review(1/3): traceability, native prerequisites and early contract repairs

.github/workflows/headless-embedding-contract.yml

@@ -25,7 +25,12 @@ jobs:
         uses: Swatinem/rust-cache@v2
 
       - name: Install C# UniFFI generator
-        run: cargo install uniffi-bindgen-cs --version 0.9.0 --locked
+        # Official v0.9.0+v0.28.3 source; this version is not on crates.io.
+        run: >-
+          cargo install uniffi-bindgen-cs
+          --git https://github.com/NordSecurity/uniffi-bindgen-cs
+          --rev 2f4880f03ed08d960ad0ee14d11cf95444eee540
+          --locked
 
       - name: Run workflow service tests
         run: cargo test -p pantograph-workflow-service

.github/workflows/quality-gates.yml

@@ -20,6 +20,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Install Node toolchain
         uses: actions/setup-node@v4
@@ -30,7 +32,36 @@ jobs:
       - name: Install npm dependencies
         run: npm ci --include=optional
 
+      - name: Test decision traceability gate
+        run: node --test scripts/check-decision-traceability.test.mjs
+
+      - name: Resolve explicit traceability range
+        id: traceability-range
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          EVENT_BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
+          EVENT_HEAD: ${{ github.event.pull_request.head.sha || github.sha }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          base="$(git rev-parse --verify --end-of-options "${EVENT_BASE}^{commit}")"
+          head="$(git rev-parse --verify --end-of-options "${EVENT_HEAD}^{commit}")"
+          if [[ "$EVENT_NAME" == pull_request ]]; then
+            # The PR owns changes since its fork point, not reverse changes
+            # from an independently advanced target branch.
+            base="$(git merge-base --all "$base" "$head")"
+            if [[ -z "$base" || "$base" == *$'\n'* ]]; then
+              echo "Traceability requires one unambiguous PR merge base" >&2
+              exit 1
+            fi
+          fi
+          printf 'base=%s\nhead=%s\n' "$base" "$head" >> "$GITHUB_OUTPUT"
+
       - name: Run no-new-debt lint gate
+        env:
+          TRACEABILITY_MODE: range
+          TRACEABILITY_BASE_REF: ${{ steps.traceability-range.outputs.base }}
+          TRACEABILITY_HEAD_REF: ${{ steps.traceability-range.outputs.head }}
         run: npm run lint:no-new
 
   typecheck:
@@ -97,21 +128,8 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install Ubuntu native desktop dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y \
-            build-essential \
-            libayatana-appindicator3-dev \
-            libglib2.0-dev \
-            libgtk-3-dev \
-            libjavascriptcoregtk-4.1-dev \
-            librsvg2-dev \
-            libsoup-3.0-dev \
-            libssl-dev \
-            libwebkit2gtk-4.1-dev \
-            libxdo-dev \
-            pkg-config
+      - name: Install Ubuntu native build dependencies
+        run: ./scripts/install-ubuntu-build-dependencies.sh
 
       - name: Checkout Pumas-Library
         uses: actions/checkout@v4
@@ -160,10 +178,18 @@ jobs:
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@1.92.0
+        with:
+          components: clippy
 
       - name: Cache Cargo
         uses: Swatinem/rust-cache@v2
 
+      - name: Run scheduler contract and accessor compatibility tests
+        run: cargo test -p pantograph-scheduler
+
+      - name: Check scheduler standard-trait accessor lint
+        run: cargo clippy -p pantograph-scheduler --all-targets -- -D clippy::should_implement_trait
+
       - name: Run node-engine tests
         run: cargo test -p node-engine --lib
 
@@ -292,21 +318,8 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install Ubuntu native desktop dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y \
-            build-essential \
-            libayatana-appindicator3-dev \
-            libglib2.0-dev \
-            libgtk-3-dev \
-            libjavascriptcoregtk-4.1-dev \
-            librsvg2-dev \
-            libsoup-3.0-dev \
-            libssl-dev \
-            libwebkit2gtk-4.1-dev \
-            libxdo-dev \
-            pkg-config
+      - name: Install Ubuntu native build dependencies
+        run: ./scripts/install-ubuntu-build-dependencies.sh
 
