feat: v5

.github/workflows/integration-celld.yaml

@@ -7,7 +7,7 @@ name: celld (live + e2e-celld)
 #   make -C tests/e2e-celld test
 #   make -C tests/e2e-ui up && make -C tests/e2e-ui up-celld-nats
 #   WATCH=0 WATCH_WORKER=0 make -C tests/e2e-celld run
-#   E2E_UI_ORIGIN=http://localhost:5180 npx --prefix tests/e2e-ui playwright test \
+#   E2E_UI_ORIGIN=http://localhost:8791 npx --prefix tests/e2e-ui playwright test \
 #     todos.user.spec.ts chat.user.spec.ts --project chromium-user
 #
 # Default `cargo test` (quality) still runs fixture-only celld checks and
@@ -25,6 +25,47 @@ env:
   DISTRIBUTED_INTERNAL_SECRET: test-only-internal-secret-change-me-2026
 
 jobs:
+  storage:
+    name: celld SQL transactions and crash recovery
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
+        with:
+          toolchain: stable
+          targets: wasm32-unknown-unknown
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: tests/celld/worker -> tests/celld/worker/target
+          shared-key: celld-storage
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - name: Install test runtimes
+        run: |
+          sudo apt-get update && sudo apt-get install -y sqlite3
+          npm install -g esbuild
+          cargo install worker-build --locked
+          curl -fsSL https://celld.dev/install.sh | sh
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+      - name: Build isolated fault-probe Worker
+        working-directory: tests/celld/worker
+        run: worker-build --release --features storage-conformance
+      - name: Prove SQL atomicity, fencing, autonomous recovery and growth
+        run: node tests/celld/storage-conformance.mjs
+      - name: Retain storage proof results and logs
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: celld-storage-proof
+          path: |
+            /tmp/distributed-cell-storage-*/results.json
+            /tmp/distributed-cell-storage-*/celld-*.log
+          if-no-files-found: ignore
+
   e2e-celld:
     name: e2e-celld workspace tests
     runs-on: ubuntu-latest
@@ -133,12 +174,13 @@ jobs:
           export BIND=127.0.0.1:8791
           export CELLD_URL=http://127.0.0.1:18880
           export NATS_URL=nats://127.0.0.1:14222
-          export AUTH_URL=http://localhost:5180
+          export PUBLIC_ORIGIN=http://localhost:8791
+          export AUTH_URL="$PUBLIC_ORIGIN"
           export AUTH_USE_SECURE_COOKIES=false
           export AUTH_TRUST_HOST=true
           export PUBLIC_E2E_PROFILE=celld-nats
           export UI_BIND=localhost
-          export UI_URL=http://localhost:5180
+          export UI_URL=http://localhost:8791
 
           target/debug/distributed dev tests/e2e-celld \
             > tests/e2e-celld/.ci-distributed-dev.log 2>&1 &
@@ -165,13 +207,13 @@ jobs:
           fi
           grep -F 'lifecycle dev: process api ready http://127.0.0.1:8791' \
             tests/e2e-celld/.ci-distributed-dev.log
-          grep -F 'lifecycle dev: process ui ready http://localhost:5180' \
+          grep -F 'lifecycle dev: process ui ready http://localhost:8791' \
             tests/e2e-celld/.ci-distributed-dev.log
 
           ok=0
           for i in $(seq 1 60); do
             code=$(curl -s -o /dev/null -w '%{http_code}' \
-              "http://localhost:5180/" 2>/dev/null || echo 000)
+              "http://localhost:8791/" 2>/dev/null || echo 000)
             if [ "$code" = "200" ] || [ "$code" = "302" ] || [ "$code" = "303" ]; then
               ok=1
               break
@@ -230,7 +272,7 @@ jobs:
           npx playwright test todos.user.spec.ts chat.user.spec.ts
           --project chromium-user
         env:
-          E2E_UI_ORIGIN: http://localhost:5180
+          E2E_UI_ORIGIN: http://localhost:8791
           E2E_API_ORIGIN: http://127.0.0.1:8791
           CI: true
 

.github/workflows/integration-e2e-ui.yaml

@@ -106,47 +106,56 @@ jobs:
       - name: Start application with Distributed dev
         run: |
           set -euo pipefail
-          export AUTH_URL="${E2E_UI_ORIGIN:-http://localhost:5180}"
+          export PUBLIC_ORIGIN="${E2E_UI_ORIGIN:-http://localhost:8791}"
+          export AUTH_URL="$PUBLIC_ORIGIN"
           export AUTH_USE_SECURE_COOKIES=false
           export AUTH_TRUST_HOST=true
 
