✨ (VoteSecure P1/3) Devcontainer and CI tooling

.devcontainer/.env.development

@@ -381,6 +381,17 @@ B4_PG_DATABASE=b4
 B4_BIND=0.0.0.0:50051
 B4_URL=http://b4:50051
 
+# wbraid (packages/wbraid) dev loop. b4.sh, serve.sh and the live-b4 tests read
+# these and fall back to the upstream defaults when unset (b4 on 3000, the
+# emulator's server on 8080, S3 on localhost:4566). 3000 is the voting portal's
+# and 8080 is Hasura's, hence the different ports here; S3 is the opt-in
+# `localstack` compose service.
+# These can be removed once the wbraid tree is integrated into the parent system.
+WBRAID_B4_BIND=127.0.0.1:3005
+WBRAID_B4_URL=http://127.0.0.1:3005
+WBRAID_S3_ENDPOINT_URL=http://localstack:4566
+WBRAID_SERVE_PORT=8085
+
 # loadero
 LOADERO_BASE_URL=https://api.loadero.com/v2/projects/13356
 LOADERO_API_KEY=a133481e0cf90882554c73bac3e7b2e82a8d79e19c170ed5

.devcontainer/devcontainer.json

@@ -21,7 +21,9 @@
     "rabbitmq:5672",
     "rabbitmq:15672",
     "b4:50051",
-    "simplesamlphp:8083"
+    "simplesamlphp:8083",
+    // wbraid's S3 emulator (opt-in profile; packages/wbraid/localstack.sh)
+    "localstack:4566"
   ],
   // Fixes usage of LOCAL_WORKSPACE_FOLDER. See:
   // https://github.com/microsoft/vscode-remote-release/issues/6844#issuecomment-1252288457

.devcontainer/docker-compose-base.yml

@@ -165,6 +165,49 @@ services:
       - KEYCLOAK_ELECTION_EVENT_REALM_CONFIG_S3_KEY=${KEYCLOAK_ELECTION_EVENT_REALM_CONFIG_S3_KEY}
     entrypoint: /scripts/entrypoint.sh
 
+  # S3 emulator for the wbraid dev loop (packages/wbraid): its b4v6 bulletin
+  # board keeps every message body in S3. Opt-in profile — not started with the
+  # base stack; packages/wbraid/localstack.sh brings it up by name, which
+  # auto-enables the profile.
+  # The image is pinned to the 4.x line: from the 2026 calendar releases on,
+  # localstack/localstack:latest exits at startup without an auth token.
+  localstack:
+    profiles: [ "wbraid" ]
+    container_name: localstack
+    image: localstack/localstack:4
+    ports:
+      - "4566:4566"
+    environment:
+      - HOSTNAME_EXTERNAL=localhost
+      - S3_HOSTNAME=localhost:4566
+    healthcheck:
+      test: [ "CMD-SHELL", "curl -sf http://localhost:4566/_localstack/health" ]
+      interval: 5s
+      timeout: 10s
+      retries: 25
+      start_period: 5s
+
+  # Creates the wbraid-messages bucket and applies its CORS rules — the twin of
+  # what localstack.ps1 does inline on Windows.
+  configure-localstack:
+    profiles: [ "wbraid" ]
+    container_name: configure-localstack
+    image: amazon/aws-cli
+    volumes:
+      - "${LOCAL_WORKSPACE_FOLDER:-..}/packages/wbraid/s3-cors.json:/aws/s3-cors.json:ro,z"
+    depends_on:
+      localstack:
+        condition: service_healthy
+    environment:
+      - AWS_ACCESS_KEY_ID=test
+      - AWS_SECRET_ACCESS_KEY=test
+      - AWS_DEFAULT_REGION=us-east-1
+    entrypoint: /bin/sh
+    command: >-
+      -c "aws --endpoint-url=http://localstack:4566 s3 mb s3://wbraid-messages 2>/dev/null;
+      aws --endpoint-url=http://localstack:4566 s3api put-bucket-cors
+      --bucket wbraid-messages --cors-configuration file:///aws/s3-cors.json"
+
   # hashicorp vault to store secrets
   # vault:
   #   profiles: ["full", "base"]

