feat: consume PliegoRS topology and prepare RC.3

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -15,7 +15,7 @@ body:
     attributes:
       label: PliegoCSS version
       description: Exact crate version, CLI version, or commit SHA.
-      placeholder: 0.1.0-rc.2
+      placeholder: 0.1.0-rc.3
     validations:
       required: true
   - type: dropdown

.github/ISSUE_TEMPLATE/config.yml

@@ -6,3 +6,6 @@ contact_links:
   - name: Security report
     url: https://github.com/celiumsai/pliegocss/security/advisories/new
     about: Report vulnerabilities privately. Do not open a public issue.
+  - name: G7 external adoption cohort
+    url: https://github.com/celiumsai/pliegocss/issues/7
+    about: Read the cohort boundary and apply without posting private evidence.

.github/ISSUE_TEMPLATE/g7_pilot.yml

@@ -0,0 +1,73 @@
+name: G7 pilot interest
+description: Signal interest in the external adoption cohort without posting private material.
+title: "[G7 pilot]: "
+labels:
+  - g7-pilot
+body:
+  - type: markdown
+    attributes:
+      value: |
+        This public form is a recruitment signal only. It is not consent and does not count as
+        evidence. Do not post names, email addresses, credentials, private repository URLs,
+        proprietary source, transcripts, or incident material.
+
+        Read the [cohort notice](https://github.com/celiumsai/pliegocss/issues/7) and
+        [privacy notice](https://pliegocss.dev/legal/privacy/). Private intake uses
+        hello@pliegocss.dev after eligibility review.
+  - type: dropdown
+    id: adapter
+    attributes:
+      label: Candidate adapter
+      options:
+        - Static HTML
+        - Vite 8.1.5
+        - Pinned PliegoRS rendered output
+        - Outside the certified pilot matrix
+    validations:
+      required: true
+  - type: dropdown
+    id: tailwind
+    attributes:
+      label: Tailwind baseline
+      options:
+        - Tailwind CSS 3.4.19
+        - Tailwind CSS 4.3.3
+        - Another version
+        - Not currently using Tailwind
+    validations:
+      required: true
+  - type: dropdown
+    id: visibility
+    attributes:
+      label: Project visibility
+      options:
+        - Public project
+        - Private project — details will be shared only through private intake
+    validations:
+      required: true
+  - type: input
+    id: public_project
+    attributes:
+      label: Public project URL
+      description: Optional. Leave blank for a private project; never paste a private URL.
+      placeholder: https://github.com/example/project
+  - type: textarea
+    id: goal
+    attributes:
+      label: Pilot goal
+      description: Describe the adoption question without source code or identifying private details.
+    validations:
+      required: true
+  - type: checkboxes
+    id: boundary
+    attributes:
+      label: Eligibility and privacy boundary
+      options:
+        - label: I maintain or control the candidate project.
+          required: true
+        - label: The project is not owned by Celiums Solutions, PliegoCSS, or celiumsai.
+          required: true
+        - label: This issue contains no personal data, credentials, proprietary source, or private evidence.
+          required: true
+        - label: I understand this public issue is not research consent and does not count as G7 evidence.
+          required: true

