feat(node): serve authenticated browser clients over WebRTC Direct

.github/workflows/ci.yml

@@ -12,6 +12,15 @@ env:
   FOUNDRY_VERSION: v1.7.1
 
 jobs:
+  msrv:
+    name: Rust 1.91 MSRV
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@1.91.0
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo check --all-targets --all-features --locked
+
   fmt:
     name: Format Check
     runs-on: ubuntu-latest
@@ -101,6 +110,8 @@ jobs:
           # noticing. This is what makes that loud.
           grep -qE 'test result: ok\. [1-9]' /tmp/scale.log \
             || { echo 'scale ran no tests'; exit 1; }
+      - name: Run browser RPC privacy regressions
+        run: cargo test --test webrtc_direct_devnet
       - name: Run e2e tests
         run: cargo test --test e2e --features test-utils -- --test-threads=1
       - name: Run v12 storage-bound audit attack PoCs
@@ -245,9 +256,29 @@ jobs:
         uses: foundry-rs/foundry-toolchain@v1
         with:
           version: ${{ env.FOUNDRY_VERSION }}
+      # Compile without cfg(test) too: browser unit tests can otherwise hide
+      # unused helpers whose production callers require webrtc-direct.
+      - name: Check library without default features
+        run: cargo check --lib --no-default-features --locked
       - name: Run unit tests without logging
         run: cargo test --lib --no-default-features
 
+  browser-devnet:
+    name: WebRTC Direct five-node devnet
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - name: Install Foundry
+        uses: foundry-rs/foundry-toolchain@v1
+        with:
+          version: ${{ env.FOUNDRY_VERSION }}
+      - name: Run persistent-session discovery and transfer test
+        run: >-
+          cargo test --test webrtc_direct_devnet --features test-utils
+          -- --ignored --test-threads=1
+
   security:
     name: Security Audit
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -349,7 +349,8 @@ jobs:
     name: Publish to crates.io
     needs: [validate]
     runs-on: ubuntu-latest
-    if: github.event.inputs.dry_run != 'true' && needs.validate.outputs.is_prerelease != 'true'
+    # Dry runs must exercise registry dependency resolution and package verification.
+    if: needs.validate.outputs.is_prerelease != 'true'
     steps:
       - uses: actions/checkout@v4
 
@@ -362,6 +363,7 @@ jobs:
         run: cargo publish --dry-run --allow-dirty
 
       - name: Publish to crates.io
+        if: github.event.inputs.dry_run != 'true'
         run: cargo publish --no-verify --allow-dirty
         env:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_IO_TOKEN }}