feat(decider): make the platform production-ready beyond its first consumer

.config/mise/tasks/artifacts/wasm-components

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+#MISE description="Build every rsworkspace/wasm-components/* decider to dist/decider/<name>.wasm"
+#MISE depends=["proto:schedules-descriptor-set", "rust:wasm-target"]
+#
+# `proto:schedules-descriptor-set` only feeds the schedules component's own dist
+# artifact (copied below when present); it is not required by, and does not
+# block, other components.
+set -euo pipefail
+
+ROOT="${GITHUB_WORKSPACE:-$(git rev-parse --show-toplevel)}"
+cd "$ROOT/rsworkspace"
+
+mkdir -p dist/decider
+for manifest in wasm-components/*/Cargo.toml; do
+    crate_dir="$(dirname "$manifest")"
+    crate="$(basename "$crate_dir")"
+    crate_file="${crate//-/_}"
+    alias="${crate#trogon-}"
+    alias="${alias%-decider}"
+    cargo component build -p "$crate" --target wasm32-unknown-unknown --release
+    cp "target/wasm32-unknown-unknown/release/${crate_file}.wasm" "dist/decider/${alias}.wasm"
+    binpb="target/wasm32-unknown-unknown/release/${crate_file}.binpb"
+    if [[ -f "$binpb" ]]; then
+        cp "$binpb" "dist/decider/${alias}.binpb"
+    fi
+done

.config/mise/tasks/github-actions/build-release-binary

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+#MISE description="Build the acp-nats-stdio release binary for TARGET, via cross when USE_CROSS=true"
+set -euo pipefail
+
+: "${USE_CROSS:?USE_CROSS is required}"
+: "${TARGET:?TARGET is required}"
+
+ROOT="${GITHUB_WORKSPACE:-$(git rev-parse --show-toplevel)}"
+cd "$ROOT/rsworkspace"
+
+if [[ "$USE_CROSS" == "true" ]]; then
+    cross build --release --target "$TARGET" -p acp-nats-stdio
+else
+    cargo build --release --target "$TARGET" -p acp-nats-stdio
+fi

.config/mise/tasks/github-actions/decider-test-suites

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+#MISE description="Run wasm decider conformance: sim schedules suite, macro compile-fail tests, and every decider-test YAML fixture"
+set -euo pipefail
+
+ROOT="${GITHUB_WORKSPACE:-$(git rev-parse --show-toplevel)}"
+cd "$ROOT/rsworkspace"
+
+cargo test -p trogon-decider-sim --test schedules --features test-support
+cargo test -p trogon-decider-guest-macros --test compile_fail
+cargo build -p trogon-decider-test --release
+
+shopt -s nullglob
+for wasm in dist/decider/*.wasm; do
+    alias="$(basename "$wasm" .wasm)"
+    yaml="cli/trogon-decider-test/${alias}.yaml"
+    if [[ -f "$yaml" ]]; then
+        ./target/release/decider-test "$wasm" "$yaml"
+    else
+        echo "no decider-test fixture for $alias ($yaml not found); skipping"
+    fi
+done

.config/mise/tasks/github-actions/dylint-tests

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+#MISE description="Run the repo Rust policy lint crate's own tests on its pinned dylint toolchain"
+set -euo pipefail
+
+ROOT="${GITHUB_WORKSPACE:-$(git rev-parse --show-toplevel)}"
+cd "$ROOT/rsworkspace/dylints/trogon_lints"
+
+dylint_toolchain="$(python - <<'PY'
+import tomllib
+
+with open("rust-toolchain.toml", "rb") as toolchain_file:
+    print(tomllib.load(toolchain_file)["toolchain"]["channel"])
+PY
+)"
+
+rustup run "$dylint_toolchain" cargo test

