feat(evidence): add a relying-party client library with Node and Python bindings

.github/scripts/ci_changes.py

@@ -31,7 +31,14 @@
         "registry-manifest-core",
     ),
     "relay": ("registry-relay",),
-    "evidence": ("registry-evidence", "registry-evidencectl"),
+    "evidence": (
+        "registry-evidence",
+        "registry-evidence-client",
+        "registry-evidence-client-node",
+        "registry-evidence-client-py",
+        "registry-evidence-verifier",
+        "registry-evidencectl",
+    ),
     "mint": ("registry-mint",),
     "developer-tools": (
         "registry-config-report",
@@ -71,9 +78,21 @@
     }
 )
 
+# Binding crates (the Node and Python relying-party SDKs today; more may join
+# them) stay in EVIDENCE_PACKAGES and the `evidence` shard, because their own
+# source is covered by check-source-neutrality.sh, and that is what makes
+# `evidence_contracts` run the neutrality check against them. A binding-only
+# change does not, on its own, replay the docs Evidence tutorials: it touches
+# none of a tutorial's shell commands or fixtures, so it is excluded here.
+EVIDENCE_BINDING_PACKAGES = frozenset(
+    {"registry-evidence-client-node", "registry-evidence-client-py"}
+)
+
 # The gate also builds and runs `mint`, because one tutorial serves assertions
 # to a caller holding a real Mint-issued token.
-EVIDENCE_TUTORIAL_PACKAGES = EVIDENCE_PACKAGES | frozenset(SHARDS["mint"])
+EVIDENCE_TUTORIAL_PACKAGES = (EVIDENCE_PACKAGES - EVIDENCE_BINDING_PACKAGES) | frozenset(
+    SHARDS["mint"]
+)
 
 ROOT_RUST_INPUTS = {
     "Cargo.lock",
@@ -463,6 +482,11 @@ def classify(
         for path in paths
     )
     editors = complete or any(path.startswith("editors/") for path in paths)
+    # Reverse dependents, not changed paths: both bindings are Cargo path
+    # dependents of the SDK and the verifier, so a change to either can move
+    # the native surface or the error envelope the packages wrap without
+    # touching a file inside a binding crate.
+    client_bindings = complete or bool(affected & EVIDENCE_BINDING_PACKAGES)
 
     tutorial_infrastructure = any(
         path
@@ -545,6 +569,7 @@ def classify(
         "docs": docs,
         "docs_archives": docs_archives,
         "editors": editors,
+        "client_bindings": client_bindings,
         "registryctl_tutorial": registryctl_tutorial,
         "evidence_tutorial": evidence_tutorial,
     }

.github/scripts/test_ci_changes.py

@@ -221,6 +221,40 @@ def test_evidence_code_and_product_contracts_select_its_shards_and_drift_gate(se
                     {"evidence", "mint"},
                 )
 
+    def test_binding_only_change_runs_contracts_but_not_the_tutorial_job(self) -> None:
+        # A Node-binding-only change has no bearing on any tutorial's shell
+        # commands or fixtures, so it must not replay them; but the binding's
+        # own source neutrality still needs the contracts gate to run.
+        outputs = classify(
+            self.workspace,
+            ("crates/registry-evidence-client-node/src/lib.rs",),
+        )
+        self.assertFalse(outputs["evidence_tutorial"])
+        self.assertTrue(outputs["evidence_contracts"])
+        self.assertTrue(outputs["client_bindings"])
+        self.assertEqual(
+            {entry["name"] for entry in outputs["rust_matrix"]["include"]},
+            {"evidence"},
+        )
+
+    def test_an_sdk_or_verifier_change_also_runs_the_binding_job(self) -> None:
+        # Both bindings are Cargo path-dependents of the SDK and the verifier,
+        # so either can change the native surface or the error envelope the
+        # packages wrap. Selecting the job from changed paths alone would skip
+        # the npm suite, the type-drift check, and the Python unittest suite for
+        # exactly the changes most able to break them.
+        for path in (
+            "crates/registry-evidence-client/src/client.rs",
+            "crates/registry-evidence-verifier/src/lib.rs",
+        ):
+            with self.subTest(path=path):
+                outputs = classify(self.workspace, (path,))
+                self.assertTrue(outputs["client_bindings"])
+                self.assertIn(
+                    "registry-evidence-client-node", outputs["rust_packages"]
+                )
+                self.assertIn("registry-evidence-client-py", outputs["rust_packages"])
+
     def test_current_contract_gates_replace_the_retired_notary_gate(self) -> None:
         workflow = Path(".github/workflows/ci.yml").read_text(encoding="utf-8")
         self.assertIn("\n  evidence-contracts:\n", workflow)

.github/workflows/ci.yml

@@ -51,6 +51,7 @@ jobs:
       docs: ${{ steps.filter.outputs.docs }}
       docs_archives: ${{ steps.filter.outputs.docs_archives }}
       editors: ${{ steps.filter.outputs.editors }}
+      client_bindings: ${{ steps.filter.outputs.client_bindings }}
       registryctl_tutorial: ${{ steps.filter.outputs.registryctl_tutorial }}
       evidence_tutorial: ${{ steps.filter.outputs.evidence_tutorial }}
     steps:
@@ -460,6 +461,9 @@ jobs:
       - name: Enforce Evidence source-product neutrality
         run: products/evidence/scripts/check-source-neutrality.sh
 
+      - name: Enforce Evidence verifier portability
+        run: products/evidence/scripts/check-verifier-portability.sh
+
   relay-contracts:
     name: Relay API contracts
     needs: changes
@@ -1155,6 +1159,41 @@ jobs:
           cargo check --locked --target wasm32-wasip2 --manifest-path editors/zed/Cargo.toml
           cmp LICENSE editors/zed/LICENSE
 
+  client-bindings:
+    name: Evidence client bindings
+    needs: changes
+    if: needs.changes.outputs.client_bindings == 'true'
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        with:
+          fetch-depth: 0
+          submodules: false
+
+      - name: Setup Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        with:
+          node-version: 22.12.0
+          cache: npm
+          cache-dependency-path: crates/registry-evidence-client-node/package-lock.json
+
+      - name: Build and test the Node binding
+        working-directory: crates/registry-evidence-client-node
+        run: |
+          npm ci
+          npm run build:debug
+          npm test
+          npm run check:types
+          cmp ../../LICENSE LICENSE
+
+      - name: Build and test the Python binding
+        working-directory: crates/registry-evidence-client-py
+        run: |
+          cargo build --locked -p registry-evidence-client-py --lib --features registry-evidence-client-py/extension-module
+          python3 -m unittest discover -s tests/python -v
+          cmp ../../LICENSE LICENSE
+
   ci-result:
     name: CI result
     if: always()
@@ -1173,6 +1212,7 @@ jobs:
       - evidence-tutorials
       - docs
       - editor-extensions
+      - client-bindings
     runs-on: ubuntu-24.04
     env:
       CI_JOB_RESULTS: ${{ toJSON(needs) }}