feat: production hardening — benchmarks, workflows, Containerfile, security standard

Add criterion benchmarks (7 total: IPP parsing/response/hashing, encrypt/decrypt
roundtrip, integrity hashing at 4 sizes, audit recording, perspective correction).

Add 3 new GitHub Actions workflows: security.yml (cargo-audit, strict clippy,
panic surface check), release.yml (build + GitHub Release on tag), bench.yml
(run benchmarks on push to main).

Add multi-stage Containerfile using chainguard wolfi-base with non-root runtime,
health check, and OCI labels.

Update Trustfile.hs to implement 7-step hyperpolymath security standard
verification (ABI proofs, banned patterns, audit integrity, encryption safety,
post-quantum readiness, hash compliance, policy hash). Documents migration path
from current crypto (SHA-256, Ed25519, age/X25519) to target standard (SHAKE3-512,
Ed448+Dilithium5, Kyber-1024, XChaCha20-Poly1305, Argon2id).

Fix CodeQL workflow (actions language, not javascript-typescript).
Fix fallback init (AppServices::fallback with in-memory databases).
Add crates.io metadata, CHANGELOG.md, security architecture documentation.
Update all stats: 46 files, 10749 lines, 68 tests, 7 benchmarks, 21 workflows.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Jonathan D.A. Jewell

.github/workflows/bench.yml

@@ -0,0 +1,27 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Presswerk — Run workspace benchmarks (informational)
+
+name: Benchmarks
+
+on:
+  push:
+    branches: [main]
+
+permissions: read-all
+
+jobs:
+  bench:
+    name: Run Benchmarks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+      - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libxdo-dev libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev libsoup-3.0-dev libjavascriptcoregtk-4.1-dev
+
+      - name: Run benchmarks
+        run: cargo bench --workspace

.github/workflows/codeql.yml

@@ -1,11 +1,12 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
+# Presswerk — CodeQL workflow analysis (Rust not supported; scans Actions only)
 name: CodeQL Security Analysis
 
 on:
   push:
-    branches: [main, master]
+    branches: [main]
   pull_request:
-    branches: [main, master]
+    branches: [main]
   schedule:
     - cron: '0 6 * * 1'
 
@@ -21,20 +22,20 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - language: javascript-typescript
+          - language: actions
             build-mode: none
 
     steps:
       - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.28.1
+        uses: github/codeql-action/init@6624720a57d4c312633c7b953db2f2da5bcb4c3a # v3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.28.1
+        uses: github/codeql-action/analyze@6624720a57d4c312633c7b953db2f2da5bcb4c3a # v3
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/release.yml

@@ -0,0 +1,65 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Presswerk — Build release binary and create GitHub Release on tag push
+
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions: write-all
+
+jobs:
+  build-linux:
+    name: Build (x86_64-unknown-linux-gnu)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+        with:
+          targets: x86_64-unknown-linux-gnu
+      - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libxdo-dev libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev libsoup-3.0-dev libjavascriptcoregtk-4.1-dev
+
+      - name: Build release binary
+        run: cargo build --release --target x86_64-unknown-linux-gnu -p presswerk-app
+
+      - name: Package binary
+        run: |
+          mkdir -p dist
+          cp target/x86_64-unknown-linux-gnu/release/presswerk-app dist/presswerk-linux-x86_64
+          chmod +x dist/presswerk-linux-x86_64
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: presswerk-linux-x86_64
+          path: dist/presswerk-linux-x86_64
+          retention-days: 7
+
+  create-release:
+    name: Create GitHub Release
+    runs-on: ubuntu-latest
+    needs: build-linux
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: presswerk-linux-x86_64
+          path: dist/
+
+      - name: Create release
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
+        with:
+          generate_release_notes: true
+          files: |
+            dist/presswerk-linux-x86_64
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/security.yml

