release: refuse to pack a cdylib against an ABI that cannot carry it

.busbar-ref pins the exact busbar commit a release builds and packs against, and nothing checked
that the pinned commit's plugin-sdk dispatch actually routes the Store methods this repo
implements. It doesn't have to: busbar_api::Store gives every method a default body, so an
unrouted method compiles, packs, signs, attests and then silently takes the default at runtime --
reporting success while dropping the write. busbar 74a1f9fa ("a task written through a plugin
store is no longer discarded") is that bug, already shipped once.

The new abi-completeness job runs before create-release, so a failure leaves no tag-attached
Release, no artifact, no signature and no attestation. It derives the method list from this repo's
own `impl Store for` block rather than naming any one feature, so it stays correct as the trait
grows and cannot go stale the way a hardcoded pin can.

Against the currently pinned ref this job is RED, and correctly so: ten Store methods this repo
implements (the six task methods and the four mcp-call methods) are not routed by the pinned
plugin-sdk. .busbar-ref is deliberately left alone -- it is written by release-on-upstream from a
real upstream release, and busbar has not cut 1.6.0 yet.

Author: MattJackson

.github/scripts/verify-abi-completeness.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0
+#
+# ABI-COMPLETENESS GATE: refuse to build a plugin artifact whose source implements Store methods
+# that the PINNED busbar ABI cannot carry.
+#
+# WHY THIS EXISTS. `.busbar-ref` pins the exact busbar commit a release builds and packs against.
+# The plugin's `impl Store for ...` is compiled against `busbar-api` from that commit, but the wire
+# is `busbar-plugin-sdk`'s `dispatch` — the match arm that turns a decoded StoreRequest into a call
+# on the store. `busbar_api::Store` gives every method a DEFAULT body, so a method the pinned SDK's
+# dispatch never routes does not fail to compile: it compiles, ships, signs, attests, and then
+# silently takes the default at runtime. busbar 74a1f9fa ("a task written through a plugin store is
+# no longer discarded") is exactly that failure, already shipped once: a store that implemented
+# `put_task` perfectly had every task DISCARDED at the ABI while `put_task` reported success.
+#
+# That class of defect is invisible to every other gate in this repo. The test suite runs against a
+# busbar checkout too, but through the in-process trait, not the ABI; fmt/clippy/build cannot see it;
+# verify-assets only proves an asset exists. So this script checks the one thing nothing else does:
+#
+#   for every method this repo implements in `impl Store for <T>`,
+#   the pinned busbar's crates/plugin-sdk/src/lib.rs `dispatch` must actually call `store.<method>(`.
+#
+# A method implemented here but unrouted there is a SILENT DATA-LOSS PATH. It is a hard failure.
+#
+# This is deliberately generic — it is not a list of task methods. Any future Store method added to
+# a plugin ahead of the pinned engine trips it the same way, so the gate cannot go stale the way a
+# hardcoded pin can.
+#
+# Usage: verify-abi-completeness.sh <path-to-plugin-repo> <path-to-busbar-checkout>
+set -euo pipefail
+
+plugin_root="${1:?usage: verify-abi-completeness.sh <plugin-repo> <busbar-checkout>}"
+busbar_root="${2:?usage: verify-abi-completeness.sh <plugin-repo> <busbar-checkout>}"
+
+sdk="${busbar_root}/crates/plugin-sdk/src/lib.rs"
+[ -f "$sdk" ] || { echo "::error::not a busbar checkout: ${sdk} does not exist" >&2; exit 1; }
+
+# The single `impl Store for <T>` block in this repo's store crate. Found, not hardcoded, so the
+# script is identical in all four store repos.
+impl_file="$(grep -rl --include='*.rs' '^impl Store for ' "$plugin_root" \
+  | grep -v '/target/' | head -1 || true)"
+[ -n "$impl_file" ] || { echo "::error::no 'impl Store for' block found under ${plugin_root}" >&2; exit 1; }
+
+# Slice the impl block: from `impl Store for` to the first column-0 `}`, then take the method names.
+methods="$(awk '/^impl Store for /{inblock=1} inblock{print} inblock&&/^\}/{exit}' "$impl_file" \
+  | sed -n 's/^    fn \([a-z0-9_]*\)(.*/\1/p' | sort -u)"
+[ -n "$methods" ] || { echo "::error::parsed ZERO methods out of ${impl_file} — the parser is wrong, not the ABI" >&2; exit 1; }
+
+echo "plugin store impl : ${impl_file}"
+echo "pinned busbar sdk : ${sdk}"
+echo "methods implemented here: $(echo "$methods" | wc -l | tr -d ' ')"
+echo
+
+missing=""
+for m in $methods; do
+  if grep -q "store\.${m}(" "$sdk"; then
+    echo "  ok      ${m}"
+  else
+    echo "  MISSING ${m}"
+    missing="${missing} ${m}"
+  fi
+done
+
+if [ -n "$missing" ]; then
+  echo
+  echo "::error::ABI-COMPLETENESS FAILURE. The pinned busbar commit's plugin-sdk dispatch does not" \
+       "route these Store methods that this plugin implements:${missing}." \
+       "Packing a cdylib against this ABI would ship a plugin whose calls to those methods take" \
+       "busbar_api::Store's DEFAULT bodies at runtime — succeeding silently while dropping the data." \
+       "Do not release. Advance .busbar-ref to a busbar commit whose crates/plugin-sdk dispatch" \
+       "carries these methods (and whose crates/api defines the row types they take)." >&2
+  exit 1
+fi
+
+echo
+echo "ABI-completeness OK: every Store method implemented here is routed by the pinned busbar's dispatch."

