feat: consolidate Build #5 kernel integration, CoCo allocation, and legacy service hardening

.claude/rules/governance.md

@@ -10,6 +10,8 @@ paths:
 
 # Governance rules — RamShared
 
+Production posture: source target v0.15.0; latest published stable v0.14.1.
+
 These rules exist so that every PR (Patch/Pull Request) carries reviewable context and so that changes in agent rules live synchronized between `CLAUDE.md`, `AGENTS.md`, and `.claude/rules/*`.
 
 ## PR Template (canonical format)
@@ -83,8 +85,8 @@ systems or other repositories.
 ## Release, Packaging & Reliability Gap Parity
 
 1. **Stable Release Alignment**:
-   - Production posture is strictly stable (`v0.14.0`). No beta or prerelease flags remain on public releases.
-   - Package build scripts (`scripts/package/build-deb-package.sh`, `build-rpm-package.sh`), documentation badges (`README.md`, `README.pt-BR.md`), and manifests (`docs/localization/manifest.json`) must stay synchronized with the active release tag.
+   - The current source/release candidate target is `v0.15.0`; the latest published stable release remains `v0.14.1` until the candidate is promoted. Do not label a target as published before its release exists.
+   - Package build scripts (`scripts/package/build-deb-package.sh`, `build-rpm-package.sh`), documentation badges (`README.md`, `README.pt-BR.md`), and manifests (`docs/localization/manifest.json`) must state the source target and published release accurately.
 2. **Semantic Gap Register Governance**:
    - `docs/reliability/GAP-REGISTER.md` must accurately reflect real CI and repository state.
    - Never retain phantom blockers (e.g. "await external Guard repair") when CI gates for that capability are passing.

.github/workflows/ci-contract.yml

@@ -73,6 +73,14 @@ jobs:
           --test-coverage-functions=80
           tools/ci/plan-rust-slice-coverage.test.mjs
 
+      - name: Rust coverage runner coverage
+        run: >-
+          node --test --experimental-test-coverage
+          --test-coverage-include=tools/ci/check-rust-slice-coverage.mjs
+          --test-coverage-lines=80 --test-coverage-branches=80
+          --test-coverage-functions=80
+          tools/ci/check-rust-slice-coverage.test.mjs
+
       - name: Validate exact SPEC coverage map
         run: node tools/ci/plan-rust-slice-coverage.mjs --all
 
@@ -158,6 +166,30 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Install Mesa software Vulkan ICD
+        shell: bash
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install --yes --no-install-recommends libvulkan1 mesa-vulkan-drivers
+          icd_path="$(find /usr/share/vulkan/icd.d -maxdepth 1 -type f -name 'lvp_icd*.json' -print -quit)"
+          test -n "$icd_path"
+          printf 'VK_ICD_FILENAMES=%s\n' "$icd_path" >> "$GITHUB_ENV"
+
+      - name: Fetch immutable Rust slice baselines
+        run: |
+          set -euo pipefail
+          while IFS= read -r revision; do
+            [[ "$revision" =~ ^[0-9a-f]{40}$ ]]
+            if ! git cat-file -e "${revision}^{commit}" 2>/dev/null; then
+              git fetch --no-tags origin "$revision"
+            fi
+            git cat-file -e "${revision}^{commit}"
+          done < <(
+            jq -r '.entries[] | select(.kind == "rust-ignored-test-relocation") | .base_revision' \
+              docs/governance/rust-slice-coverage.json | sort -u
+          )
+
       - name: Set up Rust 1.98.0 coverage toolchain
         uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # action pinned
         with:

.github/workflows/ci.yml

@@ -40,6 +40,40 @@ jobs:
       - name: Tests (ignored cases require GPU/root)
         run: cargo test --workspace -- --test-threads=1
 
+  guest-pressure-safety:
+    name: guest pressure safety guards
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Shell syntax
+        run: |
+          set -euo pipefail
+          for script in \
+            scripts/safety/cascade-pressure-probe.sh \
+            scripts/safety/guest-pressure-runtime-guard.sh \
+            scripts/safety/test-cascade-pressure-probe-static.sh \
+            scripts/safety/test-guest-pressure-runtime-guard.sh \
+            scripts/safety/ramshared-guest-memory-admission.sh \
+            scripts/safety/test-ramshared-guest-memory-admission.sh \
+            scripts/safety/test-wsl2-freeze-campaign-artifact-static.sh \
+            scripts/safety/wsl2-freeze-campaign.sh \
+            scripts/safety/Test-Wsl2FreezeCampaignStatic.sh; do
+            bash -n "$script"
+          done
+
+      - name: Guest memory and pressure fixtures
+        run: |
+          set -euo pipefail
+          bash scripts/safety/test-guest-pressure-runtime-guard.sh
+          bash scripts/safety/test-cascade-pressure-probe-static.sh
+          bash scripts/safety/test-ramshared-guest-memory-admission.sh
+          bash scripts/safety/test-wsl2-freeze-campaign-artifact-static.sh
+          bash scripts/safety/Test-Wsl2FreezeCampaignStatic.sh
+
   docs:
     name: docs index + links
     runs-on: ubuntu-latest
@@ -145,7 +179,7 @@ jobs:
   ci-summary:
     name: ci-summary
     if: always()
-    needs: [rust, docs]
+    needs: [rust, docs, guest-pressure-safety]
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
@@ -155,9 +189,10 @@ jobs:
         env:
           RUST_RESULT: ${{ needs.rust.result }}
           DOCS_RESULT: ${{ needs.docs.result }}
+          GUEST_PRESSURE_RESULT: ${{ needs.guest-pressure-safety.result }}
         run: |
           set -euo pipefail
-          for result in "$RUST_RESULT" "$DOCS_RESULT"; do
+          for result in "$RUST_RESULT" "$DOCS_RESULT" "$GUEST_PRESSURE_RESULT"; do
             if [ "$result" != success ]; then
               echo "CI_CORE_SUMMARY=FAIL"
               exit 1

