fix(ffi): pin musl toolchain, fix builtins default-features, bundle cel + valkey

- release-ffi.yaml: install the Rust toolchain with @1.96.0 (matching
  rust-toolchain.toml) instead of @stable. @stable added the musl target to
  the stable toolchain, but the repo override forced 1.96.0 at build time, so
  the cross target was missing (E0463: can't find crate for core). The two
  musl legs failed; gnu/darwin (host targets) passed.
- Cargo.toml: set default-features = false on the cpex-builtins workspace
  dependency. Members declared default-features = false but it was being
  ignored (the inherited workspace entry didn't specify it), so cpex-builtins
  built with all defaults. This restores cpex's granular jwt/oauth/... feature
  subsetting and clears the 'default-features is ignored' warning.
- cpex-ffi: bundle both PDPs (cedar-direct + cel) and the Valkey session store
  in the default .a; drop the now-redundant opt-in valkey feature. Factory
  registration is feature-driven via cpex-builtins, so no code wiring needed.

Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>

Author: araujof

.github/workflows/release-ffi.yaml

@@ -63,9 +63,13 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Install Rust toolchain
-        # dtolnay/rust-toolchain is the de-facto rustup action.
-        # `stable` picks the latest stable; pin if we need a floor.
-        uses: dtolnay/rust-toolchain@stable
+        # Pin to the same toolchain as rust-toolchain.toml (1.96.0). Using
+        # @stable here installs the matrix target onto `stable`, but the
+        # repo's rust-toolchain.toml overrides cargo to 1.96.0 at build time,
+        # so the cross (musl) target ends up missing on the toolchain actually
+        # used (E0463: can't find crate for `core`). Pinning installs the
+        # target onto 1.96.0 directly. Mirrors the other workflows.
+        uses: dtolnay/rust-toolchain@1.96.0
         with:
           targets: ${{ matrix.target }}
 

Cargo.toml

@@ -105,7 +105,7 @@ regex = "1"
 cpex-core                     = { path = "crates/cpex-core",                   version = "0.2.0-alpha.5" }
 cpex-orchestration            = { path = "crates/cpex-orchestration",          version = "0.2.0-alpha.5" }
 cpex-sdk                      = { path = "crates/cpex-sdk",                     version = "0.2.0-alpha.5" }
-cpex-builtins                 = { path = "crates/cpex-builtins",               version = "0.2.0-alpha.5" }
+cpex-builtins                 = { path = "crates/cpex-builtins",               version = "0.2.0-alpha.5", default-features = false }
 apl-core                      = { path = "crates/apl-core",                    version = "0.2.0-alpha.5" }
 apl-cmf                       = { path = "crates/apl-cmf",                      version = "0.2.0-alpha.5" }
 apl-cpex                      = { path = "crates/apl-cpex",                     version = "0.2.0-alpha.5" }

crates/cpex-ffi/Cargo.toml

@@ -33,14 +33,18 @@ apl-cpex = { workspace = true }
 # cpex-builtins, whose `register_builtins` expands to explicit
 # `register_factory` calls — so the factory symbols survive in the
 # staticlib (no inventory/linkme link-section GC hazard). The feature set
-# below is the exact bundle the default `.a` ships: four hook plugins plus
-# the cedar-direct PDP (note: NOT `cel`, matching the prior footprint).
+# below is the exact bundle the default `.a` ships: four hook plugins, both
+# bundled PDPs (cedar-direct and cel), and the Valkey session store. Valkey
+# pulls a redis client + rustls TLS stack, so it adds materially to the `.a`
+# size and to the musl cross-build surface.
 cpex-builtins = { workspace = true, default-features = false, features = [
     "pii-scanner",
     "audit-logger",
     "identity-jwt",
     "delegator-oauth",
     "cedar-direct",
+    "cel",
+    "valkey",
 ] }
 tokio = { workspace = true }
 serde = { workspace = true }
@@ -50,11 +54,9 @@ serde_bytes = { workspace = true }
 tracing = { workspace = true }
 
 [features]
+# No opt-in features: the bundled set (including the Valkey session store) is
+# fixed in the cpex-builtins dependency above.
 default = []
-# Opt-in Valkey-backed SessionStore (redis client + rustls TLS stack).
-# Routed through cpex-builtins so the `.a` artifact size is unaffected
-# without the feature. Build with `cargo build -p cpex-ffi --features valkey`.
-valkey = ["cpex-builtins/valkey"]
 
 [dev-dependencies]
 async-trait = { workspace = true }

crates/cpex-ffi/src/apl.rs

@@ -41,11 +41,15 @@ use crate::{CpexManagerInner, RC_INVALID_HANDLE, RC_OK, RC_PANIC};
 ///   - `identity/jwt`        → identity-jwt
 ///   - `delegator/oauth`     → delegator-oauth
 ///
-/// Bundled PDP factory (consulted for `global.apl.pdp[]` entries):
+/// Bundled PDP factories (consulted for `global.apl.pdp[]` entries):
 ///   - `cedar-direct`        → cedar-direct
+///   - `cel`                 → cel
 ///
-/// With the `valkey` cargo feature, the Valkey-backed session store factory
-/// is additionally wired.
+/// Bundled session store factory (consulted for `global.apl.session_store`):
+///   - `valkey`              → Valkey-backed SessionStore
+///
+/// The default in-process `MemorySessionStore` stays active unless the config
+/// selects a `session_store`.
 ///
 /// Returns `RC_OK` on success, `RC_INVALID_HANDLE` if `mgr` is null, or
 /// `RC_PANIC` if registration panicked (caught at the FFI boundary).
@@ -69,10 +73,10 @@ pub unsafe extern "C" fn cpex_apl_install(mgr: *const CpexManagerInner) -> c_int
 
         // APL config visitor + PDP / session-store factories. The factory
         // sets are consulted for `global.apl.pdp[]` and
-        // `global.apl.session_store` entries; cedar-direct is the bundled
-        // PDP default and the Valkey store is wired when the `valkey`
-        // feature is on (otherwise the lists are empty and the in-process
-        // MemorySessionStore default stays active). The visitor keeps a
+        // `global.apl.session_store` entries; cedar-direct and cel are the
+        // bundled PDPs and the Valkey session-store factory is bundled too.
+        // Unless the config selects a `session_store`, the in-process
+        // MemorySessionStore default stays active. The visitor keeps a
         // Weak<PluginManager> (see CpexManagerInner) that upgrades during
         // load_config_yaml.
         let mut opts = apl_cpex::AplOptions::in_process();