ci: validate AuditLog persistence on release matrix

.codex/agents/bacnet-performance-reviewer.toml

@@ -6,7 +6,7 @@ You are a BACnet performance and A/B benchmark reviewer for rusty-bacnet.
 
 Mission:
 - Establish or review reproducible base/head benchmarks for performance-sensitive protocol work.
-- Check workload validity for codec, BVLL, NPDU, APDU, B/IP, BACnet/SC, router, BBMD, segmentation, services, Python, WASM, and optional data-link suites.
+- Check workload validity for codec, BVLL, NPDU, APDU, B/IP, BACnet/SC, router, BBMD, segmentation, services, Python, and optional data-link suites.
 - Interpret latency, throughput, memory, allocation, and error deltas conservatively.
 
 Rules:

.codex/agents/bacnet-services-objects-reviewer.toml

@@ -12,7 +12,7 @@ Rules:
 - Do not edit files.
 - Do not treat implemented structs as conformance evidence unless service behavior and tests exist.
 - Map every support claim to ledger rows and tests where possible.
-- Identify client/server parity and Python/WASM exposure risks when relevant.
+- Identify client/server parity and Python exposure risks when relevant.
 
 Return:
 1. Reviewed service/object scope.

.github/scripts/check-msrv.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+#
+# Check the published crates at the workspace MSRV.
+#
+# The MSRV is a promise to people who depend on this workspace from crates.io,
+# so the gate covers exactly the crates they can depend on. The list is derived
+# from `cargo metadata` rather than written here: a hardcoded list drifts in the
+# dangerous direction silently, because a newly published member that nobody
+# remembers to add is simply never checked.
+#
+# Run with RUSTUP_TOOLCHAIN set to the MSRV, which overrides rust-toolchain.toml:
+#   RUSTUP_TOOLCHAIN=1.93 bash .github/scripts/check-msrv.sh
+set -euo pipefail
+
+cd "$(dirname "$0")/../.."
+
+PKGS=$(
+  cargo metadata --no-deps --format-version 1 |
+    python3 -c 'import json,sys
+for p in json.load(sys.stdin)["packages"]:
+    if p.get("publish") != []:
+        print(p["name"])' |
+    sort
+)
+
+if [ -z "$PKGS" ]; then
+  echo "error: no publishable crates found in cargo metadata" >&2
+  exit 1
+fi
+
+ARGS=""
+for p in $PKGS; do
+  ARGS="$ARGS -p $p"
+done
+
+# Optional features a consumer can enable. Without them the gate sees only
+# default features, which leaves the BACnet/SC and IPv6 module trees — and the
+# MSRVs of rustls, tokio-rustls and tokio-tungstenite — unchecked.
+#
+# `serial`, `serial-gpio`, `ethernet` and `pcap` are deliberately absent: they
+# need Linux system packages this job does not install. Extending the gate to
+# them is tracked as #196.
+FEATURES="bacnet-transport/sc-tls,bacnet-transport/ipv6"
+FEATURES="$FEATURES,bacnet-client/sc-tls,bacnet-client/ipv6"
+FEATURES="$FEATURES,bacnet-server/sc-tls"
+FEATURES="$FEATURES,bacnet-cli/sc-tls"
+
+echo "MSRV gate covers:"
+for p in $PKGS; do echo "  - $p"; done
+echo "with features: $FEATURES"
+echo
+
+# shellcheck disable=SC2086
+exec cargo check --locked $ARGS --features "$FEATURES"

.github/workflows/ci.yml

@@ -26,7 +26,19 @@ permissions:
   id-token: write
 
 # =============================================================================
-# Tier 1 — CI (runs on PR updates to main/dev, pushes to main, and v* tags)
+# Tier 1 — CI
+#
+# Two tiers of jobs share the triggers (PRs to main/dev, push to main, v* tags):
+#   Lean  — every PR (incl. feature→dev), push to main, v* tags.
+#           Fast gate: fmt, clippy, file-size, no-secret, Linux test.
+#   Heavy — skips feature→dev PRs; runs on dev→main PRs, push to main, v* tags.
+#           Cross-OS tests, MSRV, cargo-audit, cargo-deny.
+# This keeps the high-throughput feature→dev loop fast while the dev→main
+# gate (and the tag/push-main release gate) run the full matrix before merge.
+#
+# Guard cheat-sheet (the `if:` on each job is one of these two):
+#   lean : github.event_name != 'push' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
+#   heavy: github.event_name == 'push' || github.base_ref == 'main'
 # =============================================================================
 
 jobs:
@@ -40,7 +52,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@master
         with:
-          toolchain: "1.95.0"
+          toolchain: "1.97.1"
           components: rustfmt
       - run: cargo fmt --all --check
 
