chore: roll up security migration changes

.github/PULL_REQUEST_TEMPLATE.md

@@ -14,10 +14,14 @@
 
 Commands actually run, with their outcome:
 
+The feature runner excludes the `tinywallet-client` native integration tests,
+which need the module staged by `scripts/test-e2e.sh`. Use the shell runner on
+Unix and the PowerShell runner on Windows.
+
 - [ ] `cargo fmt --all -- --check`
 - [ ] `cargo clippy --all-targets --all-features -- -D warnings`
 - [ ] `cargo build --all-targets --all-features`
-- [ ] `cargo test --all-features`
+- [ ] `bash scripts/test-features.sh` (or `scripts/test-features.ps1` on Windows)
 
 ## Tests
 

.github/workflows/ci.yml

@@ -21,13 +21,30 @@ jobs:
         [
           {"packages":["tinywallet","tinywallet-crypto"],"all_targets":true,"all_features":true},
           {"packages":["tinywallet-bus"],"features":["wire"]},
+          {"packages":["tinywallet-bus"],"all_targets":true,"all_features":true},
+          {"packages":["tinywallet-client"],"all_targets":true,"all_features":true},
           {"packages":["tinywallet-x402"],"features":["wire","eip712","abi"],"all_targets":true,"no_default_features":true},
+          {"packages":["tinywallet-module"],"all_targets":true,"all_features":true},
           {"packages":["tinywallet-web3"],"all_targets":true}
         ]
       module-e2e-script: scripts/test-e2e.sh
       module-e2e-toolchain: '1.88.0'
       feature-test-script: scripts/test-features.sh
 
+  wallet-ledger-msrv:
+    name: Wallet x402 ledger MSRV
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          submodules: recursive
+      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # stable
+        with:
+          toolchain: '1.88.0'
+      - name: Test the x402 ledger consumer at its minimum Rust version
+        run: cargo test --locked -p tinywallet-x402 --features ledger
+
   wallet-dependency-boundaries:
     name: Wallet dependency boundaries
     runs-on: ubuntu-latest
@@ -43,6 +60,8 @@ jobs:
         run: |
           python3 scripts/check_bus_boundaries_tests.py
           python3 scripts/release_workflow_tests.py
+          python3 scripts/test_reviewed_release_workflow.py
+          python3 scripts/test_native_e2e_topology.py
           python3 scripts/check-bus-boundaries.py
       - name: Implementation crates pull no signing stack
         shell: bash
@@ -71,3 +90,21 @@ jobs:
             echo "quote/ and seams/ must stay free of crypto vocabulary" >&2
             exit 1
           fi
+
+  wallet-storage-contract:
+    name: Wallet storage collection contract
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          submodules: recursive
+      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # stable
+        with:
+          toolchain: '1.88.0'
+      - name: Compile the excluded canonical-type consumer
+        run: cargo test --locked --manifest-path proof-workspaces/storage-contract/Cargo.toml
+      - name: Keep the storage contract's normal/build graph data-only
+        run: |
+          python3 scripts/check_bus_boundaries_tests.py
+          python3 scripts/check-bus-boundaries.py

