ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  security-regressions:
    name: Fast Security Regressions
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Run security regression contract tests
        run: |
          cargo test -p hush-cli --test abuse_harness -- --nocapture
          cargo test -p clawdstrike --test security_regressions -- --nocapture
          cargo test -p hushd --test security_regressions -- --nocapture
          cargo test -p hush-cli hush_run::tests::connect_proxy_rejects_ip_target_with_allowlisted_sni_mismatch -- --exact
          cargo test -p hush-cli hush_run::tests::connect_proxy_hostname_target_is_ip_pinned_after_policy_check -- --exact

  policy-torture:
    name: Policy Torture (PR Gate)
    runs-on: ubuntu-latest
    timeout-minutes: 20
    needs: security-regressions
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Install protoc
        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler

      - name: Run policy torture battery
        run: bash tests/policy-torture/run.sh

      - name: Upload policy torture JSON reports
        if: always()
        uses: actions/upload-artifact@v6
        with:
          name: policy-torture-reports
          path: tests/policy-torture/reports/*.json
          if-no-files-found: error

  check:
    name: Check
    runs-on: ubuntu-latest
    needs: [security-regressions, policy-torture]
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Cache cargo registry
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-

      - name: Install protoc
        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler

      - name: Check formatting
        run: cargo fmt --all -- --check

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version: "24"

      - name: Install TypeScript compiler
        run: npm install -g typescript@5.9.3

      - name: Smoke test TS file dependency workflows
        run: bash scripts/smoke-ts-file-deps.sh

      - name: Validate Docker Compose topology
        run: docker compose -f infra/docker/docker-compose.services.yaml config > /dev/null

      - name: Lint moved paths
        run: bash scripts/path-lint.sh

      - name: Validate moved path targets
        run: bash scripts/move-validation.sh

      - name: Validate architecture guardrails
        run: bash scripts/architecture-guardrails.sh

      - name: Setup Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install mypy
        run: python -m pip install --disable-pip-version-check mypy==1.19.1

      - name: Validate docs code blocks
        run: tools/scripts/validate-docs

      - name: Clippy
        run: cargo clippy --all-targets --all-features -- -D warnings

      - name: Build
        run: cargo build --all-targets

      - name: Test
        run: cargo test --all --exclude sdr-integration-tests

  tauri-rust-check:
    name: Tauri Rust Crates
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install Linux dependencies for Tauri
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libgtk-3-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            protobuf-compiler
          sudo apt-get install -y libwebkit2gtk-4.1-dev || sudo apt-get install -y libwebkit2gtk-4.0-dev

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo registry
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-tauri-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-tauri-
            ${{ runner.os }}-cargo-

      - name: Check desktop Tauri crate
        run: cargo check --manifest-path apps/desktop/src-tauri/Cargo.toml

      - name: Check agent Tauri crate
        run: cargo check --manifest-path apps/agent/src-tauri/Cargo.toml

  desktop-frontend:
    name: Desktop Frontend
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: oven-sh/setup-bun@v2
      - name: Install deps
        working-directory: apps/desktop
        run: bun install --frozen-lockfile
      - name: TypeScript typecheck
        working-directory: apps/desktop
        run: bun run typecheck

  cloud-dashboard:
    name: Cloud Dashboard
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '24'
          cache: 'npm'
          cache-dependency-path: apps/cloud-dashboard/package-lock.json

      - name: Install dependencies
        working-directory: apps/cloud-dashboard
        run: npm ci

      - name: Type check
        working-directory: apps/cloud-dashboard
        run: npm run typecheck

      - name: Build
        working-directory: apps/cloud-dashboard
        run: npm run build

  sdr-integration-tests:
    name: SDR Integration Tests
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: check
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo registry
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-sdr-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-sdr-
            ${{ runner.os }}-cargo-

      - name: Install protoc
        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler

      - name: Spine pipeline tests
        run: cargo test -p hush-spine --test pipeline_test

      - name: Bridge roundtrip tests
        run: cargo test -p sdr-integration-tests --test bridge_roundtrip_test

