Merge pull request #37 from dhawal-ss/beta/production-readiness-2026-08

Bind Phase 2 through 6 implementation to reviewed source

Author: dhawal-ss

.gitattributes

@@ -1 +1,3 @@
 * text=auto eol=lf
+mesh/infra/container-prototypes/caddy/patches/*.patch whitespace=-space-before-tab
+mesh/infra/container-candidates/caddy/patches/*.patch whitespace=-space-before-tab

.github/CODEOWNERS

@@ -1,9 +1,15 @@
 * @dhawal-ss
 
 # Release publication and its security policy require an owner review.
+/.github/workflows/ @dhawal-ss
+/.github/dependabot.yml @dhawal-ss
+/.github/CODEOWNERS @dhawal-ss
 /.github/workflows/release-beta.yml @dhawal-ss
 /.github/workflows/security.yml @dhawal-ss
 /.github/dependency-review-config.yml @dhawal-ss
+/mesh/release/ @dhawal-ss
+/mesh/infra/ @dhawal-ss
+/mesh/docs/operations/ @dhawal-ss
 /mesh/scripts/beta-release-preflight.ps1 @dhawal-ss
 /mesh/scripts/check-matrix-release-dependencies.ps1 @dhawal-ss
 /mesh/scripts/rust-dependency-policy.json @dhawal-ss

.github/dependabot.yml

@@ -45,3 +45,50 @@ updates:
     labels:
       - dependencies
       - rust
+
+  - package-ecosystem: npm
+    directory: /mesh/feature-deps/matrix-voice
+    schedule:
+      interval: weekly
+      day: monday
+      time: "08:35"
+      timezone: America/Chicago
+    open-pull-requests-limit: 3
+    labels: [dependencies, matrix-voice]
+
+  - package-ecosystem: npm
+    directory: /mesh/feature-deps/legacy-lan
+    schedule:
+      interval: weekly
+      day: monday
+      time: "08:40"
+      timezone: America/Chicago
+    open-pull-requests-limit: 3
+    labels: [dependencies, legacy-lan]
+
+  - package-ecosystem: docker
+    directory: /mesh/infra/homeserver
+    schedule:
+      interval: weekly
+      day: monday
+      time: "08:45"
+      timezone: America/Chicago
+    labels: [dependencies, containers, homeserver]
+
+  - package-ecosystem: docker
+    directory: /mesh/infra/matrixrtc
+    schedule:
+      interval: weekly
+      day: monday
+      time: "08:50"
+      timezone: America/Chicago
+    labels: [dependencies, containers, matrixrtc]
+
+  - package-ecosystem: docker
+    directory: /mesh/infra/matrix-spike
+    schedule:
+      interval: weekly
+      day: monday
+      time: "08:55"
+      timezone: America/Chicago
+    labels: [dependencies, containers, matrix-spike]

.github/workflows/ci.yml

@@ -8,8 +8,10 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
+  MESH_MATRIX_VOICE_FRONTEND: matrix-voice
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
@@ -21,7 +23,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest]
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@d0befba8b9ddf874327619e84c39b094edd58b66 # 1.93.0
@@ -41,7 +43,7 @@ jobs:
             libsqlcipher-dev
 
       - name: Cache cargo registry & build
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry
@@ -74,11 +76,17 @@ jobs:
         working-directory: mesh/src-tauri
         run: cargo test --no-default-features --features matrix-backend --locked --jobs 1
 
+      - name: Check and test signed-candidate Matrix voice backend
+        working-directory: mesh/src-tauri
+        run: |
+          cargo check --no-default-features --features matrix-voice --locked --jobs 1
+          cargo test --no-default-features --features matrix-voice --locked --jobs 1
+
   legacy-rust:
     name: Legacy LAN Rust
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@d0befba8b9ddf874327619e84c39b094edd58b66 # 1.93.0
@@ -95,7 +103,7 @@ jobs:
             libsqlcipher-dev
 
       - name: Cache cargo registry & legacy build
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry
@@ -120,18 +128,21 @@ jobs:
     name: Frontend Build & Browser E2E
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # The readiness validator binds sourceTreeHash to an exact historical
           # sourceCommit, so a synthetic depth-one PR merge is insufficient.
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm
-          cache-dependency-path: mesh/package-lock.json
+          cache-dependency-path: |
+            mesh/package-lock.json
+            mesh/feature-deps/matrix-voice/package-lock.json
+            mesh/feature-deps/legacy-lan/package-lock.json
 
