feat(bus): expose canonical document storage needs

.github/workflows/ci.yml

@@ -9,6 +9,16 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 jobs:
+  release-workflow-test:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - name: Test release routing and input guards
+        run: python3 scripts/test-release-workflow.py
   module-ci:
     uses: tinyhumansai/.github/.github/workflows/module-ci.yml@4adc1080fb495098e7af1aade82ed7e6e3c69bb7
     with:

.github/workflows/release.yml

@@ -6,6 +6,16 @@ on:
         description: Existing version tag (vX.Y.Z) committed through a reviewed PR
         type: string
         required: true
+      release_mode:
+        description: Use the ordinary main path or reviewed-epic release admission
+        type: choice
+        options: [main, reviewed-epic]
+        default: main
+        required: true
+      reviewed_pr:
+        description: Positive canonical PR number whose merge commit the tag names (reviewed-epic mode only)
+        type: number
+        required: false
   push:
     tags: ['v*']
 permissions: {}
@@ -18,11 +28,15 @@ jobs:
     outputs:
       tag: ${{ steps.tag.outputs.tag }}
       version: ${{ steps.tag.outputs.version }}
+      release_mode: ${{ steps.tag.outputs.release_mode }}
+      reviewed_pr: ${{ steps.tag.outputs.reviewed_pr }}
     steps:
       - id: tag
         shell: bash
         env:
           TAG: ${{ github.event_name == 'push' && github.ref_name || inputs.tag }}
+          RELEASE_MODE: ${{ github.event_name == 'push' && 'main' || inputs.release_mode }}
+          REVIEWED_PR: ${{ inputs.reviewed_pr }}
         run: |
           set -euo pipefail
           [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([+-][0-9A-Za-z.-]+)?$ ]] || {
@@ -31,8 +45,30 @@ jobs:
           }
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
+          [[ "$RELEASE_MODE" == main || "$RELEASE_MODE" == reviewed-epic ]] || {
+            echo "release_mode must be main or reviewed-epic" >&2
+            exit 2
+          }
+          if [[ "$RELEASE_MODE" == reviewed-epic ]]; then
+            [[ "$REVIEWED_PR" =~ ^[1-9][0-9]*$ ]] || {
+              echo "reviewed_pr must be a positive integer in reviewed-epic mode" >&2
+              exit 2
+            }
+          else
+            [[ -z "$REVIEWED_PR" || "$REVIEWED_PR" == 0 ]] || {
+              echo "reviewed_pr is only valid in reviewed-epic mode" >&2
+              exit 2
+            }
+            REVIEWED_PR=""
+          fi
+          {
+            echo "release_mode=$RELEASE_MODE"
+            # The reusable workflow input is numeric; zero is the ordinary-path sentinel.
+            echo "reviewed_pr=${REVIEWED_PR:-0}"
+          } >> "$GITHUB_OUTPUT"
   module-release:
     needs: resolve
+    if: needs.resolve.outputs.release_mode == 'main'
     permissions:
       contents: write
     uses: tinyhumansai/.github/.github/workflows/module-release.yml@4adc1080fb495098e7af1aade82ed7e6e3c69bb7
@@ -41,3 +77,16 @@ jobs:
       version: ${{ needs.resolve.outputs.version }}
       module-crate: tinybox-module
       asset-name: tinybox
+  module-reviewed-epic-release:
+    needs: resolve
+    if: needs.resolve.outputs.release_mode == 'reviewed-epic'
+    permissions:
+      contents: write
+      pull-requests: read
+      checks: read
+      actions: read
+    uses: tinyhumansai/.github/.github/workflows/module-reviewed-epic-release.yml@837d0424c7f38e4293f41c795f12ed5eb5dd7280
+    with:
+      tag: ${{ needs.resolve.outputs.tag }}
+      version: ${{ needs.resolve.outputs.version }}
+      reviewed-pr: ${{ fromJSON(needs.resolve.outputs.reviewed_pr || '0') }}

.gitignore

@@ -1,5 +1,6 @@
 # Build output
 /target/
+/crates/tinybox-bus/pure-consumer/target/
 **/*.rs.bk
 *.pdb
 

CONTRIBUTING.md

@@ -104,3 +104,5 @@ Do not report vulnerabilities through public issues. Follow the process in
 ## Releasing
 
 Change the Cargo package versions through a reviewed PR. After it merges, tag that commit as vX.Y.Z and push the tag, or dispatch Release with an existing version tag. The shared release verifies the package version, builds and loads all 17 native and distro artifacts, and publishes their checksum manifest. Release does not push version bumps to main.
+
+The TinyBox bus also has an independent pure-consumer workspace and committed lockfile at `crates/tinybox-bus/pure-consumer/`. When changing the workspace package version or the storage metadata pin, refresh that lock with `cargo generate-lockfile --manifest-path crates/tinybox-bus/pure-consumer/Cargo.toml` and commit it with the change. CI runs the consumer with `--locked` and checks its full dependency and feature graph, so a stale proof lock blocks the reviewed release commit.