ci: reconcile dev/main + cut over to trunk (#640)

.github/workflows/ci.yml

@@ -10,45 +10,18 @@ name: CI
 
 on:
   push:
-    branches: [main, dev]
+    branches: [main]
   pull_request:
-    branches: [main, dev]
+    branches: [main]
   merge_group:
-    branches: [main, dev]
+    branches: [main]
   workflow_dispatch:
 
 jobs:
-  # ENFORCE: PRs to main must come from dev branch only
-  enforce-main-pr-source:
-    if: github.event_name == 'pull_request' && github.base_ref == 'main'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check PR source branch
-        run: |
-          if [[ "${{ github.head_ref }}" != "dev" ]]; then
-            echo "::error::PRs to main MUST come from the dev branch."
-            echo ""
-            echo "❌ BLOCKED: PR from '${{ github.head_ref }}' to main"
-            echo ""
-            echo "The dev → main workflow exists so that:"
-            echo "  • All changes are tested on dev first"
-            echo "  • Releases are coherent snapshots of dev"
-            echo "  • main is always a subset of dev (no divergence)"
-            echo ""
-            echo "CORRECT WORKFLOW:"
-            echo "  1. Create PR to dev first: gh pr create --base dev"
-            echo "  2. After merge to dev, create release PR:"
-            echo "     gh pr create --base main --head dev --title 'Release'"
-            echo ""
-            exit 1
-          fi
-          echo "✓ PR from dev to main - allowed"
-
-  # Fast quality gates - must pass before anything else
+  # Fast quality gates - must pass before anything else.
+  # Trunk model: PRs target main directly (the dev -> main promotion that caused
+  # release-history divergence is retired). See #640.
   check:
-    # Wait for branch enforcement on PRs to main
-    needs: [enforce-main-pr-source]
-    if: always() && (needs.enforce-main-pr-source.result == 'success' || needs.enforce-main-pr-source.result == 'skipped')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -59,9 +32,27 @@ jobs:
           node-version: 20
           cache: 'npm'
 
+      - name: Setup Rust 1.97.0
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: 1.97.0
+          components: clippy,rustfmt
+
       - name: Install dependencies
         run: npm ci
 
+      - name: Check generated Cluster Protocol artifacts
+        run: npm run protocol:check
+
+      - name: Check Rust formatting
+        run: cargo fmt --all -- --check
+
+      - name: Lint Rust
+        run: cargo clippy --workspace --all-targets -- -D warnings
+
+      - name: Test Rust workspace
+        run: cargo test --workspace
+
       - name: Security audit
         run: npm audit --audit-level=moderate --omit=dev
         continue-on-error: false
@@ -219,10 +210,8 @@ jobs:
 
   release-preflight:
     name: Release preflight
-    needs: [enforce-main-pr-source]
     if: |
       always() &&
-      (needs.enforce-main-pr-source.result == 'success' || needs.enforce-main-pr-source.result == 'skipped') &&
       (
         (github.event_name == 'pull_request' && github.base_ref == 'main') ||
         (github.event_name == 'merge_group' && (

.gitignore

@@ -8,6 +8,7 @@ yarn-error.log*
 # Build output
 dist/
 build/
+/target/
 *.tsbuildinfo
 
 # Environment

.prettierignore

@@ -4,3 +4,4 @@ coverage
 .tsbuildinfo
 .eslintcache
 lib/agent-cli-provider
+protocol/openengine-cluster/v1

AGENTS.md

@@ -21,28 +21,49 @@ Destructive commands (need permission): `zeroshot kill`, `zeroshot clear`, `zero
 
