Introduce native Rust am CLI with GitHub Releases distribution

.claude-plugin/marketplace.json

@@ -12,7 +12,7 @@
       "name": "claude-code",
       "source": "./plugins/claude-code",
       "description": "Persistent semantic memory for Claude Code - user preferences, project context, prior decisions, and codebase facts that survive across sessions.",
-      "version": "0.2.1",
+      "version": "0.2.2",
       "category": "productivity",
       "homepage": "https://docs.atomicstrata.ai/integrations/coding-agents/claude-code",
       "license": "Apache-2.0"

.github/CODEOWNERS

@@ -31,6 +31,12 @@
 /turbo.json                             @atomicstrata/atomicmemory-maintainers
 /pnpm-lock.yaml                         @atomicstrata/atomicmemory-maintainers
 
+# CLI and wire types.
+/crates/                                @atomicstrata/atomicmemory-maintainers
+/Cargo.toml                             @atomicstrata/atomicmemory-maintainers
+/Cargo.lock                             @atomicstrata/atomicmemory-maintainers
+/rust-toolchain.toml                    @atomicstrata/atomicmemory-maintainers
+
 # Packages, adapters, plugins.
 /packages/core/                         @atomicstrata/atomicmemory-core
 /packages/sdk/                          @atomicstrata/atomicmemory-sdk

.github/workflows/ci-rust.yml

@@ -0,0 +1,135 @@
+name: CI Rust
+
+on:
+  pull_request:
+    paths:
+      - "crates/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - "rust-toolchain.toml"
+      - "deny.toml"
+      - ".github/workflows/ci-rust.yml"
+  push:
+    branches:
+      - main
+    paths:
+      - "crates/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - "rust-toolchain.toml"
+      - "deny.toml"
+      - ".github/workflows/ci-rust.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-rust-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  msrv:
+    name: msrv-check
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install MSRV toolchain
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        with:
+          toolchain: 1.88.0
+
+      - name: Cache Cargo
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32
+        with:
+          workspaces: .
+
+      - name: cargo check (MSRV)
+        run: cargo check --workspace --locked
+
+  cross-platform:
+    name: cross-platform-check (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-14, windows-2022]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 25
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        with:
+          toolchain: 1.88.0
+
+      - name: Cache Cargo
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32
+        with:
+          workspaces: .
+
+      - name: cargo check
+        run: cargo check --workspace --locked
+
+      # The config file lock (fs4) and the atomic rename used for
+      # config.toml/credentials.toml are the most platform-dependent code in
+      # the workspace, so the suite has to actually execute here, not just
+      # type-check.
+      - name: cargo test
+        run: cargo test --workspace --locked
+
+  deny:
+    name: cargo-deny
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: cargo deny
+        uses: EmbarkStudios/cargo-deny-action@b66acf5e9fe20f8aba065be86778a8a4c846f902
+        with:
+          command: check advisories bans licenses sources
+
+  rust:
+    name: fmt-clippy-test
+    needs: msrv
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        with:
+          toolchain: 1.88.0
+          components: rustfmt, clippy
+
+      - name: Cache Cargo
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32
+        with:
+          workspaces: .
+
+      - name: cargo fmt
+        run: cargo fmt --all -- --check
+
+      - name: cargo clippy
+        run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
+
+      - name: cargo test
+        run: cargo test --workspace --locked
+
+      - name: Build release CLI
+        run: cargo build -p atomicmemory --release --locked --bin am
+
+      - name: Smoke am --help
+        run: ./target/release/am --help

.github/workflows/ci.yml

@@ -270,5 +270,15 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
-      - name: Run security compliance
-        run: node scripts/security/security-compliance.mjs
+      - name: Setup pnpm
+        run: |
+          corepack enable
+          corepack prepare pnpm@${PNPM_VERSION} --activate
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --ignore-scripts
+      - name: Run security compliance contract tests
+        run: |
+          pnpm run test:security-compliance
+          pnpm run test:release-cli-version
+          pnpm run test:install-cli
+          pnpm run security-compliance