       - name: Install dependencies
         working-directory: mesh
@@ -157,14 +168,18 @@ jobs:
         working-directory: mesh
         run: npm run check:icons
 
+      - name: Check bundled interface sounds
+        working-directory: mesh
+        run: npm run check:interface-sounds
+
       - name: Check reviewed public services
         working-directory: mesh
         run: npm run check:public-services
 
-      - name: Check production readiness ledger
+      - name: Check protected evidence and production readiness ledger
         working-directory: mesh
         run: |
-          node --test scripts/check-readiness-ledger.test.mjs
+          npm run check:protected-evidence
           npm run check:readiness-ledger
 
       - name: Check fail-closed external acceptance contract
@@ -177,6 +192,10 @@ jobs:
         working-directory: mesh
         run: npm run check:public-site
 
+      - name: Check approved owner decisions
+        working-directory: mesh
+        run: npm run check:owner-decisions
+
       - name: Check beta product boundary
         working-directory: mesh
         run: npm run check:beta-contract
@@ -206,13 +225,23 @@ jobs:
         working-directory: mesh
         run: npm run test -- --maxWorkers=4
 
-      - name: Build frontend
+      - name: Test isolated voice dependency graphs
+        working-directory: mesh
+        run: npm run test:voice-features
+
+      - name: Build non-shipping comparison frontends
+        working-directory: mesh
+        run: |
+          npm run build:lan
+          npm run build:matrix
+
+      - name: Build signed-candidate Matrix voice frontend
         working-directory: mesh
-        run: npm run build
+        run: npm run build:matrix-voice
 
       - name: Enforce frontend entry bundle budget
         working-directory: mesh
-        run: npm run check:bundle-size
+        run: npm run check:bundle-size -- --report release/bundle-report.json
 
       - name: Install Playwright browser
         working-directory: mesh
@@ -221,3 +250,64 @@ jobs:
       - name: Run browser E2E tests and WCAG scans
         working-directory: mesh
         run: npm run e2e
+
+  protected-evidence:
+    name: Protected CI evidence manifest
+    if: always()
+    needs: [matrix-rust, legacy-rust, check-frontend]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+      - name: Fail closed unless every protected job passed
+        env:
+          MATRIX_RUST: ${{ needs.matrix-rust.result }}
+          LEGACY_RUST: ${{ needs.legacy-rust.result }}
+          FRONTEND: ${{ needs.check-frontend.result }}
+        run: |
+          node mesh/scripts/protected-ci-results.mjs
+      - name: Upload protected CI payload
+        id: payload
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ci-r0-payload-${{ github.sha }}
+          path: mesh/release/ci-run-results.json
+          if-no-files-found: error
+          retention-days: 90
+      - name: Resolve protected CI payload archive size
+        id: payload-metadata
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ARTIFACT_ID: ${{ steps.payload.outputs.artifact-id }}
+        run: echo "size=$(gh api repos/${GITHUB_REPOSITORY}/actions/artifacts/${ARTIFACT_ID} --jq .size_in_bytes)" >> "$GITHUB_OUTPUT"
+      - name: Generate protected CI evidence manifest
+        working-directory: mesh
+        run: |
+          node scripts/protected-evidence-manifest.mjs \
+            --source-sha "${{ github.sha }}" \
+            --tree-hash "$(git rev-parse HEAD^{tree})" \
+            --workflow-name CI \
+            --run-id "${{ github.run_id }}" \
+            --run-attempt "${{ github.run_attempt }}" \
+            --workflow-uri "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+            --payload-path release/ci-run-results.json \
+            --payload-name ci-r0-payload-${{ github.sha }} \
+            --payload-uri "${{ steps.payload.outputs.artifact-url }}" \
+            --payload-digest "${{ steps.payload.outputs.artifact-digest }}" \
+            --payload-size "${{ steps.payload-metadata.outputs.size }}" \
+            --command "matrix-rust + legacy-rust + check-frontend protected jobs" \
+            --build-mode matrix-voice \
+            --features matrix-voice,legacy-p2p \
+            --retention-days 90 \
+            --output release/ci-protected-evidence-manifest.json
+      - name: Upload protected CI evidence manifest
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ci-protected-evidence-${{ github.sha }}
+          path: mesh/release/ci-protected-evidence-manifest.json
+          if-no-files-found: error
+          retention-days: 90

