Merge pull request #12 from dhawal-ss/codex/integrate-production-readiness

Integrate Mesh production readiness foundation

Author: dhawal-ss

.github/CODEOWNERS

@@ -0,0 +1,12 @@
+* @dhawal-ss
+
+# Release publication and its security policy require an owner review.
+/.github/workflows/release-beta.yml @dhawal-ss
+/.github/workflows/security.yml @dhawal-ss
+/.github/dependency-review-config.yml @dhawal-ss
+/mesh/scripts/beta-release-preflight.ps1 @dhawal-ss
+/mesh/scripts/check-matrix-release-dependencies.ps1 @dhawal-ss
+/mesh/scripts/rust-dependency-policy.json @dhawal-ss
+/mesh/src-tauri/tauri.conf.json @dhawal-ss
+/mesh/src-tauri/Cargo.toml @dhawal-ss
+/mesh/src-tauri/Cargo.lock @dhawal-ss

.github/dependabot.yml

@@ -0,0 +1,47 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "08:00"
+      timezone: America/Chicago
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - ci
+
+  - package-ecosystem: npm
+    directory: /mesh
+    schedule:
+      interval: weekly
+      day: monday
+      time: "08:15"
+      timezone: America/Chicago
+    open-pull-requests-limit: 5
+    groups:
+      npm-minor-and-patch:
+        update-types:
+          - minor
+          - patch
+    labels:
+      - dependencies
+      - frontend
+
+  - package-ecosystem: cargo
+    directory: /mesh/src-tauri
+    schedule:
+      interval: weekly
+      day: monday
+      time: "08:30"
+      timezone: America/Chicago
+    open-pull-requests-limit: 5
+    groups:
+      cargo-minor-and-patch:
+        update-types:
+          - minor
+          - patch
+    labels:
+      - dependencies
+      - rust

.github/dependency-review-config.yml

@@ -0,0 +1,28 @@
+fail-on-severity: moderate
+license-check: true
+allow-licenses:
+  - 0BSD
+  - AGPL-3.0-only
+  - Apache-2.0
+  - BSD-1-Clause
+  - BSD-2-Clause
+  - BSD-3-Clause
+  - BlueOak-1.0.0
+  - BSL-1.0
+  - CC-BY-4.0
+  - CC0-1.0
+  - CDLA-Permissive-2.0
+  - ISC
+  - MIT
+  - MIT-0
+  - MPL-2.0
+  - OFL-1.1
+  - Unicode-3.0
+  - Unlicense
+  - Zlib
+vulnerability-check: true
+# These exact advisories are retained in the raw Cargo audit and are confined
+# to the legacy-p2p graph, which every shipping Matrix artifact excludes.
+allow-ghsas: GHSA-3v94-mw7p-v465, GHSA-q2qq-hmj6-3wpp
+show-openssf-scorecard: true
+warn-only: false

.github/workflows/ci.yml

@@ -24,9 +24,8 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@387aeee55b189f024a4f6d94890c5b18d73339cc
+        uses: dtolnay/rust-toolchain@d0befba8b9ddf874327619e84c39b094edd58b66 # 1.93.0
         with:
-          toolchain: 1.93.0
           components: clippy, rustfmt
 
       - name: Install system dependencies (Linux)
@@ -82,9 +81,7 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@387aeee55b189f024a4f6d94890c5b18d73339cc
-        with:
-          toolchain: 1.93.0
+        uses: dtolnay/rust-toolchain@d0befba8b9ddf874327619e84c39b094edd58b66 # 1.93.0
 
       - name: Install system dependencies
         run: |
@@ -109,7 +106,7 @@ jobs:
 
       - name: Check legacy LAN backend
         working-directory: mesh/src-tauri
-        run: cargo check --no-default-features --features legacy-p2p --locked
+        run: cargo check --no-default-features --features legacy-p2p --locked --jobs 1
 
       - name: Test legacy LAN backend
         working-directory: mesh/src-tauri
@@ -160,10 +157,34 @@ jobs:
         working-directory: mesh
         run: npm run check:public-services
 
+      - name: Check production readiness ledger
+        working-directory: mesh
+        run: |
+          node --test scripts/check-readiness-ledger.test.mjs
+          npm run check:readiness-ledger
+
+      - name: Check fail-closed external acceptance contract
+        working-directory: mesh
+        run: |
+          node --test scripts/check-external-acceptance.test.mjs
+          node scripts/check-external-acceptance.mjs
+
       - name: Check public site source
         working-directory: mesh
         run: npm run check:public-site
 
+      - name: Check beta product boundary
+        working-directory: mesh
+        run: npm run check:beta-contract
+
+      - name: Check production operations boundary
+        working-directory: mesh
+        run: npm run check:operations-contract
+
+      - name: Check third-party notices and licenses
+        working-directory: mesh
+        run: npm run check:third-party-notices
+
       - name: Check homeserver recovery scripts
         working-directory: mesh
         run: |

.github/workflows/developer-preview.yml

@@ -26,9 +26,7 @@ jobs:
           node-version: 22
           cache: npm
           cache-dependency-path: mesh/package-lock.json
-      - uses: dtolnay/rust-toolchain@387aeee55b189f024a4f6d94890c5b18d73339cc
-        with:
-          toolchain: 1.93.0
+      - uses: dtolnay/rust-toolchain@d0befba8b9ddf874327619e84c39b094edd58b66 # 1.93.0
 
