Sync alpha with latest upstream while preserving fork changes

.agent/CODING_TASTE.md

@@ -25,7 +25,7 @@ quantified and bounded.
   parallel paths (a separate `GetAppKeyAmd` was rejected on these grounds, #630). When an
   existing API is the wrong shape, add a purpose-built one rather than overloading a return
   value (`is_app_allowed` returning policy → add `auth_api.get_app_policy` instead, #538).
-- **Names must say what the thing does.** `GetQuote` for an app key → `GetAttestationForAppKey`
+- **Names must say what the thing does.** `GetQuote` for an app key → `AttestAppKey`
   (#360). An RPC named `ComposeHash` that returns an `app_id` is wrong (#181).
 - **Avoid enums in protobuf APIs** that surface as JSON — proto has no way to express
   snake_case serde renaming, so use strings (#241).
@@ -257,6 +257,11 @@ not just the symptom:
 
 ## Readability and idioms
 
+- **Import for readability, not minimum path length.** Import specific types and
+  frequently repeated operations when their short names remain unambiguous
+  (`TcpListener::bind`, `timeout`, `Command::new`). Keep qualifiers that carry useful
+  semantic context (`serde_json::from_slice`, `tokio::spawn`, `anyhow::bail!`). Follow
+  the surrounding module when either form is equally clear.
 - **Errors**: `anyhow` everywhere in services — `thiserror` only in library crates whose
   callers match on error variants. `bail!` inside an `if` is the guard idiom; **`ensure!`
   is never used in this codebase** (0 occurrences) and reads as foreign. `let ... else

.claude/agents/sdk-sync-checker.md

@@ -67,10 +67,10 @@ Details:
 
 ## Locations
 - Protos: `dstack/guest-agent/rpc/proto/*.proto`
-- Python: `sdk/python/src/dstack_sdk/dstack_client.py`
-- Go: `sdk/go/dstack/client.go`
-- Rust: `sdk/rust/types/src/dstack.rs`
-- JS: `sdk/js/src/index.ts`
+- Python: `sdk/python/src/dstack_sdk/dstack_client_v0.py`, `dstack_client_v1.py`
+- Go: `sdk/go/dstack/client_v0.go`, `client_v1.go`
+- Rust: `sdk/rust/types/src/dstack_v0.rs`, `dstack_v1.rs`
+- JS: `sdk/js/src/client-v0.ts`, `client-v1.ts`
 - Docs: `sdk/curl/api.md`, `sdk/curl/api-tappd.md`
 
 Focus on API surface differences. Provide specific file paths and line numbers.

.github/workflows/docker-build-check.yml

@@ -4,24 +4,66 @@
 
 name: Docker Build Check
 
+# Not a required status check, so a workflow-level filter is safe here: a pull
+# request that skips it is not left waiting on a check that never arrives. What
+# it verifies -- that the builder images still build and that their pinned
+# package lists still match -- cannot change unless something under `dstack/`
+# does.
 on:
   push:
-    branches: [ master, next, dev-* ]
+    branches: [ next, 'release/**' ]
+    paths:
+      - 'dstack/**'
+      - 'rust-toolchain.toml'
+      - '.github/workflows/docker-build-check.yml'
+      - '.github/workflows/kms-release.yml'
+      - '.github/workflows/gateway-release.yml'
+      - '.github/workflows/verifier-release.yml'
   pull_request:
-    branches: [ master, next, dev-* ]
+    branches: [ next, 'release/**' ]
+    paths:
+      - 'dstack/**'
+      - 'rust-toolchain.toml'
+      - '.github/workflows/docker-build-check.yml'
+      - '.github/workflows/kms-release.yml'
+      - '.github/workflows/gateway-release.yml'
+      - '.github/workflows/verifier-release.yml'
 
 env:
   DSTACK_REV: ${{ github.event.pull_request.head.sha || github.sha }}
   DSTACK_SRC_URL: ${{ github.event.pull_request.head.repo.clone_url || format('{0}/{1}', github.server_url, github.repository) }}
 
