feat(sdk): add dash-platform-cxx, a thin CXX shell over dash-sdk for C++ embedders

.github/package-filters/rs-packages-direct.yml

@@ -131,6 +131,9 @@ dash-platform-queries:
 dash-sdk:
   - packages/rs-sdk/**
 
+dash-platform-cxx:
+  - packages/rs-platform-cxx/**
+
 rs-sdk-ffi:
   - packages/rs-sdk-ffi/**
 

.github/package-filters/rs-packages-no-workflows.yml

@@ -153,6 +153,11 @@ dash-sdk: &sdk
   - *dapi_client
   - *drive
 
+dash-platform-cxx:
+  - packages/rs-platform-cxx/**
+  - *sdk
+  - *platform_encryption
+
 rs-sdk-ffi: &sdk_ffi
   - packages/rs-sdk-ffi/**
   - *simple-signer

.github/package-filters/rs-packages.yml

@@ -181,6 +181,12 @@ dash-sdk: &sdk
   - *dapi_client
   - *drive
 
+dash-platform-cxx:
+  - .github/workflows/tests*
+  - packages/rs-platform-cxx/**
+  - *sdk
+  - *platform_encryption
+
 rs-sdk-ffi: &sdk_ffi
   - .github/workflows/tests*
   - packages/rs-sdk-ffi/**

.github/workflows/tests-rs-workspace.yml

@@ -269,6 +269,31 @@ jobs:
             done
           done
 
+      # The C++ embedder (Dash Core's platform GUI) links dash-platform-cxx
+      # as a static archive whose trust anchor must be the embedder's own
+      # LLMQ store and masternode list: no trusted-provider crate, no HTTP
+      # client, no OpenSSL, no default seed list may enter its closure or
+      # its sources. (It wraps the full dash-sdk, networking included, so
+      # it is deliberately absent from the transport-free cuts above.)
+      - name: Check the Platform CXX embedder's trust closure
+        run: |
+          for banned in rs-sdk-trusted-context-provider reqwest openssl-sys native-tls; do
+            if cargo tree -p dash-platform-cxx -e normal -i "$banned" 2>/dev/null | grep -q .; then
+              echo "::error::$banned leaked into dash-platform-cxx's dependency tree"
+              exit 1
+            fi
+          done
+          if grep -rnE 'new_mainnet|new_testnet|fetch_unproved|dash_network_seeds' \
+              packages/rs-platform-cxx/src packages/rs-platform-cxx/include; then
+            echo "::error::dash-platform-cxx must build its SDK from the embedder's endpoints only"
+            exit 1
+          fi
+
+      # The C++ embedding surface must link and run from the staged headers
+      # and archive alone; the Rust tests cannot see a broken header layout.
+      - name: Link the Platform CXX embedder from C++
+        run: packages/rs-platform-cxx/scripts/cxx-smoke.sh
+
       - name: Detect immutable structure changes
         if: github.event_name == 'pull_request'
         run: |
@@ -456,6 +481,7 @@ jobs:
             --package rs-sdk-ffi \
             --package platform-wallet-ffi \
             --package rs-dapi-client \
+            --package dash-platform-cxx \
             --package platform-serialization \
             --package dapi-grpc \
             --package json-schema-compatibility-validator \

Cargo.toml

@@ -40,6 +40,7 @@ members = [
     "packages/app-connect-contract",
     "packages/moderation-charters-contract",
     "packages/rs-sdk-ffi",
+    "packages/rs-platform-cxx",
     "packages/wasm-drive-verify",
     "packages/dash-platform-balance-checker",
     "packages/rs-dapi",