Run production dataplane tests and simplify harness architecture

.gitattributes

@@ -0,0 +1 @@
+docker/mcp-conformance.patch text eol=lf

.github/workflows/ci.yml

@@ -19,54 +19,7 @@ env:
 
 jobs:
   quality:
-    name: quality
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@1.97.0
-        with:
-          components: clippy,rustfmt
-
-      - name: Restore Rust cache
-        uses: Swatinem/rust-cache@v2.9.1
-
-      - name: Check formatting
-        run: cargo fmt --all --check
-
-      - name: Run Clippy
-        run: cargo clippy --all-targets --locked -- -D warnings
-
-      - name: Run full test suite
-        run: cargo test --all-targets --locked
-
-      - name: Verify standalone lazy runtime state
-        shell: bash
-        run: |
-          cargo build --locked --bin cf-integration
-          sandbox=$(mktemp -d)
-          binary="$GITHUB_WORKSPACE/target/debug/cf-integration"
-          if (cd "$sandbox" && CF_INTEGRATION_DIR="$sandbox/state" "$binary" conformance report); then
-            echo "report unexpectedly succeeded without prior results" >&2
-            exit 1
-          fi
-          test ! -e "$sandbox/state"
-          if (cd "$sandbox" && CF_INTEGRATION_DIR="$sandbox/state" "$binary" stack config --lane external); then
-            echo "stack config unexpectedly succeeded outside a checkout" >&2
-            exit 1
-          fi
-          test -f "$sandbox/state/secrets.env"
-          find "$sandbox/state/assets" \
-            -path '*/docker/docker-compose.cf-integration.yaml' \
-            -type f -print -quit | grep -q .
-
-      - name: Verify published package
-        run: cargo package --locked
-
-      - name: Validate GitHub Actions workflows
-        run: go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
+    uses: ./.github/workflows/quality.yml
 
   native:
     name: native (${{ matrix.target }})

.github/workflows/quality.yml

@@ -0,0 +1,64 @@
+name: Quality checks
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_TARGET_DIR: target
+  RUSTFLAGS: -D warnings
+
+jobs:
+  quality:
+    name: quality
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@1.97.0
+        with:
+          components: clippy,rustfmt
+
+      - name: Restore Rust cache
+        uses: Swatinem/rust-cache@v2.9.1
+
+      - name: Check formatting
+        run: cargo fmt --all --check
+
+      - name: Run Clippy
+        run: cargo clippy --all-targets --locked -- -D warnings
+
+      - name: Run full test suite
+        run: cargo test --all-targets --locked
+
+      - name: Verify standalone lazy runtime state
+        shell: bash
+        run: |
+          cargo build --locked --bin cf-integration
+          sandbox=$(mktemp -d)
+          binary="$GITHUB_WORKSPACE/target/debug/cf-integration"
+          if (cd "$sandbox" && CF_INTEGRATION_DIR="$sandbox/state" "$binary" conformance report); then
+            echo "report unexpectedly succeeded without prior results" >&2
+            exit 1
+          fi
+          test ! -e "$sandbox/state"
+          if (cd "$sandbox" && CF_INTEGRATION_DIR="$sandbox/state" "$binary" stack config --lane external); then
+            echo "stack config unexpectedly succeeded outside a checkout" >&2
+            exit 1
+          fi
+          test -f "$sandbox/state/secrets.env"
+          find "$sandbox/state/assets" \
+            -path '*/docker/docker-compose.cf-integration.yaml' \
+            -type f -print -quit | grep -q .
+
+      - name: Verify published package
+        run: cargo package --locked
+
+      - name: Validate GitHub Actions workflows
+        run: go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
+

