Skip to content

Commit 98f151f

Browse files
MapleEveMapleEve
authored
feat: add Rust kernel bridge foundation
Add the Rust core bridge foundation, provider capability metadata, Rust kernel mode configuration, release/Docker wheel packaging, heavy gate validation, and the python-multipart security floor update.
1 parent 7b49fb0 commit 98f151f

26 files changed

Lines changed: 906 additions & 15 deletions

‎.env.example‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,13 @@ FFMPEG_TIMEOUT_SEC=1800
4242
# with the most free memory.
4343
MODEL_IDLE_TIMEOUT_SEC=180
4444

45+
# Runtime mode for optional Rust-backed provider/kernel paths.
46+
# off — default; use Python implementations.
47+
# required — selected Rust-backed paths must run and hard-fail on import/call errors.
48+
# CI/Docker packaging still validates the Rust extension directly even when
49+
# the runtime default is off.
50+
RUST_KERNEL_MODE=off
51+
4552
# UID/GID the container process runs as. Must match the owner of DATA_DIR
4653
# and MODEL_CACHE_DIR on the host, otherwise writes fail. On a typical
4754
# Linux host `id -u` / `id -g` is 1000, which is the default.

‎.github/workflows/claude-code-review.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ name: Claude Code Review
22

33
on:
44
pull_request:
5-
types: [opened, synchronize, reopened, ready_for_review]
5+
types: [opened, reopened, ready_for_review]
66
branches: [main]
77

88
permissions:

‎.github/workflows/fossa.yml‎

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -22,22 +22,16 @@ jobs:
2222
run: echo "FOSSA_API_KEY is not configured; skipping FOSSA scan."
2323
- uses: actions/checkout@v4
2424
if: ${{ env.FOSSA_API_KEY != '' }}
25+
with:
26+
ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
2527
- name: Run FOSSA scan
2628
if: ${{ env.FOSSA_API_KEY != '' }}
2729
uses: fossas/fossa-action@v1.9.0
2830
with:
2931
api-key: ${{ secrets.FOSSA_API_KEY }}
3032
pinned-cli-version: v3.17.1
31-
- name: Run FOSSA diff test
32-
if: ${{ env.FOSSA_API_KEY != '' && github.event_name == 'pull_request' }}
33-
uses: fossas/fossa-action@v1.9.0
34-
with:
35-
api-key: ${{ secrets.FOSSA_API_KEY }}
36-
pinned-cli-version: v3.17.1
37-
run-tests: true
38-
test-diff-revision: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || '' }}
3933
- name: Run FOSSA policy test
40-
if: ${{ env.FOSSA_API_KEY != '' && github.event_name != 'pull_request' }}
34+
if: ${{ env.FOSSA_API_KEY != '' }}
4135
uses: fossas/fossa-action@v1.9.0
4236
with:
4337
api-key: ${{ secrets.FOSSA_API_KEY }}

‎.github/workflows/release.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,36 @@ jobs:
1919
- name: Checkout repository
2020
uses: actions/checkout@v4
2121

22+
- name: Set up Python
23+
uses: actions/setup-python@v5
24+
with:
25+
python-version: "3.11"
26+
cache: pip
27+
28+
- name: Install Rust toolchain
29+
run: rustup toolchain install stable --profile minimal
30+
31+
- name: Install maturin
32+
run: python -m pip install "maturin>=1.13,<2"
33+
34+
- name: Build Rust wheel
35+
run: python -m maturin build --release --manifest-path crates/voscript_core/Cargo.toml --features extension-module --out dist
36+
37+
- name: Stage Rust wheel for Docker context
38+
id: wheel
39+
run: |
40+
set -euo pipefail
41+
mkdir -p app/.wheelhouse
42+
wheel_count="$(find dist -maxdepth 1 -name 'voscript_core-*.whl' | wc -l | tr -d ' ')"
43+
if [ "$wheel_count" != "1" ]; then
44+
echo "Expected exactly one voscript_core wheel, found $wheel_count" >&2
45+
find dist -maxdepth 1 -type f >&2
46+
exit 1
47+
fi
48+
wheel_path="$(find dist -maxdepth 1 -name 'voscript_core-*.whl' -print -quit)"
49+
cp "$wheel_path" app/.wheelhouse/
50+
echo "name=$(basename "$wheel_path")" >> "$GITHUB_OUTPUT"
51+
2252
- name: Set up Docker Buildx
2353
uses: docker/setup-buildx-action@v3
2454

@@ -56,6 +86,8 @@ jobs:
5686
context: ./app
5787
platforms: linux/amd64
5888
push: true
89+
build-args: |
90+
VOSCRIPT_CORE_WHEEL=${{ steps.wheel.outputs.name }}
5991
tags: ${{ steps.tags.outputs.tags }}
6092
cache-from: type=gha
6193
cache-to: type=gha,mode=max

