✨ (VoteSecure P1/3) Devcontainer and CI tooling

.devcontainer/devcontainer.json

@@ -21,7 +21,9 @@
     "rabbitmq:5672",
     "rabbitmq:15672",
     "b4:50051",
-    "simplesamlphp:8083"
+    "simplesamlphp:8083",
+    // wbraid's S3 emulator (opt-in profile; packages/wbraid/localstack.sh)
+    "localstack:4566"
   ],
   // Fixes usage of LOCAL_WORKSPACE_FOLDER. See:
   // https://github.com/microsoft/vscode-remote-release/issues/6844#issuecomment-1252288457

.devcontainer/docker-compose-base.yml

@@ -165,6 +165,49 @@ services:
       - KEYCLOAK_ELECTION_EVENT_REALM_CONFIG_S3_KEY=${KEYCLOAK_ELECTION_EVENT_REALM_CONFIG_S3_KEY}
     entrypoint: /scripts/entrypoint.sh
 
+  # S3 emulator for the wbraid dev loop (packages/wbraid): its b4v6 bulletin
+  # board keeps every message body in S3. Opt-in profile — not started with the
+  # base stack; packages/wbraid/localstack.sh brings it up by name, which
+  # auto-enables the profile.
+  # The image is pinned to the 4.x line: from the 2026 calendar releases on,
+  # localstack/localstack:latest exits at startup without an auth token.
+  localstack:
+    profiles: [ "wbraid" ]
+    container_name: localstack
+    image: localstack/localstack:4
+    ports:
+      - "4566:4566"
+    environment:
+      - HOSTNAME_EXTERNAL=localhost
+      - S3_HOSTNAME=localhost:4566
+    healthcheck:
+      test: [ "CMD-SHELL", "curl -sf http://localhost:4566/_localstack/health" ]
+      interval: 5s
+      timeout: 10s
+      retries: 25
+      start_period: 5s
+
+  # Creates the wbraid-messages bucket and applies its CORS rules — the twin of
+  # what localstack.ps1 does inline on Windows.
+  configure-localstack:
+    profiles: [ "wbraid" ]
+    container_name: configure-localstack
+    image: amazon/aws-cli
+    volumes:
+      - "${LOCAL_WORKSPACE_FOLDER:-..}/packages/wbraid/s3-cors.json:/aws/s3-cors.json:ro,z"
+    depends_on:
+      localstack:
+        condition: service_healthy
+    environment:
+      - AWS_ACCESS_KEY_ID=test
+      - AWS_SECRET_ACCESS_KEY=test
+      - AWS_DEFAULT_REGION=us-east-1
+    entrypoint: /bin/sh
+    command: >-
+      -c "aws --endpoint-url=http://localstack:4566 s3 mb s3://wbraid-messages 2>/dev/null;
+      aws --endpoint-url=http://localstack:4566 s3api put-bucket-cors
+      --bucket wbraid-messages --cors-configuration file:///aws/s3-cors.json"
+
   # hashicorp vault to store secrets
   # vault:
   #   profiles: ["full", "base"]

.github/actions/setup-rust-tests/action.yml

@@ -15,6 +15,14 @@ inputs:
   cargo-lock-path:
     description: Cargo lockfile used to invalidate the package build cache
     required: true
+  components:
+    description: Toolchain components to install (comma-separated)
+    required: false
+    default: rustfmt
+  targets:
+    description: Extra compilation targets to install (comma-separated)
+    required: false
+    default: x86_64-unknown-linux-musl
 
 runs:
   using: composite
@@ -23,8 +31,8 @@ runs:
       uses: dtolnay/rust-toolchain@stable
       with:
         toolchain: 1.96.0
-        components: rustfmt
-        targets: x86_64-unknown-linux-musl
+        components: ${{ inputs.components }}
+        targets: ${{ inputs.targets }}
 