      - name: E2E pipeline tests
        run: cargo test -p sdr-integration-tests --test e2e_pipeline

  msrv:
    name: Minimum Supported Rust Version
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install MSRV toolchain
        uses: dtolnay/rust-toolchain@1.93

      - name: Install protoc
        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler

      - name: Build with MSRV
        run: cargo build --all-targets

  offline:
    name: Offline Build/Test (vendored)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Install protoc
        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler

      - name: Test offline
        run: scripts/cargo-offline.sh test --workspace --all-targets
        env:
          CARGO_NET_OFFLINE: "true"

  docs:
    name: Documentation
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Install protoc
        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler

      - name: Build documentation
        run: cargo doc --no-deps --all-features
        env:
          RUSTDOCFLAGS: -D warnings

  security-audit:
    name: Security Audit
    runs-on: ubuntu-latest
    needs: security-regressions
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Install cargo-audit
        run: cargo install cargo-audit --locked --version 0.22.0

      - name: Enforce advisory exception policy metadata
        run: tools/scripts/check-advisory-expiry.sh

      - name: Run security audit
        run: |
          cargo audit --deny warnings \
            --ignore RUSTSEC-2024-0375 \
            --ignore RUSTSEC-2025-0141 \
            --ignore RUSTSEC-2024-0388 \
            --ignore RUSTSEC-2024-0436 \
            --ignore RUSTSEC-2025-0134 \
            --ignore RUSTSEC-2021-0145

  license-check:
    name: License Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Install cargo-deny
        uses: taiki-e/install-action@cargo-deny

      - name: Run cargo-deny
        run: cargo deny check

  coverage:
    name: Code Coverage
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: llvm-tools-preview

      - name: Install protoc
        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler

      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@cargo-llvm-cov

      - name: Generate coverage report
        run: cargo llvm-cov --all-features --lcov --output-path lcov.info

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v5
        with:
          files: lcov.info
          fail_ci_if_error: false

  wasm:
    name: WASM Build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-unknown-unknown

      - name: Cache cargo registry
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-wasm-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-wasm-

      - name: Install wasm-pack
        run: cargo install wasm-pack --locked --version 0.14.0

      - name: Build WASM
        run: |
          cd crates/libs/hush-wasm
          wasm-pack build --target web --release

      - name: Check bundle size
        run: |
          SIZE=$(wc -c < crates/libs/hush-wasm/pkg/hush_wasm_bg.wasm)
          echo "Bundle size: $SIZE bytes"
          if [ $SIZE -gt 512000 ]; then
            echo "ERROR: Bundle exceeds 500KB limit"
            exit 1
          fi
          echo "Bundle size is within 500KB limit"

  proptest:
    name: Property Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Install protoc
        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler

      - name: Cache cargo registry
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-proptest-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-proptest-

      - name: Run property tests
        run: cargo test --workspace proptest
        env:
          PROPTEST_CASES: 500

  integration-tests:
    name: Integration Tests
    runs-on: ubuntu-latest
    needs: check
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Install protoc
        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler

      - name: Cache cargo registry
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-integration-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-integration-
            ${{ runner.os }}-cargo-

      - name: Build daemon
        run: cargo build -p hushd

      - name: Start daemon in background
        run: |
          ./target/debug/hushd start &
          echo $! > /tmp/hushd.pid
        env:
          RUST_LOG: info

      - name: Wait for daemon health
        run: |
          for i in {1..30}; do
            if curl -s http://127.0.0.1:9876/health | grep -q '"status":"healthy"'; then
              echo "Daemon is healthy"
              exit 0
            fi
            echo "Waiting for daemon... (attempt $i/30)"
            sleep 1
          done
          echo "Daemon failed to start"
          exit 1

      - name: Run integration tests
        run: cargo test -p hushd --test integration
        env:
          HUSHD_TEST_URL: http://127.0.0.1:9876