 ## Where to Look
 
-| Concept                  | File                                          |
-| ------------------------ | --------------------------------------------- |
-| Conductor classification | `src/conductor-bootstrap.js`                  |
-| Base templates           | `cluster-templates/base-templates/`           |
-| Message bus              | `src/message-bus.js`                          |
-| Ledger (SQLite)          | `src/ledger.js`                               |
-| Guidance topics          | `src/guidance-topics.js`                      |
-| Guidance mailbox helper  | `src/ledger.js`                               |
-| Guidance live injection  | `src/orchestrator.js`                         |
-| Trigger evaluation       | `src/logic-engine.js`                         |
-| Agent wrapper            | `src/agent-wrapper.js`                        |
-| Providers registry       | `src/providers/index.js`                      |
-| Provider implementations | `src/providers/`                              |
-| Provider engine registry | `src/agent-cli-provider/provider-registry.ts` |
-| Gateway runner           | `src/agent-cli-provider/gateway-runner.ts`    |
-| Gateway tools/policy     | `src/agent-cli-provider/gateway-tools.ts`     |
-| Provider detection       | `lib/provider-detection.js`                   |
-| Provider capabilities    | `src/providers/capabilities.js`               |
-| Start-cluster helper     | `lib/start-cluster.js`                        |
-| Docker mounts/env        | `lib/docker-config.js`                        |
-| Container lifecycle      | `src/isolation-manager.js`                    |
-| Settings                 | `lib/settings.js`                             |
+| Concept                    | File                                                               |
+| -------------------------- | ------------------------------------------------------------------ |
+| Conductor classification   | `src/conductor-bootstrap.js`                                       |
+| Base templates             | `cluster-templates/base-templates/`                                |
+| Message bus                | `src/message-bus.js`                                               |
+| Ledger (SQLite)            | `src/ledger.js`                                                    |
+| Guidance topics            | `src/guidance-topics.js`                                           |
+| Guidance mailbox helper    | `src/ledger.js`                                                    |
+| Guidance live injection    | `src/orchestrator.js`                                              |
+| Trigger evaluation         | `src/logic-engine.js`                                              |
+| Agent wrapper              | `src/agent-wrapper.js`                                             |
+| Providers registry         | `src/providers/index.js`                                           |
+| Provider implementations   | `src/providers/`                                                   |
+| Provider engine registry   | `src/agent-cli-provider/provider-registry.ts`                      |
+| Gateway runner             | `src/agent-cli-provider/gateway-runner.ts`                         |
+| Gateway tools/policy       | `src/agent-cli-provider/gateway-tools.ts`                          |
+| Provider detection         | `lib/provider-detection.js`                                        |
+| Provider capabilities      | `src/providers/capabilities.js`                                    |
+| Start-cluster helper       | `lib/start-cluster.js`                                             |
+| Docker mounts/env          | `lib/docker-config.js`                                             |
+| Container lifecycle        | `src/isolation-manager.js`                                         |
+| Settings                   | `lib/settings.js`                                                  |
+| Cluster wire/domain types  | `crates/openengine-cluster-protocol/`                              |
+| Graph AST/bindings/guards  | `crates/openengine-cluster-protocol/src/graph.rs`                  |
+| Closed payload algebra     | `crates/openengine-cluster-protocol/src/payload.rs`                |
+| Compiled IR/identity       | `crates/openengine-cluster-protocol/src/canonical.rs`              |
+| Artifact receipts          | `crates/openengine-cluster-protocol/src/artifact.rs`               |
+| Graph diagnostics/bounds   | `crates/openengine-cluster-protocol/src/diagnostic.rs`             |
+| Shared wire-value bounds   | `crates/openengine-cluster-protocol/src/value.rs`                  |
+| Cluster dispatch/stdio     | `crates/openengine-cluster-server/`                                |
+| Cluster typed transports   | `crates/openengine-cluster-client/`                                |
+| Cluster fixtures/artifacts | `crates/openengine-cluster-testkit/`                               |
+| Negative graph vectors     | `crates/openengine-cluster-testkit/src/negative_graph_fixtures.rs` |
+| Graph contract prose       | `docs/openengine-cluster-protocol/v1/graph-contract.md`            |
+| Generated graph fixtures   | `protocol/openengine-cluster/v1/fixtures/graph/`                   |
+
+Cluster Protocol Rust types are the source of truth. Files under
+`protocol/openengine-cluster/v1/` are generated projections; update them with
+`cargo run -p openengine-cluster-testkit --bin generate-cluster-protocol -- --write` and
+verify byte-for-byte drift with `npm run protocol:check`. These generator-formatted artifacts
+are excluded from Prettier; never format them independently.
+Graph syntax, payload subtyping, compiled IR, diagnostics, and artifact receipt Rust types are
+authoritative contract types only. They do not provide graph admission, verification, or execution.
 
 The TUI is not included in this release. Use `zeroshot list`, `zeroshot status <id>`,
 and `zeroshot logs <id> -f` or `zeroshot logs <id> -w` for monitoring.
@@ -194,11 +215,11 @@ Docker: fresh git clone in container, credentials mounted, auto-cleanup.
 
 Configurable credential mounts for `--docker` mode. See `lib/docker-config.js`.
 
-| Setting | Type | Default | Description |
+| Setting                | Type          | Default  | Description                                           |
 | ---------------------- | ------------- | -------- | ----------------------------------------------------- | ---------------------------------------- |
-| `dockerMounts` | `Array<string | object>` | `['gh','git','ssh']` | Presets or `{host, container, readonly}` |
-| `dockerEnvPassthrough` | `string[]` | `[]` | Extra env vars (supports `VAR`, `VAR_*`, `VAR=value`) |
-| `dockerContainerHome` | `string` | `/root` | Container home for `$HOME` expansion |
+| `dockerMounts`         | `Array<string | object>` | `['gh','git','ssh']`                                  | Presets or `{host, container, readonly}` |
+| `dockerEnvPassthrough` | `string[]`    | `[]`     | Extra env vars (supports `VAR`, `VAR_*`, `VAR=value`) |
+| `dockerContainerHome`  | `string`      | `/root`  | Container home for `$HOME` expansion                  |
 
 Mount presets: infrastructure presets plus provider ids from `src/agent-cli-provider/provider-registry.ts`.