@@ -0,0 +1,87 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Presswerk — Security scanning (cargo-audit, strict clippy, unwrap detection)
+
+name: Security Scan
+
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "0 6 * * 1"
+
+permissions: read-all
+
+jobs:
+  cargo-audit:
+    name: Cargo Audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+      - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
+
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+
+      - name: Run cargo audit
+        run: cargo audit
+
+  clippy-strict:
+    name: Clippy (Strict / Library Crates)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+        with:
+          components: clippy
+      - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libxdo-dev libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev libsoup-3.0-dev libjavascriptcoregtk-4.1-dev
+
+      - name: Clippy pedantic (library crates)
+        run: |
+          cargo clippy \
+            -p presswerk-core \
+            -p presswerk-security \
+            -p presswerk-document \
+            -p presswerk-print \
+            -- -D warnings -W clippy::pedantic
+
+  panic-check:
+    name: Panic Surface Check (Informational)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Count unwrap/expect usage outside tests
+        run: |
+          echo "=== Scanning for unwrap()/expect() in crates/ ==="
+          echo "(Excluding #[cfg(test)] and mod tests blocks)"
+          echo ""
+          count=0
+          while IFS= read -r file; do
+            results=$(awk '
+              /^[[:space:]]*#\[cfg\(test\)\]/ { skip=1; next }
+              /^[[:space:]]*mod tests/ { skip=1; brace=0; next }
+              skip && /{/ { brace++ }
+              skip && /}/ { brace--; if (brace<=0) skip=0; next }
+              skip { next }
+              /\.unwrap\(\)|\.expect\(/ { print FILENAME ":" NR ": " $0 }
+            ' "$file")
+            if [ -n "$results" ]; then
+              echo "$results"
+              file_count=$(echo "$results" | wc -l)
+              count=$((count + file_count))
+            fi
+          done < <(find crates/ -name '*.rs' -type f)
+          echo ""
+          echo "=== Total unwrap()/expect() calls outside test code: $count ==="
+          if [ "$count" -gt 0 ]; then
+            echo "::notice::Found $count unwrap()/expect() calls outside test code."
+          else
+            echo "::notice::No unwrap()/expect() calls found outside test code."
+          fi
+          exit 0

