fix(sparklink): isolate event lifecycle and align language ABI

.agents/skills/sparklink-compliance-audit/SKILL.md

@@ -115,7 +115,7 @@ cd ~/Documents/sparklink && cargo test --workspace 2>&1 | grep 'test result'
 
 ## 步骤 5：输出格式
 
-### 标准型输出（写入 `docs/AUDIT.md`）
+### 标准型输出（写入 `history/cleanup/audit.md`）
 
 ```markdown
 ## 审计日期：YYYY-MM-DD

.agents/skills/sparklink-kernel-dev/SKILL.md

@@ -268,7 +268,7 @@ Tests: N passed."
 | `data/dbus/sparklink.conf` | D-Bus 策略文件 |
 | `data/udev/99-sparklink.rules` | udev 规则 |
 | `data/pkgconfig/sparklink.pc` | pkg-config 文件 |
-| `docs/API.md` | ioctl 参考（126 命令） |
-| `docs/ARCHITECTURE.md` | 架构总览 |
-| `docs/AUDIT.md` | 覆盖率审计 |
-| `docs/BLUEZ_COMPARISON.md` | BlueZ 对比分析 |
+| `project/reference/management/api.md` | 历史 API 索引；当前接口以源码和能力入口为准 |
+| `project/architecture.md` | 架构总览 |
+| `history/cleanup/audit.md` | 覆盖率审计 |
+| `project/reference/architecture/bluez-comparison.md` | BlueZ 对比分析 |

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,12 @@
+## 行为与契约
+
+说明本批生产行为、受影响读者任务、接口/权限/生命周期或配置变化。
+
+## 文档与验收
+
+- 同批更新对应参考、指南、绑定/CLI/man/示例；无文档影响时说明原因。
+- 记录本批必要门禁的准确源码、命令、结果、限定范围、未执行项及剩余条件。
+- 文档/静态/形式化与真实设备结果分开；保持 VM-only 和历史失败证据。
+- 更新唯一计划、资格记录及关联 issues；部分成果不关闭整项。
+
+持续维护规则见 [AGENTS.md](../AGENTS.md)。

.github/workflows/ci.yml

@@ -18,7 +18,13 @@ jobs:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
-      - run: cargo check --workspace
+      - name: Default/all-features production boundaries and retired entry guard
+        run: |
+          python3 -m unittest discover -s tools/tests -p test_production_dependencies.py -v
+          python3 tools/check_production_dependencies.py
+          python3 -m unittest discover -s tools/tests -p test_retired_interfaces.py -v
+          python3 tools/check_retired_interfaces.py
+      - run: cargo check --locked --workspace --all-targets --all-features
 
   test:
     name: cargo test
@@ -28,7 +34,37 @@ jobs:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
-      - run: cargo test --workspace
+      - name: Install private D-Bus regression dependency
+        run: sudo apt-get update && sudo apt-get install -y dbus-daemon
+      - name: Test workspace and export actual local application reports
+        env:
+          SLKTEST_REPORT_FIXTURE_DIR: ${{ runner.temp }}/slktest-report-fixtures
+          SPARKLINK_APPLICATION_FFI_ARTIFACT_DIR: ${{ runner.temp }}/application-client-fixtures
+        run: cargo test --locked --workspace --all-features
+      - name: Independently check actual production schema2 reports (AF_UNIX only)
+        env:
+          PYTHONPATH: tools
+        run: |
+          python3 -m unittest discover -s tools/tests -p test_ws73_benchmark.py -v
+          for mode in rate window duplex; do
+            python3 tools/ws73_benchmark.py --fixture --left "$RUNNER_TEMP/slktest-report-fixtures/$mode-0.json" --right "$RUNNER_TEMP/slktest-report-fixtures/$mode-1.json" --output "$RUNNER_TEMP/slktest-report-fixtures/$mode-check.json"
+          done
+      - name: Retain local report fixtures; not performance or hardware qualification
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: slktest-local-reports-not-performance-qualification
+          path: ${{ runner.temp }}/slktest-report-fixtures
+          if-no-files-found: error
+          retention-days: 14
+      - name: Retain actual C/Python consumer executable and outputs; not device qualification
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: application-client-private-bus-not-device-qualification
+          path: ${{ runner.temp }}/application-client-fixtures
+          if-no-files-found: error
+          retention-days: 14
 
   clippy:
     name: clippy
@@ -40,7 +76,7 @@ jobs:
         with:
           components: clippy
       - uses: Swatinem/rust-cache@v2
-      - run: cargo clippy --workspace -- -W clippy::all
+      - run: cargo clippy --locked --workspace --all-targets --all-features -- -W clippy::all
 
   fmt:
     name: rustfmt
@@ -60,12 +96,17 @@ jobs:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
-      - run: cargo install cbindgen --locked
+      - run: cargo install cbindgen --version 0.29.4 --locked