.config/mise/tasks/github-actions/image-audit-summary

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+#MISE description="Append the canary image security audit report to GITHUB_STEP_SUMMARY"
+set -euo pipefail
+
+: "${SERVICE:?SERVICE is required}"
+: "${IMAGE_NAME:?IMAGE_NAME is required}"
+: "${IMAGE_DIGEST:?IMAGE_DIGEST is required}"
+: "${RUNTIME_BASE:?RUNTIME_BASE is required}"
+: "${GITHUB_STEP_SUMMARY:?GITHUB_STEP_SUMMARY is required}"
+
+{
+    echo "## Image security audit: \`${SERVICE}\`"
+    echo ""
+    echo "- Image: \`${IMAGE_NAME}@${IMAGE_DIGEST}\`"
+    echo "- Runtime base: \`${RUNTIME_BASE}\`"
+    echo "- SBOM artifact: \`sbom-${SERVICE}-spdx\` (SPDX JSON)"
+    echo ""
+    echo "### Vulnerability scan (Trivy, image packages)"
+    echo '```text'
+    cat trivy-results.txt
+    echo '```'
+} >>"$GITHUB_STEP_SUMMARY"

.config/mise/tasks/github-actions/package-release-binary

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+#MISE description="Package the built acp-nats-stdio binary into a versioned tarball and export ASSET via GITHUB_ENV"
+set -euo pipefail
+
+: "${VERSION:?VERSION is required}"
+: "${TARGET:?TARGET is required}"
+: "${GITHUB_ENV:?GITHUB_ENV is required}"
+
+ROOT="${GITHUB_WORKSPACE:-$(git rev-parse --show-toplevel)}"
+cd "$ROOT"
+
+staging="acp-nats-stdio-${VERSION}-${TARGET}"
+mkdir -p "$staging"
+cp "rsworkspace/target/${TARGET}/release/acp-nats-stdio" "$staging/"
+tar czf "$staging.tar.gz" "$staging"
+echo "ASSET=$staging.tar.gz" >>"$GITHUB_ENV"

.config/mise/tasks/github-actions/release-upload

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+#MISE description="Create the GitHub release for the current tag if missing and upload all artifacts"
+set -euo pipefail
+
+: "${GITHUB_REF_NAME:?GITHUB_REF_NAME is required}"
+: "${GH_TOKEN:?GH_TOKEN is required}"
+
+gh release view "$GITHUB_REF_NAME" ||
+    gh release create "$GITHUB_REF_NAME" --title "$GITHUB_REF_NAME" --generate-notes
+gh release upload "$GITHUB_REF_NAME" artifacts/* --clobber

.config/mise/tasks/github-actions/resolve-image

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+#MISE description="Resolve the canary container image name and short SHA into GITHUB_OUTPUT"
+set -euo pipefail
+
+: "${IMAGE_OWNER:?IMAGE_OWNER is required}"
+: "${SERVICE_IMAGE:?SERVICE_IMAGE is required}"
+: "${GITHUB_SHA:?GITHUB_SHA is required}"
+: "${GITHUB_OUTPUT:?GITHUB_OUTPUT is required}"
+
+owner_lower="$(tr '[:upper:]' '[:lower:]' <<<"$IMAGE_OWNER")"
+echo "name=ghcr.io/${owner_lower}/${SERVICE_IMAGE}" >>"$GITHUB_OUTPUT"
+echo "short_sha=${GITHUB_SHA:0:7}" >>"$GITHUB_OUTPUT"

.config/mise/tasks/github-actions/wasm-validate

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+#MISE description="Assert every built decider component declares zero imports and passes wasm validation"
+set -euo pipefail
+
+ROOT="${GITHUB_WORKSPACE:-$(git rev-parse --show-toplevel)}"
+cd "$ROOT"
+
+shopt -s nullglob
+components=(rsworkspace/dist/decider/*.wasm)
+if [[ ${#components[@]} -eq 0 ]]; then
+    echo "no decider components found under rsworkspace/dist/decider; run 'mise run artifacts:wasm-components' first" >&2
+    exit 1
+fi
+
+for wasm in "${components[@]}"; do
+    wit_text="$(wasm-tools component wit "$wasm")"
+    printf '%s\n' "$wit_text"
+    if grep -E '^[[:space:]]*import ' <<<"$wit_text"; then
+        echo "component declares imports: $wasm" >&2
+        exit 1
+    fi
+    wasm-tools validate "$wasm"
+done