      - name: Stop daemon
        if: always()
        run: |
          if [ -f /tmp/hushd.pid ]; then
            kill $(cat /tmp/hushd.pid) 2>/dev/null || true
            rm /tmp/hushd.pid
          fi

  fuzz-check:
    name: Fuzz Smoke (PR)
    runs-on: ubuntu-latest
    needs: security-regressions
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust nightly
        uses: dtolnay/rust-toolchain@nightly

      - name: Install cargo-fuzz
        run: cargo install cargo-fuzz --locked --version 0.13.1

      - name: Build fuzz targets
        run: |
          cd fuzz
          cargo +nightly build

      - name: Run fuzz smoke targets
        run: |
          cd fuzz
          cargo +nightly fuzz run fuzz_policy_parse -- -max_total_time=30
          cargo +nightly fuzz run fuzz_irm_net_parse -- -max_total_time=30
          cargo +nightly fuzz run fuzz_remote_extends_parse -- -max_total_time=30

  typescript-sdk:
    name: TypeScript SDK
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: packages/sdk/hush-ts
    steps:
      - uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '24'
          cache: 'npm'
          cache-dependency-path: |
            packages/sdk/hush-ts/package-lock.json
            packages/adapters/clawdstrike-adapter-core/package-lock.json

      - name: Bootstrap file deps (adapter-core)
        working-directory: packages/adapters/clawdstrike-adapter-core
        run: npm ci

      - name: Build file deps (adapter-core)
        working-directory: packages/adapters/clawdstrike-adapter-core
        run: npm run build

      - name: Install dependencies
        run: npm ci

      - name: Type check
        run: npm run typecheck

      - name: Build
        run: npm run build

      - name: Test
        run: npm test

      - name: Verify package exports
        run: |
          node -e "const sdk = require('./dist/index.cjs'); console.log('CJS exports:', Object.keys(sdk).slice(0, 10))"
          node --input-type=module -e "import * as sdk from './dist/index.js'; console.log('ESM exports:', Object.keys(sdk).slice(0, 10))"

  agent-fail-closed-smoke:
    name: Agent Fail-Closed Smoke
    runs-on: ubuntu-latest
    needs: security-regressions
    steps:
      - uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '24'
          cache: 'npm'
          cache-dependency-path: |
            packages/adapters/clawdstrike-adapter-core/package-lock.json
            packages/adapters/clawdstrike-openai/package-lock.json
            packages/adapters/clawdstrike-claude/package-lock.json
            packages/adapters/clawdstrike-hush-cli-engine/package-lock.json
            packages/adapters/clawdstrike-hushd-engine/package-lock.json

      - name: Install dependencies
        run: |
          npm --prefix packages/adapters/clawdstrike-adapter-core ci
          npm --prefix packages/adapters/clawdstrike-openai ci
          npm --prefix packages/adapters/clawdstrike-claude ci
          npm --prefix packages/adapters/clawdstrike-hush-cli-engine ci
          npm --prefix packages/adapters/clawdstrike-hushd-engine ci

      - name: Build dependencies and adapters
        run: |
          npm --prefix packages/adapters/clawdstrike-adapter-core run build
          npm --prefix packages/adapters/clawdstrike-openai run build
          npm --prefix packages/adapters/clawdstrike-claude run build
          npm --prefix packages/adapters/clawdstrike-hush-cli-engine run build
          npm --prefix packages/adapters/clawdstrike-hushd-engine run build

      - name: Run fail-closed smoke POCs
        run: node tools/scripts/agent-fail-closed-smoke.mjs

      - name: Upload fail-closed smoke report
        if: always()
        uses: actions/upload-artifact@v6
        with:
          name: agent-fail-closed-smoke-report
          path: |
            docs/reports/agent-fail-closed-smoke.json
            docs/reports/agent-fail-closed-smoke.md
          if-no-files-found: error

  openclaw-plugin:
    name: OpenClaw Plugin
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: packages/adapters/clawdstrike-openclaw
    steps:
      - uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '24'
          cache: 'npm'
          cache-dependency-path: packages/adapters/clawdstrike-openclaw/package-lock.json

