Stabilize provider routing and quality checks

.github/workflows/ci.yml

@@ -24,10 +24,12 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 25
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "26.1.0"
           cache: "npm"
@@ -82,7 +84,9 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 40
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
@@ -136,3 +140,61 @@ jobs:
         with:
           name: rust-lcov
           path: src-tauri/lcov.info
+
+  check-cross-platform:
+    name: Cross-platform Compatibility (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 35
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - name: Install Linux system dependencies
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            libayatana-appindicator3-dev \
+            librsvg2-dev \
+            patchelf \
+            libxdo-dev
+
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: "26.1.0"
+          cache: "npm"
+          cache-dependency-path: src/package-lock.json
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
+        with:
+          toolchain: 1.95.0
+
+      - name: Rust Cache
+        uses: Swatinem/rust-cache@65012b490220f477f20ab979e35ae732e6de4e68 # node24
+        continue-on-error: true
+        with:
+          workspaces: "src-tauri -> target"
+          cache-targets: false
+
+      - name: Install Dependencies
+        run: |
+          cd src
+          npm ci
+
+      - name: Frontend Type Check
+        run: |
+          cd src
+          npm run typecheck
+
+      - name: Backend Target Check
+        run: |
+          cd src-tauri
+          cargo check --all-targets --all-features

.github/workflows/codeql.yml

@@ -35,7 +35,9 @@ jobs:
 
         steps:
             - name: Checkout repository
-              uses: actions/checkout@v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
 
             - name: Setup Rust
               if: matrix.language == 'rust'

.github/workflows/dependency-review.yml

@@ -24,7 +24,9 @@ jobs:
         timeout-minutes: 10
         steps:
             - name: Checkout repository
-              uses: actions/checkout@v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
 
             - name: Review dependency changes
               uses: actions/dependency-review-action@v5

.github/workflows/release.yml

@@ -31,8 +31,9 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           ref: ${{ env.RELEASE_TAG }}
 
@@ -59,7 +60,7 @@ jobs:
           }
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "26.1.0"
           cache: "npm"

.github/workflows/security-audit.yml

@@ -19,10 +19,12 @@ jobs:
         timeout-minutes: 20
         steps:
             - name: Checkout repository
-              uses: actions/checkout@v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
 
             - name: Setup Node.js
-              uses: actions/setup-node@v6
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
               with:
                   node-version: "26.1.0"
                   cache: "npm"
@@ -44,7 +46,9 @@ jobs:
         timeout-minutes: 25
         steps:
             - name: Checkout repository
-              uses: actions/checkout@v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
 
             - name: Setup Rust
               uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7

SECURITY.md

@@ -34,6 +34,8 @@ Release tags must match project versions and point to commits reachable from `ma
 Current application security posture:
 
 - provider secrets are backend-owned
+- provider secrets are stored in an encrypted backend file today; platform
+  keystore storage is planned but not implemented yet
 - frontend/backend contracts are generated from Rust types
 - local integration API tokens are runtime-issued and scoped
 - import paths, runtime entry paths, settings UI paths, archive entries, and log

docs/examples/sdk/javascript/axelate-client.mjs

@@ -35,7 +35,7 @@ export class AxelateClient {
 
     saveSettings(settings) {
         return this.request(
-            'PUT',
+            'PATCH',
             `/v1/modules/${encodeURIComponent(this.moduleId)}/settings`,
             settings,
         );

docs/examples/sdk/python/axelate_sdk.py

@@ -61,7 +61,7 @@ def settings(self) -> dict[str, Any]:
 
     def save_settings(self, settings: dict[str, Any]) -> dict[str, Any]:
         return self.request(
-            "PUT",
+            "PATCH",
             f"/v1/modules/{self.encoded_module_id}/settings",
             settings,
         )