       - name: Checkout Pumas-Library
         uses: actions/checkout@v4

.github/workflows/runtime-separation-check.yml

@@ -13,6 +13,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Install Ubuntu native build dependencies
+        run: ./scripts/install-ubuntu-build-dependencies.sh
+
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@1.92.0
 

bindings/beam/pantograph_native_smoke/README.md

@@ -38,6 +38,11 @@ The same runner is used by the required `Rustler BEAM smoke` job in
 - The local `Pantograph.Native` shim defines generated NIF stubs for the full
   default Rustler export surface so `:erlang.load_nif/2` can load the compiled
   library before individual smoke tests call the narrower contract under test.
+  This includes the package-facts snapshot (arity 3), individual summary (arity 2),
+  and update-cursor query (arity 3) exports. Their stubs permit native loading;
+  this smoke harness does not claim model-library query behavior coverage.
+  The seven `frontend-http` exports are feature-gated and outside this default
+  build's export surface.
 - This harness now also pins a backend-owned validation error path by
   asserting that unknown edge endpoints round-trip back to BEAM as validation
   strings through `workflow_validate/1`.

bindings/beam/pantograph_native_smoke/lib/pantograph/native.ex

@@ -58,6 +58,9 @@ defmodule Pantograph.Native do
     {:pumas_list_models, 1},
     {:pumas_search_models, 4},
     {:pumas_get_model, 2},
+    {:pumas_model_package_facts_summary_snapshot, 3},
+    {:pumas_resolve_model_package_facts_summary, 2},
+    {:pumas_list_model_library_updates_since, 3},
     {:pumas_rebuild_index, 1},
     {:pumas_search_hf, 4},
     {:pumas_get_repo_files, 2},

bindings/beam/pantograph_native_smoke/test/pantograph_native_smoke_test.exs

@@ -20,13 +20,16 @@ defmodule PantographNativeSmokeTest do
   test "workflow_validate returns edge-reference errors for unknown nodes" do
     graph_json =
       Pantograph.Native.workflow_new("beam-invalid", "BEAM Invalid")
-      |> Pantograph.Native.workflow_add_edge("missing-source", "out", "missing-target", "in")
+      |> Pantograph.Native.workflow_add_node("known-source", "text-input", 0.0, 0.0, "{}")
+      |> Pantograph.Native.workflow_add_node("known-target", "text-output", 100.0, 0.0, "{}")
+      |> Pantograph.Native.workflow_add_edge("missing-source", "text", "known-target", "text")
+      |> Pantograph.Native.workflow_add_edge("known-source", "text", "missing-target", "text")
 
     errors = Pantograph.Native.workflow_validate(graph_json)
 
     assert is_list(errors)
-    assert Enum.any?(errors, &String.contains?(&1, "unknown node 'missing-source'"))
-    assert Enum.any?(errors, &String.contains?(&1, "unknown node 'missing-target'"))
+    assert Enum.any?(errors, &String.contains?(&1, "unknown source node 'missing-source'"))
+    assert Enum.any?(errors, &String.contains?(&1, "unknown target node 'missing-target'"))
   end
 
   test "workflow_from_json returns parse errors as BEAM tuples" do
@@ -57,6 +60,7 @@ defmodule PantographNativeSmokeTest do
     queryable = Pantograph.Native.node_registry_queryable_ports(registry)
 
     assert String.contains?(queryable, ~s("node_type":"puma-lib"))
-    assert String.contains?(queryable, ~s("port_id":"model_path"))
+    assert String.contains?(queryable, ~s("port_id":"pumas_model_ref"))
+    refute String.contains?(queryable, ~s("port_id":"model_path"))
   end
 end

bindings/csharp/Pantograph.DirectRuntimeQuickstart/Program.cs

@@ -29,6 +29,7 @@
 
     if (args.Contains("--run-session", StringComparer.Ordinal))
     {
+        await PublishSavedWorkflow(runtime, workflowId, savedPath);
         await RunWorkflowSession(runtime, workflowId);
     }
     else
@@ -173,6 +174,56 @@ await runtime.WorkflowGraphCloseEditSession(
         $$"""{"session_id":{{JsonSerializer.Serialize(editSessionId)}}}""");
 }
 
