feat(eventbus): close END-297 — finalize message broker closure pass

.github/workflows/audit.yml

@@ -22,6 +22,6 @@ jobs:
             contents: read
             issues: write
         steps:
-            - uses: actions/checkout@v6
-            - uses: actions-rust-lang/audit@v1
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+            - uses: actions-rust-lang/audit@72c09e02f132669d52284a3323acdb503cfc1a24 # v1.2.7
               name: Audit Rust Dependencies

.github/workflows/benchmarks.yml

@@ -1,6 +1,23 @@
 name: Benchmarks
 
 on:
+    # The eventbus-latency-slo job gates PRs on the END-297 local-IPC round-trip
+    # p99 latency SLO (<1ms). Scoped to paths that can plausibly affect IPC
+    # latency so we don't run a bench on every PR. Other jobs in this workflow
+    # (benchmarks, load-tests) remain workflow_dispatch-only and are gated by
+    # per-job `if` conditions below; they are informational and expensive to
+    # run on every PR.
+    pull_request:
+        branches: [ main ]
+        paths:
+            - "daemoneye-eventbus/**"
+            - "collector-core/**"
+            - ".github/workflows/benchmarks.yml"
+            # Toolchain or workspace-level dep changes can shift Tokio/compiler
+            # behavior and move p99 without touching the eventbus crate itself.
+            - "Cargo.toml"
+            - "Cargo.lock"
+            - "rust-toolchain.toml"
     workflow_dispatch:
         inputs:
             suite:
@@ -30,12 +47,15 @@ env:
 
 jobs:
     benchmarks:
+        # Informational benchmark suite; runs only on manual dispatch to avoid
+        # spending PR CI time on non-gating criterion runs.
+        if: github.event_name == 'workflow_dispatch'
         runs-on: ubuntu-latest
         timeout-minutes: 15
         steps:
             - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-            - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
+            - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
               with:
                   install: true
                   cache: true
@@ -45,7 +65,8 @@ jobs:
               uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
               with:
                   path: target/criterion
-                  key: criterion-baseline-${{ runner.os }}-${{ hashFiles('rust-toolchain.toml', 'Cargo.lock') }}
+                  key: criterion-baseline-${{ runner.os }}-${{ hashFiles('rust-toolchain.toml',
+                      'Cargo.lock') }}
 
             - name: Run benchmarks
               env:
@@ -80,23 +101,26 @@ jobs:
               if: github.ref == 'refs/heads/main'
               with:
                   path: target/criterion
-                  key: criterion-baseline-${{ runner.os }}-${{ hashFiles('rust-toolchain.toml', 'Cargo.lock') }}
+                  key: criterion-baseline-${{ runner.os }}-${{ hashFiles('rust-toolchain.toml',
+                      'Cargo.lock') }}
 
             - name: Upload benchmark results
-              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
               if: always()
               with:
                   name: benchmark-results
                   path: bench-output.txt
                   retention-days: 30
 
     load-tests:
+        # Informational load tests; runs only on manual dispatch.
+        if: github.event_name == 'workflow_dispatch'
         runs-on: ubuntu-latest
         timeout-minutes: 10
         steps:
             - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-            - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
+            - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
               with:
                   install: true
                   cache: true
@@ -114,3 +138,50 @@ jobs:
                   name: load-test-results
                   path: load-test-output.txt
                   retention-days: 30
+
+    # END-297 acceptance-criterion gate: local-IPC round-trip p99 latency < 1ms.
+    # See daemoneye-eventbus/benches/ipc_performance.rs::latency_p99_slo.
+    # Gated on Linux and macOS only; Windows and FreeBSD are informational per
+    # the END-297 plan (Key Technical Decisions) and the AGENTS.md OS support
+    # matrix.
+    eventbus-latency-slo:
+        strategy:
+            fail-fast: false
+            matrix:
+                os:
+                    - ubuntu-latest
+                    - macos-latest
+        runs-on: ${{ matrix.os }}
+        timeout-minutes: 15
+        steps:
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+            - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+              with:
+                  install: true
+                  cache: true
+                  github_token: ${{ secrets.GITHUB_TOKEN }}
+
+            # Cache `target/` across runs so the cold-build time doesn't eat the
+            # 15-minute job timeout. Key includes the OS and Cargo.lock so the
+            # cache invalidates on toolchain/dep changes.
+            - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+              with:
+                  shared-key: eventbus-latency-slo-${{ matrix.os }}
+                  cache-targets: "true"
+                  cache-all-crates: "true"
+
+            - name: Run END-297 latency p99 SLO bench (<1ms)
+              # Filter anchored with ^...$ so it matches only the SLO bench ID
+              # and not the pre-existing `latency/*` bench IDs in the same file.
+              run: |
+                  set -o pipefail
+                  mise x -- cargo bench --package daemoneye-eventbus --bench ipc_performance -- '^latency_p99_slo$' 2>&1 | tee eventbus-latency-slo.txt
+
+            - name: Upload latency SLO results
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+              if: always()
+              with:
+                  name: eventbus-latency-slo-${{ matrix.os }}
+                  path: eventbus-latency-slo.txt
+                  retention-days: 30