.github/workflows/canary-container-images.yml

@@ -40,9 +40,8 @@ jobs:
         id: image
         env:
           IMAGE_OWNER: ${{ github.repository_owner }}
-        run: |
-          echo "name=ghcr.io/${IMAGE_OWNER,,}/${{ steps.service_config.outputs.image }}" >> "$GITHUB_OUTPUT"
-          echo "short_sha=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
+          SERVICE_IMAGE: ${{ steps.service_config.outputs.image }}
+        run: ./.config/mise/tasks/github-actions/resolve-image
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
@@ -88,16 +87,9 @@ jobs:
 
       - name: Document image security audit
         shell: bash
-        run: |
-          {
-            echo "## Image security audit: \`${{ matrix.service }}\`"
-            echo ""
-            echo "- Image: \`${{ steps.image.outputs.name }}@${{ steps.build_image.outputs.digest }}\`"
-            echo "- Runtime base: \`debian:bookworm-20260518-slim\`"
-            echo "- SBOM artifact: \`sbom-${{ matrix.service }}-spdx\` (SPDX JSON)"
-            echo ""
-            echo "### Vulnerability scan (Trivy, image packages)"
-            echo '```text'
-            cat trivy-results.txt
-            echo '```'
-          } >> "$GITHUB_STEP_SUMMARY"
+        env:
+          SERVICE: ${{ matrix.service }}
+          IMAGE_NAME: ${{ steps.image.outputs.name }}
+          IMAGE_DIGEST: ${{ steps.build_image.outputs.digest }}
+          RUNTIME_BASE: debian:bookworm-20260518-slim
+        run: ./.config/mise/tasks/github-actions/image-audit-summary

.github/workflows/ci-rust.yml

@@ -65,16 +65,7 @@ jobs:
         working-directory: rsworkspace
 
       - name: Test repo Rust policy lints
-        run: |
-          dylint_toolchain="$(python - <<'PY'
-          import tomllib
-
-          with open("rust-toolchain.toml", "rb") as toolchain_file:
-              print(tomllib.load(toolchain_file)["toolchain"]["channel"])
-          PY
-          )"
-          rustup run "$dylint_toolchain" cargo test
-        working-directory: rsworkspace/dylints/trogon_lints
+        run: mise run github-actions:dylint-tests
 
       - name: Run repo Rust policy lints
         run: env -u RUSTUP_TOOLCHAIN cargo dylint --path dylints/trogon_lints --workspace --no-deps -- --all-features --all-targets
@@ -115,8 +106,7 @@ jobs:
           tool: cargo-llvm-cov,nextest
 
       - name: Build decider components for sim fixtures
-        run: cargo component build -p trogon-schedules-decider --target wasm32-unknown-unknown --release
-        working-directory: rsworkspace
+        run: mise run artifacts:wasm-components
 
       - name: Run documentation tests
         run: cargo test --doc
@@ -187,28 +177,14 @@ jobs:
           workspaces: rsworkspace -> target
           save-if: always
 
-      - name: Build schedules decider component
-        run: cargo component build -p trogon-schedules-decider --target wasm32-unknown-unknown --release
-        working-directory: rsworkspace
+      - name: Build decider components
+        run: mise run artifacts:wasm-components
 
       - name: Assert zero imports and validate
-        run: |
-          for WASM in rsworkspace/target/wasm32-unknown-unknown/release/trogon_schedules_decider.wasm; do
-            wasm-tools component wit "$WASM" | tee /tmp/wit.txt
-            if grep -E '^[[:space:]]*import ' /tmp/wit.txt; then
-              echo "component declares imports: $WASM"
-              exit 1
-            fi
-            wasm-tools validate "$WASM"
-          done
+        run: mise run github-actions:wasm-validate
 