.machine_readable/STATE.scm

@@ -1,40 +1,50 @@
 ;; SPDX-License-Identifier: PMPL-1.0-or-later
-(state (metadata (version "0.2.0") (last-updated "2026-02-14") (status active))
+(state (metadata (version "0.3.0") (last-updated "2026-02-14") (status active))
   (project-context
     (name "presswerk")
     (purpose "High-assurance local print router and server for iOS/Android")
-    (completion-percentage 65))
+    (completion-percentage 75))
   (components
-    (component "presswerk-core" (status "complete") (description "Shared types, errors, config — 244-line types, 70-line errors"))
-    (component "presswerk-security" (status "complete") (description "age encryption, SHA-256 integrity, Ed25519 certs, SQLite audit trail — 14 tests"))
-    (component "presswerk-document" (status "complete") (description "PDF read/merge/split/rotate, image processing, scan enhancement, OCR — 7 tests"))
-    (component "presswerk-print" (status "complete") (description "Full IPP/1.1 server (1936 lines), IPP client, mDNS discovery, SQLite job queue — 40 tests"))
+    (component "presswerk-core" (status "complete") (description "Shared types, errors, config — 248-line types, 70-line errors"))
+    (component "presswerk-security" (status "complete") (description "age encryption, SHA-256 integrity, Ed25519 certs, SQLite audit trail — 14 tests, 3 benchmarks"))
+    (component "presswerk-document" (status "complete") (description "PDF read/merge/split/rotate, image processing, scan enhancement with perspective correction, OCR — 7 tests, 1 benchmark"))
+    (component "presswerk-print" (status "complete") (description "Full IPP/1.1 server (2170 lines), IPP client, mDNS discovery, SQLite job queue — 47 tests, 3 benchmarks"))
     (component "presswerk-bridge" (status "unverified") (description "iOS objc2 (894 lines) + Android JNI (973 lines) — detailed but untested on device"))
-    (component "presswerk-app" (status "functional") (description "Dioxus UI with 10 pages, routing, AppServices layer, settings"))
+    (component "presswerk-app" (status "functional") (description "Dioxus UI with 10 pages, routing, AppServices layer with fallback mode, settings"))
     (component "abi-proofs" (status "complete") (description "5 Idris2 files: Types, Protocol, Encryption, Layout, Bridge — no Admitted"))
-    (component "ffi-zig" (status "complete") (description "C-compatible FFI with 5 tests — lifecycle, transitions, hash, version")))
+    (component "ffi-zig" (status "complete") (description "C-compatible FFI with 5 tests — lifecycle, transitions, hash, version"))
+    (component "benchmarks" (status "complete") (description "Criterion benchmarks for security (3), print (3), document (1) — 7 total"))
+    (component "ci-workflows" (status "complete") (description "21 GitHub Actions workflows including security.yml, release.yml, bench.yml"))
+    (component "containerfile" (status "complete") (description "Multi-stage chainguard-based Containerfile for headless print server"))
+    (component "trustfile" (status "complete") (description "Haskell-based security verification — 7-step hyperpolymath standard")))
   (metrics
-    (rust-files 43)
-    (rust-lines 10219)
+    (rust-files 46)
+    (rust-lines 10749)
     (idris2-files 5)
     (zig-files 3)
-    (unit-tests 61)
+    (unit-tests 68)
+    (benchmarks 7)
+    (workflows 21)
     (clippy-warnings 0)
+    (cargo-audit-vulnerabilities 0)
     (panic-attack-critical 0)
     (panic-attack-high 4)
     (panic-attack-medium 5))
   (current-position
-    (phase "Phase 7 — Production Hardening")
-    (milestone "Core implementation complete, formal verification done, doc storage implemented")
+    (phase "Phase 8 — Release and Packaging")
+    (milestone "Production hardening complete, benchmarks added, CI/security workflows deployed")
     (next-actions
-      ("Test iOS bridge on device/simulator (requires macOS + Xcode)"
+      ("Create v0.1.0 release tag and GitHub release"
+       "Push to GitLab mirror"
+       "Test iOS bridge on device/simulator (requires macOS + Xcode)"
        "Test Android bridge on device/emulator (requires NDK)"
-       "Add TLS to IPP server (rustls cert already generated)"
-       "Add rate limiting to IPP server"
+       "Migrate to post-quantum crypto standard (Argon2id, SHAKE3-512, Kyber-1024)"
        "Apple Developer Team ID for iOS signing")))
   (blockers-and-issues
     (blocker "iOS bridge never compiled on target — need macOS + Xcode")
     (blocker "Android bridge never compiled on target — need NDK")
     (blocker "Dioxus.toml team_id empty — need Apple Developer account")
     (note "Desktop dev mode works via stub bridge")
-    (note "All 4 panic-attack High findings are unavoidable FFI unsafe — covered by Bridge.idr proofs")))
+    (note "All 4 panic-attack High findings are unavoidable FFI unsafe — covered by Bridge.idr proofs")
+    (note "14 cargo audit warnings are unmaintained GTK3 transitive deps from dioxus-desktop — not actionable")
+    (note "Crypto migration: SHA-256 -> SHAKE3-512, Ed25519 -> Ed448+Dilithium5, X25519 -> Kyber-1024")))

0-AI-MANIFEST.a2ml

@@ -63,17 +63,23 @@ Generated C headers in `generated/abi/`.
 ## SESSION STARTUP CHECKLIST
 
 1. Read THIS file (0-AI-MANIFEST.a2ml) first
-2. Read `.machine_readable/STATE.scm` for current status (65% complete)
-3. Run `cargo test --workspace` to verify state (61 tests expected)
+2. Read `.machine_readable/STATE.scm` for current status (75% complete)
+3. Run `cargo test -p presswerk-core -p presswerk-security -p presswerk-document -p presswerk-print` to verify state (68 tests expected)
 4. Check for blockers in STATE.scm
 