.github/workflows/release.yml

@@ -2,10 +2,21 @@ name: Release
 on:
   workflow_dispatch:
     inputs:
+      mode:
+        description: Ordinary tag release or reviewed OpenHuman epic release
+        type: choice
+        required: true
+        default: standard
+        options: [standard, reviewed-epic]
       tag:
         description: Existing version tag (vX.Y.Z) committed through a reviewed PR
         type: string
         required: true
+      reviewed_pr:
+        description: Positive canonical PR number for reviewed-epic mode; zero is reserved for the standard path
+        type: string
+        required: false
+        default: '0'
   push:
     tags: ['v*']
 permissions: {}
@@ -33,10 +44,53 @@ jobs:
           echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
   module-release:
     needs: resolve
+    if: github.event_name == 'push' || inputs.mode == 'standard'
     permissions:
       contents: write
     uses: tinyhumansai/.github/.github/workflows/module-release.yml@4adc1080fb495098e7af1aade82ed7e6e3c69bb7
     with:
       tag: ${{ needs.resolve.outputs.tag }}
       version: ${{ needs.resolve.outputs.version }}
       module-crate: tinywallet-module
+
+  validate-reviewed-dispatch:
+    if: github.event_name == 'workflow_dispatch' && inputs.mode == 'reviewed-epic'
+    needs: [resolve]
+    permissions: {}
+    outputs:
+      reviewed_pr: ${{ steps.validate.outputs.reviewed_pr }}
+    runs-on: ubuntu-latest
+    steps:
+      - id: validate
+        env:
+          REVIEWED_PR: ${{ inputs.reviewed_pr }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          [[ "${GITHUB_REPOSITORY:-}" == "tinyhumansai/tinywallet" ]] || {
+            echo "reviewed releases run only in tinyhumansai/tinywallet" >&2
+            exit 2
+          }
+          [[ "${GITHUB_REF:-}" == "refs/heads/epic/8056-modules-wiring" ]] || {
+            echo "reviewed releases run only from epic/8056-modules-wiring" >&2
+            exit 2
+          }
+          [[ "${REVIEWED_PR:-}" =~ ^[1-9][0-9]*$ ]] || {
+            echo "reviewed_pr must be a positive integer" >&2
+            exit 2
+          }
+          printf 'reviewed_pr=%s\n' "$REVIEWED_PR" >> "$GITHUB_OUTPUT"
+
+  module-reviewed-release:
+    if: github.event_name == 'workflow_dispatch' && inputs.mode == 'reviewed-epic'
+    needs: [resolve, validate-reviewed-dispatch]
+    permissions:
+      contents: write
+      pull-requests: read
+      checks: read
+      actions: read
+    uses: tinyhumansai/.github/.github/workflows/module-reviewed-epic-release.yml@6ed83b04aab2d8977ec62e966cb914531e534fa4
+    with:
+      tag: ${{ needs.resolve.outputs.tag }}
+      version: ${{ needs.resolve.outputs.version }}
+      reviewed-pr: ${{ fromJSON(needs.validate-reviewed-dispatch.outputs.reviewed_pr || '0') }}

.gitignore

@@ -1,5 +1,6 @@
 # Build output
 /target/
+/proof-workspaces/storage-contract/target/
 **/*.rs.bk
 *.pdb
 __pycache__/

AGENTS.md

@@ -87,20 +87,26 @@ the crate-wide `Result<T>` from fallible public APIs.
 
 ## Build And Test
 
-Run every command from the repository root. These four are the contract; CI
-runs exactly them, so a green local run should mean a green CI run.
+Run every command from the repository root. CI builds and lints the workspace
+directly. The `tinywallet-client` native integration tests need a staged
+release module, so the feature runner excludes them. Run them with
+`scripts/test-e2e.sh` or `scripts/test-e2e.ps1`.
 
 ```sh
 cargo fmt --all -- --check
 cargo clippy --all-targets --all-features -- -D warnings
 cargo build --all-targets --all-features
-cargo test --all-features
+bash scripts/test-features.sh
 ```
 
 Supporting commands:
 
 - `cargo fmt --all` — format before committing.
 - `cargo test <filter>` — run a focused subset while iterating.
+- `scripts/test-features.sh` (or `scripts/test-features.ps1` on Windows) — run
+  workspace tests excluding `tinywallet-client`, then the client's library
+  tests. A bare `cargo test --all-features` would include native client tests
+  without their staged module and is not the supported full test command.
 - `cargo run --example basic` — run the bundled example.
 - `cargo doc --no-deps --all-features` — build the rustdoc CI also builds with
   `RUSTDOCFLAGS="-D warnings"`.

CONTRIBUTING.md

@@ -15,9 +15,14 @@ git submodule update --init --recursive
 cargo fmt --all -- --check
 cargo clippy --all-targets --all-features -- -D warnings
 cargo build --all-targets --all-features
-cargo test --all-features
+bash scripts/test-features.sh
 ```
 
+On Windows, run `scripts/test-features.ps1`. These runners exclude the
+`tinywallet-client` native integration tests, then run the client's library
+tests. Use `scripts/test-e2e.sh` or `scripts/test-e2e.ps1` for tests that need
+the wallet module staged.
+
 The bundled example should also run:
 
 ```sh
@@ -55,7 +60,7 @@ regardless.
 - [ ] `cargo fmt --all -- --check`
 - [ ] `cargo clippy --all-targets --all-features -- -D warnings`
 - [ ] `cargo build --all-targets --all-features`
-- [ ] `cargo test --all-features`
+- [ ] `bash scripts/test-features.sh` (or `scripts/test-features.ps1` on Windows)
 - [ ] tests added or updated for behavior changes
 - [ ] documentation updated for public API, architecture, or usage changes
 - [ ] the pull request is focused on one logical change