From b180826ecca30d18a0422ae8acb59cc4a09ad938 Mon Sep 17 00:00:00 2001
From: Lothnic <joshimayank08012007@gmail.com>
Date: Tue, 4 Aug 2026 01:05:29 +0530
Subject: [PATCH 1/2] ci: control-plane workflow with cross-repo connection in
 CI
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds a dedicated control-plane job: installs the [control] extra, checks out
meridian-node and installs it, then lint/type-checks meridian_control and runs
tests/control — which includes the real node<->control cross-repo tests (the
compatibility target) and the verify_connection.py numbers report. Additive;
does not touch the existing gateway CI.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/control.yml | 48 +++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 .github/workflows/control.yml

diff --git a/.github/workflows/control.yml b/.github/workflows/control.yml
new file mode 100644
index 0000000..bb7e687
--- /dev/null
+++ b/.github/workflows/control.yml
@@ -0,0 +1,48 @@
+name: control-plane
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch: {}
+
+concurrency:
+  group: control-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  control:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # Check out meridian-node so the cross-repo tests exercise the real
+      # node <-> control connection (the compatibility target) in CI.
+      - name: Checkout meridian-node
+        uses: actions/checkout@v4
+        with:
+          repository: IMV-IN/meridian-node
+          path: meridian-node
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install control + node agent
+        run: |
+          pip install -e ".[control,dev]"
+          pip install -e ./meridian-node[http]
+
+      - name: Lint + type-check control
+        run: |
+          ruff check meridian_control tests/control
+          mypy meridian_control
+
+      - name: Test control + cross-repo connection
+        run: pytest tests/control -q
+
+      - name: Connection numbers report
+        run: python scripts/verify_connection.py

From b9b10045a85041e9d612f65312ec38553a2fae67 Mon Sep 17 00:00:00 2001
From: Lothnic <joshimayank08012007@gmail.com>
Date: Tue, 4 Aug 2026 01:09:20 +0530
Subject: [PATCH 2/2] ci: make meridian-node checkout optional in the control
 workflow

The node repo is private, so the default token can't check it out. Make the
checkout optional (continue-on-error + optional MERIDIAN_NODE_TOKEN secret);
when it's unavailable the cross-repo tests skip via importorskip and the rest of
the control suite still runs. Drop the verify_connection step from CI (it needs
the node agent; it stays a local/on-demand tool).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/control.yml | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/control.yml b/.github/workflows/control.yml
index bb7e687..6c249da 100644
--- a/.github/workflows/control.yml
+++ b/.github/workflows/control.yml
@@ -18,31 +18,35 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      # Check out meridian-node so the cross-repo tests exercise the real
-      # node <-> control connection (the compatibility target) in CI.
-      - name: Checkout meridian-node
+      # Optional: check out meridian-node so the cross-repo tests run against the
+      # real node agent. Needs a token with read access to the (private) repo;
+      # without it the cross-repo tests skip via importorskip, and the rest of the
+      # control suite (service, mTLS binding, migrations, projection) still runs.
+      - name: Checkout meridian-node (optional)
+        id: node
+        continue-on-error: true
         uses: actions/checkout@v4
         with:
           repository: IMV-IN/meridian-node
           path: meridian-node
+          token: ${{ secrets.MERIDIAN_NODE_TOKEN }}
 
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
           python-version: "3.11"
 
-      - name: Install control + node agent
+      - name: Install control (+ node agent if available)
         run: |
           pip install -e ".[control,dev]"
-          pip install -e ./meridian-node[http]
+          if [ "${{ steps.node.outcome }}" = "success" ]; then
+            pip install -e ./meridian-node[http]
+          fi
 
       - name: Lint + type-check control
         run: |
           ruff check meridian_control tests/control
           mypy meridian_control
 
-      - name: Test control + cross-repo connection
+      - name: Test control (+ cross-repo connection if node is present)
         run: pytest tests/control -q
-
-      - name: Connection numbers report
-        run: python scripts/verify_connection.py