chore: promote dev/m1 to develop

.dockerignore

@@ -14,9 +14,6 @@ target/
 /data/
 data/
 
-# Backtest tooling output: large JSON fixtures + Python venv state.
-# Re-collected on demand via `tools/backtest-collect/backtest_collect.py`.
-tools/backtest-collect/fixtures-*.json
 tools/baseline-latency/data/
 tools/**/__pycache__/
 tools/**/*.pyc

.github/actions/rust-setup/action.yml

@@ -1,5 +1,5 @@
 name: rust-setup
-description: Pinned Rust 1.94 + sccache (R2 backend, configured at the workflow env level) + registry-only Swatinem cache shared across jobs.
+description: Pinned Rust 1.94 + sccache (GitHub Actions cache backend, SCCACHE_GHA_ENABLED) + registry-only Swatinem cache shared across jobs.
 
 inputs:
   targets:
@@ -11,7 +11,7 @@ inputs:
   save-if:
     description: >
       May this run WRITE the registry cache? Defaults to always: Swatinem now caches
-      only the small ~/.cargo registry (target/ moved to sccache/R2), and the GHA
+      only the small ~/.cargo registry (target/ moved to sccache over the GitHub Actions cache), and the GHA
       cache is branch-scoped, so a PR saving its own registry warms its re-runs
       without touching the develop baseline. Set false to make a job restore-only.
     default: "true"

.github/workflows/ci.yml

@@ -19,24 +19,14 @@ env:
   # jobs: any per-job RUSTFLAGS delta re-fingerprints the whole graph and every
   # sccache object key, defeating reuse.
   RUSTFLAGS: "-D warnings"
-  # sccache caches individual rustc invocations across jobs AND runs, including the
-  # workspace crates (which Swatinem drops). Requires incremental off. Backed by a
-  # Cloudflare R2 bucket (S3 API), so the cache is shared across jobs, runs, the
-  # Dockerfile build, and the local host sccache — one silo, zero egress cost.
-  # Set at the workflow env level (not the composite) because composite actions
-  # cannot read the `secrets` context. Keys are content-addressed on the full
-  # compiler input, and the sole build.rs (cow-venue) + nexum-macros are
-  # deterministic, so PR builds writing to the shared bucket write correct objects
-  # under correct keys (no poisoning); bound storage with an R2 lifecycle-expiry
-  # rule on the bucket (sccache does not evict cloud backends itself).
+  # sccache caches individual rustc invocations across jobs and runs, including the
+  # workspace crates (which Swatinem drops). Requires incremental off. Backed by the
+  # GitHub Actions cache (SCCACHE_GHA_ENABLED): free, no secrets, and available on
+  # fork pull_request runs, so forks build cached too. The per-repo cache evicts LRU
+  # on its own; a miss degrades to a cold compile, never a build failure.
   RUSTC_WRAPPER: sccache
   CARGO_INCREMENTAL: "0"
-  SCCACHE_BUCKET: shepherd-sccache
-  SCCACHE_ENDPOINT: https://${{ secrets.R2_ACCOUNT_ID }}.r2.cloudflarestorage.com
-  SCCACHE_REGION: auto
-  SCCACHE_S3_KEY_PREFIX: ci/rust-1.94
-  AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-  AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+  SCCACHE_GHA_ENABLED: "true"
 
 jobs:
   fmt:
@@ -78,7 +68,8 @@ jobs:
       - uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
         with:
           tool: nextest
-      # Build all 15 guest module wasms ONCE (release/wasm32-wasip2): the single
+      # Build all 17 guest wasms ONCE (16 modules + the cow adapter,
+      # release/wasm32-wasip2): the single
       # source of truth for guest buildability and the artifacts the integration
       # tests load. Replaces the deleted 9-way build-module matrix, which recompiled
       # the shared wasm dependency graph ~9x cold. Per-module size report folded in;
@@ -87,9 +78,14 @@ jobs:
         run: |
           cargo build --release --target wasm32-wasip2 --locked \
             -p example -p twap-monitor -p ethflow-watcher -p price-alert \
-            -p balance-tracker -p stop-loss -p http-probe \
-            -p clock-reader -p flaky-bomb -p fuel-bomb \
-            -p memory-bomb -p panic-bomb -p slow-host
+            -p balance-tracker -p http-probe -p echo-venue \
+            -p echo-client -p echo-keeper -p clock-reader -p flaky-bomb -p flaky-venue \
+            -p fuel-bomb -p memory-bomb -p panic-bomb -p slow-host
+          # Separate invocation on purpose: unifying `cow-venue/adapter`
+          # into the module build would link the adapter's component
+          # export glue into every keeper module wasm.
+          cargo build --release --target wasm32-wasip2 --locked \
+            -p cow-venue --features cow-venue/adapter
           {
             echo "### module .wasm sizes"
             echo "| module | bytes |"
@@ -143,3 +139,42 @@ jobs:
           CXX_aarch64_unknown_linux_gnu: aarch64-linux-gnu-g++
           AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar
         run: cargo check --workspace --all-features --locked --target aarch64-unknown-linux-gnu
+
+  # Blocking zero-leak gate: host-layer crate graphs stay venue-free, the
+  # runtime Rust sources carry no charter symbol and no privileged router
+  # field, and nexum:host names no foreign WIT package and resolves as a
+  # leaf (scripts/check-venue-agnostic.sh).
+  venue-agnostic:
+    name: venue-agnostic
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: ./.github/actions/rust-setup
+      - uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
+        with:
+          tool: wasm-tools,ripgrep
+      - run: ./scripts/check-venue-agnostic.sh
+
+  # Blocking orderbook-only gate: the CoW venue crate carries no
+  # composable symbol (scripts/check-cow-orderbook-only.sh).
+  cow-orderbook-only:
+    name: cow-orderbook-only
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
+        with:
+          tool: ripgrep
+      - run: ./scripts/check-cow-orderbook-only.sh
+
+  # Blocking dep-sync gate for the transitional three-grouping workspace: every
+  # crate is grouped under nexum/videre/shepherd and depends only within or below
+  # its tier, so no upward edge becomes a circular repo dependency at the carve
+  # (scripts/check-carve-groups.sh, M5 #403).
+  carve-groups:
+    name: carve-groups
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: ./.github/actions/rust-setup
+      - run: ./scripts/check-carve-groups.sh

.gitignore

@@ -32,6 +32,9 @@ skills-lock.json
 
 # Engine runtime state (default state_dir from engine.toml).
 data/
+# Shipped crate data slices are source, not runtime state: keep them.
+!crates/*/data/
+!crates/*/data/**
 
 # E2E automation: rendered configs with embedded RPC keys + script state
 # never get committed.