ci(harness): radar layers + anti-false-green gates + cross-SDK protocol conformance

[EfeDurmaz16]

Makes CI catch the bug classes that shipped green before — fabricated-deposit,
fail-open store, compute-budget drain, canonical-JSON divergence, and ~21 harness
tests that were dead in CI. Infra only: no SDK behaviour changes here — the
fixes these gates enforce ship in the per-language PRs.

This PR is intentionally CI/harness-heavy, so a RED CI here is expected, not a
regression. The harness's behaviour + cross-SDK legs drive the per-language SDK
code, so they stay red until the per-language fix PRs merge (merge-order — see
below); this PR is the net that pins them. The three language-agnostic meta-gates
(ci-coverage-gate, matrix-coverage-gate, vector-accounting) are green on their own.

⚠️ Read first — merge order

Gates that encode fixed SDK behaviour go RED on main until the per-language
fix PRs merge (each such leg says so in a comment). Merge the per-language PRs
first, then this. The three language-agnostic meta-gates are green regardless.

What's in it

Area	Adds
Radar L1–L8	metamorphic · concurrency/race · property · mutation (guard meter) · fuzz · on-chain differential · semgrep · reference-oracle differential
Meta-gates (kill dead tests)	ci-coverage-gate — every harness test runs in a workflow or is documented-exempt · matrix-coverage-gate — 118-cell path×outcome matrix · vector-accounting — every vector has a live consumer
Cross-SDK protocol conformance	canonical mpp-tools vectors, full adversarial set, through all 6 SDK runners (go/rust/python/php/lua/ts); per-SDK divergences tracked in KNOWN_RUNNER_DIVERGENCES; hung-runner hard timeout
False-green fixes	Python cap path (was a silent skip) · Go e2e assert-run-count (was passable with 0 payment pairs) · value-binding vectors now actually executed · fail-closed store boot probes
Supply-chain / hygiene	SECURITY.md · publish-guard + repo-hygiene scripts · dependency pins · cargo-mutants config

Cross-SDK bug matrix this surfaced

Running the canonical vectors against every SDK (not just TS, as before) exposed
the same bug family across SDKs — each fixed in that SDK's per-language PR:

SDK	Divergence
go	CRLF-in-description, uppercase-method not rejected
rust / python	empty realm / intent not rejected
ruby	unescaped quote/backslash · deferred (needs ruby-3.3 verify + runner stdin-encoding fix)
php / typescript	conform ✅

Where to look

• Anti-false-green core: harness/test/{ci-coverage-gate,matrix-coverage-gate,vector-accounting}.test.ts
• Cross-SDK: harness/test/protocol-conformance.test.ts + harness/src/protocol/runners/spawn.ts

Verify

cd harness && MPP_CONFORMANCE_LANGUAGES=typescript pnpm exec vitest run \
  test/{ci-coverage-gate,matrix-coverage-gate,vector-accounting,value-binding-verify,boot-policy,compute-budget-caps,protocol-conformance}.test.ts

→ 410 passed / 6 skipped. Surfaced by a multi-agent audit + two independent
second-model review rounds (the second caught 3 issues in the first remediation,
all fixed + re-verified).

[EfeDurmaz16]

@greptile-apps please review

[greptile-apps]

Greptile Summary

This PR installs a comprehensive CI harness enforcement layer — Radar L1–L8 (metamorphic, concurrency, property, mutation, fuzz, on-chain differential, semgrep, oracle-differential), three language-agnostic meta-gates that prevent dead tests from silently passing, and cross-SDK protocol conformance runners that exposed the same codec-bug family (empty realm/intent, CRLF-in-description, unescaped escapes) across Go, Rust, Python, and Ruby. No SDK runtime behaviour changes are included; all changes are in the harness, CI workflows, scripts, and supporting probe fixtures.

• Meta-gates (ci-coverage-gate, matrix-coverage-gate, vector-accounting) prevent future silent-dead-test regressions by requiring every harness/test/*.test.ts file to be either wired in a workflow or explicitly exempted with a reason.
• Cross-SDK conformance promotes the TypeScript-only smoke slice to the full canonical adversarial set run against all six SDK spawned runners, with confirmed divergences tracked in KNOWN_RUNNER_DIVERGENCES per SDK.
• False-green fixes correct a Python cap-path silent-skip, a Go e2e passable-with-zero-pairs guard, value-binding vectors that were authored but never executed, and fail-closed store boot probes that were unproven until this PR.

Confidence Score: 5/5

Safe to merge as a CI/harness-infrastructure PR; no SDK runtime behaviour is changed, and all three language-agnostic meta-gates are confirmed green independently.

