Sync sanitized implementation and public CI

.github/ci-policy.yml

@@ -0,0 +1,5 @@
+version: 1
+workflows:
+  .github/workflows/ci.yml: fast
+  .github/workflows/fuzz.yml: deep
+  .github/workflows/interoperability.yml: deep

.github/workflows/actions-policy.yml

@@ -9,8 +9,6 @@ on:
     paths:
       - '.github/workflows/**'
       - '.github/dependabot.yml'
-  schedule:
-    - cron: '53 4 * * 1'
   workflow_dispatch:
 
 permissions:

.github/workflows/ci.yml

@@ -1,9 +1,13 @@
 name: CI
 
 on:
-  push:
-    branches: [main]
   pull_request:
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+  workflow_dispatch:
+  schedule:
+    - cron: '7 3 * * 1'
 
 permissions:
   contents: read
@@ -14,6 +18,7 @@
 
 jobs:
   build-and-test:
+    if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-24.04
     timeout-minutes: 45
     steps:
@@ -27,6 +32,11 @@
           rustup toolchain install 1.97.0 --profile minimal --component rustfmt
           rustup default 1.97.0
 
+      - name: Install optional OCSP build dependencies
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends libssl-dev pkg-config
+
       - name: Check formatting
         run: cargo fmt --all --check
 
@@ -36,6 +46,9 @@
       - name: Check profiling build
         run: cargo check -p httpjet --bin httpjet --features profiling --locked
 
+      - name: Replay HTTP/1 framing and chunked corpus
+        run: cargo test --locked -p httpjet --test h1_corpus -- --nocapture
+
       - name: Reject the CDDL flamegraph dependency
         run: |
           if cargo tree --all-features -i inferno >/tmp/inferno-tree 2>&1; then
@@ -77,3 +90,49 @@
 
       - name: Verify DCO sign-offs
         run: scripts/check-dco.sh "${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}"
+
+  linux-matrix:
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [ubuntu-22.04, ubuntu-24.04-arm]
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 45
+    env:
+      CARGO_BUILD_JOBS: '2'
+      CARGO_INCREMENTAL: '0'
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
+      - name: Install Rust
+        run: rustup toolchain install 1.97.0 --profile minimal
+      - name: Install optional OCSP build dependencies
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends libssl-dev pkg-config
+      - name: Record platform and check feature builds
+        run: |
+          uname -a
+          rustc +1.97.0 -Vv
+          cargo +1.97.0 check --locked -p httpjet --all-features
+      - name: Replay parser corpus
+        run: cargo +1.97.0 test --locked -p httpjet --test h1_corpus -- --nocapture
+      - name: Exercise native io_uring H1 and H2
+        # A denied io_uring operation fails the job; it is not silently skipped.
+        run: cargo +1.97.0 test --locked -p httpjet uring::uds_tests::uds_listener_serves_h1_and_h2c_with_unix_peer
+
+  oci-smoke:
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    steps:
+      - name: Check out source
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
+      - name: Install HTTP/3 smoke client
+        run: python3 -m pip install --disable-pip-version-check aioquic==1.3.0
+      - name: Build and run non-privileged OCI example
+        run: bash scripts/oci-smoke.sh

.github/workflows/fuzz.yml

@@ -0,0 +1,46 @@
+name: Bounded fuzzing
+
+on:
+  schedule:
+    - cron: '23 4 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fuzz-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  fuzz:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 35
+    strategy:
+      fail-fast: false
+      max-parallel: 2
+      matrix:
+        target: [h1_chunked_decode, h1_request_framing, hpack_decode, hpack_roundtrip, lsapi_resp_header]
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
+      - name: Install pinned fuzz toolchain
+        run: |
+          rustup toolchain install nightly-2026-08-31 --profile minimal --component rust-src
+          cargo +nightly-2026-08-31 install cargo-fuzz --version 0.13.2 --locked
+      - name: Run bounded ASan fuzz target
+        env:
+          FUZZ_SECONDS: '300'
+          FUZZ_TARGET: ${{ matrix.target }}
+        run: bash scripts/fuzz-bounded.sh "$FUZZ_TARGET"
+      - name: Preserve corpus and crash artifacts
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: fuzz-${{ matrix.target }}-${{ github.run_id }}
+          path: |
+            fuzz/artifacts/${{ matrix.target }}/
+            fuzz/corpus/${{ matrix.target }}/
+            fuzz/Cargo.lock
+          retention-days: 14

