[INTEROP-04] Internal relay interop is repeatedly relied upon in CI as if it were external interop, with non-gating || true wrappers

[SoundMatt]

Finding. relay interop is RELAY's own cross-protocol / golden-vector CLI check — an internal
self-consistency tool, not third-party interoperability testing. Several ports (rust-CAN, rust-LIN,
rust-RCP reportedly among them) run it in CI wrapped in || true plus a brittle grep scrape of its
output, which silently tolerates both output-format drift and genuinely non-matching results, meaning
the step can report green while validating nothing.

Recommendation. Remove the || true wrapper and assert on the command's actual exit code instead
of grep-scraping its stdout; and, ecosystem-wide, label these CI steps "internal conformance" rather
than "interop" so a reader of the CI config doesn't overstate the coverage they provide. This overlaps
THEME-I (CI gates that don't gate, filed separately in this batch) for the || true half of the
finding, and THEME-K for the mislabeling half.

---

Filed from the 2026-07-29 ecosystem audit register; independently re-verified against current HEAD before filing.

[SoundMatt]

rust-RCP's half of this finding fixed and merged: rust-RCP#171.

Replaced output=$(relay interop ... 2>&1) || true + a brittle grep of stdout with a plain relay interop --strict --protocol RCP target/release/rust-rcp invocation whose real exit code gates the step directly — matching go-RCP's existing clean pattern for the same check. Also renamed the job from relay-interop/"RELAY interop" to relay-cli-conformance/"RELAY CLI conformance" per the naming convention in docs/INTEROP-ARCHITECTURE.md — this step only checks self-consistency against RELAY's own embedded golden vector, not a third-party reference implementation.

Worth noting: the first push actually broke CI outright — relay-conformance collided with an already-existing, differently-scoped job of the same ID in the same workflow file (a Rust unit-test job, "RELAY spec v2.0 unit conformance"). yaml.safe_load silently accepted the duplicate key (YAML spec says last-one-wins) so my own pre-push check missed it; GitHub Actions' schema validation correctly rejected the file. Renamed to relay-cli-conformance to avoid the collision, re-verified with a proper duplicate-key detector, and CI came back fully green (18/18 checks) on the corrected push.

Both fixes independently re-verified post-merge from a fresh clone at 84a541f: cargo build/test/fmt clean, no duplicate job IDs, and relay interop --strict --protocol RCP manually run against a freshly-built binary confirms RESULT: PASS / exit 0.

rust-LIN's identical || true pattern is still open — same fix needed there, not yet done.

[SoundMatt]

Both halves fixed and merged, per docs/INTEROP-ARCHITECTURE.md (THEME-K, #125):

• rust-RCP: rust-RCP#171 — replaced || true + grep-scrape with real exit-code gating on relay interop --strict --protocol RCP; also renamed the job (relay-interop → relay-cli-conformance) per the naming-discipline convention, since it only checks self-consistency against RELAY's own golden vector, not a third-party reference implementation.
• rust-LIN: rust-LIN#43 — identical exit-code fix on relay interop --strict --protocol LIN. No rename needed there; the surrounding job was already correctly named "conformance".

Both fixes verified locally (build/test/fmt clean) and mutation-tested against a deliberately broken binary before push — confirmed RESULT: FAIL / exit 1, which the previous || true form would have silently swallowed. Both independently re-verified post-merge from fresh clones.

One real bug found and fixed along the way (rust-RCP#171's first push): renaming the job to relay-conformance collided with an already-existing, differently-scoped job of the same ID in the same workflow file — yaml.safe_load silently accepted the duplicate key (YAML spec: last-one-wins) so my own pre-push check missed it, but GitHub Actions' schema validation correctly rejected the file outright. Renamed to relay-cli-conformance instead; rust-LIN's fix was checked for the same class of collision before pushing and had none (5 unique job IDs).