Integrate canonical channel contracts and native runtime for OpenHuman

.github/PULL_REQUEST_TEMPLATE.md

@@ -16,7 +16,7 @@
 - [ ] `cargo build --all-targets`
 - [ ] `cargo build --all-targets --all-features`
 - [ ] `cargo test`
-- [ ] `cargo test --all-features`
+- [ ] `scripts/test-features.sh` (stages pinned native artifacts and runs all feature lanes)
 
 ## Documentation
 

.github/workflows/ci.yml

@@ -9,9 +9,40 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 jobs:
+  storage-boundary:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-deny
+      - name: Verify every native library depends on ports only
+        run: |
+          python3 scripts/check-webpki-roots.py --self-test
+          python3 scripts/check-webpki-roots.py
+          scripts/check-storage-engine-trees.sh --self-test
+          scripts/check-storage-engine-trees.sh
+          cargo deny check all
   module-ci:
     uses: tinyhumansai/.github/.github/workflows/module-ci.yml@3e87ade76b622844985d0c665a3b075313e4545c
     with:
       coverage-script: scripts/check-coverage.sh
       module-e2e-script: scripts/test-e2e.sh
       feature-test-script: scripts/test-features.sh
+  storage-needs-boundary:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+      - uses: dtolnay/rust-toolchain@1.94.0
+      - name: Test the standalone storage-needs consumer
+        run: cargo run --locked --manifest-path proofs/storage-needs-consumer/Cargo.toml --target-dir target/storage-needs-consumer
+      - name: Check the storage-needs dependency boundary
+        run: python3 scripts/check-storage-needs-boundary.py
+      - name: Test dependency-boundary negative controls
+        run: python3 scripts/test-storage-needs-boundary.py

.github/workflows/release.yml

@@ -2,10 +2,21 @@ name: Release
 on:
   workflow_dispatch:
     inputs:
+      mode:
+        description: Select the ordinary tag release or the reviewed epic release path.
+        type: choice
+        options: [tag, reviewed]
+        default: tag
+        required: true
       tag:
         description: Existing version tag (vX.Y.Z) committed through a reviewed PR
         type: string
         required: true
+      reviewed_pr:
+        description: Positive canonical PR number for a reviewed epic release.
+        type: string
+        default: '0'
+        required: false
   push:
     tags: ['v*']
 permissions: {}
@@ -31,12 +42,65 @@ jobs:
           }
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
+  validate:
+    if: inputs.mode == 'reviewed'
+    runs-on: ubuntu-latest
+    permissions: {}
+    outputs:
+      reviewed_pr: ${{ steps.validate.outputs.reviewed_pr }}
+    steps:
+      - name: Validate reviewed epic dispatch inputs
+        id: validate
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          REPOSITORY: ${{ github.repository }}
+          REF: ${{ github.ref }}
+          RELEASE_MODE: ${{ inputs.mode }}
+          REVIEWED_PR: ${{ inputs.reviewed_pr || '0' }}
+        run: |
+          set -euo pipefail
+          [[ "$EVENT_NAME" == "workflow_dispatch" ]] || {
+            echo "reviewed release must be dispatched" >&2
+            exit 2
+          }
+          [[ "$REPOSITORY" == "tinyhumansai/tinychannels" ]] || {
+            echo "release caller is not the canonical TinyChannels repository" >&2
+            exit 2
+          }
+          [[ "$REF" == "refs/heads/epic/8056-modules-wiring" ]] || {
+            echo "release must run from epic/8056-modules-wiring" >&2
+            exit 2
+          }
+          [[ "$RELEASE_MODE" == "reviewed" ]] || {
+            echo "release mode must be reviewed" >&2
+            exit 2
+          }
+          [[ "$REVIEWED_PR" =~ ^[1-9][0-9]*$ ]] || {
+            echo "reviewed_pr must be a positive integer" >&2
+            exit 2
+          }
+          printf 'reviewed_pr=%s\n' "$REVIEWED_PR" >> "$GITHUB_OUTPUT"
   module-release:
     needs: resolve
+    if: github.event_name == 'push' || inputs.mode != 'reviewed'
     permissions:
       contents: write
     uses: tinyhumansai/.github/.github/workflows/module-release.yml@3e87ade76b622844985d0c665a3b075313e4545c
     with:
       tag: ${{ needs.resolve.outputs.tag }}
       version: ${{ needs.resolve.outputs.version }}
       module-crate: tinychannels-module
+  module-reviewed-epic-release:
+    needs: [resolve, validate]
+    if: inputs.mode == 'reviewed'
+    permissions:
+      contents: write
+      pull-requests: read
+      checks: read
+      actions: read
+    uses: tinyhumansai/.github/.github/workflows/module-reviewed-epic-release.yml@6ed83b04aab2d8977ec62e966cb914531e534fa4
+    with:
+      tag: ${{ needs.resolve.outputs.tag }}
+      version: ${{ needs.resolve.outputs.version }}
+      reviewed-pr: ${{ fromJSON(needs.validate.outputs.reviewed_pr || '0') }}

.gitignore

@@ -3,6 +3,8 @@
 # behind — which then gets committed as build output.
 target/
 **/*.rs.bk
+__pycache__/
+*.py[cod]
 
 # Release staging built by the `native-bundles` job. Local runs of that
 # packaging step leave a multi-megabyte `cdylib` and its archive here, and an

CONTRIBUTING.md

@@ -81,3 +81,15 @@ Do not report vulnerabilities through public issues. Use the process in
 ## Releasing
 
 Change the Cargo package versions through a reviewed PR. After it merges, tag that commit as vX.Y.Z and push the tag, or dispatch Release with an existing version tag. The shared release verifies the package version, builds and loads all 17 native and distro artifacts, and publishes their checksum manifest. Release does not push version bumps to main.
+
+The TinyBus module SDK is pinned as a source gitlink in `vendor/tinybus` and
+as an exact version and revision in the workspace dependencies. Keep the
+client test fixture's path dependency on that same SDK version when updating
+the pin.
+
+For a release through OpenHuman epic #8056, dispatch
+`.github/workflows/release.yml` from `epic/8056-modules-wiring` with
+`mode=reviewed`, the existing tag, and the positive canonical PR number whose
+merge commit the tag names. The legacy zero default is rejected. Ordinary tags
+and the existing Release dispatch continue through the same workflow's default
+`mode=tag` path.