+# Builds go through the `docker` driver, i.e. the daemon's own BuildKit, rather
+# than the `docker-container` builder setup-buildx creates by default. With a
+# container builder every `--load` compresses the result into a tarball and
+# imports it into the daemon; for the `*-builder` targets, which carry the Rust
+# toolchain and the cargo target directory, that alone was two to three
+# minutes. With the daemon's builder the image lands in the store directly, and
+# the second build of the `*-builder` target is a cache hit on the first.
+#
+# No BuildKit layer cache (`cache-to: type=gha`). The source is cloned at
+# DSTACK_REV inside the build, so the cargo layer misses on every commit, and
+# `mode=max` still exported the whole builder stage to the Actions cache: about
+# two and a half minutes per job, and most of the repository's 10 GB cache
+# quota, which evicted the cargo caches the other workflows depend on. What it
+# could have saved was the pinned-package install, roughly fifteen seconds.
 jobs:
+  build-script-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - name: Test release build orchestration
+        run: python3 -m unittest discover -s dstack/build/shared/tests -v
+
   gateway:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
+        with:
+          driver: docker
 
       - name: Build Gateway Docker image
         uses: docker/build-push-action@v5
@@ -73,6 +115,8 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
+        with:
+          driver: docker
 
       - name: Build KMS Docker image
         uses: docker/build-push-action@v5
@@ -88,10 +132,10 @@ jobs:
             DSTACK_REV=${{ env.DSTACK_REV }}
             DSTACK_SRC_URL=${{ env.DSTACK_SRC_URL }}
 
-      - name: Verify pinned packages (qemu stage)
+      - name: Verify pinned packages
         run: |
           dstack/build/shared/verify-pinned-packages.sh dstack-kms-check:latest \
-            dstack/kms/dstack-app/builder/shared/qemu-pinned-packages.txt
+            dstack/kms/dstack-app/builder/shared/pinned-packages.txt
 
       - name: Build kms-builder target
         run: |
@@ -125,6 +169,8 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
+        with:
+          driver: docker
 
       - name: Build Verifier Docker image
         uses: docker/build-push-action@v5
@@ -163,21 +209,3 @@ jobs:
         run: |
           dstack/build/shared/verify-pinned-packages.sh verifier-builder-check:latest \
             dstack/verifier/builder/shared/builder-pinned-packages.txt
-
-      - name: Build acpi-builder target
-        run: |
-          docker buildx build \
-            --load \
-            --target acpi-builder \
-            --tag verifier-acpi-check:latest \
-            --provenance=false \
-            --file dstack/verifier/builder/Dockerfile \
-            --build-context build-shared=dstack/build/shared \
-            --build-arg "DSTACK_REV=${DSTACK_REV}" \
-            --build-arg "DSTACK_SRC_URL=${DSTACK_SRC_URL}" \
-            dstack/verifier
-
-      - name: Verify qemu pinned packages
-        run: |
-          dstack/build/shared/verify-pinned-packages.sh verifier-acpi-check:latest \
-            dstack/verifier/builder/shared/qemu-pinned-packages.txt

.github/workflows/foundry-test.yml

@@ -56,6 +56,9 @@ jobs:
           forge build --sizes
         id: build
 
+      - name: Install OpenZeppelin upgrades validator
+        run: npm install --no-save --package-lock=false @openzeppelin/upgrades-core@^1.37.0
+
       - name: Run Forge tests
         run: |
           forge test --ffi -vvv

