feat(bazel): full AADL → WIT → wit-bindgen → .wasm component chain builds

Real end-to-end Bazel build using rules_wasm_component pinned to a
specific main-branch SHA (the v1.0.0 tag predates the Bazel-9
CcInfo migration). The chain:

  arch/kvs.wit
    │
    ▼  wit_library + rust_wasm_component_bindgen
    │   (in BUILD.bazel)
    │
  src/lib.rs implements the wit-bindgen-generated `Guest` trait
    │
    ▼  rust + WASI sysroot toolchain (pulled by rules_wasm_component)
    │
  bazel-bin/.../kvs_component_*_wasm_base.wasm   ← real .wasm

Local + CI:
  bazel build //...                   ✓ Build completed successfully
  bazel test  //:kvs_component_test   ✓ PASSED

If src/lib.rs's `impl Guest for Component` doesn't match the WIT
signatures (renamed method, wrong arity, drifted error variant),
the Rust compile fails. The binary contract is enforced at build
time — the operational difference from eclipse-score's
interface-as-documentation model is now demonstrably real, not
narrative.

## Files

- MODULE.bazel — rules_wasm_component via git_override (SHA-pinned
  to main; v1.0.0 tag has a Bazel-9 incompat issue); rules_rust,
  bazel_skylib, platforms; crate_universe (`@crates`) wired to
  Cargo.toml for the bitflags + wit-bindgen runtime deps the
  bindgen rule needs (known wart in rules_wasm_component — its
  docstring explicitly tells external consumers to wire this).
- BUILD.bazel — wit_library + rust_wasm_component_bindgen +
  rust_wasm_component_test.
- Cargo.toml + Cargo.lock — bitflags + wit-bindgen 0.46 (matched
  to the CLI version rules_wasm_component embeds).
- src/lib.rs — in-memory KVS impl. ~80 LOC; implements the WIT
  `Guest` trait with store / load / delete / snapshot_create /
  snapshot_restore. Key validation gates per
  COMP-REQ-KVS-KEY-NAMING.
- .github/workflows/validate.yml — bazel-wasm-component job
  installs bazelisk and runs `bazel build //...` + `bazel test`
  on every push/PR.
- .gitignore — bazel-* outputs, MODULE.bazel.lock, target/

README updated to reflect that the chain actually builds (status
table at the top now uses ✅ / 📄 instead of "real infrastructure
/ skeleton" prose).

This closes the user's "but then you need the full stack with
bazel as well or?" question: yes, and it does now.

Author: avrabe

.github/workflows/validate.yml

@@ -39,3 +39,23 @@ jobs:
 
       - name: artifact-driven verification gate
         run: make verify
+
+  bazel-wasm-component:
+    name: bazel build (AADL → WIT → wasm component)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install bazelisk
+        run: |
+          curl -fsSL https://github.com/bazelbuild/bazelisk/releases/download/v1.20.0/bazelisk-linux-amd64 \
+              -o /usr/local/bin/bazelisk
+          chmod +x /usr/local/bin/bazelisk
+          ln -s /usr/local/bin/bazelisk /usr/local/bin/bazel
+          bazel --version
+
+      - name: bazel build //... (WIT → wit-bindgen → rust_component → .wasm)
+        run: bazel build //...
+
+      - name: bazel test //... (rust_wasm_component_test)
+        run: bazel test //... --test_output=errors

.gitignore

@@ -2,3 +2,9 @@
 *.swp
 .DS_Store
 /tmp-*/
+
+# Bazel outputs
+bazel-*
+MODULE.bazel.lock
+/target/
+

BUILD.bazel

@@ -0,0 +1,52 @@
+"""Bazel build for the persistency::kvs WASM component.
+
+The chain:
+  1. wit_library declares the KVS interface contract (arch/kvs.wit)
+  2. rust_wasm_component_bindgen generates Rust bindings from the WIT,
+     compiles src/lib.rs against those bindings, and produces a WASM
+     component artifact.
+  3. rust_wasm_component_test smoke-tests that the produced .wasm is
+     a well-formed component.
+
+If src/lib.rs's `impl Guest for Component` doesn't match the WIT
+signatures, the Rust compile fails — the binary contract is
+enforced at build time, which is the central operational difference
+from eclipse-score's interface-as-documentation approach.
+"""
+
+load("@rules_wasm_component//rust:defs.bzl",
+     "rust_wasm_component_bindgen",
+     "rust_wasm_component_test")
+load("@rules_wasm_component//wit:defs.bzl", "wit_library")
+
+package(default_visibility = ["//visibility:public"])
+
+# ── 1. Declare the WIT interface ──────────────────────────────────────
+# arch/kvs.wit declares `package pulseengine:kvs@0.1.0;` with the
+# `kvs` interface and `kvs-component` world. This target makes the
+# WIT available as a Bazel dependency.
+wit_library(
+    name = "kvs_interface",
+    package_name = "pulseengine:kvs",
+    srcs = ["arch/kvs.wit"],
+    world = "kvs-component",
+)
+
+# ── 2. Generate bindings + compile the Rust impl ──────────────────────
+# rust_wasm_component_bindgen runs wit-bindgen on :kvs_interface to
+# generate the Rust trait `Guest`, then compiles src/lib.rs (which
+# implements `Guest`) against those bindings, producing a WASM
+# component at bazel-bin/kvs_component.wasm.
+rust_wasm_component_bindgen(
+    name = "kvs_component",
+    srcs = ["src/lib.rs"],
+    profiles = ["release"],
+    validate_wit = False,  # consistent with rules_wasm_component basic example
+    wit = ":kvs_interface",
+)
+
+# ── 3. Smoke-test the produced component ──────────────────────────────
+rust_wasm_component_test(
+    name = "kvs_component_test",
+    component = ":kvs_component",
+)