Integrate architecture boundaries and acceptance fixes

.github/workflows/ci.yml

@@ -1,6 +1,7 @@
 name: Rewrite contracts
 on:
   push:
+    branches: [main]
   pull_request:
   workflow_dispatch:
 permissions:
@@ -18,7 +19,7 @@ jobs:
         shard: [0, 1, 2, 3]
     services:
       postgres:
-        # Ubuntu runner provides pg_dump 16; its client must not be older than the server.
+        # Recovery jobs explicitly install matching PostgreSQL 16 client tools.
         image: postgres:16
         env:
           POSTGRES_USER: msgtest
@@ -60,12 +61,17 @@ jobs:
       - name: Install required recovery and ingress test tools
         run: |
           sudo apt-get update -qq
-          sudo apt-get install -y -qq age nginx openssl git-lfs
+          sudo env NEEDRESTART_MODE=l apt-get install -y -qq postgresql-client-16 age nginx openssl git-lfs bubblewrap apparmor-profiles
+          echo /usr/lib/postgresql/16/bin >> "$GITHUB_PATH"
           age --version
           nginx -v
           openssl version
+          bwrap --version
+          sudo apparmor_parser -r /usr/share/apparmor/extra-profiles/bwrap-userns-restrict
       - name: Install the complete dependency set
         run: python -m pip install -e '.[dev]'
+      - name: Check real tool isolation before running shards
+        run: python scripts/check_tool_sandbox.py
       - name: Compile all new modules
         run: python -m compileall -q src
       - name: Run core, business and security tests

.github/workflows/client-boundary.yml

@@ -0,0 +1,72 @@
+name: Client boundary
+on:
+  push:
+    branches: ['fix/client-boundary-*']
+  pull_request:
+    paths:
+      - 'src/msg/**'
+      - 'pyproject.toml'
+      - 'tests/test_client_boundary.py'
+      - 'scripts/check_client_install.py'
+      - '.github/workflows/client-boundary.yml'
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: client-boundary-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  installed-client:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.15'
+          allow-prereleases: true
+          cache: pip
+      - name: Record tested source
+        run: |
+          mkdir -p artifacts
+          python - <<'PY'
+          import json, os, pathlib, subprocess
+          def git(*args):
+              return subprocess.check_output(['git', *args], text=True).strip()
+          pathlib.Path('artifacts/source.json').write_text(json.dumps({
+              'commit': git('rev-parse', 'HEAD'), 'tree': git('rev-parse', 'HEAD^{tree}'),
+              'run_id': os.environ['GITHUB_RUN_ID'], 'event': os.environ['GITHUB_EVENT_NAME'],
+          }, indent=2) + '\n')
+          PY
+      - name: Install full development dependencies
+        run: python -m pip install -e '.[dev]'
+      - name: Verify helper ownership, exact proof context and fail-closed assembly
+        run: python -m pytest tests/test_client_boundary.py --junitxml=artifacts/client-boundary.xml
+      - name: Build the distributable wheel and source archive
+        if: always()
+        run: |
+          python -m build
+          python scripts/check_package_artifacts.py dist
+      - name: Install a clean client-only wheel outside the checkout
+        if: always()
+        run: |
+          python -m venv "$RUNNER_TEMP/msg-client-only"
+          client_python="$RUNNER_TEMP/msg-client-only/bin/python"
+          "$client_python" -m pip install dist/*.whl
+          "$client_python" -m pip check
+          mkdir -p "$RUNNER_TEMP/msg-client-outside"
+          cd "$RUNNER_TEMP/msg-client-outside"
+          "$RUNNER_TEMP/msg-client-only/bin/msg" --help > "$GITHUB_WORKSPACE/artifacts/client-help.txt"
+          "$RUNNER_TEMP/msg-client-only/bin/msgd" --help > "$GITHUB_WORKSPACE/artifacts/daemon-help.txt"
+          "$client_python" -I "$GITHUB_WORKSPACE/scripts/check_client_install.py" --minimal-install \
+              > "$GITHUB_WORKSPACE/artifacts/client-install.json"
+          "$client_python" -m pip list --format=json > "$GITHUB_WORKSPACE/artifacts/client-packages.json"
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: client-boundary
+          path: |
+            artifacts/
+            dist/

