[CHIRP-3538]: BSSCI 1.1 interoperability, durability and protocol hardening

.github/workflows/pipeline-build.yml

@@ -4,8 +4,7 @@ on:
   workflow_dispatch:
   push:
     branches:
-      - main
-      - dev
+      - "**"
     tags-ignore:
       - "v*"
   pull_request:
@@ -73,10 +72,10 @@ jobs:
           go-version-file: go.work
       - name: Run Go tests (unit only, no DB/infra)
         run: |
-          echo "::group::Testing KC-Core (skip bssci integration)"
-          (cd KC-Core && go test -short -timeout 3m $(go list ./... | grep -v /pkg/bssci$))
+          echo "::group::Testing KC-Core (full suite)"
+          (cd KC-Core && go test -timeout 10m ./...)
           echo "::endgroup::"
-          echo "::group::Testing KC-DB (skip postgres integration)"
+          echo "::group::Testing KC-DB (postgres suite runs in test-postgres)"
           (cd KC-DB && go test -short -timeout 3m $(go list ./... | grep -v /postgres))
           echo "::endgroup::"
           for mod in KC-Gateway KC-Identity KC-MQTT pkg; do
@@ -85,8 +84,53 @@ jobs:
             echo "::endgroup::"
           done
 
+  # The KC-DB postgres suite runs against real testcontainers-managed
+  # PostgreSQL instances, plus a migrated service database for the
+  # env-DB-backed schema tests (SetupEnvDBOrSkip fail-fasts when CI=true).
+  # It takes ~15 minutes and gates image publication.
+  test-postgres:
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:17.5
+        env:
+          POSTGRES_PASSWORD: changeme
+          POSTGRES_USER: kilocenter
+          POSTGRES_DB: kilocenter
+        ports:
+          - 5433:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    env:
+      DB_HOST: localhost
+      DB_PORT: 5433
+      DB_NAME: kilocenter
+      DB_USER: kilocenter
+      DB_PASSWORD: changeme
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.work
+      - name: Install golang-migrate
+        run: |
+          go install -tags 'postgres' github.com/golang-migrate/migrate/v4/cmd/migrate@latest
+          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
+      - name: Run database migrations
+        run: |
+          migrate -path KC-DB/migrations \
+            -database "postgres://$DB_USER:$DB_PASSWORD@$DB_HOST:$DB_PORT/$DB_NAME?sslmode=disable" \
+            up
+      - name: Run KC-DB postgres integration tests
+        run: |
+          (cd KC-DB && go test -timeout 25m ./storage/postgres/...)
+
   build-kc-core:
-    needs: [generate-version, lint, test]
+    needs: [generate-version, lint, test, test-postgres]
+    if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -107,7 +151,8 @@ jobs:
           tags: ${{ needs.generate-version.outputs.registry }}/kc-core:${{ needs.generate-version.outputs.version }}
 
   build-kc-gateway:
-    needs: [generate-version, lint, test]
+    needs: [generate-version, lint, test, test-postgres]
+    if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -128,7 +173,8 @@ jobs:
           tags: ${{ needs.generate-version.outputs.registry }}/kc-gateway:${{ needs.generate-version.outputs.version }}
 
   build-kc-identity:
-    needs: [generate-version, lint, test]
+    needs: [generate-version, lint, test, test-postgres]
+    if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -149,7 +195,8 @@ jobs:
           tags: ${{ needs.generate-version.outputs.registry }}/kc-identity:${{ needs.generate-version.outputs.version }}
 
   build-kc-web:
-    needs: [generate-version, lint, test]
+    needs: [generate-version, lint, test, test-postgres]
+    if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     permissions:
       contents: write

KC-Core/api/proto/core.proto

@@ -573,7 +573,9 @@ message SendULTransmitResponse {
 
 // Base Station Status Request (BSSCI 3.5)
 message BaseStationStatusRequest {
-  uint64 bs_eui = 1;          // Base Station EUI
+  // Deprecated: uint64 loses precision above 2^53 in browser JavaScript clients; use bs_eui_hex.
+  uint64 bs_eui = 1 [deprecated = true];
+  string bs_eui_hex = 2;      // Base Station EUI as hex string (browser-safe full-range representation; accepts dashed or non-dashed)
 }
 
 message BaseStationStatusResponse {
@@ -584,7 +586,9 @@ message BaseStationStatusResponse {
 
 // Ping Request (BSSCI §5.4)
 message InitiatePingRequest {
-  uint64 bs_eui = 1;  // Base Station EUI
+  // Deprecated: uint64 loses precision above 2^53 in browser JavaScript clients; use bs_eui_hex.
+  uint64 bs_eui = 1 [deprecated = true];
+  string bs_eui_hex = 2;  // Base Station EUI as hex string (browser-safe full-range representation; accepts dashed or non-dashed)
 }
 
 message InitiatePingResponse {

KC-Core/cmd/certgen/main.go

@@ -18,6 +18,13 @@ import (
 	"time"
 )
 
+// Certificate subject identity shared by the CA and issued certificates.
+const (
+	certSubjectOrganization = "KiloCenter"
+	certSubjectProvince     = "California"
+	certSubjectLocality     = "San Francisco"
+)
+
 func main() {
 	var (
 		certDir      = flag.String("dir", "certs", "Directory to store certificates")
@@ -151,11 +158,11 @@ func generateCA(validYears int) (*x509.Certificate, *rsa.PrivateKey, error) {
 	template := x509.Certificate{
 		SerialNumber: big.NewInt(1),
 		Subject: pkix.Name{
-			Organization:       []string{"KiloCenter"},
+			Organization:       []string{certSubjectOrganization},
 			OrganizationalUnit: []string{"MIOTY Certificate Authority"},
 			Country:            []string{"US"},
-			Province:           []string{"California"},
-			Locality:           []string{"San Francisco"},
+			Province:           []string{certSubjectProvince},
+			Locality:           []string{certSubjectLocality},
 			CommonName:         "KiloCenter Root CA",
 		},
 		NotBefore:             time.Now(),
@@ -197,11 +204,11 @@ func generateClientCert(caCert *x509.Certificate, caKey *rsa.PrivateKey, clientN
 	template := x509.Certificate{
 		SerialNumber: serialNumber,
 		Subject: pkix.Name{
-			Organization:       []string{"KiloCenter"},
+			Organization:       []string{certSubjectOrganization},
 			OrganizationalUnit: []string{"MIOTY Base Station"},
 			Country:            []string{"US"},
-			Province:           []string{"California"},
-			Locality:           []string{"San Francisco"},
+			Province:           []string{certSubjectProvince},
+			Locality:           []string{certSubjectLocality},
 			CommonName:         clientName,
 		},
 		NotBefore:   time.Now(),
@@ -236,11 +243,11 @@ func generateServerCert(caCert *x509.Certificate, caKey *rsa.PrivateKey, serverN
 	template := x509.Certificate{
 		SerialNumber: big.NewInt(2),
 		Subject: pkix.Name{
-			Organization:       []string{"KiloCenter"},
+			Organization:       []string{certSubjectOrganization},
 			OrganizationalUnit: []string{"MIOTY Service Center"},
 			Country:            []string{"US"},
-			Province:           []string{"California"},
-			Locality:           []string{"San Francisco"},
+			Province:           []string{certSubjectProvince},
+			Locality:           []string{certSubjectLocality},
 			CommonName:         serverName,
 		},
 		NotBefore:   time.Now(),