.github/workflows/ci.yml

@@ -7,6 +7,12 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+  # Manual trigger for the twilio-live job (pre-release validation against
+  # real Twilio credentials). Never runs per-PR — the routine clippy/test
+  # jobs use default features (MockCallControlClient); the live
+  # TwilioCallControlClient is feature-gated behind `twilio-live` + only the
+  # maintainer exercises it before tagging a release (spec §1.2 + plan T6/T10).
+  workflow_dispatch:
 
 env:
   CARGO_TERM_COLOR: always
@@ -80,3 +86,34 @@ jobs:
       - uses: EmbarkStudios/cargo-deny-action@v2
         with:
           command: check
+
+  # The live TwilioCallControlClient is feature-gated behind `twilio-live`
+  # (reqwest + rustls-tls + tracing + serde_json pulled in only when the
+  # feature is on). This job exercises it against REAL Twilio credentials.
+  # It runs ONLY on manual `workflow_dispatch` (never per-PR) — the routine
+  # clippy/test jobs above use default features (MockCallControlClient).
+  # The maintainer triggers this before tagging a release, after setting the
+  # TWILIO_* secrets in the repo settings (spec §1.2 + plan T10 Step 3).
+  twilio-live:
+    name: twilio-live (manual only)
+    runs-on: ubuntu-latest
+    if: github.event_name == 'workflow_dispatch'
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - name: Install libopus (media crate FFI dep)
+        run: apt-get update && apt-get install -y libopus-dev
+      - uses: Swatinem/rust-cache@v2
+      - name: Clippy with twilio-live feature
+        run: cargo clippy --all --all-targets --features=twilio-live -- -D warnings
+      - name: Twilio-live tests (includes ignored live e2e; needs TWILIO_* secrets)
+        env:
+          RUTSTER_TWILIO_ACCOUNT_SID: ${{ secrets.TWILIO_ACCOUNT_SID }}
+          RUTSTER_TWILIO_AUTH_TOKEN: ${{ secrets.TWILIO_AUTH_TOKEN }}
+          RUTSTER_TWILIO_MEDIA_BIND: 0.0.0.0:8081
+          RUTSTER_TWILIO_WEBHOOK_BASE: ${{ secrets.TWILIO_WEBHOOK_BASE }}
+          RUTSTER_TWILIO_TEST_TO: ${{ secrets.TWILIO_TEST_TO }}
+          RUTSTER_TWILIO_TEST_FROM: ${{ secrets.TWILIO_TEST_FROM }}
+        run: cargo test --all --features=twilio-live -- --include-ignored

crates/rutster-trunk/src/lib.rs

@@ -10,7 +10,7 @@
 //!
 //! ## Spearhead step 5 — what's here vs what's deferred
 //!
-//! The provider call-control seam ([`provider`](crate::provider)) lands in T2: the
+//! The provider call-control seam ([`provider`]) lands in T2: the
 //! `CallControlClient` trait, `MockCallControlClient`, and `TwilioCredentials` (with
 //! redacted `Debug`). The live `TwilioCallControlClient` (T6) is feature-gated behind
 //! `twilio-live`. The WSS ingress (`g711`, `twilio_media_streams`, `session`,

crates/rutster-trunk/src/provider/mock.rs

@@ -21,7 +21,7 @@
 //! *test double*, a poisoned mutex means a previous test assertion failed; the
 //! right move is to recover the inner value (`.into_inner()`) rather than
 //! propagate the poison (which would cascade one test failure into every
-//! subsequent test). [`lock_or_recover`] does this idiomatically — and avoids
+//! subsequent test). `lock_or_recover` does this idiomatically — and avoids
 //! the `unwrap()`/`expect()` that AGENTS.md's hot-path rule forbids in library
 //! code (the mock is library code, not `#[cfg(test)]`, because T7/T8 integration
 //! tests in `tests/` import it).