.github/workflows/adapter-coexistence.yml

@@ -0,0 +1,139 @@
+name: Adapter coexistence certification
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  host:
+    name: ${{ matrix.host }}
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 35
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - host: windows-x64-chromium
+            runner: windows-latest
+          - host: linux-x64-chromium
+            runner: ubuntu-24.04
+          - host: macos-arm64-chromium
+            runner: macos-15
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22.13.0
+      - name: Install pnpm
+        run: npm install --global pnpm@11.7.0
+      - name: Install locked dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Validate adapter authority
+        run: pnpm check:adapter-coexistence-authority
+      - name: Install Rust toolchain
+        run: rustup toolchain install 1.96.0 --profile minimal
+      - name: Install Chromium and Linux dependencies
+        if: runner.os == 'Linux'
+        run: pnpm exec playwright install --with-deps chromium
+      - name: Install Chromium
+        if: runner.os != 'Linux'
+        run: pnpm exec playwright install chromium
+      - name: Execute adapter coexistence host
+        run: pnpm check:adapter-coexistence -- --browser=chromium --host=${{ matrix.host }} --output=target/adapter-coexistence-certification/evidence/${{ matrix.host }}.json --require-clean
+      - name: Upload host evidence
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: adapter-coexistence-${{ matrix.host }}-${{ github.sha }}
+          path: target/adapter-coexistence-certification/evidence/${{ matrix.host }}.json
+          if-no-files-found: error
+          retention-days: 30
+
+  pliegors-framework:
+    name: PliegoRS framework/browser adapter
+    runs-on: windows-latest
+    timeout-minutes: 35
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+          path: pliegocss
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          repository: celiumsai/pliegors
+          ref: abb8653e75da4a5cb4dd9b51200114fbb1e760c7
+          path: pliegors
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22.13.0
+      - name: Install pnpm
+        run: npm install --global pnpm@11.7.0
+      - name: Install locked dependencies
+        run: pnpm install --frozen-lockfile
+        working-directory: pliegocss
+      - name: Install PliegoRS Rust toolchain
+        run: |
+          rustup toolchain install 1.86.0 --profile minimal
+          rustup toolchain install 1.96.0 --profile minimal
+          rustup target add wasm32-unknown-unknown --toolchain 1.86.0
+      - name: Install pinned wasm-bindgen CLI
+        run: |
+          cargo +1.96.0 install wasm-bindgen-cli --version 0.2.126 --locked --root "$env:RUNNER_TEMP\wasm-bindgen-cli"
+          "$env:RUNNER_TEMP\wasm-bindgen-cli\bin" | Out-File -FilePath $env:GITHUB_PATH -Append
+      - name: Execute pinned PliegoRS browser gate
+        run: pnpm integration:pliegors-browser
+        working-directory: pliegocss
+        env:
+          PLIEGORS_ROOT: ${{ github.workspace }}\pliegors
+          PLIEGOCSS_PLIEGORS_BROWSER_EVIDENCE: target/adapter-coexistence-certification/pliegors-framework.json
+      - name: Upload PliegoRS evidence
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: adapter-coexistence-pliegors-framework-${{ github.sha }}
+          path: pliegocss/target/adapter-coexistence-certification/pliegors-framework.json
+          if-no-files-found: error
+          retention-days: 30
+
+  matrix:
+    name: Aggregate adapter coexistence matrix
+    needs: [host, pliegors-framework]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22.13.0
+      - name: Install pnpm
+        run: npm install --global pnpm@11.7.0
+      - name: Install locked dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Validate adapter authority
+        run: pnpm check:adapter-coexistence-authority
+      - name: Download host evidence
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          pattern: adapter-coexistence-*-chromium-${{ github.sha }}
+          path: target/adapter-coexistence-certification/incoming
+          merge-multiple: true
+      - name: Download PliegoRS evidence
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: adapter-coexistence-pliegors-framework-${{ github.sha }}
+          path: target/adapter-coexistence-certification/pliegors
+      - name: Validate complete matrix
+        run: pnpm check:adapter-coexistence-matrix -- --evidence-root=target/adapter-coexistence-certification/incoming --pliegors-evidence=target/adapter-coexistence-certification/pliegors/pliegors-framework.json --output=target/adapter-coexistence-certification/adapter-coexistence-matrix.json --require-clean
+      - name: Upload complete matrix
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: adapter-coexistence-matrix-${{ github.sha }}
+          path: target/adapter-coexistence-certification/adapter-coexistence-matrix.json
+          if-no-files-found: error
+          retention-days: 30