      - name: Bootstrap file deps (adapter-core)
        working-directory: packages/adapters/clawdstrike-adapter-core
        run: npm ci

      - name: Build file deps (adapter-core)
        working-directory: packages/adapters/clawdstrike-adapter-core
        run: npm run build

      - name: Bootstrap file deps (policy)
        working-directory: packages/policy/clawdstrike-policy
        run: npm ci

      - name: Build file deps (policy)
        working-directory: packages/policy/clawdstrike-policy
        run: npm run build

      - name: Install dependencies
        run: npm ci

      - name: Type check
        run: npm run typecheck

      - name: Build
        run: npm run build

      - name: Test
        run: npm test

      - name: OpenClaw E2E (simulated runtime)
        run: npm run e2e

  clawdstrike-policy:
    name: Canonical Policy Engine (TS)
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: packages/policy/clawdstrike-policy
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo registry
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-policy-parity-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-policy-parity-
            ${{ runner.os }}-cargo-

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '24'
          cache: 'npm'
          cache-dependency-path: |
            packages/policy/clawdstrike-policy/package-lock.json
            packages/adapters/clawdstrike-adapter-core/package-lock.json
            packages/sdk/hush-ts/package-lock.json

      - name: Bootstrap file deps (adapter-core)
        working-directory: packages/adapters/clawdstrike-adapter-core
        run: npm ci

      - name: Build file deps (adapter-core)
        working-directory: packages/adapters/clawdstrike-adapter-core
        run: npm run build

      - name: Build hush CLI (for policy parity)
        working-directory: .
        run: cargo build -p hush-cli --bin hush

      - name: Install dependencies
        run: npm ci

      - name: Type check
        run: npm run typecheck

      - name: Build
        run: npm run build

      - name: Bootstrap file deps (hush-ts)
        working-directory: packages/sdk/hush-ts
        run: npm ci

      - name: Build file deps (hush-ts)
        working-directory: packages/sdk/hush-ts
        run: npm run build

      - name: Policy parity (Rust ↔ TS)
        working-directory: .
        run: node tools/scripts/policy-parity.mjs

      - name: Test
        run: npm test

  agent-framework-integrations:
    name: Agent Framework Integrations (${{ matrix.name }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: Adapter Core
            dir: packages/adapters/clawdstrike-adapter-core
            bootstrap_adapter_core: false
            bootstrap_sdk: false
          - name: Hush CLI Engine
            dir: packages/adapters/clawdstrike-hush-cli-engine
            bootstrap_adapter_core: true
            bootstrap_sdk: false
            bootstrap_hush: true
          - name: OpenAI
            dir: packages/adapters/clawdstrike-openai
            bootstrap_adapter_core: true
            bootstrap_sdk: false
            bootstrap_hush: false
          - name: OpenCode
            dir: packages/adapters/clawdstrike-opencode
            bootstrap_adapter_core: true
            bootstrap_sdk: false
            bootstrap_hush: false
          - name: Claude
            dir: packages/adapters/clawdstrike-claude
            bootstrap_adapter_core: true
            bootstrap_sdk: false
            bootstrap_hush: false
          - name: Vercel AI
            dir: packages/adapters/clawdstrike-vercel-ai
            bootstrap_adapter_core: true
            bootstrap_sdk: true
            bootstrap_hush: false
          - name: LangChain
            dir: packages/adapters/clawdstrike-langchain
            bootstrap_adapter_core: true
            bootstrap_sdk: false
            bootstrap_hush: false
          - name: Hushd Engine
            dir: packages/adapters/clawdstrike-hushd-engine
            bootstrap_adapter_core: true
            bootstrap_sdk: false
            bootstrap_hush: false
    steps:
      - uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '24'
          cache: 'npm'
          cache-dependency-path: ${{ matrix.dir }}/package-lock.json

      - name: Install Rust toolchain
        if: ${{ matrix.bootstrap_hush }}
        uses: dtolnay/rust-toolchain@stable

      - name: Build hush binary
        if: ${{ matrix.bootstrap_hush }}
        run: cargo build -p hush-cli

