diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2fa58f6..aa0e047 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,7 +4,10 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+  workflow_dispatch:
   workflow_call:  # Allow this workflow to be called by other workflows
+permissions:
+  contents: read
 env:
   CARGO_TERM_COLOR: always
   RUSTFLAGS: "-Dwarnings"
@@ -16,6 +19,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Check formatting
         run: cargo fmt --all -- --check
   lint:
@@ -23,6 +28,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Run Clippy
         run: cargo clippy --workspace --all-targets --all-features -- -D warnings
   msrv:
@@ -30,6 +37,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Install Rust 1.88.0
         uses: dtolnay/rust-toolchain@stable
         with:
@@ -48,6 +57,8 @@ jobs:
           - target: aarch64-pc-windows-msvc
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.target }}
@@ -61,47 +72,107 @@ jobs:
       - name: cargo check
         run: cargo check -p ipcprims-transport -p ipcprims-frame --all-targets --target ${{ matrix.target }}
   windows-test:
-    name: Windows Test
-    runs-on: windows-latest
+    name: Windows Test (${{ matrix.target }})
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: windows-latest
+            target: x86_64-pc-windows-msvc
+          - runner: windows-latest-arm64-s
+            target: aarch64-pc-windows-msvc
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
+      - name: Verify native host
+        shell: bash
+        run: test "$(rustc -vV | awk '/^host:/{print $2}')" = "${{ matrix.target }}"
       - name: Run tests
         run: cargo test --workspace --all-features
   windows-test-async:
-    name: Windows Test (async)
-    runs-on: windows-latest
+    name: Windows Test (async, ${{ matrix.target }})
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: windows-latest
+            target: x86_64-pc-windows-msvc
+          - runner: windows-latest-arm64-s
+            target: aarch64-pc-windows-msvc
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
+      - name: Verify native host
+        shell: bash
+        run: test "$(rustc -vV | awk '/^host:/{print $2}')" = "${{ matrix.target }}"
       - name: Run async tests
         run: cargo test --workspace --features async
   windows-dogfood:
-    name: Windows Dogfood (CLI)
-    runs-on: windows-latest
+    name: Windows Dogfood (CLI, ${{ matrix.target }})
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: windows-latest
+            target: x86_64-pc-windows-msvc
+          - runner: windows-latest-arm64-s
+            target: aarch64-pc-windows-msvc
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
+      - name: Verify native host
+        shell: bash
+        run: test "$(rustc -vV | awk '/^host:/{print $2}')" = "${{ matrix.target }}"
       - name: Run CLI dogfood matrix
         shell: bash
         run: bash scripts/dogfood/cli-matrix.sh
   test:
     name: Test (${{ matrix.target }})
-    runs-on: ${{ matrix.os }}
+    runs-on: ${{ matrix.runner }}
     strategy:
       fail-fast: false
       matrix:
         include:
           - target: x86_64-unknown-linux-gnu
-            os: ubuntu-latest
+            runner: ubuntu-latest
           - target: aarch64-unknown-linux-gnu
-            os: ubuntu-latest-arm64-s
+            runner: ubuntu-latest-arm64-s
           - target: aarch64-apple-darwin
-            os: macos-latest
+            runner: macos-latest
+          - target: x86_64-pc-windows-msvc
+            runner: windows-latest
+          - target: aarch64-pc-windows-msvc
+            runner: windows-latest-arm64-s
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Verify native host
+        shell: bash
+        run: test "$(rustc -vV | awk '/^host:/{print $2}')" = "${{ matrix.target }}"
       - name: Run tests
         run: cargo test --workspace --all-features
+  platforms:
+    name: platforms
+    if: always()
+    needs: [test, windows-test, windows-test-async, windows-dogfood]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require all native platforms and Windows runtime jobs
+        run: |
+          test "${{ needs.test.result }}" = "success"
+          test "${{ needs.windows-test.result }}" = "success"
+          test "${{ needs.windows-test-async.result }}" = "success"
+          test "${{ needs.windows-dogfood.result }}" = "success"
   build:
     name: Build (${{ matrix.target }})
     runs-on: ${{ matrix.os }}
@@ -117,6 +188,8 @@ jobs:
             os: macos-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Build release
         run: cargo build --workspace --release
   test-musl:
@@ -124,6 +197,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Install musl tools
         run: sudo apt-get update && sudo apt-get install -y musl-tools
       - name: Add musl target
@@ -145,6 +220,8 @@ jobs:
             os: macos-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Install cbindgen
         run: cargo install cbindgen --locked
       - name: Build FFI crate
@@ -171,6 +248,8 @@ jobs:
             os: macos-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
@@ -202,6 +281,8 @@ jobs:
             os: macos-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Set up Node
         uses: actions/setup-node@v6
         with:
@@ -223,6 +304,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Install cargo-deny
         run: cargo install cargo-deny --locked
       - name: License check
@@ -234,6 +317,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Install cargo-audit
         run: cargo install cargo-audit --locked
       - name: Security audit
@@ -244,6 +329,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Check version consistency
         run: ./scripts/check-version.sh
   planning-hygiene:
@@ -251,5 +338,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Check no tracked planning-plane references
         run: bash scripts/check-planning-hygiene.sh
diff --git a/Makefile b/Makefile
index 178f037..f929857 100644
--- a/Makefile
+++ b/Makefile
@@ -13,7 +13,7 @@
 .PHONY: check-windows check-windows-msvc check-windows-gnu check-windows-arm64-msvc
 .PHONY: check-unix-clippy
 .PHONY: ffi-header build-ffi go-bindings-sync go-build go-test ts-build ts-test
-.PHONY: precommit prepush ci-clippy npm-publish-prereqs-check deny audit
+.PHONY: precommit prepush ci-clippy check-targets npm-publish-prereqs-check deny audit
 .PHONY: msrv
 .PHONY: build-release
 .PHONY: version-patch version-minor version-major version-set version-sync version-check
@@ -86,6 +86,7 @@ help: ## Show available targets
 	@echo "  precommit       Pre-commit checks (fast: fmt, clippy)"
 	@echo "  prepush         Pre-push checks (including current CI stable Clippy)"
 	@echo "  ci-clippy       Update stable Rust and run the CI Clippy command"
+	@echo "  check-targets   Check async Rust peer code for Linux x64/arm64 and Windows x64"
 	@echo "  msrv            Verify build+test on MSRV toolchain (core crates)"
 	@echo "  deny            Run cargo-deny license and advisory checks"
 	@echo "  audit           Run cargo-audit security scan"
@@ -462,7 +463,13 @@ ci-clippy: ## Match the floating stable Rust toolchain used by CI
 	rustup update stable --no-self-update
 	RUSTFLAGS="-Dwarnings" cargo +stable clippy --workspace --all-targets --all-features -- -D warnings
 