       - name: Generate sparklink.h
         working-directory: crates/libsparklink
         run: cbindgen --config cbindgen.toml --crate libsparklink --output /tmp/sparklink.h
       - name: Verify header unchanged
         run: diff -u crates/libsparklink/include/sparklink.h /tmp/sparklink.h
+      - name: Generate Native header
+        working-directory: crates/slk-native
+        run: cbindgen --config cbindgen.toml --crate slk-native --output /tmp/sparklink_native.h
+      - name: Verify independent Native header
+        run: diff -u crates/slk-native/include/sparklink_native.h /tmp/sparklink_native.h
 
   build-release:
     name: release build
@@ -75,7 +116,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
-      - run: cargo build --release --workspace
+      - run: cargo build --locked --release --workspace
       - name: Upload binaries
         uses: actions/upload-artifact@v4
         with:
@@ -84,19 +125,187 @@ jobs:
             target/release/slkd
             target/release/slkconfig
             target/release/slctl
+            target/release/slktest
             target/release/slkmon
             target/release/slkdump
-            target/release/libsparklink.so
+            target/release/liblibsparklink.so
+            target/release/libslk_native.so
           retention-days: 14
 
   python-check:
-    name: Python binding lint
+    name: Python bindings and kernel ABI conformance
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
+      - name: Check out matching canonical kernel UAPI
+        uses: actions/checkout@v4
+        with:
+          repository: OpenSparklink/linux
+          # Update this pin together with intentional kernel UAPI changes.
+          ref: 2fc210af68ee3bce0eed3553117d8be635dfdd15
+          path: .kernel-uapi
+          sparse-checkout: |
+            include/uapi/linux/sparklink_ioctl.h
+            include/uapi/linux/sparklink.h
+            include/uapi/linux/sparklink_socket.h
+          sparse-checkout-cone-mode: false
+      - uses: dtolnay/rust-toolchain@stable
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
+      - name: Prepare 32-bit header compilation and actual cdylib
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gcc-multilib
+          cargo build --locked -p libsparklink -p slk-native --lib
+      - name: Compare both actual cdylib exports with their independent public headers
+        run: |
+          PYTHONPATH=tools python3 -m unittest discover -s tools/tests -p test_public_symbols.py -v
+          python3 tools/check_public_symbols.py --application-library target/debug/liblibsparklink.so --native-library target/debug/libslk_native.so
+      - name: Compare actual C and broker socket v2/v3 layout
+        run: CC=cc python tools/channel_socket_contract.py --kernel .kernel-uapi
       - run: python -m py_compile bindings/python/sparklink/__init__.py
       - run: python -m py_compile bindings/python/sparklink/structs.py
-      - run: python -m py_compile bindings/python/sparklink/adapter.py
+      - run: python -m compileall -q bindings/python/sparklink
+      - run: python -m py_compile bindings/python/sparklink/native.py
+      - name: Run Python unit and compiled C/Rust ABI tests
+        env:
+          PYTHONPATH: bindings/python
+          LIBSPARKLINK_PATH: ${{ github.workspace }}/target/debug/liblibsparklink.so
+          LIBSLK_NATIVE_PATH: ${{ github.workspace }}/target/debug/libslk_native.so
+          SPARKLINK_KERNEL_UAPI: ${{ github.workspace }}/.kernel-uapi/include/uapi/linux/sparklink_ioctl.h
+          SPARKLINK_KERNEL_SOURCE: ${{ github.workspace }}/.kernel-uapi
+        run: python -m unittest discover -s bindings/python/tests -v
+
+  tooling-test:
+    name: WS73 tooling and evidence validation (no hardware)
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check out matching kernel lab helpers
+        uses: actions/checkout@v4
+        with:
+          repository: OpenSparklink/linux
+          ref: 2fc210af68ee3bce0eed3553117d8be635dfdd15
+          path: .kernel-tools
+          # Raw worker ioctls also compile against the canonical pinned UAPI.