.github/workflows/release.yml

@@ -64,10 +64,45 @@ jobs:
       service: valkey
       busbar_ref: ${{ needs.resolve-busbar-ref.outputs.sha }}
 
+  # ── ABI-COMPLETENESS GATE ────────────────────────────────────────────────────────────────────
+  # THE GATE THAT REFUSES A CDYLIB THE PINNED ABI CANNOT CARRY. This runs BEFORE `create-release`,
+  # so a failure here leaves no tag-attached Release, no artifact, no signature and no attestation.
+  #
+  # `gate` above proves this repo's suite passes against the pinned core. It cannot prove the pinned
+  # core's plugin-sdk `dispatch` actually ROUTES the Store methods this repo implements — the suite
+  # exercises the trait in-process, while a shipped plugin is reached over the C ABI. Because
+  # `busbar_api::Store` gives every method a DEFAULT body, an unrouted method does not fail to
+  # compile: it compiles, packs, signs, attests, and then silently takes the default at runtime,
+  # reporting success while dropping the write. busbar 74a1f9fa ("a task written through a plugin
+  # store is no longer discarded") is that bug, already shipped once.
+  #
+  # The check is generic — it derives the method list from this repo's own `impl Store for` block
+  # rather than naming any one feature, so it stays correct as the Store trait grows and cannot go
+  # stale the way a hardcoded pin can. See .github/scripts/verify-abi-completeness.sh.
+  abi-completeness:
+    needs: resolve-busbar-ref
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout store-valkey
+        uses: actions/checkout@v7
+        with:
+          path: store-valkey
+
+      - name: Checkout busbar at the PINNED .busbar-ref sha (not a branch)
+        uses: actions/checkout@v7
+        with:
+          repository: GetBusbar/busbar
+          ref: ${{ needs.resolve-busbar-ref.outputs.sha }}
+          path: busbarAI
+
+      - name: Every Store method implemented here must be routed by the pinned ABI
+        run: bash store-valkey/.github/scripts/verify-abi-completeness.sh store-valkey busbarAI
+        shell: bash
+
   # Create the Release first so the parallel per-target upload jobs have something to attach to
   # (uploading from a matrix without a pre-existing release races -> "release not found").
   create-release:
-    needs: gate
+    needs: [gate, abi-completeness]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7