.github/workflows/release.yml

@@ -14,56 +14,9 @@ env:
 
 jobs:
   quality:
-    name: Release quality gate
-    runs-on: ubuntu-24.04
+    uses: ./.github/workflows/quality.yml
     permissions:
       contents: read
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@1.97.0
-        with:
-          components: clippy,rustfmt
-
-      - name: Restore Rust cache
-        uses: Swatinem/rust-cache@v2.9.1
-
-      - name: Check formatting
-        run: cargo fmt --all --check
-
-      - name: Run Clippy
-        run: cargo clippy --all-targets --locked -- -D warnings
-
-      - name: Run full test suite
-        run: cargo test --all-targets --locked
-
-      - name: Verify standalone lazy runtime state
-        shell: bash
-        run: |
-          cargo build --locked --bin cf-integration
-          sandbox=$(mktemp -d)
-          binary="$GITHUB_WORKSPACE/target/debug/cf-integration"
-          if (cd "$sandbox" && CF_INTEGRATION_DIR="$sandbox/state" "$binary" conformance report); then
-            echo "report unexpectedly succeeded without prior results" >&2
-            exit 1
-          fi
-          test ! -e "$sandbox/state"
-          if (cd "$sandbox" && CF_INTEGRATION_DIR="$sandbox/state" "$binary" stack config --lane external); then
-            echo "stack config unexpectedly succeeded outside a checkout" >&2
-            exit 1
-          fi
-          test -f "$sandbox/state/secrets.env"
-          find "$sandbox/state/assets" \
-            -path '*/docker/docker-compose.cf-integration.yaml' \
-            -type f -print -quit | grep -q .
-
-      - name: Verify published package
-        run: cargo package --locked
-
-      - name: Validate GitHub Actions workflows
-        run: go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
 
   build-binaries:
     name: Build ${{ matrix.target }}

AGENTS.md

@@ -11,3 +11,5 @@ Scope:
 - Preserve the public routing contract: `/servers/{virtual_host_id}/mcp` goes to `cf-dataplane`; raw `/mcp` and UI/API traffic go to `cf-controlplane`.
 - Use published `cf-dataplane` images by default. Local builds should be explicit overrides.
 - Keep `CHANGELOG.md` current for user-visible behavior, CLI, workflow, and packaging changes. Add normal changes under `Unreleased`; when bumping the package version, move those entries into a dated version section.
+
+- Write repository-owned code in Rust or Python only. Implement harness helpers in Rust; use Python where required by Python tools such as Locust.

CHANGELOG.md

@@ -9,6 +9,32 @@ and this project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html)
 
 ### Changed
 
+- Run official conformance and Inspector inside a Docker tooling image, removing
+  the host Node/npm requirement. Client drivers publish directly to Redis, and
+  runner containers are removed after completion, failure, or interruption.
+
+- Moved standalone auth and config publishing into the Rust CLI, replacing the Node
+  helper image and npm dependencies. Fixture customization uses a checked patch.
+
+- Consolidated server and client conformance artifact validation, baseline gates,
+  and reporting into one direction-aware path.
+- Removed unused MCP transport features and stack command wrappers; tests now
+  exercise the same MCP POST client used by probes and conformance.
+- Shared asynchronous child-process execution and CI/release quality checks.
+
+### Fixed
+
+- Preserve configured Docker connection settings when removing conformance and
+  Inspector containers, including after failure or interruption.
+
+## [0.3.2] - 2026-09-07
+
+### Changed
+
+- Standalone workflows now run against production dataplane images without
+  `with_tools`. The harness signs ephemeral JWTs, serves loopback JWKS, and
+  publishes MessagePack routing snapshots directly to Redis.
+
 - Simplified runtime dispatch and shared authenticated workflow setup, removing
   forwarding wrappers while preserving token revocation and stack cleanup.
 
@@ -25,6 +51,8 @@ and this project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html)
   setup before a baseline can be blessed.
 - Made the dataplane config writer available to normal external client conformance
   and preserved schemas for its scenario tools.
+- Embedded the ClickStack collector configuration required by installed-binary
+  conformance runs.
 - Accepted empty pagination cursors and legacy SSE keepalives during discovery,
   and used the fixture's protocol era when configuring backends for clients from
   a different era.