+static async Task PublishSavedWorkflow(
+    FfiPantographRuntime runtime, string workflowId, string savedPath)
+{
+    string fileJson = runtime.WorkflowGraphLoad(JsonSerializer.Serialize(new { path = savedPath }));
+    using JsonDocument file = JsonDocument.Parse(fileJson);
+    string editJson = await runtime.WorkflowGraphCreateEditSession(JsonSerializer.Serialize(new
+    {
+        workflow_id = workflowId,
+        graph = file.RootElement.GetProperty("graph"),
+    }));
+    string editSessionId = ReadString(editJson, "session_id");
+    string graphRevision = ReadString(editJson, "graph_revision");
+    try
+    {
+        string validationJson = await runtime.WorkflowGraphRefreshCurrentValidationSummary(
+            JsonSerializer.Serialize(new
+            {
+                graph_session_id = editSessionId,
+                graph_revision = graphRevision,
+            }));
+        using JsonDocument validation = JsonDocument.Parse(validationJson);
+        JsonElement summary = validation.RootElement.GetProperty("summary");
+        if (summary.GetProperty("state").GetString() != "current"
+            || !summary.GetProperty("submit_gate").GetProperty("allowed").GetBoolean())
+        {
+            throw new InvalidOperationException($"Workflow validation is not executable: {validationJson}");
+        }
+        string validationSessionId = summary.GetProperty("validation_session_id").GetString()
+            ?? throw new InvalidOperationException("Missing validation session identity");
+        string publicationJson = await runtime.PublishGraphSessionExecutableValidationSnapshot(
+            JsonSerializer.Serialize(new
+            {
+                workflow_id = workflowId,
+                workflow_semantic_version = "0.1.0",
+                graph_session_id = editSessionId,
+                validation_session_id = validationSessionId,
+            }));
+        if (ReadString(publicationJson, "validation_session_id") != validationSessionId
+            || string.IsNullOrWhiteSpace(ReadString(publicationJson, "validation_snapshot_id")))
+        {
+            throw new InvalidOperationException($"Unexpected publication identity: {publicationJson}");
+        }
+    }
+    finally
+    {
+        await runtime.WorkflowGraphCloseEditSession(
+            JsonSerializer.Serialize(new { session_id = editSessionId }));
+    }
+}
+
 static async Task RunWorkflowSession(FfiPantographRuntime runtime, string workflowId)
 {
     string createResponse = await runtime.WorkflowCreateSession(

bindings/csharp/Pantograph.DirectRuntimeQuickstart/README.md

@@ -36,5 +36,11 @@ your workflow and append `--run-session`.
 - Loads the saved workflow through `WorkflowGraphLoad`.
 - Opens a graph edit session, mutates node data, saves the edited graph, and
   closes the graph edit session.
-- When `--run-session` is passed: opens a workflow execution session, submits a
+- When `--run-session` is passed: refreshes owner validation for the saved graph,
+  publishes its current executable snapshot, closes that edit session, opens a
+  workflow execution session, submits a
   session run, prints outputs, and closes the workflow execution session.
+
+The native runtime's attribution store is ephemeral. The example publishes again
+each time it opens the runtime. Missing or stale validation is an error; the
+example does not construct snapshot content or bypass admission.

bindings/csharp/Pantograph.NativeSmoke/Program.cs

@@ -46,6 +46,8 @@ private static async Task RunTextSmoke(FfiPantographRuntime runtime, string proj
     {
         WriteTextWorkflow(projectRoot, TextWorkflowId);
         ExerciseGraphAuthoringDiscovery(runtime);
+        await PublishSavedWorkflow(runtime, TextWorkflowId,
+            Path.Combine(projectRoot, ".pantograph", "workflows", $"{TextWorkflowId}.json"));
 
         string createResponse = await runtime.WorkflowCreateSession(
             $$"""{"workflow_id":"{{TextWorkflowId}}","keep_alive":true}""");
@@ -113,6 +115,56 @@ private static void ExerciseGraphAuthoringDiscovery(FfiPantographRuntime runtime
         }
     }
 
