUST_TOOLCHAIN: "1.89.0"

jobs:
  check:
    name: Check
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Cache cargo registry and build
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: ${{ runner.os }}-cargo-

      - name: Install protoc
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler

      - name: Cargo check
        run: cargo check --all-targets

  fmt:
    name: Format
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
          components: rustfmt

      - name: Check formatting
        run: cargo fmt --all -- --check

  clippy:
    name: Clippy
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
          components: clippy

      - name: Cache cargo registry and build
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: ${{ runner.os }}-cargo-

      - name: Install protoc
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler

      - name: Run clippy
        run: cargo clippy --all-targets -- -D warnings

  test:
    name: Test
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Cache cargo registry and build
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: ${{ runner.os }}-cargo-

      - name: Install protoc
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler

      - name: Run tests
        run: cargo test --all-targets
        env:
          MACP_MEMORY_ONLY: "1"

      - name: Run conformance tests
        run: cargo test conformance
        env:
          MACP_MEMORY_ONLY: "1"

      - name: Run policy tests
        run: cargo test policy
        env:
          MACP_MEMORY_ONLY: "1"

  build:
    name: Build
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Cache cargo registry and build
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: ${{ runner.os }}-cargo-

      - name: Install protoc
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler

      - name: Build release
        run: cargo build --release

  deps-isolation:
    name: Crate Dependency Isolation
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Install protoc
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler

      # Enforce the workspace's layering invariants: the transport-free
      # vocabulary and logic crates must not pull in transport, storage, auth,
      # or any concrete policy engine. A regression here defeats the split.
      - name: macp-core is transport/runtime-free
        run: |
          deps=$(cargo tree -p macp-core --edges normal)
          echo "$deps"
          if echo "$deps" | grep -qiE "tonic|tokio|rocksdb|redis|reqwest|macp-storage|macp-auth|macp-modes|macp-runtime"; then
            echo "::error::macp-core pulled a forbidden dependency"; exit 1
          fi

      - name: macp-modes has no concrete policy / transport
        run: |
          deps=$(cargo tree -p macp-modes --edges normal)
          echo "$deps"
          if echo "$deps" | grep -qiE "tonic|macp-policy|macp-storage|macp-auth|macp-runtime|reqwest|rocksdb|redis"; then
            echo "::error::macp-modes pulled a forbidden dependency"; exit 1
          fi

      - name: auth deps stay out of the vocabulary crates
        run: |
          for crate in macp-core macp-modes macp-policy macp-storage; do
            deps=$(cargo tree -p "$crate" --edges normal)
            if echo "$deps" | grep -qiE "jsonwebtoken|reqwest"; then
              echo "::error::$crate pulled an auth-only dependency"; exit 1
            fi
          done

  audit:
    name: Security Audit
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Run cargo audit
        uses: rustsec/audit-check@v2.0.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

  coverage:
    name: Coverage
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Cache cargo registry and build
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: ${{ runner.os }}-cargo-

      - name: Install protoc
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler

      - name: Install cargo-tarpaulin
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-tarpaulin

      - name: Generate coverage
        run: cargo tarpaulin --all-targets --out xml
        env:
          MACP_MEMORY_ONLY: "1"

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v4
        with:
          files: cobertura.xml
          fail_ci_if_error: false

  ci-pass:
    name: All Checks Passed
    runs-on: ubuntu-latest
    needs: [check, fmt, clippy, test, build, deps-isolation, audit]

    steps:
      - name: Summary
        run: |
          echo "All checks passed successfully"
          echo "  - cargo check"
          echo "  - cargo fmt"
          echo "  - cargo clippy"
          echo "  - cargo test"
          echo "  - cargo build --release"
          echo "  - crate dependency isolation"
          echo "  - cargo audit"