@@ -52,27 +64,14 @@ jobs:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@master
         with:
-          toolchain: "1.95.0"
+          toolchain: "1.97.1"
           components: clippy
       - uses: Swatinem/rust-cache@v2
-      - run: cargo clippy --workspace --exclude rusty-bacnet --exclude bacnet-wasm --all-targets --locked
-
-  wasm-check:
-    name: WASM Check
-    if: ${{ github.event_name != 'push' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') }}
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: "1.95.0"
-          targets: wasm32-unknown-unknown
-      - uses: Swatinem/rust-cache@v2
-      - run: cargo check -p bacnet-wasm --target wasm32-unknown-unknown --locked
+      - run: cargo clippy --workspace --exclude rusty-bacnet --all-targets --locked
 
   audit:
     name: Cargo Audit
-    if: ${{ github.event_name != 'push' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') }}
+    if: ${{ github.event_name == 'push' || github.base_ref == 'main' }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -104,11 +103,11 @@ jobs:
 
   msrv:
     name: MSRV (1.93)
-    if: ${{ github.event_name != 'push' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') }}
+    if: ${{ github.event_name == 'push' || github.base_ref == 'main' }}
     runs-on: ubuntu-latest
     env:
       # Override `rust-toolchain.toml` (which pins the dev/CI channel to
-      # 1.95.0) so this job exercises the documented MSRV from the
+      # 1.97.1) so this job exercises the documented MSRV from the
       # workspace `Cargo.toml`.
       RUSTUP_TOOLCHAIN: "1.93"
     steps:
@@ -119,7 +118,10 @@ jobs:
       - uses: Swatinem/rust-cache@v2
         with:
           key: msrv
-      - run: cargo check --workspace --exclude rusty-bacnet --exclude bacnet-wasm --locked
+      # Derives the publishable crates from cargo metadata and checks them with
+      # the optional features a consumer can enable. See the script for why the
+      # list is derived rather than written down.
+      - run: bash .github/scripts/check-msrv.sh
 
   test:
     name: Test (${{ matrix.os }})
@@ -129,20 +131,17 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          # Linux: full feature set (serial + ethernet are Linux-only deps)
+          # Linux only in the lean tier: the full-feature suite (serial +
+          # ethernet are Linux-only deps). macOS/Windows run in `test-cross`
+          # below, gated to dev→main PRs / push-main / tags so the
+          # feature→dev loop isn't held up by cross-OS runners.
           - os: ubuntu-latest
-            features: "--features bacnet-transport/ipv6,bacnet-transport/sc-tls,bacnet-transport/serial,bacnet-transport/ethernet"
-          # macOS: ipv6 + sc-tls only
-          - os: macos-latest
-            features: "--features bacnet-transport/ipv6,bacnet-transport/sc-tls"
-          # Windows: ipv6 + sc-tls only
-          - os: windows-latest
-            features: "--features bacnet-transport/ipv6,bacnet-transport/sc-tls"
+            features: "--features bacnet-types/serde,bacnet-transport/ipv6,bacnet-transport/sc-tls,bacnet-transport/serial,bacnet-transport/ethernet"
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@master
         with:
-          toolchain: "1.95.0"
+          toolchain: "1.97.1"
       - uses: Swatinem/rust-cache@v2
         with:
           key: ${{ matrix.os }}
@@ -151,11 +150,37 @@ jobs:
           # causing `cargo test` to invoke a broken `rustup-init`. This
           # bit us on macos-15-arm64 image 20260511.0048 — see PR #21.
           cache-bin: false
-      - run: cargo test --workspace --exclude rusty-bacnet --exclude bacnet-wasm --locked ${{ matrix.features }}
+      - run: cargo test --workspace --exclude rusty-bacnet --locked ${{ matrix.features }}
+
+  test-cross:
+    name: Test (${{ matrix.os }})
+    if: ${{ github.event_name == 'push' || github.base_ref == 'main' }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Cross-OS legs (macOS/Windows) — heavy tier, only on dev→main PRs,
+          # push to main, and v* tags. Linux is already covered by `test`
+          # above in the lean tier.
+          - os: macos-latest
+            features: "--features bacnet-types/serde,bacnet-transport/ipv6,bacnet-transport/sc-tls"
+          - os: windows-latest
+            features: "--features bacnet-types/serde,bacnet-transport/ipv6,bacnet-transport/sc-tls"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: "1.97.1"
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: ${{ matrix.os }}
+          cache-bin: false
+      - run: cargo test --workspace --exclude rusty-bacnet --locked ${{ matrix.features }}
 
