Stabilize 0.43 security and release readiness

.github/CODEOWNERS

@@ -0,0 +1,14 @@
+# Default ownership
+* @danilkryachko
+
+# Security and release boundaries
+/.github/ @danilkryachko
+/Cargo.toml @danilkryachko
+/Cargo.lock @danilkryachko
+/deny.toml @danilkryachko
+/src/app/http_security.rs @danilkryachko
+/src/app/egress.rs @danilkryachko
+/src/app/mcp_server.rs @danilkryachko
+/src/app/mcp_server/ @danilkryachko
+/src/rag_security.rs @danilkryachko
+/SECURITY.md @danilkryachko

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -2,13 +2,15 @@ name: CI
 
 on:
   push:
+    branches: [main]
   pull_request:
+  merge_group:
 
 permissions:
   contents: read
 
 concurrency:
-  group: ci-${{ github.workflow }}-${{ github.ref }}
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 env:
@@ -17,53 +19,173 @@ env:
   DUKEMEMORY_GEN_PROVIDER: mock
 
 jobs:
+  msrv:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: dtolnay/rust-toolchain@ad7910d95e317a4b12a9a3dfad520f4b409b3ec0 # 1.91.0
+      - name: Check declared minimum Rust version
+        run: cargo check --locked
+
+  platform:
+    name: Platform (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-14, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
+      - name: Check minimal cross-platform build
+        run: cargo check --locked --all-targets --no-default-features
+      - name: Test cross-platform core
+        run: cargo test --locked --no-default-features --bin dukememory
+      - name: Check release sqlite-vec feature set
+        run: cargo check --locked --all-targets --features vec
+
   quality:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
         with:
           components: rustfmt, clippy
+      - name: Cache Cargo
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+            target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: ${{ runner.os }}-cargo-
       - name: Format
         run: cargo fmt --all -- --check
+      - name: Enforce architecture growth budgets
+        run: scripts/architecture-budget.sh
+      - name: Enforce dependency growth budgets
+        run: scripts/dependency-budget.sh
+      - name: Check minimal feature build
+        run: cargo check --locked --all-targets --no-default-features
       - name: Check all targets
-        run: cargo check --all-targets
+        run: cargo check --locked --all-targets
       - name: Clippy
-        run: cargo clippy --all-targets --all-features -- -D warnings
+        run: cargo clippy --locked --all-targets --all-features -- -D warnings
       - name: Test default features
         run: >-
-          cargo test --
+          cargo test --locked --
           --skip v14_6_local_memory_ui_and_http_actions
           --skip v14_9_autonomous_memory_runs_and_rolls_back
+      - name: Run performance regression gate
+        run: cargo test --locked --test performance -- --ignored --nocapture
       - name: Test sqlite-vec native backend
         run: |
-          cargo test --features vec --bin dukememory
-          cargo test --features vec --test cli review_conflicts_links_session_and_vec_status -- --exact
-          cargo test --features vec --test cli sqlite_vec_backend_runs_knn_and_matches_json_fallback -- --exact
-          cargo test --features vec --test cli sqlite_vec_persists_rag_chunk_index -- --exact
+          cargo test --locked --features vec --bin dukememory
+          cargo test --locked --features vec --test cli review_conflicts_links_session_and_vec_status -- --exact
+          cargo test --locked --features vec --test cli sqlite_vec_backend_runs_knn_and_matches_json_fallback -- --exact
+          cargo test --locked --features vec --test cli sqlite_vec_persists_rag_chunk_index -- --exact
       - name: Smoke-test installed vec-enabled binary
         run: |
-          cargo build --features vec
+          cargo build --locked --features vec
           scripts/release-smoke.sh target/debug/dukememory
       - name: Check local generation build
-        run: cargo check --features local-embeddings,local-generation
+        run: cargo check --locked --features local-embeddings,local-generation
 
   extended-http:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
+      - name: Cache Cargo
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+            target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: ${{ runner.os }}-cargo-
       - name: Test extended HTTP compatibility matrix
         run: >-
-          cargo test --test cli
+          cargo test --locked --test cli
           v14_6_local_memory_ui_and_http_actions -- --exact
 
