Feature: MPEG-DASH/CENC compliance + DKMS hardening + creator flow

.github/workflows/ci.yml

@@ -2,9 +2,16 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    # `main` is the live line. The feature branch is included so we can run the full
+    # gate on our own work in isolation (this entry lives only on the branch; it does
+    # NOT affect main or other branches until/unless it is merged). Drop or generalise
+    # to `feat/**` at merge time.
+    branches: [main, feat/ddrm-hardening-and-creator-parity]
   pull_request:
     branches: [main]
+  # Manual trigger so a feature branch can be put through the full Linux gate
+  # (incl. the Linux-only carrier smoke in `just verify`) before merge.
+  workflow_dispatch:
 
 env:
   CARGO_TERM_COLOR: always
@@ -64,3 +71,94 @@ jobs:
       - name: cargo build --release
         working-directory: elastos
         run: cargo build --workspace --release
+
+  # The canonical gate on Linux, MINUS the Carrier-network setup smoke: alignment-check +
+  # command smoke + candidate-command-audit + fmt/clippy/test (elastos workspace) + the dDRM
+  # capsule build+test (verify-capsules). This turns "manually covered" into "green on a clean
+  # runner". The `local-carrier-setup-smoke` step is excluded here because it fetches the
+  # net-provider artifact over Elastos Carrier, which a stock GitHub runner cannot reach — run
+  # the full `just verify` on a Carrier-capable Linux box / self-hosted runner before merge.
+  # RUSTFLAGS=-D warnings is inherited from `env` above.
+  verify:
+    name: Verify (Linux CI gate)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: |
+            elastos
+            capsules/decrypt-provider
+            capsules/ddrm-envelope
+            scripts/dev/ddrm-media-authority
+      - uses: extractions/setup-just@v2
+      - name: Install ripgrep (required by alignment-check; not preinstalled on the runner)
+        run: sudo apt-get update && sudo apt-get install -y ripgrep
+      - name: just verify-ci
+        run: just verify-ci
+
+  # Isolated, fast signal for the protected-content capsule crates that live OUTSIDE
+  # the elastos workspace (so the `check`/`test` jobs and `cargo --workspace` never
+  # reach them): the watermark codec, the grant-digest envelope, the media-authority.
+  # Independent of the carrier smoke, so a flaky/heavy smoke run never masks a capsule
+  # regression. Build+test only (these crates still carry pre-existing clippy debt).
+  capsules:
+    name: dDRM Capsule Gate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: |
+            capsules/decrypt-provider
+            capsules/ddrm-envelope
+            scripts/dev/ddrm-media-authority
+      - uses: extractions/setup-just@v2
+      - name: just verify-capsules
+        run: just verify-capsules
+
+  # Pre-mainnet deploy invariant (fix-pack ②): a PRODUCTION dkms-authority node must be a release
+  # build with DEFAULT features — the legacy unsigned-receipt path (`legacy-receipt-authz`) and the
+  # `dev-modes` opt-in that pulls it in must NEVER ship. The crate enforces this with a
+  # `compile_error!` keyed on a release build (no `debug_assertions`); this job asserts BOTH
+  # directions so the guard can't silently rot. See `docs/DEPLOY_CHECKLIST.md`.
+  # `dkms-authority` lives OUTSIDE the elastos workspace, so the other jobs never reach it.
+  dkms-release-invariant:
+    name: dKMS Release Invariant (no dev-modes/legacy)
+    runs-on: ubuntu-latest
+    # Assert the FEATURE invariant only; do not let unrelated pre-existing rustc warnings in this
+    # out-of-workspace crate mask it (the rest of CI keeps -D warnings).
+    env:
+      RUSTFLAGS: ""
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: capsules/dkms-authority
+      - name: Release build with DEFAULT features must succeed (no legacy path compiled)
+        run: cargo build --release --manifest-path capsules/dkms-authority/Cargo.toml
+      - name: Release build with legacy-receipt-authz must FAIL closed (compile guard)
+        run: |
+          if out=$(cargo build --release --manifest-path capsules/dkms-authority/Cargo.toml --features legacy-receipt-authz 2>&1); then
+            echo "::error::release build ACCEPTED legacy-receipt-authz — the release-invariant guard is missing"
+            exit 1
+          fi
+          echo "$out" | grep -q "release build must not enable" || {
+            echo "::error::release build failed, but NOT via the release-invariant guard:"; echo "$out"; exit 1;
+          }
+          echo "ok: release + legacy-receipt-authz rejected at compile time"
+      - name: Release build with dev-modes must FAIL closed (compile guard)
+        run: |
+          if out=$(cargo build --release --manifest-path capsules/dkms-authority/Cargo.toml --features dev-modes 2>&1); then
+            echo "::error::release build ACCEPTED dev-modes — the release-invariant guard is missing"
+            exit 1
+          fi
+          echo "$out" | grep -q "release build must not enable" || {
+            echo "::error::release build failed, but NOT via the release-invariant guard:"; echo "$out"; exit 1;
+          }
+          echo "ok: release + dev-modes rejected at compile time"

.gitignore

@@ -42,6 +42,9 @@ elastos/storage/
 artifacts/
 artifacts-aarch64/
 
+# Local scratch build tree (vendored linux kernel source, cargo output, etc.)
+build/
+
 # Secrets and credentials
 .env
 *.pem

ROADMAP.md

@@ -924,6 +924,13 @@ clean.
 Encrypted capsules, remote trust, reproducible builds, TPM/TEE-backed attestation, and dDRM-like flows remain future work.
 They matter, but they should not distort the core runtime contract before the local base is stable.
 
+Forensic watermarking for **audio/video** is a dedicated track: rasterizable types already ship a
+two-layer (visible + invisible) per-buyer mark, but AV is key-protected, not yet fingerprinted. The
+plan — A/B forensic variant watermarking (video) and spread-spectrum/echo-hiding (audio), produced
+once at mint and selected per buyer from their signed grant at serve time, keeping the CEK boundary
+and one canonical path intact — is designed in [docs/AV_WATERMARKING.md](docs/AV_WATERMARKING.md).
+The heavy lift is a mint-time transcode pipeline, so it is a roadmap item, not a patch.
+
 ### AI and operator surfaces
 
 Agent and AI provider surfaces should keep moving toward one stable runtime contract with explicit policy, identity, and budget boundaries instead of ad hoc special cases.