refactor: zero-based architecture cleanup

.env.example

@@ -8,23 +8,28 @@
 # Default single-stack mode. Possible: controlplane, dataplane.
 CF_MCP_STACK_MODE=dataplane
 
-# cf-controlplane checkout. Default: v1.0.7, matching the publisher contract.
+# Optional developer checkout containing source overlays. Without this, the
+# current directory is the workspace and the binary can materialize embedded
+# assets beneath CF_INTEGRATION_DIR.
+# CF_INTEGRATION_ROOT=/path/to/contextforge-dev-tools
+
+# cf-controlplane checkout. Default: main.
 # Possible: any branch, tag, or commit accepted by git checkout.
-CF_CONTROLPLANE_REF=v1.0.7
+CF_CONTROLPLANE_REF=main
 
 # cf-controlplane repository. Default: IBM upstream.
 # Possible: any git clone URL.
 CF_CONTROLPLANE_REPO=https://github.com/IBM/mcp-context-forge.git
 
-# cf-controlplane image used by upstream compose.
-# Default: ghcr.io/ibm/mcp-context-forge:latest.
+# cf-controlplane image used by upstream compose. By default, the harness maps
+# the freshly fetched origin/main revision to its commit-tagged GHCR image.
 # Set the full override only to select a different registry or immutable tag.
 # Possible: any Docker image reference.
 # CF_CONTROLPLANE_IMAGE=ghcr.io/ibm/mcp-context-forge:<tag>
 
-# Official cf-controlplane image version suffix. Default: latest.
-# Used only when CF_CONTROLPLANE_IMAGE and IMAGE_LOCAL are unset.
-CF_CONTROLPLANE_VERSION=latest
+# Official cf-controlplane image selector. Default: main. `main` resolves to the
+# fetched origin/main SHA because upstream reserves `latest` for releases.
+CF_CONTROLPLANE_VERSION=main
 
 # Build behavior. Default: auto.
 # Possible:
@@ -102,9 +107,8 @@ NGINX_PORT=8080
 # Direct public-origin override; otherwise derived from NGINX_PORT.
 # MCP_CLI_BASE_URL=http://127.0.0.1:8080
 
-# Optional global MCP protocol override. Current probe/load/Inspector/live
-# workflows default to the latest dataplane-compatible session protocol,
-# 2025-11-25. Conformance keeps its pinned 2026-07-28 readiness default.
+# Optional global MCP protocol override. Probe, conformance, live-stack, and
+# performance workflows all default to the latest supported protocol.
 # MCP_PROTOCOL_VERSION=2026-07-28
 
 # Local integration administrator. Stable random signing/encryption secrets are

.github/workflows/ci.yml

@@ -0,0 +1,98 @@
+name: Rust CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: rust-ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_TARGET_DIR: target
+  RUSTFLAGS: -D warnings
+
+jobs:
+  quality:
+    name: quality
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@1.97.0
+        with:
+          components: clippy,rustfmt
+
+      - name: Restore Rust cache
+        uses: Swatinem/rust-cache@v2.9.1
+
+      - name: Check formatting
+        run: cargo fmt --all --check
+
+      - name: Run Clippy
+        run: cargo clippy --all-targets --locked -- -D warnings
+
+      - name: Run full test suite
+        run: cargo test --all-targets --locked
+
+      - name: Verify standalone lazy runtime state
+        shell: bash
+        run: |
+          cargo build --locked --bin cf-integration
+          sandbox=$(mktemp -d)
+          binary="$GITHUB_WORKSPACE/target/debug/cf-integration"
+          if (cd "$sandbox" && CF_INTEGRATION_DIR="$sandbox/state" "$binary" conformance report); then
+            echo "report unexpectedly succeeded without prior results" >&2
+            exit 1
+          fi
+          test ! -e "$sandbox/state"
+          if (cd "$sandbox" && CF_INTEGRATION_DIR="$sandbox/state" "$binary" stack config --topology dataplane); then
+            echo "stack config unexpectedly succeeded outside a checkout" >&2
+            exit 1
+          fi
+          test -f "$sandbox/state/secrets.env"
+          find "$sandbox/state/assets" \
+            -path '*/docker/docker-compose.cf-integration.yaml' \
+            -type f -print -quit | grep -q .
+
+      - name: Verify published package
+        run: cargo package --locked
+
+      - name: Validate GitHub Actions workflows
+        run: go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
+
+  native:
+    name: native (${{ matrix.target }})
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-24.04
+            target: x86_64-unknown-linux-gnu
+          - runner: macos-15
+            target: aarch64-apple-darwin
+          - runner: windows-2025
+            target: x86_64-pc-windows-msvc
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@1.97.0
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Restore Rust cache
+        uses: Swatinem/rust-cache@v2.9.1
+
+      - name: Run native tests
+        shell: bash
+        run: cargo test --all-targets --locked