From 26f48a4c6bd175df177d00d2b8db6be607668881 Mon Sep 17 00:00:00 2001
From: "Aaron D. Lee" <himself@adlee.work>
Date: Sat, 4 Jul 2026 12:04:44 -0400
Subject: [PATCH] =?UTF-8?q?ci(slice-4):=20seam=20gate=20=E2=80=94=20loop?=
 =?UTF-8?q?=5Fdriver=20+=20rtc=5Fsession=20pinned=20byte-identical?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pins the slice-3→slice-4 media seam via blob hashes. Any legitimate
change to these files requires updating the pinned hashes in the same
PR, making the seam gate loud and reviewable.

Pinned hashes (main):
- loop_driver.rs: 744bf314edf7f4925c8bb3bd0f5176dbc88f8113
- rtc_session.rs: a4c9f2ae64e56c08e1990956391514929535b526

Signed-off-by: Aaron D. Lee <himself@adlee.work>
---
 .github/workflows/ci.yml | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 62a7815..774c338 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -40,6 +40,29 @@ jobs:
         toolchain: [stable, "1.85"]
     steps:
       - uses: actions/checkout@v4
+
+      # Seam gate (slice-4 §7 #3 / PORT_PLAN phasing):
+      #
+      # `loop_driver.rs` and `rtc_session.rs` are the hot-path media seam
+      # preserved from slice-3. They MUST remain byte-identical across
+      # slice-4 so the reflex wrapper can be added without touching the
+      # core poll loop. If a legitimate change is needed, update the pinned
+      # blob hashes below in the same PR — loud and reviewable by design.
+      - name: Seam gate — loop_driver + rtc_session byte-identical to slice-3
+        run: |
+          EXPECTED_LOOP_DRIVER='744bf314edf7f4925c8bb3bd0f5176dbc88f8113'
+          EXPECTED_RTC_SESSION='a4c9f2ae64e56c08e1990956391514929535b526'
+          GOT_LOOP_DRIVER=$(git hash-object crates/rutster-media/src/loop_driver.rs)
+          GOT_RTC_SESSION=$(git hash-object crates/rutster-media/src/rtc_session.rs)
+          if [ "$GOT_LOOP_DRIVER" != "$EXPECTED_LOOP_DRIVER" ]; then
+            echo "::error::loop_driver.rs blob mismatch: $GOT_LOOP_DRIVER != $EXPECTED_LOOP_DRIVER"
+            exit 1
+          fi
+          if [ "$GOT_RTC_SESSION" != "$EXPECTED_RTC_SESSION" ]; then
+            echo "::error::rtc_session.rs blob mismatch: $GOT_RTC_SESSION != $EXPECTED_RTC_SESSION"
+            exit 1
+          fi
+
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: ${{ matrix.toolchain }}