[intel352]

Summary

• Add a bounded, versioned JSONL bridge over the official Encrypted Spaces SDK for Space lifecycle, table, list, text, file, membership, synchronization, cancellation, and shutdown.
• Harden trusted restore, applied-update delivery, native request deadlines, unknown mutation outcomes, revocation checks, and Space-scoped opaque references.
• Build Linux/macOS amd64/arm64 backend and bridge assets with a real packaged RISC Zero receipt gate, checksums, legal notices, trusted OIDC attestation, and weekly compatibility sync automation.

Design

See the platform design.

Implementation Plan

See the locked implementation plan.

Scope Manifest

• PR Count: 22
• Tasks: 30
• Status: Locked 2026-07-10T11:45:36Z
• This PR: PR 3, Tasks 3 and 4, branch encrypted-spaces-runtime-bridge

Runtime launch transcript

Build:

$ RISC0_SKIP_BUILD=1 RISC0_DEV_MODE=1 cargo build --release --locked -p encrypted-spaces-backend-server -p encrypted-spaces-bridge --features encrypted-spaces-bridge/real-proofs
Finished release profile [optimized] target(s) in 10m 46s

Launch:

$ target/release/encrypted-spaces-backend-server --schema demos/tauri/app_schema.kdl --space-root <temporary-directory> --bind-addr 127.0.0.1 --port <ephemeral-port>
GET /healthz: ok
$ ENCRYPTED_SPACES_CLIENT_LABEL=release-launch ENCRYPTED_SPACES_SCHEMA_PATH=<schema> ENCRYPTED_SPACES_BACKEND_URL=<local-websocket> RISC0_DEV_MODE=1 target/release/encrypted-spaces-bridge
hello: ok, protocol_version=1, client_label=release-launch
space.create: ok, non-empty Space ID returned
Failure-signature scrape: clean
Verdict: PASS

Local constraint: macOS uses RISC0_SKIP_BUILD=1 for launch validation because the local real guest build faults in the RISC Zero toolchain. The unskipped Linux Packaged Linux real-proof gate builds real guest ELFs, launches packaged binaries without r0vm on PATH, and generates and verifies a real fast-forward receipt before attestation.

Verification

• cargo test --workspace --locked -- --test-threads=1
• release-binary runtime suite: 20 passed, 0 failed, 1 ignored real-proof CI gate
• cargo clippy --workspace --all-targets --locked -- -D warnings
• cargo fmt --all -- --check
• actionlint on release, publisher, upstream-sync, and compatibility workflows
• locked scope-manifest check

Doc-reconciliation: clean

Generated by the implementing agent.

Regression proof

With exact-tree and full-input correlation checks reverted:

$ cargo test -p encrypted-spaces-bridge --locked --test runtime upstream_sync_opens_ci_gated_automerge_prs -- --exact
test upstream_sync_opens_ci_gated_automerge_prs ... FAILED

assertion failed: workflow.contains("run_title=...$fork_main_sha $upstream_sha...")

With the checks restored:

$ cargo test -p encrypted-spaces-bridge --locked --test runtime upstream_sync_opens_ci_gated_automerge_prs -- --exact

test upstream_sync_opens_ci_gated_automerge_prs ... ok
test result: ok. 1 passed; 0 failed

[Copilot]

Pull request overview

This PR turns the Encrypted Spaces SDK into an “official” runtime bridge deliverable by adding a versioned, bounded JSONL stdio protocol (encrypted-spaces-bridge), hardening SDK behaviors needed for long-running native clients (timeouts, trusted restore, broadcast delivery semantics), and introducing release/upstream-sync automation to produce and attest packaged backend/bridge binaries.

Changes:

• Add bridge/ crate implementing protocol framing, request coordination/cancellation, and a process-configured runtime over the Rust SDK, plus extensive integration tests.
• Harden the SDK with native request deadlines, bounded HTTP body streaming, commit-unknown semantics for timed-out transmitted mutations, trusted snapshot restore, and “only publish applied broadcasts” behavior.
• Pin workspace/tooling for reproducible releases (Rust toolchain, dependency versions), add legal/notice artifacts, and introduce GitHub Actions workflows for release building/attestation and upstream compatibility sync.

