ci(bindings): run the Kotlin and Swift wire-contract tests on the shipped Binding Sets

.github/workflows/binding-layer-android.yaml

@@ -161,6 +161,12 @@ jobs:
       - name: Bundle the AAR
         run: gradle --project-dir bindings/android bundleReleaseAar
 
+      # The Kotlin wire-contract test of the proxy crate compiles against
+      # the Kotlin Binding Set that the AAR ships and asserts it against the
+      # crate's golden pins, which the Rust and Swift suites share.
+      - name: Run the Kotlin wire-contract test
+        run: gradle --project-dir bindings/android testReleaseUnitTest
+
       - name: Verify the AAR carries both libraries for every ABI
         run: |
           set -eu

.github/workflows/binding-layer-ios.yaml

@@ -84,6 +84,21 @@ jobs:
             --bin build-binding-layer -- \
             ios --out "${{ inputs.out }}"
 
+      # The Swift wire-contract test of the proxy crate compiles against
+      # the Swift Binding Set the package ships and asserts it against the
+      # crate's golden pins, which the Rust and Kotlin suites share. The
+      # XCFrameworks hold iOS slices only, so the test runs on a simulator.
+      - name: Run the Swift wire-contract test
+        working-directory: zingo-netutils/nym-proxy-ffi/contract-tests
+        run: |
+          set -euo pipefail
+          simulator="$(xcrun simctl list devices available iPhone -j \
+            | python3 -c 'import json,sys; print(next(d["name"] for devices in json.load(sys.stdin)["devices"].values() for d in devices))')"
+          xcodebuild test \
+            -scheme GoldenWireContractTests \
+            -destination "platform=iOS Simulator,name=$simulator" \
+            | tail -40
+
       - name: Upload the Binding Layer
         uses: actions/upload-artifact@v4
         with:

bindings/android/build.gradle.kts

@@ -9,6 +9,10 @@ val bindingNdkVersion = "28.2.13676358"
 val jvmTargetVersion = JavaVersion.VERSION_17
 val jnaDependency = "net.java.dev.jna:jna:5.18.1@aar"
 val annotationDependency = "androidx.annotation:annotation:1.8.1"
+val junitDependency = "junit:junit:4.13.2"
+val proxyCrate = "../../zingo-netutils/nym-proxy-ffi"
+val contractTests = "$proxyCrate/contract-tests/kotlin"
+val goldenDir = "$proxyCrate/test-data/golden"
 
 group = "org.zingolabs"
 
@@ -59,6 +63,15 @@ android {
             java.srcDir(layerOutput.map { it.dir("kotlin") })
             jniLibs.srcDir(layerOutput.map { it.dir("jniLibs") })
         }
+        getByName("test") {
+            java.srcDir(contractTests)
+        }
+    }
+
+    testOptions {
+        unitTests.all {
+            it.systemProperty("zingo.golden.dir", file(goldenDir).absolutePath)
+        }
     }
 }
 
@@ -75,4 +88,5 @@ tasks.named("preBuild") {
 dependencies {
     api(jnaDependency)
     compileOnly(annotationDependency)
+    testImplementation(junitDependency)
 }

zingo-netutils/nym-proxy-ffi/contract-tests/Package.swift

@@ -0,0 +1,17 @@
+// swift-tools-version:5.9
+import PackageDescription
+
+let package = Package(
+    name: "ZingoBindingsContractTests",
+    platforms: [.iOS("16.0")],
+    dependencies: [
+        .package(name: "ZingoBindings", path: "../../../bindings/swift"),
+    ],
+    targets: [
+        .testTarget(
+            name: "GoldenWireContractTests",
+            dependencies: [.product(name: "ZingoBindings", package: "ZingoBindings")],
+            path: "swift"
+        ),
+    ]
+)

zingo-netutils/nym-proxy-ffi/contract-tests/swift/GoldenWireContractTests.swift

@@ -12,6 +12,7 @@
 
 import Foundation
 import XCTest
+@testable import ZingoBindings
 
 final class GoldenWireContractTests: XCTestCase {
     private func goldenDir() -> URL {
@@ -21,6 +22,7 @@ final class GoldenWireContractTests: XCTestCase {
         return URL(fileURLWithPath: #filePath)
             .deletingLastPathComponent() // swift/
             .deletingLastPathComponent() // contract-tests/
+            .deletingLastPathComponent() // nym-proxy-ffi/
             .appendingPathComponent("test-data/golden")
     }
 

zingolib/CONTEXT.md

@@ -325,7 +325,13 @@
 
 **RN Bridge** — A React Native app's native modules and app shell, which marshal calls between JavaScript and the Binding Layer. Beyond marshalling it owns one thing, the app-serviced host of the Mixnet Session: it holds the Nym proxy's handle, watches for the proxy's death, and releases the handle. Each React Native consumer keeps its own RN Bridge in its own repository. Ruled 2026-09-23, pending review. *Avoid*: native modules (names the mechanism, not the role), FFI. See `zingo-adrs zingolib/0054`.
 
-**Prebuilt Bundle** — A compiled native artifact of the Binding Layer, such as an Android `.so` set or an iOS XCFramework, that one repository builds and another consumes without rebuilding it. Ruled 2026-09-23, pending review. *Avoid*: bundle alone, and never "bundle" for grouping changes into one pull request. See `zingo-adrs zingolib/0054`.
+**Prebuilt Bundle** — The compiled and packaged Binding Layer for one platform, which zingolib builds and publishes and a consumer fetches without rebuilding it. The Android Prebuilt Bundle is an AAR holding the four ABIs' native libraries and the compiled Kotlin Binding Sets; the iOS Prebuilt Bundle is the `ZingoBindings` Swift package holding the two XCFrameworks and the Swift Binding Sets. Ruled 2026-09-23 as a loose `.so` set or XCFramework; restated 2026-10-12 to the packaged form that #2833 publishes. *Avoid*: bundle alone, and never "bundle" for grouping changes into one pull request. See `zingo-adrs zingolib/0054`.
+
+**Binding Set** — The generated source code that projects one Binding Layer crate into one language: the Kotlin or the Swift output of UniFFI for the wallet crate or the Nym proxy crate. A Prebuilt Bundle carries one Binding Set per crate for its platform. Ruled 2026-10-12. *Avoid*: the bindings (ambiguous between one Binding Set and the whole Binding Layer).
+
+**Binding Layer Endpoint** — One function or method that the Binding Layer exports to foreign code, such as `get_version`. A consumer's RN Bridge adds one native method per Binding Layer Endpoint it uses. Ruled 2026-10-12. *Avoid*: binding alone, FFI call.
+
+**Bundle Pin** — A consumer's fixed choice of zingolib's Prebuilt Bundles: one zingolib commit, and the digest of that commit's bundle for each platform the consumer uses, kept in one lock file in the consumer's repository. The commit's tag in the registry never moves, and the pin holds the commit to its recorded digests. Ruled 2026-10-12. *Avoid*: the submodule pin (the pin zingo-mobile held before #2930), the lock alone.
 
 ---