feat(mlow): complete codec evidence and own oracle tooling

.cargo/config.toml

@@ -1,3 +1,6 @@
+[alias]
+xt = "run --quiet --release -p whatsapp-xtask --"
+
 # Workspace build configuration. Applies to builds of THIS repo only —
 # crates.io consumers are unaffected (cargo does not inherit this file
 # across package boundaries).

.github/workflows/binary-size.yml

@@ -73,7 +73,7 @@ jobs:
       - name: Install ALSA dev headers
         run: sudo apt-get update && sudo apt-get install -y libasound2-dev
       - name: Measure binary size
-        run: python3 scripts/ci/measure_binary_size.py --out-dir size-out
+        run: cargo xt ci measure-binary-size --out-dir size-out
 
       - name: Upload size artifacts
         uses: actions/upload-artifact@v7
@@ -86,22 +86,7 @@ jobs:
         id: baseline
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          # --event push: a fork PR from a branch named "main" also matches
-          # --branch main, and its artifact must not become the baseline.
-          run_id=$(gh run list --workflow binary-size.yml --branch main \
-            --event push --status success --limit 1 --json databaseId \
-            --jq '.[0].databaseId' || true)
-          if [ -n "$run_id" ] && [ "$run_id" != "null" ]; then
-            if gh run download "$run_id" --name size-metrics --dir base-out; then
-              echo "dir=base-out" >> "$GITHUB_OUTPUT"
-            else
-              echo "Baseline artifact missing or expired on run $run_id"
-            fi
-          else
-            echo "No successful Binary Size run on main yet"
-          fi
-
+        run: cargo xt ci workflow size-baseline
       # Informational (job summary); the real gate is the report script below.
       # Tolerates the window before the first push run creates the series.
       - name: Compare against gh-pages series
@@ -124,50 +109,24 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          allow=$(gh api \
-            "repos/${{ github.repository }}/issues/${PR_NUMBER}/labels" \
-            --jq 'map(.name) | index("size-increase-ok") != null')
-          echo "allow=$allow" >> "$GITHUB_OUTPUT"
-
+        run: cargo xt ci workflow size-override
       # No GH_TOKEN here: the report script is PR-controlled code.
       - name: Generate report and evaluate gate
         env:
           BASE_DIR: ${{ steps.baseline.outputs.dir }}
           ALLOW_SIZE_INCREASE: ${{ steps.override.outputs.allow }}
         run: |
-          python3 scripts/ci/binary_size_report.py --head size-out \
-            ${BASE_DIR:+--base "$BASE_DIR"} --out-dir size-out
-          cat size-out/report.md >> "$GITHUB_STEP_SUMMARY"
-
+          cargo xt ci binary-size-report --head size-out --out-dir size-out
+          cargo xt ci workflow append-summary size-out/report.md
       # Fork PRs run with a read-only token, so they only get the job summary.
       - name: Post sticky PR comment
         if: github.event.pull_request.head.repo.full_name == github.repository
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          marker='<!-- binary-size-report -->'
-          cid=$(gh api "repos/${{ github.repository }}/issues/${PR_NUMBER}/comments" \
-            --paginate \
-            --jq ".[] | select(.body | startswith(\"$marker\")) | .id" | head -n1)
-          if [ -n "$cid" ]; then
-            gh api -X PATCH "repos/${{ github.repository }}/issues/comments/${cid}" \
-              -F body=@size-out/report.md
-          else
-            gh api -X POST "repos/${{ github.repository }}/issues/${PR_NUMBER}/comments" \
-              -F body=@size-out/report.md
-          fi
-
+        run: cargo xt ci workflow size-comment
       - name: Enforce size budget
-        run: |
-          status=$(head -n1 size-out/gate.txt)
-          if [ "$status" = "FAIL" ]; then
-            echo "::error::Binary size budget exceeded — see the job summary or PR comment. If the increase is expected, add the size-increase-ok label."
-            exit 1
-          fi
-          echo "Gate status: $status"
-
+        run: cargo xt ci workflow size-gate
   binary-size-push:
     # Dispatch only publishes from main so stray branches can't pollute the series.
     if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')
@@ -214,7 +173,7 @@ jobs:
       - name: Install ALSA dev headers
         run: sudo apt-get update && sudo apt-get install -y libasound2-dev
       - name: Measure binary size
-        run: python3 scripts/ci/measure_binary_size.py --out-dir size-out
+        run: cargo xt ci measure-binary-size --out-dir size-out
 
       # This artifact is the comparison baseline for PR runs.
       - name: Upload size artifacts

.github/workflows/codspeed.yml

@@ -112,7 +112,7 @@ jobs:
       # image's own package lists, and only a miss on both refreshes them.
       - name: Key the libc6-dbg cache on the installed libc6
         id: libc6
-        run: echo "version=$(dpkg-query -W -f='${Version}' libc6)" >> "$GITHUB_OUTPUT"
+        run: cargo xt ci workflow libc-version
 