       - name: Validate developer-preview source
         working-directory: mesh
@@ -46,6 +44,7 @@ jobs:
         working-directory: mesh/src-tauri
         shell: bash
         run: |
+          set -o pipefail
           cargo check --no-default-features --features matrix-backend --locked --jobs 1
           if cargo tree --no-default-features --features matrix-backend -e normal,build --locked | grep -Eq '(^| )libp2p v'; then
             echo 'Developer preview unexpectedly contains legacy libp2p.' >&2
@@ -66,7 +65,7 @@ jobs:
           cargo install cargo-cyclonedx --version 0.5.9 --locked
           cargo cyclonedx --manifest-path mesh/src-tauri/Cargo.toml --format json
 
-          $staging = Join-Path $env:RUNNER_TEMP "mesh-developer-preview"
+          $staging = Join-Path $PWD "mesh/developer-preview-staging"
           New-Item -ItemType Directory -Path $staging | Out-Null
           $installers = @(
             Get-ChildItem mesh/src-tauri/target/release/bundle -Recurse -File |
@@ -99,17 +98,16 @@ jobs:
             } |
             Sort-Object |
             Out-File (Join-Path $staging "SHA256SUMS.txt") -Encoding ascii
-          "MESH_PREVIEW_STAGING=$staging" | Out-File $env:GITHUB_ENV -Encoding utf8 -Append
 
       - name: Attest developer-preview provenance
         uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
         with:
-          subject-path: "${{ env.MESH_PREVIEW_STAGING }}/*"
+          subject-path: "mesh/developer-preview-staging/*"
 
       - name: Upload developer-preview artifact
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: Mesh-Windows-UNSIGNED-DEVELOPER-PREVIEW-${{ github.sha }}
-          path: "${{ env.MESH_PREVIEW_STAGING }}"
+          path: mesh/developer-preview-staging/
           if-no-files-found: error
           retention-days: 30

.github/workflows/matrix-federation-acceptance.yml

@@ -38,9 +38,7 @@ jobs:
           cache-dependency-path: mesh/package-lock.json
 
       - name: Install Rust 1.93
-        uses: dtolnay/rust-toolchain@387aeee55b189f024a4f6d94890c5b18d73339cc
-        with:
-          toolchain: 1.93.0
+        uses: dtolnay/rust-toolchain@d0befba8b9ddf874327619e84c39b094edd58b66 # 1.93.0
 
       - name: Install Matrix test build dependencies
         run: |
@@ -65,29 +63,41 @@ jobs:
           key: ${{ runner.os }}-cargo-matrix-acceptance-${{ hashFiles('mesh/src-tauri/Cargo.lock') }}
           restore-keys: ${{ runner.os }}-cargo-matrix-acceptance-
 
-      - name: Reset and start disposable homeservers
+      - name: Run two independent federated encryption and recovery cycles
         working-directory: mesh
         shell: bash
         run: |
           set -o pipefail
           mkdir -p matrix-spike-logs
-          npm run setup:matrix-spike:reset 2>&1 | tee matrix-spike-logs/setup.log
-
-      - name: Run federated encryption and recovery acceptance
-        working-directory: mesh
-        shell: bash
-        run: |
-          set -o pipefail
           # The app's Linux keyring backend requires a Secret Service. This
           # disposable, empty-password keyring exists only for the isolated
           # runner and is destroyed with it; no production credential is used.
-          dbus-run-session -- bash -c '
-            set -o pipefail
-            printf "\n" | gnome-keyring-daemon \
-              --unlock --components=secrets >/dev/null
-            npm run test:matrix-spike 2>&1 |
-              tee matrix-spike-logs/acceptance.log
-          '
+          for cycle in 1 2; do
+            npm run setup:matrix-spike:reset 2>&1 |
+              tee "matrix-spike-logs/setup-cycle-$cycle.log"
+            MESH_ACCEPTANCE_LOG="matrix-spike-logs/acceptance-cycle-$cycle.log" \
+              dbus-run-session -- bash -c '
+                set -o pipefail
+                printf "\n" | gnome-keyring-daemon \
+                  --unlock --components=secrets >/dev/null
+                npm run test:matrix-spike 2>&1 | tee "$MESH_ACCEPTANCE_LOG"
+              '
+          done
+
+          source_sha="$(git rev-parse HEAD)"
+          cycle_1_sha="$(sha256sum matrix-spike-logs/acceptance-cycle-1.log | awk '{ print $1 }')"
+          cycle_2_sha="$(sha256sum matrix-spike-logs/acceptance-cycle-2.log | awk '{ print $1 }')"
+          printf '%s\n' \
+            '{' \
+            '  "schemaVersion": 1,' \
+            "  \"sourceSha\": \"$source_sha\"," \
+            '  "status": "passed",' \
+            '  "independentResetTestCycles": 2,' \
+            '  "cycles": [' \
+            "    { \"iteration\": 1, \"log\": \"acceptance-cycle-1.log\", \"sha256\": \"$cycle_1_sha\" }," \
+            "    { \"iteration\": 2, \"log\": \"acceptance-cycle-2.log\", \"sha256\": \"$cycle_2_sha\" }" \
+            '  ]' \
+            '}' > matrix-spike-logs/acceptance-report.json
 
       - name: Capture service diagnostics
         if: ${{ always() }}
@@ -105,7 +115,7 @@ jobs:
         if: ${{ always() }}
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
-          name: matrix-federation-acceptance-${{ github.run_number }}
+          name: matrix-federation-acceptance-${{ github.sha }}-${{ github.run_number }}
           path: mesh/matrix-spike-logs/
           if-no-files-found: error
           retention-days: 14