 ## PROJECT STATUS
 
-- **Completion:** 65%
-- **Stats:** 43 Rust files, 10,219 lines, 5 Idris2 ABI files, 3 Zig FFI files
-- **Tests:** 61 unit tests (40 print + 14 security + 7 document), 0 failures
+- **Version:** 0.1.0
+- **Completion:** 75%
+- **Stats:** 46 Rust files, 10,749 lines, 5 Idris2 ABI files, 3 Zig FFI files
+- **Tests:** 68 unit tests (47 print + 14 security + 7 document), 0 failures
+- **Benchmarks:** 7 criterion benchmarks (3 security + 3 print + 1 document)
+- **Workflows:** 21 GitHub Actions (CI, security scan, release, benchmarks, CodeQL, Scorecard, etc.)
 - **Clippy:** 0 warnings
+- **Audit:** 0 vulnerabilities (14 warnings — unmaintained GTK3 transitive deps)
 - **Security:** panic-attack 0 critical, 4 high (FFI — covered by Bridge.idr)
+- **Container:** Containerfile (chainguard wolfi-base, multi-stage, non-root)
+- **Trustfile:** 7-step verification (ABI, banned patterns, audit, encryption, PQ readiness, hash, policy)
 - **Remotes:** GitHub + GitLab (hyperpolymath/presswerk)
 
 ## META

CHANGELOG.md

@@ -0,0 +1,35 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.1.0] - 2026-02-14
+
+### Added
+
+- **presswerk-core**: Shared types (14 public types), error handling, app config
+- **presswerk-security**: age (X25519) encrypted storage, SHA-256 document integrity, Ed25519 TLS certificates, append-only SQLite audit trail
+- **presswerk-document**: PDF read/merge/split/rotate/crop (lopdf + printpdf), image processing (resize, rotate, crop, grayscale, brightness), scanning pipeline with Canny edge detection, Hough line detection, perspective correction, binarisation, OCR via ocrs (pure Rust)
+- **presswerk-print**: Full IPP/1.1 server (2,170 lines, RFC 8010/8011 compliant), IPP client (Print-Job, Get-Printer-Attributes, Get-Jobs, Cancel-Job), mDNS/DNS-SD printer discovery, persistent SQLite job queue
+- **presswerk-bridge**: iOS native bridges (objc2 — UIPrintInteractionController, UIImagePickerController, UIDocumentPickerViewController, Security.framework Keychain, UIActivityViewController), Android native bridges (JNI — PrintManager, Intent ACTION_IMAGE_CAPTURE, Storage Access Framework, Android Keystore, Intent ACTION_SEND)
+- **presswerk-app**: Dioxus 0.7 UI with 10 pages (Home, Print, Scan, Edit, TextEditor, Server, Jobs, Audit, Settings), bottom tab navigation, AppServices layer with in-memory fallback mode
+- **Idris2 ABI proofs**: 5 proof files (Types, Protocol, Encryption, Layout, Bridge) — 0 Admitted, 0 believe_me
+- **Zig FFI**: C-compatible exports (8 functions, 5 tests)
+- **Benchmarks**: 7 criterion benchmarks (IPP parsing, response building, content hashing, encrypt/decrypt roundtrip, integrity hashing at 4 sizes, audit recording, perspective correction)
+- **CI/CD**: 21 GitHub Actions workflows (CI, security scan, release, benchmarks, CodeQL, OpenSSF Scorecard, hypatia scan, mirror, quality, secret scanning)
+- **Containerfile**: Multi-stage chainguard (wolfi-base) build, non-root runtime, health check
+- **Trustfile**: 7-step security verification (ABI proofs, banned patterns, audit integrity, encryption safety, PQ readiness, hash compliance, policy hash)
+- **Content-addressed document storage**: Deduplication via SHA-256 hash filenames
+
+### Security
+
+- 0 critical vulnerabilities (panic-attack scan)
+- 0 dependency vulnerabilities (cargo audit)
+- All `unsafe` blocks documented with `// SAFETY:` comments referencing Idris2 proofs
+- No banned patterns: 0 `Admitted`, 0 `believe_me`, 0 `transmute`, 0 `unsafePerformIO`
+- Append-only audit trail (no DELETE/UPDATE)
+- Encryption key never persisted to disk
+
+[0.1.0]: https://github.com/hyperpolymath/presswerk/releases/tag/v0.1.0