MVP

.cargo/config.toml

@@ -0,0 +1,5 @@
+# Local wasm32 checks only. **Published CosmWasm artifacts MUST use the Docker
+# optimizer (Rust 1.86 MSRV)** — see scripts/build-crosslink-wasm.sh.
+# Host imports (db_*, ed25519_*, …) are provided by wasmvm at runtime.
+[target.wasm32-unknown-unknown]
+rustflags = ["-C", "link-arg=--allow-undefined"]

.github/workflows/basic.yml

@@ -1,85 +1,22 @@
-name: Basic
+# DEPRECATED — replaced by tiered CI.
+# See: ci-core.yml (always), ci-extended.yml (paths/labels), ci-heavy.yml (admin/nightly).
+# This stub keeps history; job always succeeds with a pointer so old branch protection
+# rules referencing "Basic" do not silently mean nothing forever.
+name: Basic (deprecated)
 
 on:
   pull_request:
+  workflow_dispatch:
 
-jobs:
-  compile:
-    name: Compile
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout sources
-        uses: actions/checkout@v2
-
-      - name: Install stable toolchain
-        uses: actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: 1.68.2
-          target: wasm32-unknown-unknown
-          override: true
-
-      - name: Compile WASM contract
-        uses: actions-rs/cargo@v1
-        with:
-          command: wasm
-          args: --locked
-
-  lint:
-    name: Lint
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout sources
-        uses: actions/checkout@v2
-
-      - name: Install stable toolchain
-        uses: actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: 1.68.2
-          override: true
-          components: rustfmt, clippy
+permissions:
+  contents: read
 
-      - uses: extractions/setup-just@v1
-
-      - name: Run cargo doc
-        uses: actions-rs/cargo@v1
-        with:
-          command: doc
-          args: -F library --no-deps
-
-      - name: Run cargo clippy
-        run: just lint
-
-      - name: Generate Schema
-        run: just schema
-
-      - name: Schema Changes
-        # fails if any changes not committed
-        run: |
-          CHANGES_IN_REPO=$(git status --porcelain)
-          if [[ -n "$CHANGES_IN_REPO" ]]; then
-            echo "Repository is dirty. Showing 'git status' and 'git --no-pager diff' for debugging now:"
-            git status && git --no-pager diff
-            exit 1
-          fi
-
-  coverage:
-    name: Coverage
+jobs:
+  redirect:
+    name: use CI Core instead
     runs-on: ubuntu-latest
-    container:
-      image: xd009642/tarpaulin:0.24.0
-      options: --security-opt seccomp=unconfined
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v2
-
-      - name: Generate code coverage
+      - name: Notice
         run: |
-          cargo tarpaulin --verbose --workspace --timeout 120 --out Xml
-
-      - name: Upload to codecov.io
-        uses: codecov/codecov-action@v2
-        with:
-          token: ${{secrets.CODECOV_TOKEN}}
-          fail_ci_if_error: true
+          echo "::warning::Workflow 'Basic' is deprecated. Real gates are CI Core / CI Extended / CI Heavy."
+          echo "See docs/ci.md and .github/workflows/ci-*.yml"

.github/workflows/ci-core.yml

@@ -0,0 +1,117 @@
+# Tier 0 — always on. Offline, no Docker, no secrets.
+# Goal: exercise terp-scripts agent contracts + lightweight internal libs.
+# Dense packing: internal libs run as 2 balanced multi-package matrix packs
+# (not one job per crate). Offline IBC pipeline stays serial (data deps).
+name: CI Core
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - master
+      - "feat/**"
+  workflow_dispatch:
+
+concurrency:
+  group: ci-core-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: 1
+  # Checkout root IS the terp-rs repo on GitHub (permissionlessweb/terp-rs).
+  # Local act sets GITHUB_WORKSPACE to this crate via scripts/act (monorepo bind).
+
+jobs:
+  # ── Agent IBC offline plane (terp-scripts) — MUST stay serial ──────────
+  terp-scripts-offline:
+    name: terp-scripts offline (ibc unit/golden + validate)
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: "1.86"
+          components: rustfmt, clippy
+
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: ". -> target"
+          shared-key: terp-scripts-offline
+
+      - name: Install just
+        uses: extractions/setup-just@v2
+
+      - name: Preflight offline
+        run: just scripts-ibc-preflight offline
+
+      - name: Offline IBC tests + rebuild-from-public
+        run: just scripts-ibc-offline
+
+      - name: Validate public/ (RunReport JSON)
+        run: just scripts-ibc-validate
+
+      - name: Assert validate ok via jq
+        run: |
+          set -euo pipefail
+          cargo run -p terp-scripts --bin terp-ibc --quiet -- validate --format json \
+            | tee /tmp/run_report.json
+          python3 - <<'PY'
+          import json, sys
+          r = json.load(open("/tmp/run_report.json"))
+          assert r.get("ok") is True, r
+          assert r.get("exit_code") == 0, r
+          assert r.get("tool") == "terp-ibc", r
+          print("RunReport OK:", r.get("verb"), r.get("duration_ms"), "ms")
+          PY
+
+  # ── Internal lib crates — dense 2-pack matrix (multi-package cargo) ───
+  internal-libs:
+    name: internal libs (${{ matrix.pack }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Balanced packs: auth/sdk-ish vs light-client/nips (see docs/ci/dense-parallel-packing.md)
+          - pack: core-libs-a
+          - pack: core-libs-b
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: "1.86"
+
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: ". -> target"
+          shared-key: internal-libs-${{ matrix.pack }}
+
+      - name: Dense pack lib tests
+        env:
+          CI_DENSE_PACK: ${{ matrix.pack }}
+          CI_DENSE_MODE: matrix
+        run: ./scripts/ci/dense-packs.sh pack "${CI_DENSE_PACK}"
+
+  # ── Gate: offline + all lib packs must pass ───────────────────────────
+  core-gate:
+    name: core gate
+    runs-on: ubuntu-latest
+    needs: [terp-scripts-offline, internal-libs]
+    steps:
+      - name: Core CI green
+        run: echo "CI Core passed (terp-scripts offline + dense internal lib packs)"