+    private static async Task PublishSavedWorkflow(
+        FfiPantographRuntime runtime, string workflowId, string savedPath)
+    {
+        string fileJson = runtime.WorkflowGraphLoad(JsonSerializer.Serialize(new { path = savedPath }));
+        using JsonDocument file = JsonDocument.Parse(fileJson);
+        string editJson = await runtime.WorkflowGraphCreateEditSession(JsonSerializer.Serialize(new
+        {
+            workflow_id = workflowId,
+            graph = file.RootElement.GetProperty("graph"),
+        }));
+        string editSessionId = ReadString(editJson, "session_id");
+        string graphRevision = ReadString(editJson, "graph_revision");
+        try
+        {
+            string validationJson = await runtime.WorkflowGraphRefreshCurrentValidationSummary(
+                JsonSerializer.Serialize(new
+                {
+                    graph_session_id = editSessionId,
+                    graph_revision = graphRevision,
+                }));
+            using JsonDocument validation = JsonDocument.Parse(validationJson);
+            JsonElement summary = validation.RootElement.GetProperty("summary");
+            if (summary.GetProperty("state").GetString() != "current"
+                || !summary.GetProperty("submit_gate").GetProperty("allowed").GetBoolean())
+            {
+                throw new InvalidOperationException($"Workflow validation is not executable: {validationJson}");
+            }
+            string validationSessionId = summary.GetProperty("validation_session_id").GetString()
+                ?? throw new InvalidOperationException("Missing validation session identity");
+            string publicationJson = await runtime.PublishGraphSessionExecutableValidationSnapshot(
+                JsonSerializer.Serialize(new
+                {
+                    workflow_id = workflowId,
+                    workflow_semantic_version = "0.1.0",
+                    graph_session_id = editSessionId,
+                    validation_session_id = validationSessionId,
+                }));
+            if (ReadString(publicationJson, "validation_session_id") != validationSessionId
+                || string.IsNullOrWhiteSpace(ReadString(publicationJson, "validation_snapshot_id")))
+            {
+                throw new InvalidOperationException($"Unexpected publication identity: {publicationJson}");
+            }
+        }
+        finally
+        {
+            await runtime.WorkflowGraphCloseEditSession(
+                JsonSerializer.Serialize(new { session_id = editSessionId }));
+        }
+    }
+
     private static async Task RunDiffusionSmoke(FfiPantographRuntime runtime, string projectRoot)
     {
         string modelId = RequireEnv("PANTOGRAPH_DIFFUSION_SMOKE_PUMAS_MODEL_ID");
@@ -123,6 +175,8 @@ private static async Task RunDiffusionSmoke(FfiPantographRuntime runtime, string
         string outputPath = Environment.GetEnvironmentVariable("PANTOGRAPH_DIFFUSION_SMOKE_OUTPUT") ?? "";
 
         WriteDiffusionWorkflow(projectRoot, DiffusionWorkflowId, modelId, pumasArtifactId);
+        await PublishSavedWorkflow(runtime, DiffusionWorkflowId,
+            Path.Combine(projectRoot, ".pantograph", "workflows", $"{DiffusionWorkflowId}.json"));
 
         string createResponse = await runtime.WorkflowCreateSession(
             $$"""{"workflow_id":"{{DiffusionWorkflowId}}","keep_alive":true}""");

bindings/csharp/README.md

@@ -10,6 +10,26 @@ Runtime smoke coverage for generated Pantograph C# bindings.
 | `Pantograph.DirectRuntimeQuickstart/` | Artifact-ready quickstart showing native save/list/load/edit-session/workflow-session usage from C#. |
 | `PACKAGE-README.md` | README copied to the generated C# binding artifact. |
 
+## Generator prerequisite
+
+The maintained workflow uses UniFFI 0.28.3 and the official
+[uniffi-bindgen-cs v0.9.0+v0.28.3 source](https://github.com/NordSecurity/uniffi-bindgen-cs/tree/2f4880f03ed08d960ad0ee14d11cf95444eee540).
+The generator is not published as crates.io version 0.9.0. Install its exact
+reviewed Git revision with the upstream lockfile:
+
+```bash
+cargo install uniffi-bindgen-cs \
+  --git https://github.com/NordSecurity/uniffi-bindgen-cs \
+  --rev 2f4880f03ed08d960ad0ee14d11cf95444eee540 --locked
+```
+
+This provisions a development/CI tool; it does not change the application's
+UniFFI dependency or hand-edit generated bindings. The headless workflow owns
+its pin and generated-artifact qualification. Keep the upstream MPL-2.0 notices
+with any redistributed generator source/binary; this repository does not vendor
+or package the generator itself. Existing generated-binding/artifact licensing
+obligations remain unchanged.
+
 ## Usage
 Run the repository-level smoke script: