Draft: Cloud Sync V2 work in progress and build fixes

.github/workflows/bridge-bindings.yml

@@ -2,32 +2,56 @@ name: Rust bridge validation
 
 on:
   workflow_dispatch:
+    inputs:
+      allow_generated_drift:
+        description: Upload regenerated bindings without failing the manual run
+        required: false
+        default: false
+        type: boolean
   push:
     paths:
       - ".github/workflows/bridge-bindings.yml"
+      - ".gitmodules"
+      - "rust/Cargo.toml"
+      - "rust/Cargo.lock"
+      - "rust/src/**"
+      - "rustpush"
       - "rust/src/api/**"
       - "flutter_rust_bridge.yaml"
       - "lib/src/rust/**"
       - "rust/src/frb_generated*"
   pull_request:
     paths:
       - ".github/workflows/bridge-bindings.yml"
+      - ".gitmodules"
+      - "rust/Cargo.toml"
+      - "rust/Cargo.lock"
+      - "rust/src/**"
+      - "rustpush"
       - "rust/src/api/**"
       - "flutter_rust_bridge.yaml"
       - "lib/src/rust/**"
       - "rust/src/frb_generated*"
 
 jobs:
   bindings:
-    runs-on: ubuntu-latest
+    # Generated bindings must be reproducible, so pin the image instead of
+    # letting ubuntu-latest drift the toolchain under the drift check.
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           submodules: recursive
 
       - name: Set up Rust
         uses: dtolnay/rust-toolchain@stable
 
+      - name: Set up Flutter for bridge generation
+        uses: subosito/flutter-action@v2
+        with:
+          flutter-version: "3.44.8"
+          channel: stable
+
       - name: Install native build tools
         run: |
           sudo apt-get update
@@ -54,5 +78,76 @@ jobs:
             cp rustpush/certs/legacy-fairplay/fairplay.crt "$destination/$name.crt"
           done
 
+      - name: Install pinned Flutter Rust Bridge generator
+        shell: bash
+        run: |
+          archive="${RUNNER_TEMP}/flutter_rust_bridge_codegen.tgz"
+          url="https://github.com/fzyzcjy/flutter_rust_bridge/releases/download/v2.3.0/flutter_rust_bridge_codegen-x86_64-unknown-linux-gnu-v2.3.0.tgz"
+          curl --fail --location --silent --show-error "$url" --output "$archive"
+          echo "bb3a5e3d1f17a543e73f8dfff886e883928b95e3a9d19ca5268da40952d80cee  $archive" | sha256sum --check --strict
+          mkdir -p "${RUNNER_TEMP}/frb-codegen"
+          tar -xzf "$archive" -C "${RUNNER_TEMP}/frb-codegen"
+          echo "${RUNNER_TEMP}/frb-codegen" >> "$GITHUB_PATH"
+
+      - name: Regenerate committed bridge bindings
+        shell: bash
+        run: flutter_rust_bridge_codegen generate --config-file flutter_rust_bridge.yaml
+
+      - name: Normalize generated SSE implementations
+        shell: pwsh
+        run: |
+          ./tooling/frb/guard_generated_sse_impls.ps1 -Mode Deduplicate -ExpectedRemovalCount 6
+          ./tooling/frb/guard_generated_sse_impls.ps1 -Mode Verify
+
+      - name: Upload regenerated bridge bindings
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: regenerated-rust-bridge-bindings
+          if-no-files-found: error
+          retention-days: 7
+          path: |
+            lib/src/rust/api/api.dart
+            lib/src/rust/frb_generated.dart
+            lib/src/rust/frb_generated.io.dart
+            lib/src/rust/frb_generated.web.dart
+            rust/src/frb_generated.rs
+            rust/src/frb_generated.io.rs
+            rust/src/frb_generated.web.rs
+
+      - name: Verify committed bridge bindings are reproducible
+        if: github.event_name != 'workflow_dispatch' || inputs.allow_generated_drift != true
+        shell: bash
+        run: |
+          git diff --exit-code -- \
+            lib/src/rust/api/api.dart \
+            lib/src/rust/frb_generated.dart \
+            lib/src/rust/frb_generated.io.dart \
+            lib/src/rust/frb_generated.web.dart \
+            rust/src/frb_generated.rs \
+            rust/src/frb_generated.io.rs \
+            rust/src/frb_generated.web.rs
+
       - name: Compile committed Rust bridge
         run: cargo check --manifest-path rust/Cargo.toml --lib --message-format short
+
+      # cargo check --lib does not even compile #[cfg(test)] code, so until now
+      # no Rust test in this repository could fail a build. That covered the
+      # canonical converter, the DTO parsers, the protected store, and the
+      # keyed identity hasher. A suite that cannot fail a build is not a gate.
+      - name: Run Rust tests
+        run: cargo test --manifest-path rust/Cargo.toml --lib
+
+      # Tests inside the rustpush submodule are not executed when rustpush is
+      # compiled only as a dependency of the bridge crate. Keep its protocol,
+      # concurrency, and log-redaction tests as an independent gate. Match the
+      # production bridge's non-macOS Anisette provider feature so icloud_auth
+      # exposes the same provider types that the application compiles against.
+      - name: Run rustpush tests
+        run: cargo test --manifest-path rustpush/Cargo.toml --lib --features remote-anisette-v3
+
+      # The protector harness is a separate crate and is deliberately
+      # dependency-light so these security invariants can run on hosts where the
+      # full application crate cannot build.
+      - name: Run the Cloud Sync protector harness
+        run: cargo test --manifest-path rust/cloud_sync_protector_harness/Cargo.toml