.github/workflows/ci-extended.yml

@@ -0,0 +1,175 @@
+# Tier 1 — path / label gated. Contracts + more crates when those paths change.
+# Dense packing: 3 balanced contract packs + independent scripts-integration;
+# optional zk heavy packs no longer wait on contracts-core (independent).
+name: CI Extended
+
+on:
+  pull_request:
+    paths:
+      - "contracts/**"
+      - "crates/**"
+      - "tests/**"
+      - "tools/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - "justfile"
+      - "scripts/ci/**"
+      - ".github/workflows/ci-extended.yml"
+    types: [opened, synchronize, reopened, labeled, ready_for_review]
+  push:
+    branches: [main, master]
+    paths:
+      - "contracts/**"
+      - "crates/**"
+      - "tests/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - "scripts/ci/**"
+  workflow_dispatch:
+    inputs:
+      full_contracts:
+        description: "Also run heavier authenticator/zk contract tests"
+        type: boolean
+        default: false
+
+concurrency:
+  group: ci-extended-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  # Repo root on GHA is terp-rs; local act sets GITHUB_WORKSPACE via scripts/act.
+
+jobs:
+  # Skip draft PRs unless labeled ci-extended (saves minutes).
+  should-run:
+    name: decide
+    runs-on: ubuntu-latest
+    outputs:
+      run: ${{ steps.d.outputs.run }}
+      heavy_contracts: ${{ steps.d.outputs.heavy_contracts }}
+    steps:
+      - id: d
+        env:
+          EVENT: ${{ github.event_name }}
+          DRAFT: ${{ github.event.pull_request.draft }}
+          LABELS: ${{ join(github.event.pull_request.labels.*.name, ',') }}
+          FULL: ${{ inputs.full_contracts }}
+        run: |
+          set -euo pipefail
+          run=true
+          heavy=false
+          if [[ "$EVENT" == "pull_request" && "$DRAFT" == "true" ]]; then
+            if [[ ",$LABELS," != *",ci-extended,"* && ",$LABELS," != *",ci-heavy,"* ]]; then
+              run=false
+            fi
+          fi
+          if [[ ",$LABELS," == *",ci-extended,"* || ",$LABELS," == *",ci-heavy,"* ]]; then
+            heavy=true
+          fi
+          if [[ "$FULL" == "true" ]]; then
+            heavy=true
+          fi
+          if [[ "$EVENT" == "workflow_dispatch" ]]; then
+            run=true
+          fi
+          echo "run=$run" >> "$GITHUB_OUTPUT"
+          echo "heavy_contracts=$heavy" >> "$GITHUB_OUTPUT"
+          echo "decide: run=$run heavy_contracts=$heavy"
+
+  # Dense 3-pack matrix — multi-package cargo per cell (not 8 sparse jobs)
+  contracts-core:
+    name: contracts (${{ matrix.pack }})
+    needs: should-run
+    if: needs.should-run.outputs.run == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - pack: contracts-a
+          - pack: contracts-b
+          - pack: contracts-c
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: "1.86"
+          targets: wasm32-unknown-unknown
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: ". -> target"
+          shared-key: contracts-${{ matrix.pack }}
+      - name: Dense pack lib tests
+        env:
+          CI_DENSE_PACK: ${{ matrix.pack }}
+          CI_DENSE_MODE: matrix
+        run: ./scripts/ci/dense-packs.sh pack "${CI_DENSE_PACK}"
+      - name: Wasm check (pack-local subset)
+        # Only packages that both need wasm and live in this pack (avoids re-checking all packs).
+        run: |
+          set -euo pipefail
+          case "${{ matrix.pack }}" in
+            contracts-a)
+              for p in terp-ed25519 terp-passkey terp-vsck; do
+                echo "::group::wasm check $p"
+                cargo check -p "$p" --target wasm32-unknown-unknown --lib || cargo check -p "$p" --lib
+                echo "::endgroup::"
+              done
+              ;;
+            contracts-c)
+              for p in cw-ics08-wasm-crosslink; do
+                echo "::group::wasm check $p"
+                cargo check -p "$p" --target wasm32-unknown-unknown --lib || cargo check -p "$p" --lib
+                echo "::endgroup::"
+              done
+              ;;
+            *)
+              echo "no wasm subset for ${{ matrix.pack }}"
+              ;;
+          esac
+
+  # Independent of contracts-core — zk packs are not data-dependent on core contracts
+  contracts-heavy:
+    name: contracts (zk / optional)
+    needs: [should-run]
+    if: needs.should-run.outputs.run == 'true' && needs.should-run.outputs.heavy_contracts == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: "1.86"
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: ". -> target"
+          shared-key: contracts-heavy
+      - name: Optional zk-related packages (multi-package dense)
+        run: ./scripts/ci/dense-packs.sh contracts-heavy
+
+  scripts-integration:
+    name: terp-scripts non-ignored integration
+    needs: should-run
+    if: needs.should-run.outputs.run == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: "1.86"
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: ". -> target"
+          shared-key: scripts-integration
+      - uses: extractions/setup-just@v2
+      - name: All non-ignored tests in terp-scripts
+        run: |
+          set -euo pipefail
+          # Does not run #[ignore] (Docker harness stays in CI Heavy).
+          cargo test -p terp-scripts --lib --tests