Implement the Protocol v1 P0-P2 roadmap

.github/workflows/analysis.yml

@@ -0,0 +1,60 @@
+name: Analysis CI
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "adc-analysis/**"
+      - "protocol/v1/**"
+      - "tools/generate_protocol_vectors.mjs"
+      - "tools/validate_protocol_vectors.py"
+      - ".github/workflows/analysis.yml"
+  pull_request:
+    paths:
+      - "adc-analysis/**"
+      - "protocol/v1/**"
+      - "tools/generate_protocol_vectors.mjs"
+      - "tools/validate_protocol_vectors.py"
+      - ".github/workflows/analysis.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: analysis-ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    name: Ruff and offline pipeline tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    defaults:
+      run:
+        working-directory: adc-analysis
+
+    steps:
+      - name: Check out source
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Set up locked Python environment
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: "0.11.26"
+          python-version: "3.13"
+          working-directory: adc-analysis
+          enable-cache: true
+          cache-dependency-glob: adc-analysis/uv.lock
+
+      - name: Install locked dependencies
+        run: uv sync --locked
+
+      - name: Check Python sources
+        run: uv run --frozen ruff check src tests
+
+      - name: Run complete offline pipeline suite
+        run: uv run --frozen python -m unittest discover -s tests -v

.github/workflows/ci.yml

@@ -52,6 +52,13 @@ jobs:
           distribution: temurin
           java-version: "17"
 
+      - name: Validate Protocol v1 and collector contracts
+        run: |
+          python3 tools/catalog.py check
+          python3 tools/catalog_parity.py
+          python3 tools/validate_protocol_vectors.py
+          python3 -m unittest discover -s tools/tests -v
+
       # The wrapper JAR is a binary in the tree; this checks it against Gradle's published
       # checksums so nobody has to take it on faith.
       - name: Validate the Gradle wrapper
@@ -81,10 +88,22 @@ jobs:
             exit 1
           fi
           "$sdkmanager" "$ANDROID_PLATFORM_PACKAGE" "$ANDROID_BUILD_TOOLS_PACKAGE"
-          echo "$(dirname "$sdkmanager")" >> "$GITHUB_PATH"
+          dirname "$sdkmanager" >> "$GITHUB_PATH"
+
+      - name: Test, lint, and build
+        run: >-
+          ./gradlew --no-daemon
+          test testDebugUnitTest lintDebug assembleDebug assembleRelease
+
+      - name: Consume shared Protocol v1 vectors in Kotlin
+        run: >-
+          ./gradlew --no-daemon
+          -I tools/protocol-conformance.init.gradle
+          :core:export:test
+          --tests adc.conformance.ProtocolConformanceTest
 
-      - name: Verify and build
-        run: ./gradlew --no-daemon test testDebugUnitTest lintDebug assembleDebug assembleRelease
+      - name: Enforce collector capability boundary
+        run: python3 tools/collector_assurance.py
 
       - name: Upload debug APK
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

.github/workflows/pages.yml

@@ -1,10 +1,8 @@
 name: Pages
 
-# A denylist, not the allowlist this used to be, because `tests/compat.spec.ts` byte-compares this
-# site's encoder against `researcher-tools` in a JVM. That makes the Kotlin codec an input to the
-# web tests, and naming exactly which Kotlin would mean restating researcher-tools' dependency list
-# here and keeping it in step forever. Running on a core change that turns out to be irrelevant
-# costs two minutes; missing one publishes a site that signs configurations the app then rejects.
+# A denylist keeps the Web authoring surface and shared Protocol corpus in step without duplicating
+# their dependency graph here. The TypeScript conformance suite consumes the same checked-in
+# vectors as Kotlin and Python; this workflow does not build a JVM artifact.
 on:
   push:
     branches:
@@ -52,17 +50,6 @@ jobs:
         with:
           persist-credentials: false
 
-      # The compatibility suite shells out to researcher-tools and builds it if it is missing, so
-      # the byte-match this workflow claims to enforce needs a JVM to be enforceable at all.
-      - name: Set up JDK 17
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
-        with:
-          distribution: temurin
-          java-version: "17"
-
-      - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@0f4528296b4bc09e8ae0fc7be30185a4ab435545 # v6.0.0
-
       - name: Set up pnpm
         uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
@@ -79,15 +66,18 @@ jobs:
         working-directory: web
         run: pnpm install --frozen-lockfile
 