.github/workflows/release-packaging.yml

@@ -7,9 +7,9 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: 'Release version tag (e.g. v0.12.0)'
+        description: 'Release version tag (e.g. v0.15.0)'
         required: false
-        default: 'v0.12.0'
+        default: 'v0.15.0'
 
 permissions:
   contents: write
@@ -37,10 +37,10 @@ jobs:
         run: cargo build --release --locked
 
       - name: Build Debian/Ubuntu Package (.deb)
-        run: ./scripts/package/build-deb-package.sh "${{ (github.ref_type == 'tag' && github.ref_name) || inputs.version || 'v0.12.0' }}"
+        run: ./scripts/package/build-deb-package.sh "${{ (github.ref_type == 'tag' && github.ref_name) || inputs.version || 'v0.15.0' }}"
 
       - name: Build Fedora/RHEL Package (.rpm)
-        run: ./scripts/package/build-rpm-package.sh "${{ (github.ref_type == 'tag' && github.ref_name) || inputs.version || 'v0.12.0' }}"
+        run: ./scripts/package/build-rpm-package.sh "${{ (github.ref_type == 'tag' && github.ref_name) || inputs.version || 'v0.15.0' }}"
 
       - name: Package Arch Linux AUR Tarball
         run: |
@@ -68,5 +68,5 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          TARGET_TAG="${{ (github.ref_type == 'tag' && github.ref_name) || inputs.version || 'v0.12.0' }}"
+          TARGET_TAG="${{ (github.ref_type == 'tag' && github.ref_name) || inputs.version || 'v0.15.0' }}"
           find artifacts/packages -maxdepth 1 -type f \( -name "*.deb" -o -name "*.rpm" -o -name "*.tar.gz" -o -name "SHA256SUMS.txt" \) -exec gh release upload "$TARGET_TAG" --clobber {} +

.github/workflows/security-scans.yml

@@ -39,8 +39,8 @@ jobs:
       - name: Audit vetted RustSec snapshot
         env:
           RUSTSEC_DB_URL: https://github.com/RustSec/advisory-db.git
-          RUSTSEC_DB_COMMIT: f58ccfe51a5954186716998f01360d1079a8a3a5
-          RUSTSEC_DB_COMMIT_UTC: "2026-09-17T07:37:14Z"
+          RUSTSEC_DB_COMMIT: ef03605143a913024f864d2edf476adad5720c93
+          RUSTSEC_DB_COMMIT_UTC: "2026-09-28T09:30:11Z"
           RUSTSEC_DB_MAX_AGE_DAYS: "7"
         run: |
           set -euo pipefail

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.14.1"
+  ".": "0.15.0"
 }

AGENTS.md

@@ -16,8 +16,6 @@ The source of truth for architecture and coding rules is:
 - [`.claude/rules/coding.md`](.claude/rules/coding.md)
 - [`.claude/rules/governance.md`](.claude/rules/governance.md)
 - [`.claude/rules/benchmarks.md`](.claude/rules/benchmarks.md)
-- Agent orchestration and dispatch: [`.claude/rules/agent-orchestration.md`](.claude/rules/agent-orchestration.md).
-- Its rendered policy and canonical typed records are the machine-checked source.
 
 ### Before planning, editing, or opening a patch/PR
 
@@ -76,5 +74,6 @@ PR descriptions must follow `.github/pull_request_template.md` strictly: canonic
 - No persisting secrets.
 - No undocumented dependencies.
 - **Reliability Gap Register & Release Parity**: Keep `docs/reliability/GAP-REGISTER.md`
-  semantically synchronized with active CI status and releases (`v0.14.0`). Phantom
+  semantically synchronized with active CI status and the `v0.15.0` source target;
+  distinguish that target from the latest published release until promotion. Phantom
   blockers (such as resolved Guard repairs) are strictly forbidden when CI gates pass.