      - name: Export HUSH_PATH for e2e tests
        if: ${{ matrix.bootstrap_hush }}
        run: echo "HUSH_PATH=${{ github.workspace }}/target/debug/hush" >> "$GITHUB_ENV"

      - name: Bootstrap file deps (adapter-core)
        if: ${{ matrix.bootstrap_adapter_core }}
        working-directory: packages/adapters/clawdstrike-adapter-core
        run: npm ci

      - name: Build file deps (adapter-core)
        if: ${{ matrix.bootstrap_adapter_core }}
        working-directory: packages/adapters/clawdstrike-adapter-core
        run: npm run build

      - name: Bootstrap file deps (sdk)
        if: ${{ matrix.bootstrap_sdk }}
        working-directory: packages/sdk/hush-ts
        run: npm ci

      - name: Build file deps (sdk)
        if: ${{ matrix.bootstrap_sdk }}
        working-directory: packages/sdk/hush-ts
        run: npm run build

      - name: Install dependencies
        working-directory: ${{ matrix.dir }}
        run: npm ci

      - name: Type check
        working-directory: ${{ matrix.dir }}
        run: npm run typecheck

      - name: Build
        working-directory: ${{ matrix.dir }}
        run: npm run build

      - name: Test
        working-directory: ${{ matrix.dir }}
        run: npm test

  parity-tests:
    name: Cross-Language Parity
    runs-on: ubuntu-latest
    needs: check
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo registry
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-parity-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-parity-
            ${{ runner.os }}-cargo-

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '24'

      - name: Bootstrap file deps (adapter-core)
        working-directory: packages/adapters/clawdstrike-adapter-core
        run: npm ci

      - name: Build file deps (adapter-core)
        working-directory: packages/adapters/clawdstrike-adapter-core
        run: npm run build

      - name: Install TS parity deps
        working-directory: packages/adapters/clawdstrike-hush-cli-engine
        run: npm ci

      - name: Run parity tests
        run: scripts/run-parity.sh

  python-sdk:
    name: Python SDK
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: packages/sdk/hush-py
    steps:
      - uses: actions/checkout@v6

      - name: Setup Python
        uses: actions/setup-python@v6
        with:
          python-version: '3.12'
          cache: 'pip'
          cache-dependency-path: packages/sdk/hush-py/pyproject.toml

      - name: Install package (editable)
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e ".[dev]"
          python -m pip install "jsonschema>=4,<5"

      - name: Run CUA roadmap fixture harnesses
        working-directory: ${{ github.workspace }}
        run: |
          python docs/roadmaps/cua/research/verify_cua_migration_fixtures.py
          python docs/roadmaps/cua/research/verify_remote_desktop_policy_matrix.py
          python docs/roadmaps/cua/research/verify_remote_desktop_ruleset_alignment.py
          python docs/roadmaps/cua/research/verify_injection_capabilities.py
          python docs/roadmaps/cua/research/verify_policy_event_mapping.py
          python docs/roadmaps/cua/research/verify_postcondition_probes.py
          python docs/roadmaps/cua/research/verify_remote_session_continuity.py
          python docs/roadmaps/cua/research/verify_envelope_semantic_equivalence.py
          python docs/roadmaps/cua/research/verify_repeatable_latency_harness.py
          python docs/roadmaps/cua/research/verify_verification_bundle.py
          python docs/roadmaps/cua/research/verify_browser_action_policy.py
          python docs/roadmaps/cua/research/verify_session_recording_evidence.py
          python docs/roadmaps/cua/research/verify_orchestration_isolation.py
          python docs/roadmaps/cua/research/verify_cua_policy_evaluation.py
          python docs/roadmaps/cua/research/verify_canonical_adapter_contract.py
          python docs/roadmaps/cua/research/verify_provider_conformance.py
          python docs/roadmaps/cua/research/verify_openclaw_cua_bridge.py
          python docs/roadmaps/cua/research/verify_trycua_connector.py

      - name: Run tests
        run: python -m pytest