Coordinate through Canton and remove the Noise transport

.cargo/audit.toml

@@ -32,17 +32,12 @@ ignore = [
   # the 0.3 line — 0.3.27 is the last release ever published, and the patch
   # landed only in 0.4.16 — so this cannot be resolved by updating.
   #
-  # Two paths pull it, neither removable from here:
-  #   * actix-http (actix-web 4), whose `http2` is a default feature;
-  #   * hyper 0.14, required by hyper-noise 0.0.3, which declares
-  #     `hyper = { features = ["full"] }` itself. Narrowing our own hyper
-  #     features changes nothing, because feature unification keeps h2 in the
-  #     graph regardless.
+  # One path pulls it: actix-http (actix-web 4), whose `http2` is a default
+  # feature. This repository cannot remove it.
   #
   # The h2 0.4 instance (AWS SDK / hyper 1.x) IS fixed, by the 0.4.16 bump in
   # the same change as this ignore.
   #
-  # Drop this ignore when hyper-noise moves off hyper 0.14, or actix-web
-  # ships an h2 0.4 release. Tracked in #351.
+  # Drop this ignore when actix-web ships an h2 0.4 release. Tracked in #351.
   "RUSTSEC-2026-0258",
 ]

.github/workflows/ci.yml

@@ -295,6 +295,8 @@ jobs:
       # id, and the DAR-verification step above already pins those identical.
       - name: Verify Daml upgrade lineage
         run: ~/.dpm/bin/dpm upgrade-check --both */.daml/dist/*.dar ../releases/v1/*.dar
+      - name: Test decman-coordination
+        run: cd decman-coordination-test && ~/.dpm/bin/dpm test
       - name: Test governance-core
         run: cd governance-core-test && ~/.dpm/bin/dpm test
       - name: Test governance-token-custody

.github/workflows/release.yml

@@ -11,10 +11,12 @@ jobs:
     uses: ./.github/workflows/ci.yml
     secrets: inherit
 
-  # Guard the peer-compatibility semver: the version peers gate on
-  # (MIN_PEER_VERSION) is decman's Cargo.toml version, so a release tag must
-  # match it. Runs in parallel with `ci` and gates `binary`, so a mismatched
-  # tag fails fast before the expensive compile.
+  # Guard the version a node publishes about itself: each node writes its
+  # Cargo.toml version into its `DecmanNode` registry entry, and operators read
+  # it to decide what a peer runs. A tag that disagrees with the crate would
+  # therefore ship a node that misreports itself. Runs in parallel with `ci`
+  # and gates `binary`, so a mismatched tag fails fast before the expensive
+  # compile.
   verify-tag:
     name: Verify tag matches crate version
     runs-on: ubuntu-latest

.gitignore

@@ -25,3 +25,8 @@ integration-tests/.e2e-pids
 
 # Other secrets
 config.toml
+
+# Coverage artefacts. code-coverage.sh runs the suite with the LLVM
+# instrumentation on, and each test process drops a .profraw beside it.
+*.profraw
+*.profdata