+          sparse-checkout: |
+            tools/testing/selftests/sparklink
+            include/uapi/linux
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: python -m unittest discover -s tools/tests -v
+        env:
+          SPARKLINK_KERNEL_SOURCE: ${{ github.workspace }}/.kernel-tools
+
+  kernel-containment:
+    name: Kernel crypto/wire and archived protocol boundaries
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: .registration-contract
+          sparse-checkout: tools/backend_registration_contract.py
+      - uses: actions/checkout@v4
+        with:
+          repository: OpenSparklink/linux
+          ref: 2fc210af68ee3bce0eed3553117d8be635dfdd15
+          path: .kernel-containment
+          sparse-checkout: |
+            net/sparklink
+            drivers/sparklink
+            include/linux/sparklink_connection.h
+            include/linux/sparklink_backend.h
+            include/linux/sparklink_native.h
+            include/trace/events/sparklink.h
+            include/linux/sparklink_usb.h
+            include/linux/sparklink_discovery.h
+            tools/testing/selftests/sparklink
+            include/uapi/linux/sparklink_ioctl.h
+            include/uapi/linux/sparklink.h
+            include/uapi/linux/sparklink_socket.h
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Check actual common Backend descriptor admission
+        working-directory: .kernel-containment
+        run: |
+          cc -std=c11 -Wall -Wextra -Werror -I include tools/testing/selftests/sparklink/sparklink_backend_test.c -o /tmp/sparklink-backend-test
+          /tmp/sparklink-backend-test
+      - name: Install compiler and sanitizer runtimes
+        run: sudo apt-get update && sudo apt-get install -y clang gcc-multilib
+      - name: Check actual registration rejects before following ops
+        run: python .registration-contract/tools/backend_registration_contract.py --kernel .kernel-containment
+      - name: Check actual WS73 DLI and security envelopes (synthetic only)
+        working-directory: .kernel-containment
+        run: |
+          clang -std=gnu11 -Wall -Wextra -Werror -O1 -g -fsanitize=address,undefined tools/testing/selftests/sparklink/ws73_dli_test.c drivers/sparklink/ws73/wire.c drivers/sparklink/ws73/dli.c -o /tmp/ws73-dli-test
+          /tmp/ws73-dli-test
+      - name: Execute actual source failure boundaries (not RF or crypto vectors)
+        working-directory: .kernel-containment
+        env:
+          CC: clang
+        run: |
+          python tools/testing/selftests/sparklink/run_security_remediation.py
+          python tools/testing/selftests/sparklink/run_crypto_mechanism_faults.py
+          python tools/testing/selftests/sparklink/run_security_relay.py
+          python tools/testing/selftests/sparklink/run_backend_containment.py
+          python tools/testing/selftests/sparklink/run_connection_tx.py
+          python tools/testing/selftests/sparklink/run_native_connection_contract.py
+          python tools/testing/selftests/sparklink/run_runtime_ingress.py
+          python tools/testing/selftests/sparklink/run_snoop_redaction.py
+          python tools/testing/selftests/sparklink/run_usb_registration.py
+          python tools/testing/selftests/sparklink/run_native_data.py
+          python tools/testing/selftests/sparklink/run_native_ticket_driver.py
+          python tools/testing/selftests/sparklink/run_native_ticket_driver.py --command