       # libc6-dbg must match libc6 exactly, so the installed libc6 version is
       # the cache key: it hits while the package is valid and misses the moment
@@ -126,56 +126,7 @@ jobs:
       - name: Bound apt and pre-install libc6-dbg
         env:
           LIBC6_VERSION: ${{ steps.libc6.outputs.version }}
-        run: |
-          sudo tee /etc/apt/apt.conf.d/99-ci-bounds > /dev/null <<'EOF'
-          Acquire::Retries "3";
-          Acquire::http::Timeout "20";
-          Acquire::https::Timeout "20";
-          DPkg::Lock::Timeout "60";
-          APT::Keep-Downloaded-Packages "true";
-          EOF
-          cache="$HOME/.cache/libc6-dbg"
-          mkdir -p "$cache"
-          if sudo dpkg -i "$cache"/*.deb 2>/dev/null; then
-            echo "installed from the cached package, no network"
-            exit 0
-          fi
-          save_deb() {
-            sudo cp /var/cache/apt/archives/libc6-dbg_*.deb "$cache"/ 2>/dev/null || true
-          }
-          # Pinned, because libc6-dbg carries `Depends: libc6 (= <version>)`:
-          # an unpinned install of a newer build pulls a libc6 upgrade with it,
-          # swapping the C library out from under benchmarks whose malloc
-          # tunables this workflow freezes for exactly that kind of stability.
-          # It would also cache a package the key, taken before the upgrade, no
-          # longer describes.
-          pinned="libc6-dbg=$LIBC6_VERSION"
-          if sudo timeout 120 apt-get install -y "$pinned"; then
-            save_deb
-            exit 0
-          fi
-          # `-q` and not `-qq`: if this ever stalls again, the per-source Get:
-          # lines are what identify which mirror is responsible.
-          for attempt in 1 2; do
-            if sudo timeout 180 apt-get update -q \
-              && sudo timeout 120 apt-get install -y "$pinned"; then
-              save_deb
-              exit 0
-            fi
-            echo "apt attempt $attempt failed"
-            sleep 15
-          done
-          # The pin is gone from the pool: the archive moved past the runner
-          # image and dropped the older build. Take the newer package anyway --
-          # the runner would install exactly the same thing, only after a
-          # multi-minute apt of its own -- but leave it out of the cache, where
-          # it would sit under a key it does not match and never install again.
-          if sudo timeout 120 apt-get install -y libc6-dbg; then
-            echo "::warning::installed a libc6-dbg newer than the image's libc6; not cached"
-            exit 0
-          fi
-          echo "::warning::libc6-dbg pre-install gave up; the runner installs it itself"
-
+        run: cargo xt ci workflow install-libc-debug
       - name: Install tools (protoc, cargo-codspeed)
         uses: taiki-e/install-action@v2
         with:
@@ -238,7 +189,7 @@ jobs:
         # under us shifts the instruction counts with no code change and
         # pollutes the CodSpeed baseline. Same freeze rationale as the malloc
         # thresholds above. Generated from .github/bartender-image.txt by
-        # scripts/ci/sync-bartender-image.sh.
+        # cargo xt ci sync-bartender-image.
         image: ghcr.io/whiskeysockets-devtools/bartender@sha256:9f3a49dd9f944414fbda50571bba5f66f2ab6fdc48001e6803d4c09a1042c78e
         credentials:
           username: ${{ github.actor }}
@@ -285,7 +236,7 @@ jobs:
       # image's own package lists, and only a miss on both refreshes them.
       - name: Key the libc6-dbg cache on the installed libc6
         id: libc6
-        run: echo "version=$(dpkg-query -W -f='${Version}' libc6)" >> "$GITHUB_OUTPUT"
+        run: cargo xt ci workflow libc-version
 