Reviewed changes

Copilot reviewed 27 out of 29 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
sdk/src/websocket_transport.rs	Add native request timeouts, bounded HTTP body collection, and stricter pending-request correlation handling.
sdk/src/state.rs	Add restore_trusted and snapshot decoding helper to enforce a process-pinned trust bundle on restore.
sdk/src/schema.rs	Add ApplicationSchema::FromOwnedBytes to avoid requiring 'static schema bytes in long-running processes.
sdk/src/lib.rs	Add tests validating trusted restore rejects mismatched trust bundles.
sdk/src/changelog.rs	Adjust broadcast fast-forward handling and add tests ensuring stale broadcasts aren’t re-emitted.
sdk/src/broadcast.rs	Only forward broadcast events to subscribers when the SDK actually applied them.
rust-toolchain.toml	Switch toolchain pinning to Rust 1.94.1.
README.md	Document the runtime bridge contract, limits, and release workflow model.
PATCHES.md	Add upstream delta ledger describing intentional fork changes.
NOTICE	Add Apache-style NOTICE content for fork attribution.
ffproof/methods/guest/Cargo.lock	Update internal crate versions to 0.1.0 within guest lockfile.
ffproof/Cargo.toml	Make real-proofs enable risc0-zkvm/prove.
Cargo.toml	Add bridge workspace member, bump workspace version, pin kdl to =6.5.0.
Cargo.lock	Bump workspace crate versions, add encrypted-spaces-bridge, and align dependency graph to kdl 6.5.0.
bridge/tests/stdio.rs	Add protocol-level stdio framing/validation/termination behavior tests.
bridge/tests/runtime.rs	Add end-to-end runtime suite validating bridge behavior, release contracts, and CI workflow invariants.
bridge/src/schema.rs	Define JSONL protocol request/operation schema and validation.
bridge/src/runtime.rs	Implement process-configured runtime that executes operations against the SDK with pinned trust roots.
bridge/src/protocol.rs	Implement coordinator/worker model for bounded frames, pending limits, cancellation, and wait-on-change sync.
bridge/src/main.rs	Add bridge binary entrypoint including --version handling.
bridge/Cargo.toml	Add bridge package manifest and real-proofs feature wiring.
backend/src/schema.rs	Derive PartialEq for schema structs to support snapshot trust comparisons.
backend/src/error.rs	Add CommitOutcomeUnknown error variant with Display formatting.
backend/server/src/app_config.rs	Enable clap version on server CLI.
.github/workflows/upstream-sync.yml	Add weekly upstream sync automation with CI-gated fast-forward merge behavior.
.github/workflows/upstream-compat.yml	Add trusted, read-only compatibility workflow to validate upstream sync candidates.
.github/workflows/release-publish.yml	Add trusted workflow_run publisher that attests and publishes only verified main/tag builds.
.github/workflows/release-bridge.yml	Add release build matrix, packaging, and real-proof gate for packaged binaries.
.github/scripts/ci_matrix.json	Add bridge crate to CI package matrix.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[intel352]

CI follow-up for 25286b9:

• Root cause: the bridge integration suite nested a backend build under nextest; CI sets CARGO_BUILD_TARGET=x86_64-unknown-linux-gnu, while the fallback expected target/debug, so the spawned fixture did not exist. Parallel test processes also contended on Cargo locks.
• Fix: prebuild both runtime executables once for the bridge matrix and pass their absolute paths through the existing test-binary boundary.
• Regression: ci_prebuilds_bridge_runtime_fixtures_for_nextest failed before the workflow change and now passes. actionlint .github/workflows/build-prototype.yml and the fixture build both pass locally.
• The fresh GitHub bridge matrix is the authoritative cargo nextest proof because cargo-nextest is not installed in the local environment.

[Copilot]

Pull request overview

Copilot reviewed 28 out of 30 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 29 out of 31 changed files in this pull request and generated 3 comments.