     - name: Cache Cargo registry
       uses: actions/cache@v4

.github/workflows/wbraid.yml

@@ -0,0 +1,107 @@
+# SPDX-FileCopyrightText: 2026 Sequent Tech Inc <legal@sequentech.io>
+#
+# SPDX-License-Identifier: AGPL-3.0-only
+
+name: wbraid
+
+# packages/wbraid is its own Cargo workspace (see packages/wbraid/PROVENANCE.md),
+# so it gets its own workflow, scoped to changes under that subtree.
+on:
+  pull_request:
+    paths:
+      - 'packages/wbraid/**'
+      - '.github/workflows/wbraid.yml'
+      - '.github/actions/setup-rust-tests/**'
+  push:
+    branches: [ 'main', 'release/[0-9]+.[0-9]+' ]
+    paths:
+      - 'packages/wbraid/**'
+      - '.github/workflows/wbraid.yml'
+      - '.github/actions/setup-rust-tests/**'
+
+defaults:
+  run:
+    working-directory: packages/wbraid
+
+jobs:
+  lint:
+    name: Format and lint
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Set up Rust
+        uses: ./.github/actions/setup-rust-tests
+        with:
+          cargo-build-name: wbraid-lint
+          cargo-build-path: packages/wbraid/target
+          cargo-lock-path: packages/wbraid/Cargo.lock
+          components: rustfmt, clippy
+
+      - name: Check formatting
+        run: cargo fmt -- --check
+
+      # vsc is a vendored fork with its own strict lint levels; its test modules
+      # and the shuffle_scaling example fail those upstream levels (identically
+      # on nightly, see PROVENANCE.md), and under -D warnings its warn-level
+      # lints (indexing_slicing) would fail too. --no-deps keeps -D warnings
+      # from leaking into vsc through the workspace wrapper; the second
+      # invocation lints vsc's lib at exactly the levels upstream chose.
+      - name: Clippy (workspace except vsc, all targets)
+        run: cargo clippy --workspace --exclude vsc --all-targets --no-deps -- -D warnings
+
+      - name: Clippy (vsc lib, upstream lint levels)
+        run: cargo clippy -p vsc --no-deps
+
+  test:
+    name: Run tests
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Set up Rust
+        uses: ./.github/actions/setup-rust-tests
+        with:
+          cargo-build-name: wbraid-test
+          cargo-build-path: packages/wbraid/target
+          cargo-lock-path: packages/wbraid/Cargo.lock
+
+      # The live-b4 protocol tests (test_protocol_http*) and the Verificatum
+      # interop tests are #[ignore]d: they need a running b4 + LocalStack or a
+      # JVM with the Verificatum jars. Wiring the live-b4 ones up here is
+      # planned for PR 4.
+      - name: Run tests
+        run: cargo test --release
+        env:
+          RUST_BACKTRACE: 'full'
+
+  build-wasm-core:
+    name: Build wasm-core
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Set up Rust
+        uses: ./.github/actions/setup-rust-tests
+        with:
+          cargo-build-name: wbraid-wasm
+          cargo-build-path: packages/wbraid/target
+          cargo-lock-path: packages/wbraid/Cargo.lock
+          targets: wasm32-unknown-unknown
+
+      # Run from the workspace root so crates/braid/.cargo/config.toml (atomics
+      # + build-std, which need RUSTC_BOOTSTRAP on stable) does not apply; the
+      # wasm-core feature needs neither, and the build stops before bindings,
+      # so no wasm-bindgen-cli is required. The full atomics `wasm` feature
+      # build stays a dev-loop concern (build-wasm.sh / build-wasm.ps1).
+      - name: Build braid wasm-core
+        run: >-
+          cargo build -p braid --lib --release
+          --target wasm32-unknown-unknown
+          --no-default-features --features wasm-core

packages/wbraid/PROVENANCE.md

@@ -91,6 +91,53 @@ nightly by enabling the named features:
 `shuffle_scaling` example (mostly `unwrap_used` and pedantic lints in test
 code, identical on nightly); that upstream state is left untouched.
 
+## Local modifications for the devcontainer dev loop and CI
+
+- **Added bash twins of the five PowerShell scripts** (`build-wasm.sh`,
+  `serve.sh`, `test-wasm.sh`, `b4.sh`, `localstack.sh`). The `.ps1` files are
+  unchanged and remain the Windows dev loop. Differences beyond syntax:
+  `build-wasm.sh` stays on the stable toolchain and uses `RUSTC_BOOTSTRAP=1`
+  instead of a nightly override (the approach of
+  `packages/braid/scripts/build-wasm.sh`); both wasm scripts verify that the
+  `wasm-bindgen` CLI on `PATH` matches the version pinned in `Cargo.lock`
+  before building; in the devcontainer, `localstack.sh` runs LocalStack the
+  way every other dev service runs — as the `localstack` compose service
+  (opt-in `wbraid` profile in `.devcontainer/docker-compose-base.yml`, with a
+  `configure-localstack` one-shot creating the bucket and CORS, mirroring
+  `configure-minio`), addressed as `http://localstack:4566` on the project
+  network — while outside a compose project it keeps `localstack.ps1`'s
+  standalone docker-run flow; the image is pinned to `localstack/localstack:4`
+  everywhere (2026-era `latest` exits at startup without an auth token);
+  `b4.sh` defaults `AWS_ENDPOINT_URL` per environment (a pre-set value wins)
+  and falls back to the `amazon/aws-cli` image joined to the project network
+  when no AWS CLI is installed; and
+  `build-wasm.sh`/`serve.sh` clear an inherited `RUSTFLAGS`, which would
+  otherwise override the atomics rustflags in `crates/braid/.cargo/config.toml`
+  entirely (the devcontainer's devenv exports `RUSTFLAGS=-Awarnings`).
+- **`server.py` honours a `PORT` environment variable** (default 8080,
+  unchanged); in the devcontainer 8080 is taken by Hasura.
+- **Ran `cargo fmt`** (rustfmt 1.96.0) over the workspace — the tree was
+  imported unformatted — so CI can gate on `cargo fmt -- --check`.
+- **Fixed the warn-level clippy findings in `braid`, `rnk` and `v2v`** so that
+  `cargo clippy --workspace --exclude vsc --all-targets --no-deps -- -D
+  warnings` passes (the CI invocation; `--no-deps` keeps `-D warnings` from
+  leaking into `vsc`, which every workspace clippy run otherwise compiles with
+  the same flags). Mechanical changes: removed clones of `Copy` types and
+  same-type casts, `is_multiple_of`/`filter_map`/needless-borrow cleanups, a
+  `&PathBuf` parameter became `&Path`, a boxed-closure type alias in a test,
+  and a duplicated `allow(dead_code)` removed. Three lints are allowed rather
+  than refactored: `too_many_arguments` on two protocol functions and one
+  spec-shaped RO helper, `items_after_test_module` in `v2v::wire::protinfo`,
+  and `inherent_to_string` in `rnk` (its `to_string` is JSON serialization
+  paired with `from_string`). `crates/vsc` is untouched: its lib passes clippy
+  at upstream's own lint levels (`cargo clippy -p vsc --no-deps`), and its test
+  modules/example still fail those levels as noted above.
+- **Added `.github/workflows/wbraid.yml`**: fmt + clippy (the two invocations
+  above), `cargo test --release`, and a `wasm-core` build for
+  `wasm32-unknown-unknown`, on pushes/PRs touching `packages/wbraid/`. The
+  shared `setup-rust-tests` action gained optional `components`/`targets`
+  inputs for this (defaults unchanged).
+
 ## Local modifications for clippy
 