.github/workflows/interoperability.yml

@@ -0,0 +1,71 @@
+name: Protocol interoperability
+
+on:
+  schedule:
+    - cron: '17 3 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: interop-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  protocols:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    env:
+      CARGO_BUILD_JOBS: '2'
+      CARGO_INCREMENTAL: '0'
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
+      - name: Install test dependencies
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends libssl-dev pkg-config
+          rustup toolchain install 1.97.0 --profile minimal
+          rustup default 1.97.0
+          python3 -m venv "$RUNNER_TEMP/h3-venv"
+          "$RUNNER_TEMP/h3-venv/bin/pip" install 'aioquic==1.3.0' 'h2==4.4.1' 'cryptography==50.0.1'
+          echo "$RUNNER_TEMP/h3-venv/bin" >> "$GITHUB_PATH"
+          curl --fail --location --max-time 60 https://github.com/summerwind/h2spec/releases/download/v2.6.0/h2spec_linux_amd64.tar.gz -o "$RUNNER_TEMP/h2spec.tar.gz"
+          echo "157ee0de702e01ad40e752dbf074b366027e550c8e7504f9450da2809e279318  $RUNNER_TEMP/h2spec.tar.gz" | sha256sum --check
+          tar -xzf "$RUNNER_TEMP/h2spec.tar.gz" -C "$RUNNER_TEMP" h2spec
+      - name: Build synthetic server
+        # Debug is acceptable for correctness; this is not a throughput benchmark.
+        run: cargo build --locked -p httpjet --features otel --bin httpjet
+      - name: H2 canonical conformance against synthetic TLS fixture
+        run: python3 -B scripts/ci-h2spec.py --binary target/debug/httpjet --h2spec "$RUNNER_TEMP/h2spec"
+      - name: H1 WebSocket and H2 dispatch tracing
+        run: cargo test --locked -p httpjet --features otel traced_fast_and_bridged_requests
+      - name: H3 actual QUIC transfers and tracing
+        run: cargo test --locked -p httpjet --features otel traced_quic_roundtrip -- --ignored
+      - name: OCSP real TLS policy and certificate lifecycle
+        run: |
+          cargo test --locked -p hj-ocsp
+          cargo test --locked -p hj-tls --features ocsp ocsp::tests
+          cargo build --locked -p httpjet --features ocsp,acme --bin httpjet
+          python3 -B scripts/ocsp-runtime-test.py --binary target/debug/httpjet
+          python3 -B scripts/ocsp-runtime-test.py --binary target/debug/httpjet --optional
+          python3 -B scripts/ocsp-runtime-test.py --binary target/debug/httpjet --optional --must-staple
+      - name: Build pinned local ACME test CA
+        env:
+          GOTOOLCHAIN: go1.24.2
+          GOMAXPROCS: '2'
+        run: |
+          GOBIN="$RUNNER_TEMP/acme-tools" go install github.com/letsencrypt/pebble/v2/cmd/pebble@v2.10.1
+          GOBIN="$RUNNER_TEMP/acme-tools" go install github.com/letsencrypt/pebble/v2/cmd/pebble-challtestsrv@v2.10.1
+          echo "HJ_PEBBLE_BIN=$RUNNER_TEMP/acme-tools/pebble" >> "$GITHUB_ENV"
+          echo "HJ_PEBBLE_DNS_BIN=$RUNNER_TEMP/acme-tools/pebble-challtestsrv" >> "$GITHUB_ENV"
+          echo "HJ_PEBBLE_SOURCE=$(go env GOMODCACHE)/github.com/letsencrypt/pebble/v2@v2.10.1" >> "$GITHUB_ENV"
+      - name: ACME issued-order recovery and renewal
+        run: cargo test --locked -p hj-acme pebble_issuance_recovery_and_renewal -- --ignored
+      - name: ACME real server bootstrap and H1 H2 H3 activation
+        run: |
+          cargo build --locked -p httpjet --features acme --bin httpjet
+          python3 scripts/acme-pebble-test.py --binary target/debug/httpjet --pebble "$HJ_PEBBLE_BIN" --dns "$HJ_PEBBLE_DNS_BIN" --pebble-source "$HJ_PEBBLE_SOURCE" --bootstrap
+          python3 scripts/acme-pebble-test.py --binary target/debug/httpjet --pebble "$HJ_PEBBLE_BIN" --dns "$HJ_PEBBLE_DNS_BIN" --pebble-source "$HJ_PEBBLE_SOURCE" --bootstrap --dns01

.gitignore

@@ -24,3 +24,6 @@ conf/
 # The public, synthetic quick-start fixture is safe and intentionally versioned.
 !examples/litespeed/conf/
 !examples/litespeed/conf/**
+# The OCI quick-start uses a second synthetic, non-secret config fixture.
+!packaging/oci/litespeed/conf/
+!packaging/oci/litespeed/conf/**