The change is purely additive harness infrastructure with no SDK runtime changes. Prior-thread issues are all addressed. The remaining observations are maintenance-quality nits with no effect on runtime correctness or security.

harness/test/protocol-conformance.test.ts — KNOWN_RUNNER_DIVERGENCES.typescript spread copy could silently diverge from KNOWN_TS_DIVERGENCES as SDK fixes land. harness/test/value-binding-verify.test.ts — hardcoded program address and discriminator should stay in sync with generated SDK constants.

Important Files Changed

Filename	Overview
harness/test/protocol-conformance.test.ts	Cross-SDK conformance loop promoted from success-only smoke slice to full canonical+adversarial case set; KNOWN_RUNNER_DIVERGENCES added per SDK; anti-vacuous guard now asserts ≥1 runner in both allowlist and unset modes. KNOWN_RUNNER_DIVERGENCES.typescript is a spread copy of KNOWN_TS_DIVERGENCES rather than a direct reference, creating a maintenance footgun if one set is updated without the other.
harness/src/protocol/runners/spawn.ts	Adds hard timeout per runner process (SIGKILL + runner_error on expiry), settled-flag to prevent double-resolution, and validateRunnerIdentity check enforcing manifest language == reported language/implementation. Logic is sound.
harness/test/ci-coverage-gate.test.ts	New meta-gate ensuring every harness test file is wired in a workflow or explicitly exempted; also asserts top-level permissions blocks on direct non-publish workflows. Stale-exemption inverse check included.
harness/test/value-binding-verify.test.ts	New test driving real TS session verifier with confirmed-but-unrelated mock RPCs to expose fabricated-deposit and distribution-divergence bugs; hardcodes PAYMENT_CHANNELS_PROGRAM_ADDRESS and TOP_UP_DISCRIMINATOR mirroring the generated SDK — fragile if either changes.
harness/test/boot-policy.test.ts	Cross-SDK fail-closed store boot probes for Go, TypeScript, Python; previous issues all addressed per the PR thread. Logic correct.
harness/python-server/mpp-adapter-boot.py	One-shot Python boot probe for MppAdapter fail-closed gate. _free_port() acquires and immediately releases a port; the ready JSON advertises it but nothing ever listens on it — acceptable for this boot-only probe but the phantom port could confuse future maintainers.
harness/scripts/assert-run-count.mjs	New post-run guard ensuring at least N (or exactly N) settlement pair-tests executed per leg; rejects non-positive floors and zero-execution legs. Previous issues resolved.
harness/test/matrix-coverage-gate.test.ts	1260-line protocol path × outcome coverage matrix gate; every cell classified as COVERED, KNOWN_GAP, or NOT_APPLICABLE with live enforcement against schema.ts reject codes and on-disk vector codes.
harness/test/compute-budget-caps.test.ts	Corrects stale Rust and Python file paths for compute-budget constants; Python row promoted from optional:true to optional:false with the corrected path — false-green eliminated.
.github/workflows/ci.yml	Pins all GitHub Action versions to full SHA digests, adds top-level contents:read permissions, adds payment-channels regen-diff gate and hygiene guards. Security posture improved.
harness/semgrep/rules/nonconstant-compare-and-swallow-catch.yaml	New Radar L7 semgrep rules covering non-constant-time secret comparison (TS/Python/Go) and swallow-catch-as-accept patterns; fixtures and both bad/good variants present.
harness/src/protocol/vectors.ts	Adds resource-bound guards on constructed-wire repeat counts and materialized wire length; PROTOCOL_OPERATIONS promoted from a type union to a const array enabling runtime coverage checks.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    subgraph Meta[Meta-gates: language-agnostic, always GREEN]
        A[ci-coverage-gate]
        B[matrix-coverage-gate]
        C[vector-accounting]
    end
    subgraph Conformance[Cross-SDK Protocol Conformance]
        D[canonical vectors]
        E[in-process TS runner]
        F[spawned runners: go/rust/python/php/lua/ts]
        D --> E
        D --> F
    end
    subgraph FG[False-green Fixes]
        G[assert-run-count]
        H[compute-budget-caps]
        I[value-binding-verify]
        J[boot-policy]
    end
    subgraph Radar[Radar L1-L8]
        K[L1-L3: metamorphic/concurrency/property]
        L[L4-L6: mutation/fuzz/on-chain diff]
        M[L7: semgrep fail-open + nonconstant-compare]
        N[L8: oracle differential]
    end
    A --> CI{CI gate}
    B --> CI
    C --> CI
    E --> CI
    F --> CI
    G --> CI
    H --> CI
    I --> CI
    J --> CI
    K --> CI
    L --> CI
    M --> CI
    N --> CI

