Merge pull request #49 from dhawal-ss/integrate/quizzical-maxwell

Merge quizzical-maxwell: voice engine, custom emoji, design refresh, navigation rework

Author: dhawal-ss

.github/workflows/ci.yml

@@ -160,6 +160,10 @@ jobs:
         working-directory: mesh
         run: npm run check:ipc-contract
 
+      - name: Check renderer and native agree on command arguments
+        working-directory: mesh
+        run: npm run check:ipc-arguments
+
       - name: Check design token source of truth
         working-directory: mesh
         run: npm run check:design-tokens

.github/workflows/developer-preview.yml

@@ -37,6 +37,7 @@ jobs:
           npm run check:public-services
           npm run check:public-site
           npm run check:ipc-contract
+          npm run check:ipc-arguments
           npm run check:ipc-types
           npm test -- --maxWorkers=4
 

.github/workflows/release-beta.yml

@@ -167,7 +167,7 @@ jobs:
               -ValidationOnly
           fi
           pwsh -NoProfile -File ./infra/matrixrtc/test-evidence-validation.ps1
-          pwsh -NoProfile -File ./scripts/matrixrtc-preflight.ps1
+          pwsh -NoProfile -File ./scripts/matrixrtc-preflight.ps1 -RequireCompose
           node --test ./scripts/check-external-acceptance.test.mjs
           node ./scripts/check-external-acceptance.mjs
           pwsh -NoProfile -File ./scripts/operator-smoke.ps1 -Milestone R2 -EnvironmentFile ./infra/operator-smoke/r2.env.example

.github/workflows/security-r3-voice.yml

@@ -26,7 +26,7 @@ jobs:
         shell: pwsh
         run: |
           ./infra/matrixrtc/test-evidence-validation.ps1
-          ./scripts/matrixrtc-preflight.ps1
+          ./scripts/matrixrtc-preflight.ps1 -RequireCompose
           ./scripts/operator-smoke.ps1 -Milestone R3
 
   container-supply-chain-r3:

.github/workflows/security.yml

@@ -76,9 +76,11 @@ jobs:
         with:
           fetch-depth: 0
       - uses: dtolnay/rust-toolchain@d0befba8b9ddf874327619e84c39b094edd58b66 # 1.93.0
-      - name: Install pinned Rust advisory scanner
+      - name: Install pinned Rust security and policy tools
         run: |
           cargo install cargo-audit --version 0.22.2 --locked
+          cargo install cargo-deny --version 0.20.2 --locked
+          cargo install cargo-geiger --version 0.13.0 --locked
       - name: Report raw Rust advisory status without suppressing legacy findings
         continue-on-error: true
         run: |
@@ -89,11 +91,39 @@ jobs:
         run: |
           ./scripts/check-matrix-release-dependencies.ps1 `
             -ReportPath release/rust-dependency-report.json
-      - name: Upload Rust dependency policy evidence
+      - name: Enforce Matrix voice license and source policy
+        working-directory: mesh/src-tauri
+        run: cargo deny --locked check licenses sources
+      - name: Record Matrix voice unsafe-code inventory
+        working-directory: mesh/src-tauri
+        # cargo-geiger 0.13.0 (the latest release; 0.12.0 reproduces identically)
+        # bundles cargo 0.86.0 as a library, whose internal clean/download-batching
+        # panics on this project's matrix-voice dependency graph:
+        # "assertion failed: self.pending_ids.insert(id)" in
+        # cargo::core::package::Downloads::start, called from cargo_geiger's own
+        # pre-scan cargo_clean::clean step. Confirmed independent of this repo's
+        # code: cargo check/build/test for matrix-voice all pass clean, and the
+        # crash reproduces locally with no CI-specific factors involved. No newer
+        # cargo-geiger exists to fix it. continue-on-error so this known upstream
+        # tool bug doesn't block merges; every other step in this job (secret
+        # scanning, SBOM, license/source policy, other feature scans) still
+        # blocks normally. Matches the existing continue-on-error precedent on
+        # the cargo audit step above.
+        continue-on-error: true
+        run: >-
+          cargo geiger
+          --no-default-features
+          --features matrix-voice
+          --locked
+          --output-format Json
+          > ../release/cargo-geiger-matrix-voice.json
+      - name: Upload Rust dependency and unsafe-code evidence
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: rust-dependency-policy-${{ github.sha }}
-          path: mesh/release/rust-dependency-report.json
+          path: |
+            mesh/release/rust-dependency-report.json
+            mesh/release/cargo-geiger-matrix-voice.json
           if-no-files-found: error
           retention-days: 30
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

SECURITY.md

@@ -35,3 +35,12 @@ draft prerelease. Public promotion is a separate owner-controlled decision and
 requires signed Windows artifacts, checksums, SBOMs, provenance, legal approval,
 updater/rollback review, and public download verification. Passing local or
 disposable CI tests is not production acceptance.
+
+## Desktop content policy
+
+Release windows enable Tauri content protection and both desktop policies deny
+objects, document base URLs, form submissions, and framing. The remaining
+`style-src 'unsafe-inline'` exception is intentional for the current React and
+Tauri renderer: removing it requires replacing runtime inline style values and
+visually revalidating every supported state. It permits CSS declarations, not
+scripts, and must not be broadened to `script-src`.