           ../../target/debug/distributed dev . > .distributed-dev.log 2>&1 &
           echo $! > .distributed-dev.pid
 
           ok=0
-          for i in $(seq 1 240); do
+          # Match the CLI's bounded cold-runtime + UI readiness budget.
+          for i in $(seq 1 720); do
             if grep -Fq 'lifecycle dev: ready generation=' .distributed-dev.log; then
               ok=1
               break
             fi
             if ! kill -0 "$(cat .distributed-dev.pid)" 2>/dev/null; then
               echo "distributed dev exited before readiness"
               tail -200 .distributed-dev.log
+              ps -eo pid,ppid,etime,stat,comm
               exit 1
             fi
             sleep 0.5
           done
           if [ "$ok" != "1" ]; then
             echo "distributed dev failed to become ready"
             tail -200 .distributed-dev.log
+            # Executable names identify quiet build children without exposing
+            # credentials from process arguments or environment variables.
+            ps -eo pid,ppid,etime,stat,comm
             exit 1
           fi
 
           grep -F 'lifecycle dev: process api ready http://127.0.0.1:8791' .distributed-dev.log
-          grep -F 'lifecycle dev: process ui ready http://localhost:5180' .distributed-dev.log
+          grep -F 'lifecycle dev: process ui ready http://localhost:8791' .distributed-dev.log
           tail -40 .distributed-dev.log
 
       - name: Install Playwright + Chromium
         run: |
           npm install
           npx playwright install chromium --with-deps
 
+      - name: Verify candidate-key SSR and live delivery end to end
+        run: cargo test --manifest-path ../../Cargo.toml --features graphql,sqlite --test graphql_unique_key_live projected_candidate_keys_reach_chromium_over_http_and_websocket -- --ignored --exact --nocapture
+
       - name: Run browser e2e
         run: |
           npm run test:browser
           npm run test:lifecycle-reload
         env:
-          E2E_UI_ORIGIN: http://localhost:5180
+          E2E_UI_ORIGIN: http://localhost:8791
           E2E_API_ORIGIN: http://127.0.0.1:8791
           CI: true
 
@@ -155,9 +164,12 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: e2e-ui-playwright-report
+          # Only the explicit paths below; never include e2e/.auth or env files.
+          include-hidden-files: true
           path: |
             tests/e2e-ui/playwright-report
             tests/e2e-ui/test-results
+            tests/e2e-ui/.distributed-dev.log
           if-no-files-found: ignore
           retention-days: 7
 

