Add optional durable receipts for consent-bound native actions

.github/workflows/action-receipts.yml

@@ -0,0 +1,36 @@
+name: Recoverable native actions
+on:
+  push:
+    branches: [durable-action-receipts]
+  pull_request:
+    paths:
+      - 'crates/action-receipts/**'
+      - '.github/workflows/action-receipts.yml'
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  portable-journal:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, windows-2025]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - run: rustup toolchain install 1.98.0 --profile minimal
+      - name: Test production journal and failure recovery
+        env:
+          RUSTUP_TOOLCHAIN: 1.98.0
+        run: cargo test --manifest-path crates/action-receipts/Cargo.toml --locked
+      - name: Compare identical history before and after indexing
+        env:
+          RUSTUP_TOOLCHAIN: 1.98.0
+        run: cargo run --manifest-path crates/action-receipts/Cargo.toml --locked --example benchmark_recovery
+      - name: Measure unresolved recovery under one account's confirmed history
+        env:
+          RUSTUP_TOOLCHAIN: 1.98.0
+        run: cargo run --manifest-path crates/action-receipts/Cargo.toml --locked --example benchmark_owned_history

Cargo.toml

@@ -65,6 +65,7 @@ members = [
 ]
 # Separate tools with their own lockfiles, and the framework checkouts.
 exclude = [
+    "crates/action-receipts",
     ".sources",
     "apps/appcard/personal-data",
     "apps/appcard/tools",

README.md

@@ -491,3 +491,7 @@ Each product is tagged on its own: `desktop-v*`, `home-v*` (the APK) and `rom-v*
 ## License
 
 Apache License 2.0 ([LICENSE](LICENSE), [NOTICE](NOTICE)). Source copied from Makepad keeps its MIT notice ([LICENSES/](LICENSES)). Dependencies keep their own licenses.
+
+## Recoverable native actions
+
+The optional [action-receipts journal](crates/action-receipts/README.md) provides consent-bound durable actions and read-only recovery for reviewed native adapters. It is separately tested and does not alter the default Shell.

README.zh-CN.md

@@ -479,3 +479,7 @@ python3 ../rom/scripts/build-home.py --help                     # the Home and B
 ## 许可证
 
 Apache License 2.0（[LICENSE](LICENSE)、[NOTICE](NOTICE)）。从 Makepad 复制的源码保留其 MIT 声明（[LICENSES/](LICENSES)）。依赖项保留各自的许可证。
+
+## 可恢复的原生动作
+
+可选的 [action-receipts 执行记录库](crates/action-receipts/README.zh-CN.md)为经过审核的原生适配器提供授权绑定、持久化执行与只读恢复。它单独验证，不改变默认 Shell。