.github/workflows/client-part-bytes.yml

@@ -0,0 +1,76 @@
+name: Client chunk size regressions
+on:
+  push:
+    paths:
+      - '.github/workflows/client-part-bytes.yml'
+      - 'src/msg/client.py'
+      - 'tests/test_client*.py'
+      - 'tests/read_only_evidence.py'
+  pull_request:
+    paths:
+      - '.github/workflows/client-part-bytes.yml'
+      - 'src/msg/client.py'
+      - 'tests/test_client*.py'
+      - 'tests/read_only_evidence.py'
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: client-part-bytes-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+jobs:
+  regression:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: msgtest
+          POSTGRES_PASSWORD: msgtest
+          POSTGRES_DB: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U msgtest"
+          --health-interval 10s --health-timeout 5s --health-retries 5
+    env:
+      MSG_TEST_POSTGRES_URL_TEMPLATE: postgresql://msgtest:msgtest@127.0.0.1:5432/{database}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.15'
+          allow-prereleases: true
+          cache: pip
+      - name: Record exact source identity
+        run: |
+          mkdir -p artifacts
+          python - <<'PY'
+          import json, os, platform, subprocess
+          from pathlib import Path
+          def git(*args):
+              return subprocess.check_output(['git', *args], text=True).strip()
+          Path('artifacts/source.json').write_text(json.dumps({
+              'commit': git('rev-parse', 'HEAD'), 'tree': git('rev-parse', 'HEAD^{tree}'),
+              'run_id': os.environ['GITHUB_RUN_ID'], 'attempt': os.environ['GITHUB_RUN_ATTEMPT'],
+              'python': platform.python_version()}, indent=2) + '\n')
+          PY
+      - name: Install real cryptographic and database test dependencies
+        run: |
+          sudo apt-get update -qq
+          sudo env NEEDRESTART_MODE=l apt-get install -y -qq age
+          python -m pip install -e '.[dev]'
+      - name: Run invalid-size and cross-protocol resume regressions
+        run: >-
+          python -m pytest -q
+          tests/test_client_part_bytes.py tests/test_client.py
+          --junitxml=artifacts/client-part-bytes.xml
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: client-part-bytes-evidence
+          path: artifacts/
+          if-no-files-found: error

.github/workflows/collaboration-list-bounds.yml

@@ -0,0 +1,72 @@
+name: Bounded collaboration Resource reads
+on:
+  push:
+    branches: [fix/collaboration-list-bounds-20260929]
+  pull_request:
+    paths:
+      - '.github/workflows/collaboration-list-bounds.yml'
+      - 'src/msg/plugins/collaboration_resources.py'
+      - 'tests/test_collaboration_list_bounds.py'
+      - 'tests/test_collaboration_list_deadline.py'
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: work-list-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+jobs:
+  regression:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: msgtest
+          POSTGRES_PASSWORD: msgtest
+          POSTGRES_DB: postgres
+        ports: ['5432:5432']
+        options: >-
+          --health-cmd "pg_isready -U msgtest -d postgres"
+          --health-interval 10s --health-timeout 5s --health-retries 5
+    env:
+      MSG_TEST_POSTGRES_URL_TEMPLATE: postgresql://msgtest:msgtest@127.0.0.1:5432/{database}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Record exact source
+        run: |
+          mkdir -p artifacts
+          python3 - <<'PY'
+          import json, os, subprocess
+          from pathlib import Path
+          def git(*args):
+              return subprocess.check_output(['git', *args], text=True).strip()
+          Path('artifacts/source.json').write_text(json.dumps({
+              'commit': git('rev-parse', 'HEAD'), 'tree': git('rev-parse', 'HEAD^{tree}'),
+              'run_id': os.environ['GITHUB_RUN_ID'], 'attempt': os.environ['GITHUB_RUN_ATTEMPT']}, indent=2) + '\n')
+          PY
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.15'
+          allow-prereleases: true
+          cache: pip
+      - name: Install real dependencies
+        run: |
+          sudo apt-get update -qq
+          sudo env NEEDRESTART_MODE=l apt-get install -y -qq age
+          python -m pip install -e '.[dev]'
+      - name: Run real bounded work-record regressions
+        run: >-
+          python -m pytest -q
+          tests/test_collaboration_list_bounds.py tests/test_collaboration_list_deadline.py
+          tests/test_collaboration_resources.py tests/test_collaboration_resource_surfaces.py
+          tests/test_proposals.py
+          --junitxml=artifacts/work-list-regressions.xml
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: collaboration-list-evidence
+          path: artifacts/
+          if-no-files-found: error