.github/workflows/gateway-cluster-tests.yml

@@ -0,0 +1,142 @@
+# SPDX-FileCopyrightText: © 2026 Phala Network <dstack@phala.network>
+#
+# SPDX-License-Identifier: Apache-2.0
+
+name: Gateway cluster tests
+
+# WaveKV replication between gateway nodes: push and periodic sync, anti-entropy
+# repair, bootstrap after losing a store, partition recovery, node identity, and
+# the admin RPCs that gate registration. Unit tests cover the store; this runs
+# three real gateways and stops, wipes and restarts them.
+#
+# The nodes authenticate each other for real, so the cluster mTLS path is
+# exercised rather than switched off -- which is what the process-based suite
+# this replaces could not do.
+on:
+  push:
+    branches: [ next, 'release/**' ]
+    paths:
+      - 'dstack/gateway/**'
+      - 'dstack/cert-client/**'
+      - 'dstack/ra-tls/**'
+      - 'dstack/guest-agent-simulator/**'
+      - 'sdk/simulator/**'
+      - 'dstack/crates/mock-attestation/**'
+      - '.github/workflows/gateway-cluster-tests.yml'
+  pull_request:
+    branches: [ next, 'release/**' ]
+    paths:
+      - 'dstack/gateway/**'
+      - 'dstack/cert-client/**'
+      - 'dstack/ra-tls/**'
+      - 'dstack/guest-agent-simulator/**'
+      - 'sdk/simulator/**'
+      - 'dstack/crates/mock-attestation/**'
+      - '.github/workflows/gateway-cluster-tests.yml'
+
+# Per workflow, not shared with the other two gateway suites.
+#
+# A group shared across all three does not serialise them, it drops one: a
+# concurrency group holds a single *pending* run, so when the third workflow
+# queued behind the first two, the one already waiting was cancelled --
+# silently, and reported as a cancelled run rather than a failure. The suites
+# no longer need serialising anyway; each brings up its own attestation fixture
+# under its own `FIXTURE_NS`, so there is nothing left to collide over.
+#
+# `cancel-in-progress` is the ordinary meaning here: a new push supersedes the
+# run for the commit it replaced.
+concurrency:
+  group: gateway-cluster-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  gateway-cluster:
+    runs-on: ${{ vars.CI_RUNNER || 'ubuntu-latest' }}
+    # 28 tests, most of which restart nodes and then wait out a 5s sync interval.
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@1.92.0
+        with:
+          targets: x86_64-unknown-linux-musl
+
+      - name: Install musl toolchain
+        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends musl-tools
+
+      # The gateways create real WireGuard interfaces inside their containers.
+      - name: Record kernel capabilities
+        run: |
+          echo "kernel: $(uname -r)"
+          sudo modprobe wireguard 2>&1 || echo "no wireguard module available"
+          echo "wireguard loaded: $(lsmod | grep -c '^wireguard ' || true)"
+
+      - name: Cache cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            dstack/target
+          key: gateway-cluster-${{ runner.os }}-${{ hashFiles('dstack/Cargo.lock') }}
+          restore-keys: gateway-cluster-${{ runner.os }}-
+
+      - name: Cluster suite
+        working-directory: dstack/gateway/test-run/cluster
+        run: ./run-cluster-tests.sh
+
+      # The suite only materialises node logs for the two tests that assert on
+      # them, so the mounted directory is close to empty for any other failure.
+      # Pull them from the daemon instead, by compose service so the shared
+      # fixture's project-scoped names do not have to be guessed.
+      - name: Collect node logs on failure
+        if: failure()
+        working-directory: dstack/gateway/test-run/cluster
+        # The compose files require `${FIXTURE_NS:?}`, and the suite script
+        # exports it only to itself. Unset here, every `docker compose` call in
+        # this step -- not just the fixture one -- fails at interpolation, and
+        # the step still passes, so the artifact carries no container logs.
+        env:
+          FIXTURE_NS: dstack-fixture-cluster
+        run: |
+          mkdir -p run/logs
+          # By project, discovered from the daemon. A bare `docker compose` here
+          # addresses the project named after this directory (`cluster`), which
+          # no test ever uses -- every test runs under `cluster-<testname>`, so
+          # the loop that used `compose config --services` collected nothing.
+          docker ps -a --filter 'label=com.docker.compose.project' \
+            --format '{{.Label "com.docker.compose.project"}}' \
+            | grep -E '^cluster-' | sort -u | while read -r project; do
+              docker compose -p "$project" -f docker-compose.yml logs --no-color \
+                > "run/logs/project-$project.log" 2>&1 || true
+            done
+          # The suite's own per-test dumps are root-owned inside the bind mount.
+          docker run --rm -v "$PWD/run:/r" alpine:latest chmod -R a+rX /r || true
+          # The attestation fixture is a project of its own now, so it is not in
+          # this suite's service list and its logs have to be asked for
+          # separately -- they are where a quote-verification failure explains
+          # itself.
+          docker compose -p "$FIXTURE_NS" -f ../attestation/fixture.yml logs \
+            --no-color > "run/logs/fixture.log" 2>&1 || true
+          docker compose ps -a > run/logs/compose-ps.txt 2>&1 || true
+
+      - name: Upload node logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: gateway-cluster-logs
+          path: dstack/gateway/test-run/cluster/run/logs/
+          if-no-files-found: ignore
+          retention-days: 7
+
+      - name: Tear down
+        if: always()
+        working-directory: dstack/gateway/test-run/cluster
+        run: ./run-cluster-tests.sh down