Security 0.3.0: own Security Event integration (#5)

.github/workflows/host-tests.yml

@@ -2,9 +2,6 @@ name: Tests
 
 on:
   push:
-    branches:
-      - main
-      - feature/observable-callback-coverage
   pull_request:
     branches: [main]
 
@@ -13,53 +10,82 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - name: Verify core Security remains Event-free
+        run: |
+          if grep -R -nE '#[[:space:]]*include[[:space:]]*[<\"]ESPressio_(Event|SecurityEvents|TransportSecurityEventBridge)' src/ESPressio_Security.hpp; then
+            echo 'Core Security umbrella must not acquire Event integration.'
+            exit 1
+          fi
       - name: Configure
         run: cmake -S tests -B build
       - name: Build
         run: cmake --build build --parallel
       - name: Test
         run: ctest --test-dir build --output-on-failure
 
-  esp32-examples:
+  esp32-event-integration:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          path: project/ESPressio-Security
       - uses: actions/checkout@v4
         with:
           repository: Flowduino/ESPressio-Observable
           ref: 3.0.1
-          path: deps/ESPressio-Observable
+          path: project/dependencies/ESPressio-Observable
+      - uses: actions/checkout@v4
+        with:
+          repository: Flowduino/ESPressio-Units
+          ref: 0.2.3
+          path: project/dependencies/ESPressio-Units
+      - uses: actions/checkout@v4
+        with:
+          repository: Flowduino/ESPressio-Timing
+          ref: 2.2.4
+          path: project/dependencies/ESPressio-Timing
+      - uses: actions/checkout@v4
+        with:
+          repository: Flowduino/ESPressio-Threads
+          ref: 3.1.4
+          path: project/dependencies/ESPressio-Threads
+      - uses: actions/checkout@v4
+        with:
+          repository: Flowduino/ESPressio-Event
+          ref: 6.0.0
+          path: project/dependencies/ESPressio-Event
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.x'
       - name: Install PlatformIO
         run: pip install platformio
-      - name: Create PlatformIO consumer project
+      - name: Create Event integration compile project
         shell: bash
         run: |
-          mkdir -p "$RUNNER_TEMP/espressio-security-ci/src" "$RUNNER_TEMP/espressio-security-ci/lib"
-          rsync -a --exclude='.git' --exclude='deps' --exclude='build' ./ "$RUNNER_TEMP/espressio-security-ci/lib/ESPressio-Security/"
-          cp -R deps/ESPressio-Observable "$RUNNER_TEMP/espressio-security-ci/lib/ESPressio-Observable"
-          cat > "$RUNNER_TEMP/espressio-security-ci/platformio.ini" <<'EOF'
-          [env:esp32dev]
+          mkdir -p project/compile/src
+          cat > project/compile/platformio.ini <<'EOF'
+          [env:esp32]
           platform = espressif32
           board = esp32dev
           framework = arduino
-          build_flags =
-              -std=gnu++17
-              -frtti
-          build_unflags =
-              -std=gnu++11
-              -fno-rtti
+          build_flags = -std=gnu++17 -frtti
+          build_unflags = -std=gnu++11 -fno-rtti
+          lib_ldf_mode = deep+
           lib_deps =
-              ESPressio-Security
-              ESPressio-Observable
+              ../dependencies/ESPressio-Observable
+              ../dependencies/ESPressio-Units
+              ../dependencies/ESPressio-Timing
+              ../dependencies/ESPressio-Threads
+              ../dependencies/ESPressio-Event
+              ../ESPressio-Security
           EOF
-      - name: Compile BasicSecurePayload
-        shell: bash
-        run: |
-          cp examples/BasicSecurePayload/BasicSecurePayload.ino "$RUNNER_TEMP/espressio-security-ci/src/main.cpp"
-          pio run -d "$RUNNER_TEMP/espressio-security-ci"
-      - name: Compile MbedTLSAlgorithms
-        shell: bash
-        run: |
-          rm -rf "$RUNNER_TEMP/espressio-security-ci/.pio"
-          cp examples/MbedTLSAlgorithms/MbedTLSAlgorithms.ino "$RUNNER_TEMP/espressio-security-ci/src/main.cpp"
-          pio run -d "$RUNNER_TEMP/espressio-security-ci"
+          cat > project/compile/src/main.cpp <<'EOF'
+          #include <Arduino.h>
+          #include <ESPressio_Security.hpp>
+          #include <ESPressio_SecurityEvents.hpp>
+          #include <ESPressio_TransportSecurityEventBridge.hpp>
+          void setup() {}
+          void loop() {}
+          EOF
+      - name: Compile Security Event integration
+        run: pio run -d project/compile

CHANGELOG.md

@@ -2,6 +2,29 @@
 
 All notable changes to ESPressio Security are documented in this file.
 