 The tree was imported with warn-level clippy findings in `braid`, `rnk` and

packages/wbraid/TESTING.md

@@ -50,19 +50,30 @@ regardless of the test. They differ in the *client* board setup:
   `SqlitePersistence`.
 
 ```sh
-# Terminal 1:  .\localstack.ps1     (S3 via LocalStack)
-# Terminal 2:  .\b4.ps1             (b4 server on :3000)
+# Terminal 1:  .\localstack.ps1     (S3 via LocalStack)      [bash: ./localstack.sh]
+# Terminal 2:  .\b4.ps1             (b4 server on :3000)     [bash: ./b4.sh]
 # Terminal 3:
 cargo test -p braid --release -- --ignored
 ```
 
+Each `.ps1` has a bash twin of the same name for the devcontainer; the flags
+map one-to-one (`.\b4.ps1 -Reset -NoRun` ⇄ `./b4.sh --reset --no-run`).
+
 ### Prerequisites
 
 - A stable Rust toolchain (for the default build).
 - For the live-b4 tests: **Docker** + the **AWS CLI** — `localstack.ps1` starts
   LocalStack, creates the `wbraid-messages` bucket, and applies `s3-cors.json` —
   and the **`b4`** server (`b4.ps1` sets the S3 endpoint/credentials and points
-  `DATABASE_URL` at a repo-root `b4.db`).
+  `DATABASE_URL` at a repo-root `b4.db`). In the devcontainer, `localstack.sh`
+  starts the `localstack` compose service instead (opt-in `wbraid` profile in
+  `.devcontainer/docker-compose-base.yml`) and the endpoint is
+  `http://localstack:4566` on the project network — `b4.sh` picks the right
+  endpoint automatically, and falls back to the `amazon/aws-cli` docker image
+  when the AWS CLI is not installed. The image is pinned to
+  `localstack/localstack:4`: from the 2026 releases on, `latest` exits at
+  startup without an auth token, so a fresh pull of `latest` (which
+  `localstack.ps1` does) no longer works.
 
 ## Wasm
 
@@ -84,7 +95,7 @@ provide COOP/COEP) — backed by the native protocol tests above.
 
 ```sh
 # From the repo root (wbraid/), NOT crates/braid.
-.\test-wasm.ps1
+.\test-wasm.ps1         # bash: ./test-wasm.sh
 ```
 
 Runs a `wasm-bindgen-test` (`tests/wasm_indexeddb.rs`) exercising the
@@ -113,6 +124,9 @@ validation that the protocol runs correctly under wasm.
 .\serve.ps1             # clears RUSTFLAGS, builds the wasm client (build-wasm.ps1,
                         # nightly + atomics + wasm-bindgen-rayon), then serves on
                         # :8080 with COOP/COEP (server.py)
+
+# bash: ./localstack.sh / ./b4.sh / ./serve.sh. In the devcontainer :8080 is
+# taken by Hasura, so use e.g. `PORT=8081 ./serve.sh` (server.py honours PORT).
 ```
 
 Then open <http://127.0.0.1:8080/emulator.html> and:
@@ -142,7 +156,8 @@ above).
 - A **nightly** toolchain — for the production wasm build (`build-wasm.ps1` sets a
   nightly override under `crates/braid`, whose `.cargo/config.toml` forces the
   atomics target-features), plus **Python** for `server.py` (the COOP/COEP dev
-  server).
+  server). `build-wasm.sh` instead stays on stable and uses `RUSTC_BOOTSTRAP=1`
+  (the toolchain must ship `rust-src`; the devcontainer's does).
 - For the emulator: **Docker/LocalStack** + **`b4`**, as in the Native live-b4
   prerequisites.
 - **`RUSTFLAGS` caveat** — clear any inherited `RUSTFLAGS` before the headless test