.github/actions/setup-rust-tests/action.yml

@@ -15,6 +15,14 @@ inputs:
   cargo-lock-path:
     description: Cargo lockfile used to invalidate the package build cache
     required: true
+  components:
+    description: Toolchain components to install (comma-separated)
+    required: false
+    default: rustfmt
+  targets:
+    description: Extra compilation targets to install (comma-separated)
+    required: false
+    default: x86_64-unknown-linux-musl
 
 runs:
   using: composite
@@ -23,8 +31,8 @@ runs:
       uses: dtolnay/rust-toolchain@stable
       with:
         toolchain: 1.96.0
-        components: rustfmt
-        targets: x86_64-unknown-linux-musl
+        components: ${{ inputs.components }}
+        targets: ${{ inputs.targets }}
 
     - name: Cache Cargo registry
       uses: actions/cache@v4

.github/workflows/wbraid.yml

@@ -0,0 +1,107 @@
+# SPDX-FileCopyrightText: 2026 Sequent Tech Inc <legal@sequentech.io>
+#
+# SPDX-License-Identifier: AGPL-3.0-only
+
+name: wbraid
+
+# packages/wbraid is its own Cargo workspace (see packages/wbraid/PROVENANCE.md),
+# so it gets its own workflow, scoped to changes under that subtree.
+on:
+  pull_request:
+    paths:
+      - 'packages/wbraid/**'
+      - '.github/workflows/wbraid.yml'
+      - '.github/actions/setup-rust-tests/**'
+  push:
+    branches: [ 'main', 'release/[0-9]+.[0-9]+' ]
+    paths:
+      - 'packages/wbraid/**'
+      - '.github/workflows/wbraid.yml'
+      - '.github/actions/setup-rust-tests/**'
+
+defaults:
+  run:
+    working-directory: packages/wbraid
+
+jobs:
+  lint:
+    name: Format and lint
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Set up Rust
+        uses: ./.github/actions/setup-rust-tests
+        with:
+          cargo-build-name: wbraid-lint
+          cargo-build-path: packages/wbraid/target
+          cargo-lock-path: packages/wbraid/Cargo.lock
+          components: rustfmt, clippy
+
+      - name: Check formatting
+        run: cargo fmt -- --check
+
+      # vsc is a vendored fork with its own strict lint levels; its test modules
+      # and the shuffle_scaling example fail those upstream levels (identically
+      # on nightly, see PROVENANCE.md), and under -D warnings its warn-level
+      # lints (indexing_slicing) would fail too. --no-deps keeps -D warnings
+      # from leaking into vsc through the workspace wrapper; the second
+      # invocation lints vsc's lib at exactly the levels upstream chose.
+      - name: Clippy (workspace except vsc, all targets)
+        run: cargo clippy --workspace --exclude vsc --all-targets --no-deps -- -D warnings
+
+      - name: Clippy (vsc lib, upstream lint levels)
+        run: cargo clippy -p vsc --no-deps
+
+  test:
+    name: Run tests
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Set up Rust
+        uses: ./.github/actions/setup-rust-tests
+        with:
+          cargo-build-name: wbraid-test
+          cargo-build-path: packages/wbraid/target
+          cargo-lock-path: packages/wbraid/Cargo.lock
+
+      # The live-b4 protocol tests (test_protocol_http*) and the Verificatum
+      # interop tests are #[ignore]d: they need a running b4 + LocalStack or a
+      # JVM with the Verificatum jars. The live-b4 ones stay ignored here until
+      # a follow-up gives this job b4 and LocalStack service containers.
+      - name: Run tests
+        run: cargo test --release
+        env:
+          RUST_BACKTRACE: 'full'
+
+  build-wasm-core:
+    name: Build wasm-core
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Set up Rust
+        uses: ./.github/actions/setup-rust-tests
+        with:
+          cargo-build-name: wbraid-wasm
+          cargo-build-path: packages/wbraid/target
+          cargo-lock-path: packages/wbraid/Cargo.lock
+          targets: wasm32-unknown-unknown
+
+      # Run from the workspace root so crates/braid/.cargo/config.toml (atomics
+      # + build-std, which need RUSTC_BOOTSTRAP on stable) does not apply; the
+      # wasm-core feature needs neither, and the build stops before bindings,
+      # so no wasm-bindgen-cli is required. The full atomics `wasm` feature
+      # build stays a dev-loop concern (build-wasm.sh / build-wasm.ps1).
+      - name: Build braid wasm-core
+        run: >-
+          cargo build -p braid --lib --release
+          --target wasm32-unknown-unknown
+          --no-default-features --features wasm-core