+## [0.3.0] - 2026-08-21
+
+### Added
+
+- Moved Security lifecycle Event types and `TransportSecurityEventBridge` ownership into ESPressio Security.
+- Added an opt-in Security -> Event integration targeting ESPressio Event 6.0.0 while keeping the normal Security core independent of Event.
+
+### Changed
+
+- Preserved the existing `ESPressio_SecurityEvents.hpp` and `ESPressio_TransportSecurityEventBridge.hpp` public names in their new owning package.
+- Updated package metadata, documentation, dependency charts, and CI for the 0.3.0 architecture.
+- The normal Security umbrella remains Event-free; Event is required only when the Event bridge headers are selected.
+
+### Compatibility
+
+- Core Security, encryption, replay-protection, and Observer APIs are unchanged.
+- Applications using the Event bridge must obtain the bridge headers from ESPressio Security 0.3.0 rather than ESPressio Event 6.0.0.
+
+### Tracking
+
+- Implements #5.
+- Coordinated with Flowduino/ESPressio-Event#36.
+
 ## [0.2.0] - 2026-08-20
 
 ### Added

DEPENDENCY_BOUNDARIES.md

@@ -0,0 +1,7 @@
+# ESPressio Security Dependency Boundaries
+
+ESPressio Security owns Security-specific lifecycle semantics and their optional Event representation.
+
+The core Security mechanism depends on Observable and remains independent of ESPressio Event. `TransportSecurityEventBridge` and the Security Event family are optional integration headers owned by Security and may depend on Event only when explicitly selected.
+
+The normal Security umbrella must remain free of Event includes.

ESPRESSIO_DEPENDENCY_CHART.md

@@ -1,38 +1,32 @@
-# ESPressio Library Dependency Chart
+# ESPressio Dependency Chart — Security 0.3.0
 
-ESPressio Security is a foundational, transport-neutral library.
+![ESPressio Library Dependency Chart](ESPRESSIO_DEPENDENCY_CHART.svg)
 
-## ESPressio Security 0.1.0
-
-**Required ESPressio dependencies: none.**
-
-Security owns authenticated encryption, key lookup, security envelopes, replay protection and transport-security policy. It deliberately does not depend on concrete communication libraries.
-
-The intended opt-in dependency direction is:
+## Security 0.3.0
 
 ```text
-ESPressio ESP-Now  - - -> ESPressio Security
-ESPressio Sockets  - - -> ESPressio Security
-future transports  - - -> ESPressio Security
+Security 0.3.0
+    -> Observable >= 3.0.1 < 4.0.0
+    - - -> Event >= 6.0.0 < 7.0.0
+            Security Event types / TransportSecurityEventBridge only
 ```
 
-Higher-level protocols remain independent of cryptography:
+The Event relationship is opt-in. Core Security remains Event-free and transport-neutral.
+
+## Final coordinated ecosystem
 
 ```text
-Event / Command / Clock Synchronization / application protocol
-                         |
-                         v
-                Secure transport adapter
-                         |
-                         v
-                 ESPressio Security
-                         |
-                         v
-                concrete transport
+Observable 3.0.1
+Serializable 0.10.2
+Units 0.2.3
+Timing 2.2.4
+Threads 3.1.4
+Command 0.4.0
+Security 0.3.0
+Event 6.0.0
+Sockets 0.6.0
+ESP-Now 0.6.0
+Serial 0.6.0
 ```
 
-Security therefore sits beside other foundational ESPressio facilities rather than beneath Event, Command, ESP-Now, or Sockets as a mandatory dependency.
-
-## Architectural rule
-
-Security is applied at the transport boundary. A received protected packet is authenticated and decrypted before its plaintext is delivered to the protocol consumer. Packets failing authentication, policy, protocol binding, envelope validation or replay checks are discarded before application processing.
+Security owns its Security-specific Event bridge. Event 6.0.0 does not depend back on Security, so no reciprocal edge remains.