+          python tools/testing/selftests/sparklink/run_session_dispatch.py
+          python tools/testing/selftests/sparklink/run_session_wake.py
+          clang -O2 -std=c11 -Wall -Wextra -Werror tools/testing/selftests/sparklink/sle_channel_table_test.c -o /tmp/sle-channel-table-test
+          /tmp/sle-channel-table-test
+          clang -std=c11 -Wall -Wextra -Werror -fsanitize=address,undefined -fno-omit-frame-pointer tools/testing/selftests/sparklink/ws73_acb_test.c drivers/sparklink/ws73/wire.c -o /tmp/ws73-acb-test
+          /tmp/ws73-acb-test
+          clang -std=c11 -Wall -Wextra -Werror -fsanitize=address,undefined tools/testing/selftests/sparklink/sle_channel_wire_test.c net/sparklink/sle_channel_wire.c -o /tmp/sle-channel-wire-test
+          /tmp/sle-channel-wire-test
+          clang -std=c11 -Wall -Wextra -Werror -fsanitize=address,undefined tools/testing/selftests/sparklink/sle_channel_signal_test.c net/sparklink/sle_channel_wire.c -o /tmp/sle-channel-signal-test
+          /tmp/sle-channel-signal-test
+          python tools/testing/selftests/sparklink/run_ssap_containment.py
+          python tools/testing/selftests/sparklink/run_event_copy.py
+          python tools/testing/selftests/sparklink/run_phy_model.py
+          CC=clang python tools/testing/selftests/sparklink/run_raw_uapi_retirement.py
+          python tools/testing/selftests/sparklink/run_power_retirement.py --output /tmp/power-retirement
+          python tools/testing/selftests/sparklink/run_diagnostic_result.py
+          python tools/testing/selftests/sparklink/run_management_release.py
+          python tools/testing/selftests/sparklink/run_link_observation.py
+          python tools/testing/selftests/sparklink/run_usb_firmware.py
+          python tools/testing/selftests/sparklink/run_usb_discovery.py
+          python tools/testing/selftests/sparklink/run_backend_command_port.py
+          python tools/testing/selftests/sparklink/run_usb_bootstrap_metadata.py
+          python tools/testing/selftests/sparklink/run_usb_binding.py
+          python tools/testing/selftests/sparklink/run_standard_provider.py
+          python tools/testing/selftests/sparklink/run_standard_driver.py
+          cc -std=gnu11 -Wall -Wextra -Werror -fsanitize=address,undefined -I include tools/testing/selftests/sparklink/virtual_codec_test.c -o /tmp/sparklink-virtual-codec-test
+          /tmp/sparklink-virtual-codec-test
+          python tools/testing/selftests/sparklink/run_usb_codec_isolation.py
+          python tools/testing/selftests/sparklink/run_backend_bus.py
+          python tools/testing/selftests/sparklink/run_backend_install.py
+          python tools/testing/selftests/sparklink/run_backend_pending_driver.py
+      - name: Check complete ioctl authorization and queue contracts
+        working-directory: .kernel-containment
+        run: |
+          python -m unittest discover -s tools/testing/selftests/sparklink -p test_authorization_contract.py -v
+          python -m unittest discover -s tools/testing/selftests/sparklink -p test_daemon_lifecycle.py -v
+          python3 tools/testing/selftests/sparklink/run_host_plan.py
+          clang -std=c11 -O2 -Wall -Wextra -Werror tools/testing/selftests/sparklink/kernel_authorization_test.c -o /tmp/kernel-authorization-probe
+      - name: Check pinned QEMU host test boundaries (no live USB or guest execution)
+        working-directory: .kernel-containment
+        run: |
+          curl --fail --location --retry 3 --output "$RUNNER_TEMP/qemu-9.2.0.tar.xz" https://download.qemu.org/qemu-9.2.0.tar.xz
