keeper: reserve submit journal before the venue call

.dockerignore

@@ -14,9 +14,6 @@ target/
 /data/
 data/
 
-# Backtest tooling output: large JSON fixtures + Python venv state.
-# Re-collected on demand via `tools/backtest-collect/backtest_collect.py`.
-tools/backtest-collect/fixtures-*.json
 tools/baseline-latency/data/
 tools/**/__pycache__/
 tools/**/*.pyc

.github/workflows/ci.yml

@@ -25,7 +25,7 @@ env:
   # Dockerfile build, and the local host sccache — one silo, zero egress cost.
   # Set at the workflow env level (not the composite) because composite actions
   # cannot read the `secrets` context. Keys are content-addressed on the full
-  # compiler input, and the sole build.rs (cow-venue) + nexum-macros are
+  # compiler input, and the sole build.rs (cow-venue) + the macro crates are
   # deterministic, so PR builds writing to the shared bucket write correct objects
   # under correct keys (no poisoning); bound storage with an R2 lifecycle-expiry
   # rule on the bucket (sccache does not evict cloud backends itself).
@@ -78,7 +78,8 @@ jobs:
       - uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
         with:
           tool: nextest
-      # Build all 15 guest module wasms ONCE (release/wasm32-wasip2): the single
+      # Build all 18 guest wasms ONCE (17 modules + the cow adapter,
+      # release/wasm32-wasip2): the single
       # source of truth for guest buildability and the artifacts the integration
       # tests load. Replaces the deleted 9-way build-module matrix, which recompiled
       # the shared wasm dependency graph ~9x cold. Per-module size report folded in;
@@ -87,9 +88,14 @@ jobs:
         run: |
           cargo build --release --target wasm32-wasip2 --locked \
             -p example -p twap-monitor -p ethflow-watcher -p price-alert \
-            -p balance-tracker -p stop-loss -p http-probe \
-            -p clock-reader -p flaky-bomb -p fuel-bomb \
-            -p memory-bomb -p panic-bomb -p slow-host
+            -p balance-tracker -p stop-loss -p http-probe -p echo-venue \
+            -p echo-client -p echo-keeper -p clock-reader -p flaky-bomb -p flaky-venue \
+            -p fuel-bomb -p memory-bomb -p panic-bomb -p slow-host
+          # Separate invocation on purpose: unifying `cow-venue/adapter`
+          # into the module build would link the adapter's component
+          # export glue into every keeper module wasm.
+          cargo build --release --target wasm32-wasip2 --locked \
+            -p cow-venue --features cow-venue/adapter
           {
             echo "### module .wasm sizes"
             echo "| module | bytes |"
@@ -143,3 +149,30 @@ jobs:
           CXX_aarch64_unknown_linux_gnu: aarch64-linux-gnu-g++
           AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar
         run: cargo check --workspace --all-features --locked --target aarch64-unknown-linux-gnu
+
+  # Blocking zero-leak gate: host-layer crate graphs stay venue-free, the
+  # runtime Rust sources carry no charter symbol and no privileged router
+  # field, and nexum:host names no foreign WIT package and resolves as a
+  # leaf (scripts/check-venue-agnostic.sh).
+  venue-agnostic:
+    name: venue-agnostic
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: ./.github/actions/rust-setup
+      - uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
+        with:
+          tool: wasm-tools,ripgrep
+      - run: ./scripts/check-venue-agnostic.sh
+
+  # Blocking orderbook-only gate: the CoW venue crate carries no
+  # composable symbol (scripts/check-cow-orderbook-only.sh).
+  cow-orderbook-only:
+    name: cow-orderbook-only
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
+        with:
+          tool: ripgrep
+      - run: ./scripts/check-cow-orderbook-only.sh

.gitignore

@@ -32,6 +32,9 @@ skills-lock.json
 
 # Engine runtime state (default state_dir from engine.toml).
 data/
+# Shipped crate data slices are source, not runtime state: keep them.
+!crates/*/data/
+!crates/*/data/**
 
 # E2E automation: rendered configs with embedded RPC keys + script state
 # never get committed.