.github/workflows/git-transport-boundaries.yml

@@ -0,0 +1,75 @@
+name: Git transport boundary contracts
+on:
+  push:
+    branches: [fix/git-transport-boundaries-20260929]
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: git-transport-boundaries-${{ github.ref }}
+  cancel-in-progress: false
+jobs:
+  contracts:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: msgtest
+          POSTGRES_PASSWORD: msgtest
+          POSTGRES_DB: postgres
+        ports: ['5432:5432']
+        options: >-
+          --health-cmd "pg_isready -U msgtest"
+          --health-interval 5s --health-timeout 5s --health-retries 10
+      valkey:
+        image: valkey/valkey:9.0.6
+        ports: ['6379:6379']
+        options: >-
+          --health-cmd "valkey-cli ping"
+          --health-interval 5s --health-timeout 5s --health-retries 10
+    env:
+      MSG_TEST_POSTGRES_URL_TEMPLATE: postgresql://msgtest:msgtest@127.0.0.1:5432/{database}
+      MSG_TEST_VALKEY_URL: redis://127.0.0.1:6379/0
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.15'
+          allow-prereleases: true
+          cache: pip
+      - name: Install actual Git, LFS and cryptographic test tools
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq age git-lfs
+          git --version
+          git lfs version
+          python -m pip install -e '.[dev]'
+      - name: Record exact source
+        env:
+          SOURCE_SHA: ${{ github.sha }}
+        run: |
+          mkdir -p artifacts
+          test "$(git rev-parse HEAD)" = "$SOURCE_SHA"
+          python - <<'PY'
+          import json,os,subprocess
+          from pathlib import Path
+          git=lambda *args:subprocess.check_output(['git',*args],text=True).strip()
+          Path('artifacts/source.json').write_text(json.dumps({'commit':git('rev-parse','HEAD'),
+              'tree':git('rev-parse','HEAD^{tree}'),'event_sha':os.environ['SOURCE_SHA'],
+              'dirty':bool(git('status','--porcelain'))},indent=2)+'\n')
+          PY
+      - name: Verify ownership and unchanged real Git reads
+        run: python -m pytest tests/test_git_transport_boundaries.py --junitxml=artifacts/git-boundaries.xml
+      - name: Preserve real HTTP, SSH, bundle, LFS and publication fences
+        run: |
+          python -m pytest tests/test_git_http_push.py tests/test_native_git_read_only.py tests/test_git_lfs.py tests/test_lfs_shared_gc_quota.py tests/test_ssh_rss.py tests/test_extensions.py tests/test_storage_layout.py tests/test_effect_completion_fencing.py tests/issue_78_80/test_lfs_integrity.py tests/issue_78_80/test_lfs_migration_contract.py --junitxml=artifacts/git-regressions.xml
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: git-transport-boundaries-${{ github.sha }}
+          path: artifacts/
+          if-no-files-found: error