.github/workflows/integration-gateway.yaml

@@ -0,0 +1,222 @@
+name: Application gateway
+
+on:
+  pull_request:
+    paths:
+      - 'src/**'
+      - 'distributed_macros/**'
+      - 'Cargo.toml'
+      - 'build.rs'
+      - 'migrations/**'
+      - 'docs/gateway/**'
+      - 'tests/e2e-ui/**'
+      - 'distributed_cli/src/lifecycle/**'
+      - 'tests/e2e-ui/ui/src/auth.ts'
+      - 'tests/e2e-ui/ui/src/lib/server/**'
+      - 'tests/e2e-ui/ui/src/routes/api/auth/**'
+      - 'tests/graphql_identity/**'
+      - 'tests/graphql_causal_transport/**'
+      - 'tests/graphql_query_protocol/**'
+      - 'tests/edge_query_delivery*'
+      - 'js/src/replica/**'
+      - 'js/tests/replica*'
+      - 'tests/gateway*'
+      - 'tests/gateway*/**'
+      - '.github/workflows/integration-gateway.yaml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  contracts:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
+        with:
+          toolchain: stable
+          targets: wasm32-unknown-unknown
+          components: rustfmt, clippy
+      - name: Format contract and fixture sources
+        run: rustfmt --edition 2021 --check src/gateway/mod.rs tests/gateway_routing.rs tests/gateway_extensions.rs tests/gateway-portable/src/lib.rs
+      - name: Test portable routing and adapter contracts
+        run: cargo test --manifest-path tests/gateway-portable/Cargo.toml --locked
+      - name: Check fixture lints
+        run: cargo clippy --manifest-path tests/gateway-portable/Cargo.toml --locked --all-targets -- -D warnings
+      - name: Compile the UI/auth consumer to Wasm
+        run: cargo check --manifest-path tests/gateway-portable/Cargo.toml --locked --target wasm32-unknown-unknown
+      - name: Test and compile portable GraphQL operation policy
+        run: |
+          cargo test --manifest-path tests/gateway-portable/Cargo.toml --locked --features gateway-delivery
+          cargo check --manifest-path tests/gateway-portable/Cargo.toml --locked --features gateway-delivery --target wasm32-unknown-unknown
+          python3 tests/gateway-portable/check_dependencies.py --features gateway-delivery
+      - name: Verify native and Wasm dependency isolation
+        run: python3 tests/gateway-portable/check_dependencies.py
+
+  auth:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
+        with:
+          toolchain: stable
+      - name: Verify gateway and backend identity
+        run: cargo test -p distributed --no-default-features --features gateway,graphql,sqlite --test graphql_identity
+      - name: Install pinned auth fixture dependencies
+        working-directory: tests/gateway-auth
+        run: npm ci
+      - name: Install Chromium
+        working-directory: tests/gateway-auth
+        run: npx playwright install --with-deps chromium
+      - name: Run production Auth.js lifecycle and browser security cases
+        working-directory: tests/gateway-auth
+        run: npm test
+
+  native:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
+        with:
+          toolchain: stable
+          components: clippy
+      - name: Test real native HTTP streams and upgrades
+        run: cargo test --manifest-path tests/gateway-native/Cargo.toml --locked
+      - name: Check native fixture lints
+        run: cargo clippy --manifest-path tests/gateway-native/Cargo.toml --locked --all-targets -- -D warnings
+      - name: Verify UI/auth executor dependency isolation
+        run: python3 tests/gateway-native/check_dependencies.py
+
+  graphql:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
+        with:
+          toolchain: stable
+      - name: Verify embedded and remote GraphQL protocols
+        run: cargo test -p distributed --no-default-features --features gateway-graphql-native,gateway-delivery,sqlite --test gateway_graphql --test gateway_graphql_operation --test graphql_causal_transport --test graphql_query_protocol --test graphql_identity --test graphql_sqlite --test sqlite_repository
+
+      - name: Verify shared query cancellation, expiry and deadlines
+        run: cargo test -p distributed --no-default-features --features gateway-graphql-native,gateway-delivery,sqlite --lib gateway::native::flight::tests
+      - name: Verify shared live replay, expiry, backpressure and teardown
+        run: cargo test -p distributed --no-default-features --features gateway-graphql-native,gateway-delivery,sqlite --lib gateway::native::live::tests
+      - name: Verify transactional cache coverage and Atomic rollback
+        run: |
+          cargo test -p distributed --no-default-features --features gateway-graphql-native,gateway-delivery,sqlite --lib graphql::delivery::versions::tests
+          cargo test -p distributed --no-default-features --features gateway-graphql-native,gateway-delivery,sqlite --lib sqlite_direct_projection_and_ledger_replay_commit_atomically
+
+  freshness:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
+        with:
+          toolchain: stable
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+      - name: Prove primary routing with paused physical standby
+        run: python3 tests/gateway-postgres/run.py
+      - name: Verify client freshness and command protocol
+        run: |
+          npm ci --prefix js
+          npm --prefix js run build
+          node --test js/tests/replica-command-runtime.test.mjs js/tests/replica-protocol.test.mjs js/tests/replica-revalidation.test.mjs js/tests/replica-graphql-transport.test.mjs
+      - name: Verify generated delivery metadata
+        run: cargo test -p distributed_cli client_compiler
+
+  worker:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
+        with:
+          toolchain: stable
+          targets: wasm32-unknown-unknown
+          components: clippy
+      - name: Install pinned local Worker and auth fixtures
+        run: |
+          cargo install worker-build --version 0.8.5 --locked
+          npm ci --prefix tests/gateway-worker
+          npm ci --prefix tests/gateway-auth
+          cd tests/gateway-auth
+          npx playwright install --with-deps chromium
+      - name: Check Wasm build and dependency boundary
+        run: |
+          cargo check --manifest-path tests/gateway-worker/Cargo.toml --locked --target wasm32-unknown-unknown
+          cargo clippy --manifest-path tests/gateway-worker/Cargo.toml --locked --target wasm32-unknown-unknown -- -D warnings
+          python3 tests/gateway-worker/check_dependencies.py
+      - name: Exercise actual workerd HTTP, WebSockets and Auth.js lifecycle
+        run: |
+          node tests/gateway-worker/proxy-runtime.mjs
+          node tests/gateway-worker/run.mjs
+      - name: Measure actual native and workerd origin/client savings
+        run: cargo test --no-default-features --features gateway-graphql-native,gateway-delivery,sqlite --test graphql_query_protocol separate_origin_and_client_savings -- --ignored --nocapture
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: gateway-delivery-load
+          path: tests/gateway-worker/artifacts/load-report.json
+      - name: Prove actual DO coordination, SQL reduction, restart and cancellation
+        run: cargo test --no-default-features --features gateway-graphql-native,gateway-delivery,sqlite --test graphql_query_protocol worker_ -- --ignored --nocapture --test-threads=1
+
+  application:
+    runs-on: ubuntu-latest
+    timeout-minutes: 35
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
+        with:
+          toolchain: stable
+          targets: wasm32-unknown-unknown
+      - name: Install isolated browser fixture
+        run: |
+          cargo install wasm-pack --locked
+          npm ci --prefix tests/gateway-auth
+          npm ci --prefix tests/e2e-ui
+          cd tests/gateway-auth
+          npx playwright install --with-deps chromium
+      - name: Verify explicit application mounts
+        run: cargo test --no-default-features --features graphql,sqlite,application-runtime,gateway --test application_composition --test application_plans --test gateway_mounts
+      - name: Build coherent application and run public-origin browser flows
+        run: node tests/e2e-ui/gateway/run.mjs
+      - name: Verify dev lifecycle and browser flows through the gateway
+        run: GATEWAY_SKIP_BUILD=1 GATEWAY_DEV=1 node tests/e2e-ui/gateway/run.mjs
+      - name: Verify controlled reloads across gateway and application restarts
+        run: GATEWAY_SKIP_BUILD=1 GATEWAY_DEV=1 GATEWAY_LIFECYCLE=1 node tests/e2e-ui/gateway/run.mjs
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: gateway-application
+          path: tests/e2e-ui/gateway/artifacts/