-prepush: check ci-clippy version-check npm-publish-prereqs-check $(PREPUSH_EXTRA) ## Run pre-push checks (thorough)
+check-targets: ## Check async peer transport on cross-platform CI targets
+	@for target in x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu x86_64-pc-windows-msvc; do \
+		rustup target add "$$target" || exit $$?; \
+		cargo check --locked -p ipcprims-peer --features async --target "$$target" || exit $$?; \
+	done
+
+prepush: check ci-clippy check-targets version-check npm-publish-prereqs-check $(PREPUSH_EXTRA) ## Run pre-push checks (thorough)
 	@echo "[ok] Pre-push checks passed"
 
 npm-publish-prereqs-check: ## Validate TypeScript npm trusted-publishing workflow prerequisites
diff --git a/deny.toml b/deny.toml
index cdf6587..2c52b84 100644
--- a/deny.toml
+++ b/deny.toml
@@ -11,7 +11,10 @@ targets = [
     "aarch64-unknown-linux-musl",
     "aarch64-unknown-linux-gnu",
     "aarch64-apple-darwin",
+    "x86_64-apple-darwin",
     "x86_64-pc-windows-msvc",
+    "x86_64-pc-windows-gnu",
+    "aarch64-pc-windows-msvc",
 ]
 
 # ============================================================================