       - name: Run decider-test suites
-        run: |
-          cd rsworkspace
-          cargo test -p trogon-decider-sim --test schedules --features test-support
-          cargo test -p trogon-decider-guest-macros --test compile_fail
-          cargo build -p trogon-decider-test --release
-          ./target/release/decider-test target/wasm32-unknown-unknown/release/trogon_schedules_decider.wasm cli/trogon-decider-test/schedules.yaml
+        run: mise run github-actions:decider-test-suites
 
       - name: Run wasm decider runtime tests
         run: cargo test -p trogon-decider-wasm-runtime

.github/workflows/release-artifacts.yml

@@ -59,29 +59,18 @@ jobs:
           tool: cross
 
       - name: Build
-        working-directory: rsworkspace
         shell: bash
         env:
           USE_CROSS: ${{ matrix.use-cross }}
           TARGET: ${{ matrix.target }}
-        run: |
-          if [ "$USE_CROSS" = "true" ]; then
-            cross build --release --target "$TARGET" -p acp-nats-stdio
-          else
-            cargo build --release --target "$TARGET" -p acp-nats-stdio
-          fi
+        run: mise run github-actions:build-release-binary
 
       - name: Package
         shell: bash
         env:
           VERSION: ${{ steps.version.outputs.version }}
           TARGET: ${{ matrix.target }}
-        run: |
-          staging="acp-nats-stdio-${VERSION}-${TARGET}"
-          mkdir -p "$staging"
-          cp "rsworkspace/target/${TARGET}/release/acp-nats-stdio" "$staging/"
-          tar czf "$staging.tar.gz" "$staging"
-          echo "ASSET=$staging.tar.gz" >> "$GITHUB_ENV"
+        run: mise run github-actions:package-release-binary
 
       - name: Attest build provenance
         uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
@@ -119,7 +108,4 @@ jobs:
       - name: Upload to GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
-        run: |
-          gh release view "$GITHUB_REF_NAME" || \
-            gh release create "$GITHUB_REF_NAME" --title "$GITHUB_REF_NAME" --generate-notes
-          gh release upload "$GITHUB_REF_NAME" artifacts/* --clobber
+        run: ./.config/mise/tasks/github-actions/release-upload

.mise.toml

@@ -69,14 +69,9 @@ description = "Enforce ADR#0015: fail if native-tls/OpenSSL enter the Rust depen
 dir = "rsworkspace"
 run = "cargo deny check bans"
 
-[tasks."artifacts:schedules-wasm"]
-description = "Build schedules decider WASM artifact to dist/decider/"
-depends = ["proto:schedules-descriptor-set", "rust:wasm-target"]
-run = "cd rsworkspace && cargo component build -p trogon-schedules-decider --target wasm32-unknown-unknown --release && mkdir -p dist/decider && cp target/wasm32-unknown-unknown/release/trogon_schedules_decider.wasm dist/decider/schedules.wasm && cp target/wasm32-unknown-unknown/release/trogon_schedules_decider.binpb dist/decider/schedules.binpb"
-
 [tasks."artifacts:decider-test"]
-description = "Build schedules decider WASM + decider-test CLI"
-depends = ["artifacts:schedules-wasm"]
+description = "Build every wasm-components/* decider + the decider-test CLI"
+depends = ["artifacts:wasm-components"]
 run = "cd rsworkspace && cargo build -p trogon-decider-test --release"
 
 [tasks."rsc"]

docs/.vitepress/config.mts

@@ -35,6 +35,7 @@ export default async () => {
           text: "Architecture",
           items: [
             { text: "ACP Conformance", link: "/architecture/acp-conformance" },
+            { text: "Decider", link: "/architecture/decider" },
             { text: "Event Metadata", link: "/architecture/event-metadata" },
           ],
         },