-      # The site signs study configurations, so it publishes only what type-checks and only what
-      # still byte-matches the Kotlin encoder these tests compare against.
+      # The site signs study configurations, so it publishes only what type-checks and consumes
+      # the reproducible shared Protocol v1 corpus without relaxing a hostile vector.
       - name: Type-check
         working-directory: web
         run: pnpm run check
 
       - name: Test
         working-directory: web
-        run: pnpm run test
+        run: |
+          pnpm run test
+          node ../tools/generate_protocol_vectors.mjs --check
+          pnpm exec vitest run --config ../tools/conformance/vitest.config.ts
 
       # A project site is served from /<repo>/, and `svelte.config.js` bakes BASE_PATH into every
       # URL the build emits. No trailing slash: SvelteKit rejects one.

.github/workflows/receiver.yml

@@ -0,0 +1,60 @@
+name: Receiver CI
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "receiver/**"
+      - "protocol/v1/**"
+      - "docs/p0-p2-implementation-contract.md"
+      - ".github/workflows/receiver.yml"
+  pull_request:
+    paths:
+      - "receiver/**"
+      - "protocol/v1/**"
+      - "docs/p0-p2-implementation-contract.md"
+      - ".github/workflows/receiver.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: receiver-ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    name: Type-check, test, and bundle
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Check out source
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with:
+          version: "10.21.0"
+
+      - name: Set up Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "22"
+          cache: pnpm
+          cache-dependency-path: receiver/pnpm-lock.yaml
+
+      - name: Install dependencies
+        working-directory: receiver
+        run: pnpm install --frozen-lockfile
+
+      - name: Verify receiver
+        working-directory: receiver
+        run: |
+          pnpm typecheck
+          pnpm test
+          pnpm build

.github/workflows/release.yml

@@ -102,7 +102,7 @@ jobs:
             exit 1
           fi
           "$sdkmanager" "$ANDROID_PLATFORM_PACKAGE" "$ANDROID_BUILD_TOOLS_PACKAGE"
-          echo "$(dirname "$sdkmanager")" >> "$GITHUB_PATH"
+          dirname "$sdkmanager" >> "$GITHUB_PATH"
 
       - name: Materialize release-signing files
         shell: bash
@@ -129,6 +129,17 @@ jobs:
           -PreleaseVersionName=${{ steps.release_metadata.outputs.version_name }}
           -PreleaseVersionCode=${{ github.run_number }}
 
+      - name: Recheck Protocol v1 and collector contracts
+        run: |
+          python3 tools/catalog.py check
+          python3 tools/catalog_parity.py
+          python3 tools/validate_protocol_vectors.py
+          python3 tools/collector_assurance.py
+          ./gradlew --no-daemon \
+            -I tools/protocol-conformance.init.gradle \
+            :core:export:test \
+            --tests adc.conformance.ProtocolConformanceTest
+
       - name: Verify and package signed APK
         id: signed_apk
         shell: bash

.gitignore

@@ -29,6 +29,10 @@
 hs_err_pid*
 replay_pid*
 
+# Python bytecode and interpreter caches
+__pycache__/
+*.py[cod]
+
 # Kotlin Gradle plugin data, see https://kotlinlang.org/docs/whatsnew20.html#new-directory-for-kotlin-data-in-gradle-projects
 .kotlin/
 
@@ -55,4 +59,4 @@ bin/
 *.keystore
 *.adcexp
 !researcher-tools/examples/INSECURE-demo-signing-private.key
-!researcher-tools/examples/INSECURE-demo-hpke-private.json
+!researcher-tools/examples/INSECURE-demo-hpke-private.key

CITATION.cff

@@ -29,5 +29,5 @@ keywords:
   - android
 license: MIT
 # TODO: update version and date-released at each tagged release.
-version: 1.0.0-rc.2
-date-released: "2026-08-03"
+version: 1.0.0-rc.3
+date-released: "2026-08-05"