.github/workflows/container-candidates.yml

@@ -0,0 +1,121 @@
+name: Mesh container candidates
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main, beta/production-readiness-2026-08]
+    paths:
+      - .github/workflows/container-candidates.yml
+      - mesh/infra/container-candidates/**
+      - mesh/scripts/check-container-candidates.mjs
+      - mesh/scripts/check-container-candidates.test.mjs
+      - mesh/scripts/check-candidate-container-signature-evidence.mjs
+      - mesh/scripts/check-candidate-container-signature-evidence.test.mjs
+      - mesh/scripts/check-registry-tag-movement.mjs
+      - mesh/scripts/check-registry-tag-movement.test.mjs
+      - mesh/docs/operations/CONTAINER_CANDIDATE_MAINTENANCE.md
+      - mesh/package.json
+  schedule:
+    - cron: '17 8 * * 1'
+
+concurrency:
+  group: mesh-container-candidates-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    name: Verify Mesh container candidate (${{ matrix.name }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: caddy
+            image: ghcr.io/dhawal-ss/mesh-caddy
+            tag: 2.11.4-mesh.1
+            digest: sha256:67cf933778f84aadd59f93fc5d2eaf6471df7b415135ae95fc1b1e6e5f4b7e4f
+          - name: lk-jwt-service
+            image: ghcr.io/dhawal-ss/mesh-lk-jwt-service
+            tag: 0.5.0-mesh.2
+            digest: sha256:78bf2f1e8535928037abc35a9886614b3f722885b54f1f707a570e6991252710
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+      - name: Validate candidate image policy
+        working-directory: mesh
+        run: npm run check:container-candidates
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - name: Resolve exact candidate image
+        id: exact
+        shell: bash
+        run: |
+          exact_image='${{ matrix.image }}:${{ matrix.tag }}@${{ matrix.digest }}'
+          docker buildx imagetools inspect "$exact_image" >/dev/null
+          echo "image=$exact_image" >> "$GITHUB_OUTPUT"
+          echo "Verified \`$exact_image\`" >> "$GITHUB_STEP_SUMMARY"
+      - name: Install pinned Cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        with:
+          cosign-release: v3.0.6
+      - name: Generate candidate CycloneDX SBOM
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        with:
+          image: ${{ steps.exact.outputs.image }}
+          format: cyclonedx-json
+          syft-version: v1.50.0
+          output-file: candidate-${{ matrix.name }}.cdx.json
+          upload-artifact: false
+          upload-release-assets: false
+      - name: Reject fixable High or Critical findings
+        uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
+        with:
+          image: ${{ steps.exact.outputs.image }}
+          fail-build: true
+          severity-cutoff: high
+          only-fixed: true
+          grype-version: v0.116.1
+          output-format: json
+          output-file: candidate-${{ matrix.name }}-grype.json
+      - name: Bind exact image, SBOM, and scanner database evidence
+        run: >-
+          node mesh/scripts/check-container-scan-evidence.mjs
+          --sbom "candidate-${{ matrix.name }}.cdx.json"
+          --scan "candidate-${{ matrix.name }}-grype.json"
+          --image '${{ steps.exact.outputs.image }}'
+          --scope release
+          --output "candidate-${{ matrix.name }}-scan-evidence.json"
+      - name: Verify the Mesh keyless candidate signature
+        shell: bash
+        env:
+          EXACT_IMAGE: ${{ steps.exact.outputs.image }}
+        run: |
+          cosign verify \
+            --certificate-identity-regexp='^https://github\.com/dhawal-ss/mesh/\.github/workflows/container-candidates\.yml@refs/heads/(main|beta/production-readiness-2026-08)$' \
+            --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
+            --output=json \
+            "$EXACT_IMAGE" > "candidate-${{ matrix.name }}-signature-raw.json"
+          node mesh/scripts/check-candidate-container-signature-evidence.mjs \
+            --verification "candidate-${{ matrix.name }}-signature-raw.json" \
+            --image "$EXACT_IMAGE" \
+            --output "candidate-${{ matrix.name }}-signature.json"
+          rm -f "candidate-${{ matrix.name }}-signature-raw.json"
+      - name: Upload immutable candidate evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: mesh-container-candidate-${{ matrix.name }}-${{ github.sha }}
+          path: |
+            candidate-${{ matrix.name }}.cdx.json
+            candidate-${{ matrix.name }}-grype.json
+            candidate-${{ matrix.name }}-scan-evidence.json
+            candidate-${{ matrix.name }}-signature.json
+          if-no-files-found: error
+          retention-days: 90