‎.github/workflows/rust-foundation-heavy.yml‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
name: Rust Foundation Heavy Gate
2+
3+
on:
4+
pull_request:
5+
types: [opened, reopened, ready_for_review]
6+
branches: [main]
7+
push:
8+
branches: [main]
9+
workflow_dispatch:
10+
inputs:
11+
ref:
12+
description: "Branch, tag, or SHA to test. Defaults to the selected ref."
13+
required: false
14+
type: string
15+
16+
permissions:
17+
contents: read
18+
19+
env:
20+
PYTHON_VERSION: "3.11"
21+
RUST_KERNEL_MODE: required
22+
23+
jobs:
24+
rust-wheel:
25+
name: rust-wheel
26+
runs-on: ubuntu-latest
27+
outputs:
28+
wheel-name: ${{ steps.wheel.outputs.name }}
29+
steps:
30+
- name: Checkout repository
31+
uses: actions/checkout@v4
32+
with:
33+
ref: ${{ github.event.inputs.ref || github.ref }}
34+
35+
- name: Set up Python
36+
uses: actions/setup-python@v5
37+
with:
38+
python-version: ${{ env.PYTHON_VERSION }}
39+
cache: pip
40+
41+
- name: Install Rust toolchain
42+
run: rustup toolchain install stable --profile minimal
43+
44+
- name: Install maturin
45+
run: python -m pip install "maturin>=1.13,<2"
46+
47+
- name: Check Rust formatting
48+
run: cargo fmt --manifest-path crates/voscript_core/Cargo.toml -- --check
49+
50+
- name: Run Rust clippy
51+
run: cargo clippy --manifest-path crates/voscript_core/Cargo.toml --all-targets -- -D warnings
52+
53+
- name: Run Rust tests
54+
run: cargo test --manifest-path crates/voscript_core/Cargo.toml
55+
56+
- name: Build Rust wheel
57+
run: python -m maturin build --release --manifest-path crates/voscript_core/Cargo.toml --features extension-module --out dist
58+
59+
- name: Verify wheel artifact
60+
id: wheel
61+
run: |
62+
set -euo pipefail
63+
wheel_count="$(find dist -maxdepth 1 -name 'voscript_core-*.whl' | wc -l | tr -d ' ')"
64+
if [ "$wheel_count" != "1" ]; then
65+
echo "Expected exactly one voscript_core wheel, found $wheel_count" >&2
66+
find dist -maxdepth 1 -type f >&2
67+
exit 1
68+
fi
69+
wheel_path="$(find dist -maxdepth 1 -name 'voscript_core-*.whl' -print -quit)"
70+
echo "name=$(basename "$wheel_path")" >> "$GITHUB_OUTPUT"
71+
72+
- name: Upload internal wheel artifact
73+
uses: actions/upload-artifact@v4
74+
with:
75+
name: voscript-core-wheel
76+
path: dist/voscript_core-*.whl
77+
if-no-files-found: error
78+
retention-days: 1
79+
80+
docker-packaging:
81+
name: docker-packaging
82+
runs-on: ubuntu-latest
83+
needs: rust-wheel
84+
steps:
85+
- name: Checkout repository
86+
uses: actions/checkout@v4
87+
with:
88+
ref: ${{ github.event.inputs.ref || github.ref }}
89+
90+
- name: Download internal wheel artifact
91+
uses: actions/download-artifact@v4
92+
with:
93+
name: voscript-core-wheel
94+
path: app/.wheelhouse
95+
96+
- name: Verify downloaded wheel
97+
run: |
98+
set -euo pipefail
99+
test -f "app/.wheelhouse/${{ needs.rust-wheel.outputs.wheel-name }}"
100+
101+
- name: Build Docker image with Rust extension
102+
run: |
103+
docker build ./app \
104+
--build-arg "VOSCRIPT_CORE_WHEEL=${{ needs.rust-wheel.outputs.wheel-name }}" \
105+
-t voscript-rust-foundation:${{ github.sha }}
106+
107+
- name: Run container extension smoke
108+
run: |
109+
docker run --rm \
110+
-e RUST_KERNEL_MODE=required \
111+
voscript-rust-foundation:${{ github.sha }} \
112+
python -c "from providers.kernel_bridge import core_smoke; result = core_smoke({'source': 'ci'}); assert result['ok'] is True; assert result['echoed']['source'] == 'ci'"
113+
114+
- name: Run health check smoke
115+
run: |
116+
set -euo pipefail
117+
cid="$(docker run -d -e DEVICE=cpu -e ALLOW_NO_AUTH=1 voscript-rust-foundation:${{ github.sha }})"
118+
trap 'docker logs "$cid" || true; docker rm -f "$cid" >/dev/null 2>&1 || true' EXIT
119+
for _ in $(seq 1 60); do
120+
if docker exec "$cid" python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8780/healthz', timeout=2).read()" >/dev/null 2>&1; then
121+
exit 0
122+
fi
123+
sleep 2
124+
done
125+
echo "Container did not pass /healthz smoke in time" >&2
126+
exit 1

‎.gitignore‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ __pycache__/
1717
.venv/
1818
venv/
1919
.pytest_cache/
20+
dist/
2021

2122
# Editor
2223
.vscode/
@@ -66,3 +67,9 @@ CLAUDE.local.md
6667

6768
# Git worktrees
6869
.worktrees/
70+
71+
# Rust / native extension build artifacts
72+
target/
73+
crates/*/target/
74+
app/.wheelhouse/*.whl
75+
!app/.wheelhouse/.gitkeep

‎Cargo.lock‎

Lines changed: 133 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Cargo.toml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
[workspace]
2+
members = ["crates/voscript_core"]
3+
resolver = "2"
4+

‎app/.wheelhouse/.gitkeep‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+

0 commit comments

Comments
 (0)