.github/workflows/ci.yml

@@ -2,12 +2,12 @@ name: CI
 
 on:
     push:
-        branches: [main]
+        branches: [ main ]
     pull_request:
-        branches: [main]
+        branches: [ main ]
     workflow_dispatch:
 
-# Restrict permissions to minimum required (principle of least privilege)
+        # Restrict permissions to minimum required (principle of least privilege)
 permissions:
     contents: read
 
@@ -38,7 +38,7 @@ jobs:
                   github_token: ${{ secrets.GITHUB_TOKEN }}
 
             - name: Ensure rustfmt and clippy are installed
-              run: rustup component add rustfmt clippy
+              run: mise x -- rustup component add rustfmt clippy
 
             - name: Check formatting
               run: just lint-rust
@@ -114,7 +114,7 @@ jobs:
     coverage:
         runs-on: ubuntu-latest
         timeout-minutes: 30
-        needs: [test, test-cross-platform, quality]
+        needs: [ test, test-cross-platform, quality ]
         steps:
             - name: Checkout repository
               uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -138,8 +138,3 @@ jobs:
                   fail_ci_if_error: false
                   token: ${{ secrets.CODECOV_TOKEN }}
                   slug: EvilBit-Labs/daemoneye
-            - name: Upload to Qlty
-              uses: qltysh/qlty-action/coverage@a19242102d17e497f437d7466aa01b528537e899 # v2.2.0
-              with:
-                  token: ${{ secrets.QLTY_COVERAGE_TOKEN }}
-                  files: target/lcov.info

.github/workflows/codeql.yml

@@ -2,9 +2,9 @@ name: CodeQL
 
 on:
     push:
-        branches: [main]
+        branches: [ main ]
     pull_request:
-        branches: [main]
+        branches: [ main ]
     schedule:
         - cron: "43 22 * * 1"
     workflow_dispatch:
@@ -19,8 +19,8 @@ jobs:
         name: CodeQL Analyze
         runs-on: ubuntu-22.04
         steps:
-            - uses: actions/checkout@v6
-            - uses: jdx/mise-action@v3
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+            - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
               with:
                   install: true
                   cache: true

.github/workflows/copilot-setup-steps.yml

@@ -28,8 +28,8 @@ jobs:
         # You can define any steps you want, and they will run before the agent starts.
         # If you do not check out your code, Copilot will do this for you.
         steps:
-            - uses: actions/checkout@v6
-            - uses: jdx/mise-action@v3
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+            - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
               with:
                   install: true
                   cache: true

.github/workflows/docs.yml

@@ -2,9 +2,9 @@ name: Deploy Documentation
 
 on:
     push:
-        branches: [main]
+        branches: [ main ]
     pull_request:
-        branches: [main]
+        branches: [ main ]
     workflow_dispatch:
 
 permissions:
@@ -24,15 +24,15 @@ jobs:
     build:
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v6
-            - uses: jdx/mise-action@v3
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+            - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
               with:
                   install: true
                   cache: true
                   github_token: ${{ secrets.GITHUB_TOKEN }}
 
             - name: Setup mdBook
-              uses: jontze/action-mdbook@v4
+              uses: jontze/action-mdbook@6c0be56d14c4bf16861b00af61f50ff7400ce502 # v4.0.0
               with:
                   token: ${{ secrets.GITHUB_TOKEN }}
                   mdbook-version: latest
@@ -41,29 +41,30 @@ jobs:
                   use-admonish: true
 