+          python tools/testing/selftests/sparklink/qemu-sle-dli/run-usb-host-boundaries.py --archive "$RUNNER_TEMP/qemu-9.2.0.tar.xz" --cc clang --output "$RUNNER_TEMP/qemu-host-boundaries"
+          python tools/testing/selftests/sparklink/qemu-sle-dli/check-ws73-model-hold.py --cc clang --sanitize --output "$RUNNER_TEMP/qemu-model-hold-boundaries"
+      - name: Compile live VFS probe (not executed without a qualified VM)
+        working-directory: .kernel-containment
+        run: |
+          clang -std=c11 -O2 -Wall -Wextra -Werror tools/testing/selftests/sparklink/sparklink_event_copy_test.c -o /tmp/event-copy-probe
+          clang -std=c11 -O2 -Wall -Wextra -Werror tools/testing/selftests/sparklink/sparklink_diagnostic_result_test.c -o /tmp/diagnostic-result-probe

.github/workflows/codec-fuzz.yml

@@ -0,0 +1,63 @@
+name: Production codec bounded fuzz
+
+on:
+  push:
+    branches: [master, codex/sparklink-ws73]
+    paths: ['.github/workflows/codec-fuzz.yml']
+  pull_request:
+    paths: ['.github/workflows/codec-fuzz.yml']
+  schedule:
+    - cron: '41 3 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  ws73-codec:
+    name: WS73 production C corpus and bounded sanitizer exploration
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    env:
+      CC: clang-18
+      LLVM_PROFDATA: llvm-profdata-18
+      LLVM_COV: llvm-cov-18
+      FUZZ_RUNS: ${{ github.event_name == 'schedule' && '100000' || '20000' }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          repository: OpenSparklink/linux
+          # Review/bump with changes to these production codecs or the harness.
+          # This is an explicit source pin; it does not silently follow a branch.
+          ref: 400bd6812608935e2845d6d2b80ec58e7a6a6415
+          path: kernel
+          sparse-checkout: |
+            drivers/sparklink/ws73/wire.c
+            drivers/sparklink/ws73/wire.h
+            drivers/sparklink/ws73/dli.c
+            drivers/sparklink/ws73/dli.h
+            drivers/sparklink/ws73/bsle.h
+            net/sparklink/sle_channel_wire.c
+            net/sparklink/sle_channel_wire.h
+            tools/testing/selftests/sparklink/channel
+            tools/testing/selftests/sparklink/run_ws73_codec_fuzz.py
+            tools/testing/selftests/sparklink/fuzz
+          sparse-checkout-cone-mode: false
+      - name: Install named compiler and matching coverage/sanitizer tools
+        run: sudo apt-get update && sudo apt-get install -y clang-18 llvm-18 libclang-rt-18-dev binutils
+      - name: Check supervisor negative controls
+        run: python3 kernel/tools/testing/selftests/sparklink/fuzz/test_ws73_codec_verdict.py
+      - name: Replay fixed corpus and explore (not a proof or hardware qualification)
+        run: python3 kernel/tools/testing/selftests/sparklink/run_ws73_codec_fuzz.py --output fuzz-result --runs "$FUZZ_RUNS" --seed 730111
+      - name: Replay and explore actual dynamic CMTC codec
+        run: python3 kernel/tools/testing/selftests/sparklink/run_ws73_codec_fuzz.py --contract cmtc --output cmtc-fuzz-result --runs "$FUZZ_RUNS" --seed 730111
+      - name: Preserve all results, failures, corpus and coverage
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: bounded-codec-fuzz-not-hardware-qualification
+          path: |
+            fuzz-result/
+            cmtc-fuzz-result/
+          if-no-files-found: error
+          retention-days: 14