.github/workflows/browser-output-certification.yml

@@ -0,0 +1,111 @@
+name: Browser output certification
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  host:
+    name: ${{ matrix.host }}
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 35
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - host: windows-x64-chromium
+            runner: windows-latest
+            browser: chromium
+          - host: windows-x64-firefox
+            runner: windows-latest
+            browser: firefox
+          - host: windows-x64-webkit
+            runner: windows-latest
+            browser: webkit
+          - host: linux-x64-chromium
+            runner: ubuntu-24.04
+            browser: chromium
+          - host: linux-x64-firefox
+            runner: ubuntu-24.04
+            browser: firefox
+          - host: linux-x64-webkit
+            runner: ubuntu-24.04
+            browser: webkit
+          - host: macos-arm64-chromium
+            runner: macos-15
+            browser: chromium
+          - host: macos-arm64-firefox
+            runner: macos-15
+            browser: firefox
+          - host: macos-arm64-webkit
+            runner: macos-15
+            browser: webkit
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22.13.0
+      - name: Install pnpm
+        run: npm install --global pnpm@11.7.0
+      - name: Install locked dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Validate certification authority
+        run: pnpm check:browser-output-authority
+      - name: Install Rust toolchain
+        run: rustup toolchain install 1.96.0 --profile minimal
+      - name: Install browser and Linux dependencies
+        if: runner.os == 'Linux'
+        run: pnpm exec playwright install --with-deps ${{ matrix.browser }}
+      - name: Install browser
+        if: runner.os != 'Linux'
+        run: pnpm exec playwright install ${{ matrix.browser }}
+      - name: Execute browser/output host
+        run: pnpm check:browser-output -- --browser=${{ matrix.browser }} --host=${{ matrix.host }} --output=target/browser-output-certification/evidence/${{ matrix.host }}.json --require-clean
+      - name: Upload host evidence
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: browser-output-${{ matrix.host }}-${{ github.sha }}
+          path: |
+            target/browser-output-certification/evidence/${{ matrix.host }}.json
+            target/browser-output-certification/evidence/${{ matrix.host }}.screenshots
+          if-no-files-found: error
+          retention-days: 30
+
+  matrix:
+    name: Aggregate browser/output matrix
+    needs: host
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22.13.0
+      - name: Install pnpm
+        run: npm install --global pnpm@11.7.0
+      - name: Install locked dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Validate certification authority
+        run: pnpm check:browser-output-authority
+      - name: Download all host evidence
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          pattern: browser-output-*-${{ github.sha }}
+          path: target/browser-output-certification/incoming
+          merge-multiple: true
+      - name: Validate complete matrix
+        run: pnpm check:browser-output-matrix -- --evidence-root=target/browser-output-certification/incoming --output=target/browser-output-certification/browser-output-matrix.json
+      - name: Upload complete matrix
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: browser-output-matrix-${{ github.sha }}
+          path: target/browser-output-certification/browser-output-matrix.json
+          if-no-files-found: error
+          retention-days: 30

.github/workflows/ci.yml

@@ -78,6 +78,7 @@ jobs:
         env:
           PLIEGO_CSSC: target/debug/pliego-cssc${{ runner.os == 'Windows' && '.exe' || '' }}
           PLIEGO_LOCK_HOLDER: target/debug/pliego-publication-lock-holder${{ runner.os == 'Windows' && '.exe' || '' }}
+          PLIEGOCSS_RUST_TOOLCHAIN: ${{ matrix.toolchain }}
         run: node scripts/check-parallel-determinism.mjs
       - name: Check cross-platform bundle contract
         run: node scripts/check-portability.mjs
@@ -120,6 +121,10 @@ jobs:
           node-version: 22.13.0
       - name: Install pnpm for documentation gates
         run: npm install --global pnpm@11.7.0
+      - name: Install Rust toolchains
+        run: |
+          rustup toolchain install 1.85.0 --profile minimal
+          rustup toolchain install 1.96.0 --profile minimal --component rustfmt
       - name: Verify release profile registry
         run: node scripts/check-release.test.mjs
       - name: Check documentation graph
@@ -128,8 +133,6 @@ jobs:
         run: node scripts/check-brand.mjs
       - name: Check compatibility policy
         run: node scripts/check-compatibility-policy.mjs
-      - name: Install rustfmt
-        run: rustup toolchain install 1.96.0 --profile minimal --component rustfmt
       - name: Check formatting
         run: |
           cargo +1.96.0 fmt --all -- --check
@@ -247,6 +250,18 @@ jobs:
           rustup target add wasm32-unknown-unknown --toolchain 1.96.0
       - name: Install benchmark dependencies
         run: pnpm install --frozen-lockfile
+      - name: Check Benchmark Authority v2
+        run: pnpm check:benchmark-authority
+      - name: Check browser/output certification authority
+        run: pnpm check:browser-output-authority
+      - name: Check adapter coexistence authority
+        run: pnpm check:adapter-coexistence-authority
+      - name: Check external adoption authority
+        run: pnpm check:external-adoption-authority
+      - name: Check repository-only pnpm distribution contract
+        run: pnpm check:repository-distribution
+      - name: Smoke Benchmark Authority v2 runner
+        run: pnpm check:benchmark-smoke
       - name: Build and validate the PliegoRS-authored website
         run: pnpm check:site
       - name: Validate the Cloudflare public deployment profile