+  mcp-conformance:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
+      - name: Cache Cargo
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+            target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: ${{ runner.os }}-cargo-
+      - name: Build minimal MCP server
+        run: cargo build --locked --no-default-features
+      - name: Run official MCP Streamable HTTP conformance scenarios
+        run: scripts/mcp-conformance.sh target/debug/dukememory
+
   extended-autonomy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
+      - name: Cache Cargo
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+            target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: ${{ runner.os }}-cargo-
       - name: Test autonomous maintenance and rollback matrix
         run: >-
-          cargo test --test cli
+          cargo test --locked --test cli
           v14_9_autonomous_memory_runs_and_rolls_back -- --exact
+
+  release-evidence:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
+      - name: Cache Cargo
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+            target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: ${{ runner.os }}-cargo-
+      - name: Build offline release evidence binary
+        run: cargo build --locked --no-default-features
+      - name: Run reproducible deployment evidence gate
+        run: scripts/release-evidence-gate.sh target/debug/dukememory
+
+  ci-gate:
+    if: always()
+    needs:
+      - msrv
+      - platform
+      - quality
+      - extended-http
+      - mcp-conformance
+      - extended-autonomy
+      - release-evidence
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require every CI job
+        env:
+          NEEDS_JSON: ${{ toJson(needs) }}
+        run: jq -e 'all(.[]; .result == "success")' <<<"${NEEDS_JSON}"

.github/workflows/codeql.yml

@@ -0,0 +1,43 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  merge_group:
+  schedule:
+    - cron: "23 2 * * 4"
+
+permissions:
+  contents: read
+  security-events: write
+
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  rust:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Initialize CodeQL for Rust
+        uses: github/codeql-action/init@f52b05f4acaaa234e44466e66d29050e135ea9ef # v4.36.0
+        with:
+          languages: rust
+          build-mode: none
+      - name: Analyze
+        uses: github/codeql-action/analyze@f52b05f4acaaa234e44466e66d29050e135ea9ef # v4.36.0
+        with:
+          category: /language:rust
+
+  codeql-gate:
+    if: always()
+    needs: [rust]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require CodeQL analysis
+        env:
+          CODEQL_RESULT: ${{ needs.rust.result }}
+        run: test "${CODEQL_RESULT}" = success

.github/workflows/coverage.yml

@@ -0,0 +1,50 @@
+name: Coverage gate
+
+on:
+  pull_request:
+  merge_group:
+  workflow_dispatch:
+  schedule:
+    - cron: "41 4 * * 3"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: coverage-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  coverage:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
+        with:
+          components: llvm-tools-preview
+      - name: Install pinned cargo-llvm-cov
+        run: cargo install cargo-llvm-cov --version 0.8.6 --locked
+      - name: Enforce line coverage floor
+        run: >-
+          cargo llvm-cov --locked --features vec
+          --lcov --output-path lcov.info --fail-under-lines 55 --
+          --skip v14_6_local_memory_ui_and_http_actions
+          --skip v14_9_autonomous_memory_runs_and_rolls_back
+      - name: Enforce critical-module coverage floors
+        run: scripts/coverage-budget.sh lcov.info
+      - name: Upload coverage report
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: lcov-${{ github.sha }}
+          path: lcov.info
+
+  coverage-gate:
+    if: always()
+    needs: [coverage]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require coverage enforcement
+        env:
+          COVERAGE_RESULT: ${{ needs.coverage.result }}
+        run: test "${COVERAGE_RESULT}" = success

.github/workflows/fuzz.yml

@@ -0,0 +1,55 @@
+name: Fuzz smoke tests
+
+on:
+  pull_request:
+  merge_group:
+  schedule:
+    - cron: "17 3 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fuzz-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  fuzz:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [mcp_content_length, http_framing, rag_prompt_injection, sync_payload, egress_url]
+    env:
+      CARGO_FUZZ_VERSION: 0.13.2
+      FUZZ_TIME: ${{ github.event_name == 'schedule' && '300' || '30' }}
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # nightly
+        with:
+          toolchain: nightly
+      - name: Install pinned cargo-fuzz
+        run: cargo install cargo-fuzz --version "${CARGO_FUZZ_VERSION}" --locked
+      - name: Build fuzz target
+        run: cargo fuzz build "${{ matrix.target }}"
+      - name: Run bounded fuzz smoke test
+        run: cargo fuzz run "${{ matrix.target }}" -- -max_total_time="${FUZZ_TIME}"
+      - name: Upload crash artifacts
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: fuzz-${{ matrix.target }}-${{ github.sha }}
+          path: fuzz/artifacts
+          if-no-files-found: ignore
+
+  fuzz-gate:
+    if: always()
+    needs: [fuzz]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require every fuzz target
+        env:
+          FUZZ_RESULT: ${{ needs.fuzz.result }}
+        run: test "${FUZZ_RESULT}" = success