             - name: Install cargo-binstall
-              uses: cargo-bins/cargo-binstall@main
+              uses: cargo-bins/cargo-binstall@dc19f1e48450eefe5a29b8da6c6b00a87d730b37 # v1.18.1
 
             - name: Install mdbook plugins
-              run: cargo binstall mdbook-tabs mdbook-i18n-helpers mdbook-yml-header mdbook-image-size --no-confirm
+              run: cargo binstall mdbook-tabs mdbook-i18n-helpers mdbook-yml-header
+                  mdbook-image-size --no-confirm
 
             - name: Build rustdoc
               run: |
-                  cargo doc --no-deps --document-private-items --target-dir target
+                  mise x -- cargo doc --no-deps --document-private-items --target-dir target
                   mkdir -p docs/book/api
                   cp -r target/doc/* docs/book/api/
 
             - name: Build mdBook
               run: |
                   cd docs
-                  mdbook build
+                  mise x -- mdbook build
 
             - name: Setup Pages
               if: github.ref == 'refs/heads/main'
-              uses: actions/configure-pages@v5
+              uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
 
             - name: Upload artifact
               if: github.ref == 'refs/heads/main'
-              uses: actions/upload-pages-artifact@v4
+              uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
               with:
                   path: docs/book
 
@@ -77,4 +78,4 @@ jobs:
         steps:
             - name: Deploy to GitHub Pages
               id: deployment
-              uses: actions/deploy-pages@v4
+              uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.github/workflows/release.yml

@@ -27,26 +27,26 @@ jobs:
             - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
                   fetch-depth: 0
-            - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
+            - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
               with:
                   install: true
                   cache: true
                   github_token: ${{ secrets.GITHUB_TOKEN }}
 
             - name: Install Rust toolchain
-              uses: dtolnay/rust-toolchain@1.91.0
+              uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
               with:
+                  toolchain: stable
                   targets: >-
-                      x86_64-unknown-linux-gnu,
-                      aarch64-unknown-linux-gnu
+                      x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu
 
             - name: Install cross-compilation dependencies
               run: |
                   sudo apt-get update
                   sudo apt-get install -y gcc-aarch64-linux-gnu
 
             - name: Run GoReleaser
-              uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7.0.0
+              uses: goreleaser/goreleaser-action@e24998b8b67b290c2fa8b7c14fcfa7de2c5c9b8c # v7.1.0
               with:
                   distribution: goreleaser
                   version: "~> v2"
@@ -61,21 +61,21 @@ jobs:
             - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
                   fetch-depth: 0
-            - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
+            - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
               with:
                   install: true
                   cache: true
                   github_token: ${{ secrets.GITHUB_TOKEN }}
 
             - name: Install Rust toolchain
-              uses: dtolnay/rust-toolchain@1.91.0
+              uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
               with:
+                  toolchain: stable
                   targets: >-
-                      x86_64-apple-darwin,
-                      aarch64-apple-darwin
+                      x86_64-apple-darwin, aarch64-apple-darwin
 
             - name: Run GoReleaser
-              uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7.0.0
+              uses: goreleaser/goreleaser-action@e24998b8b67b290c2fa8b7c14fcfa7de2c5c9b8c # v7.1.0
               with:
                   distribution: goreleaser
                   version: "~> v2"
@@ -91,21 +91,21 @@ jobs:
             - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
                   fetch-depth: 0
-            - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
+            - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
               with:
                   install: true
                   cache: true
                   github_token: ${{ secrets.GITHUB_TOKEN }}
 
             - name: Install Rust toolchain
-              uses: dtolnay/rust-toolchain@1.91.0
+              uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
               with:
+                  toolchain: stable
                   targets: >-
-                      x86_64-pc-windows-msvc,
-                      aarch64-pc-windows-msvc
+                      x86_64-pc-windows-msvc, aarch64-pc-windows-msvc
 
             - name: Run GoReleaser
-              uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7.0.0
+              uses: goreleaser/goreleaser-action@e24998b8b67b290c2fa8b7c14fcfa7de2c5c9b8c # v7.1.0
               with:
                   distribution: goreleaser
                   version: "~> v2"