   deny:
     name: Cargo Deny
-    if: ${{ github.event_name != 'push' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') }}
+    if: ${{ github.event_name == 'push' || github.base_ref == 'main' }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -168,7 +193,22 @@ jobs:
   validate:
     name: Validate Release
     if: startsWith(github.ref, 'refs/tags/v')
-    needs: [fmt, clippy, test, deny, wasm-check, audit, no-secret-scan]
+    # Every Tier 1 job, listed in declaration order so the list can be audited
+    # against the jobs above at a glance. A Tier 1 job omitted here still runs on
+    # the tag and can still fail — it just stops gating the release, which is how
+    # file-size-cap and msrv came to be missing.
+    needs:
+      [
+        fmt,
+        clippy,
+        audit,
+        file-size-cap,
+        no-secret-scan,
+        msrv,
+        test,
+        test-cross,
+        deny,
+      ]
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.version.outputs.version }}
@@ -204,7 +244,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@master
         with:
-          toolchain: "1.95.0"
+          toolchain: "1.97.1"
       - uses: Swatinem/rust-cache@v2
 
       - name: Publish bacnet-types
@@ -243,6 +283,12 @@ jobs:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
       - run: sleep 30
 
+      - name: Publish bacnet-endpoint-core
+        run: cargo publish -p bacnet-endpoint-core --no-verify
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+      - run: sleep 30
+
       - name: Publish bacnet-server
         run: cargo publish -p bacnet-server --no-verify
         env:
@@ -319,38 +365,6 @@ jobs:
           name: wheels-sdist
           path: dist
 
-  build-wasm:
-    name: Build WASM
-    if: startsWith(github.ref, 'refs/tags/v')
-    needs: validate
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: "1.95.0"
-          targets: wasm32-unknown-unknown
-      - uses: Swatinem/rust-cache@v2
-
-      - name: Install wasm-pack
-        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
-
-      - name: Build (bundler target)
-        run: wasm-pack build crates/bacnet-wasm --target bundler --out-dir ../../dist/wasm-npm
-
-      - name: Build (web target)
-        run: wasm-pack build crates/bacnet-wasm --target web --out-dir ../../dist/wasm-web
-
-      - uses: actions/upload-artifact@v4
-        with:
-          name: wasm-npm
-          path: dist/wasm-npm
-
-      - uses: actions/upload-artifact@v4
-        with:
-          name: wasm-web
-          path: dist/wasm-web
-
   publish-pypi:
     name: Publish to PyPI
     if: startsWith(github.ref, 'refs/tags/v')
@@ -366,33 +380,10 @@ jobs:
 
       - uses: pypa/gh-action-pypi-publish@release/v1
 
-  publish-npm:
-    name: Publish to npm
-    if: startsWith(github.ref, 'refs/tags/v')
-    needs: [build-wasm]
-    runs-on: ubuntu-latest
-    environment: release
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          name: wasm-npm
-          path: dist/wasm-npm
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-          registry-url: "https://registry.npmjs.org"
-
-      - name: Upgrade npm for trusted publishing
-        run: npm install -g npm@latest
-
-      - name: Publish to npm
-        run: cd dist/wasm-npm && npm publish --provenance --access public
-
   github-release:
     name: GitHub Release
     if: startsWith(github.ref, 'refs/tags/v')
-    needs: [publish-crates, publish-pypi, publish-npm, build-cli-binaries]
+    needs: [publish-crates, publish-pypi, build-cli-binaries]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -449,7 +440,7 @@ jobs:
 
       - uses: dtolnay/rust-toolchain@master
         with:
-          toolchain: "1.95.0"
+          toolchain: "1.97.1"
           targets: ${{ matrix.target }}
 
       - uses: Swatinem/rust-cache@v2

.gitignore

@@ -25,6 +25,9 @@ dist/
 
 # AI assistants
 codex-id.json
+claude-id.json
+_codex-briefs/
+codex-overnight-status.md
 .claude/
 CLAUDE.md
 .copilot/
@@ -40,6 +43,9 @@ mcp.json
 # Proprietary spec
 _spec/
 
+# Local conformance artifacts
+/conformance/
+
 # OS
 .DS_Store
 Thumbs.db
@@ -50,8 +56,3 @@ Thumbs.db
 *.swp
 *.swo
 *~
-
-# JavaScript/WASM
-node_modules/
-pkg/
-*.tgz