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    subgraph Meta[Meta-gates: language-agnostic, always GREEN]
        A[ci-coverage-gate]
        B[matrix-coverage-gate]
        C[vector-accounting]
    end
    subgraph Conformance[Cross-SDK Protocol Conformance]
        D[canonical vectors]
        E[in-process TS runner]
        F[spawned runners: go/rust/python/php/lua/ts]
        D --> E
        D --> F
    end
    subgraph FG[False-green Fixes]
        G[assert-run-count]
        H[compute-budget-caps]
        I[value-binding-verify]
        J[boot-policy]
    end
    subgraph Radar[Radar L1-L8]
        K[L1-L3: metamorphic/concurrency/property]
        L[L4-L6: mutation/fuzz/on-chain diff]
        M[L7: semgrep fail-open + nonconstant-compare]
        N[L8: oracle differential]
    end
    A --> CI{CI gate}
    B --> CI
    C --> CI
    E --> CI
    F --> CI
    G --> CI
    H --> CI
    I --> CI
    J --> CI
    K --> CI
    L --> CI
    M --> CI
    N --> CI

Loading

_{Reviews (3): Last reviewed commit: "ci(harness): close R1/R6/R7/R9/R11/R12/R..." | Re-trigger Greptile}

[EfeDurmaz16]

@greptile-apps please re-review — all 6 P2 findings addressed in 983d51e (replies inline).

[EfeDurmaz16]

Thanks — 5/5 confirmed. Addressed the one remaining stylistic note in c474862: removed the unreachable --exact NaN guard (the earlier min NaN check catches it first). All six prior findings were confirmed fixed in 983d51e. Merge order unchanged: this harness/CI layer stays behind the per-language SDK fix PRs as documented.

[EfeDurmaz16]

@lgalabru ready for review — this is the harness/CI base for the per-language re-delivery. The SDK fix PRs stack into it and turn its inherited red green as they land:

• ruby: fix(ruby): MPP replay-store fail-closed + x402 accepted-amount binding (+ #216 hardening) #222 fix(ruby) (Greptile 5/5, Ruby tests green) → refactor(ruby): idiomatic pass (Shopify Ruby + rubystyle) #223 refactor(ruby) stacked on it
• go: fix(go): migrate to solana-go v2 and harden verification #214 (idiomatic + solana-go/v2, re-targeted onto this branch) → fix(go): x402 source-ATA drain guard + canonical-JSON + conformance driver #224 fix(go) stacked on it (closes the Go conformance red)
• rust/python/php/swift/kotlin/lua to follow, same shape

One base note for your call: this branch trails main by one commit — #220 feat(x402)!: align upto channel roles. Because #214's Go depends on #220's roles, #214 currently carries #220's cross-language delta in its diff; that clears the moment this branch is brought up to main. #220 doesn't touch ruby, so #222/#223 are unaffected either way. Happy to merge main in here if you'd like the stacked diffs clean before review.

[EfeDurmaz16]

@greptile-apps please review

[EfeDurmaz16]

Verdict: please fix before merge. Thanks for pushing this harness base; the overall direction is useful, but I found two small blockers before I would be comfortable merging it. One runner manifest currently cannot start, and the x402 conformance dispatch looks broader than the mode capabilities declared for some SDKs. The current GitHub check state is also not diagnostic because the root jobs were cancelled and downstream legs skipped, so I would rerun after these fixes rather than treating that red as the intended merge-order signal.

[EfeDurmaz16]

This points at --example conformance_runner, but the Rust crate only declares protocol_runner; the Rust conformance lane fails before exercising any vectors. Please either point this manifest at the existing runner or add the missing example.

[EfeDurmaz16]

This filters only by intent, so runners like Go/Python still receive verify-x402-transaction vectors even though the capability registry only advertises verify-transaction for them. Please make the manifest/capability model agree or filter by mode so the gate fails on real coverage, not dispatch drift.

[EfeDurmaz16]

Verdict: please fix before merge. I rechecked the current head and the two unresolved runner/dispatch blockers remain reproducible. I also found two additional anti-false-green gaps: the Python boot-policy probe is skipped in CI, and an empty Go coverage profile scores 100%. The live Actions state is still non-diagnostic because root jobs were cancelled and dependent jobs skipped, so please rerun after these are addressed.

[EfeDurmaz16]

boot-policy.test.ts skips Python when uv is absent, but this job does not install uv and no Python-provisioned workflow runs this file, so the Python fail-closed probe remains dead in CI. Please install uv here or run this suite in a Python-provisioned job.

[EfeDurmaz16]

An empty coverage profile is treated as 100%, so a package-selection or instrumentation failure can pass both coverage gates without measuring any code. Please fail when g_total == 0 and add an empty-profile self-test.

[EfeDurmaz16]

disclaimer: i'm not arguing with myself. GPT-5.6 is reviewing the PR.