       # libc6-dbg must match libc6 exactly, so the installed libc6 version is
       # the cache key: it hits while the package is valid and misses the moment
@@ -299,56 +250,7 @@ jobs:
       - name: Bound apt and pre-install libc6-dbg
         env:
           LIBC6_VERSION: ${{ steps.libc6.outputs.version }}
-        run: |
-          sudo tee /etc/apt/apt.conf.d/99-ci-bounds > /dev/null <<'EOF'
-          Acquire::Retries "3";
-          Acquire::http::Timeout "20";
-          Acquire::https::Timeout "20";
-          DPkg::Lock::Timeout "60";
-          APT::Keep-Downloaded-Packages "true";
-          EOF
-          cache="$HOME/.cache/libc6-dbg"
-          mkdir -p "$cache"
-          if sudo dpkg -i "$cache"/*.deb 2>/dev/null; then
-            echo "installed from the cached package, no network"
-            exit 0
-          fi
-          save_deb() {
-            sudo cp /var/cache/apt/archives/libc6-dbg_*.deb "$cache"/ 2>/dev/null || true
-          }
-          # Pinned, because libc6-dbg carries `Depends: libc6 (= <version>)`:
-          # an unpinned install of a newer build pulls a libc6 upgrade with it,
-          # swapping the C library out from under benchmarks whose malloc
-          # tunables this workflow freezes for exactly that kind of stability.
-          # It would also cache a package the key, taken before the upgrade, no
-          # longer describes.
-          pinned="libc6-dbg=$LIBC6_VERSION"
-          if sudo timeout 120 apt-get install -y "$pinned"; then
-            save_deb
-            exit 0
-          fi
-          # `-q` and not `-qq`: if this ever stalls again, the per-source Get:
-          # lines are what identify which mirror is responsible.
-          for attempt in 1 2; do
-            if sudo timeout 180 apt-get update -q \
-              && sudo timeout 120 apt-get install -y "$pinned"; then
-              save_deb
-              exit 0
-            fi
-            echo "apt attempt $attempt failed"
-            sleep 15
-          done
-          # The pin is gone from the pool: the archive moved past the runner
-          # image and dropped the older build. Take the newer package anyway --
-          # the runner would install exactly the same thing, only after a
-          # multi-minute apt of its own -- but leave it out of the cache, where
-          # it would sit under a key it does not match and never install again.
-          if sudo timeout 120 apt-get install -y libc6-dbg; then
-            echo "::warning::installed a libc6-dbg newer than the image's libc6; not cached"
-            exit 0
-          fi
-          echo "::warning::libc6-dbg pre-install gave up; the runner installs it itself"
-
+        run: cargo xt ci workflow install-libc-debug
       - name: Install tools (protoc, cargo-codspeed)
         uses: taiki-e/install-action@v2
         with:
@@ -361,17 +263,7 @@ jobs:
           cache-targets: "false"
 
       - name: Wait for mock server
-        run: |
-          for i in $(seq 1 30); do
-            if curl -sk https://localhost:8080/ > /dev/null 2>&1; then
-              echo "Mock server is ready"
-              exit 0
-            fi
-            sleep 1
-          done
-          echo "Mock server failed to become ready"
-          exit 1
-
+        run: cargo xt ci workflow wait-for-mock
       # Integration benches run only the simulation (instruction-count)
       # instrument, NOT memory. send_and_receive drives a live async round-trip,
       # whose in-flight pipeline buffers (TLS/websocket/noise/decrypt/dispatch)

.github/workflows/copilot-setup-steps.yml

@@ -22,7 +22,7 @@ jobs:
     services:
       mock-server:
         # Generated from .github/bartender-image.txt by
-        # scripts/ci/sync-bartender-image.sh.
+        # cargo xt ci sync-bartender-image.
         image: ghcr.io/whiskeysockets-devtools/bartender@sha256:9f3a49dd9f944414fbda50571bba5f66f2ab6fdc48001e6803d4c09a1042c78e
         credentials:
           username: ${{ github.actor }}
@@ -57,17 +57,7 @@ jobs:
         run: cargo fetch
 
       - name: Wait for mock server
-        run: |
-          for i in $(seq 1 30); do
-            if curl -sk https://localhost:8080/ > /dev/null 2>&1; then
-              echo "Mock server is ready"
-              exit 0
-            fi
-            sleep 1
-          done
-          echo "Mock server failed to become ready"
-          exit 1
-
+        run: cargo xt ci workflow wait-for-mock
       - name: Export mock server URL
         run: |
           echo "MOCK_SERVER_URL=wss://127.0.0.1:8080/ws/chat" >> "$GITHUB_ENV"

.github/workflows/e2e.yml

@@ -36,7 +36,7 @@ jobs:
     services:
       mock-server:
         # Generated from .github/bartender-image.txt by
-        # scripts/ci/sync-bartender-image.sh.
+        # cargo xt ci sync-bartender-image.
         image: ghcr.io/whiskeysockets-devtools/bartender@sha256:9f3a49dd9f944414fbda50571bba5f66f2ab6fdc48001e6803d4c09a1042c78e
         credentials:
           username: ${{ github.actor }}
@@ -72,16 +72,7 @@ jobs:
         with:
           cache-targets: "true"
       - name: Wait for mock server
-        run: |
-          for i in $(seq 1 30); do
-            if curl -sk https://localhost:8080/ > /dev/null 2>&1; then
-              echo "Mock server is ready"
-              exit 0
-            fi
-            sleep 1
-          done
-          echo "Mock server failed to become ready"
-          exit 1
+        run: cargo xt ci workflow wait-for-mock
       # The `e2e` nextest profile (.config/nextest.toml) carries the hang guard.
       # No `--nocapture`: nextest captures per test and replays the output of the
       # failures only, so a red run is readable instead of 25 interleaved logs.
@@ -91,7 +82,7 @@ jobs:
           RUST_LOG: info
           NEXTEST_PROFILE: e2e
           TEST_TIMINGS_DIR: ${{ runner.temp }}/test-timings
-        run: scripts/ci/nextest_timed.sh e2e -p e2e-tests
+        run: cargo xt ci nextest-timed e2e -- -p e2e-tests
       - name: Publish test timings
         if: always()
         uses: actions/upload-artifact@v7