Feature/security integration

.github/workflows/security-integration-tests.yml

@@ -0,0 +1,68 @@
+name: Security Integration
+
+on:
+  push:
+    branches: [feature/security-integration, main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  host-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4
+        with:
+          repository: Flowduino/ESPressio-Command
+          ref: 0.2.0
+          path: deps/ESPressio-Command
+      - uses: actions/checkout@v4
+        with:
+          repository: Flowduino/ESPressio-Security
+          ref: 0.1.0
+          path: deps/ESPressio-Security
+      - uses: actions/checkout@v4
+        with:
+          repository: Flowduino/ESPressio-Timing
+          ref: 2.2.2
+          path: deps/ESPressio-Timing
+      - uses: actions/checkout@v4
+        with:
+          repository: Flowduino/ESPressio-Units
+          ref: 0.2.1
+          path: deps/ESPressio-Units
+      - uses: actions/checkout@v4
+        with:
+          repository: Flowduino/ESPressio-Observable
+          ref: 3.0.1
+          path: deps/ESPressio-Observable
+      - name: Configure
+        run: >-
+          cmake -S tests -B build
+          -DESPRESSIO_COMMAND_INCLUDE_DIR="$GITHUB_WORKSPACE/deps/ESPressio-Command/src"
+          -DESPRESSIO_SECURITY_INCLUDE_DIR="$GITHUB_WORKSPACE/deps/ESPressio-Security/src"
+          -DESPRESSIO_TIMING_INCLUDE_DIR="$GITHUB_WORKSPACE/deps/ESPressio-Timing/src"
+          -DESPRESSIO_UNITS_INCLUDE_DIR="$GITHUB_WORKSPACE/deps/ESPressio-Units/src"
+          -DESPRESSIO_OBSERVABLE_INCLUDE_DIR="$GITHUB_WORKSPACE/deps/ESPressio-Observable/src"
+      - name: Build
+        run: cmake --build build --parallel
+      - name: Test
+        run: ctest --test-dir build --output-on-failure
+
+  esp32-secure-tcp-example:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4
+        with:
+          repository: Flowduino/ESPressio-Security
+          ref: 0.1.0
+          path: deps/ESPressio-Security
+      - name: Install PlatformIO
+        run: pip install platformio
+      - name: Compile SecureTCPClient
+        run: >-
+          pio ci examples/SecureTCPClient/SecureTCPClient.ino
+          --board esp32dev --lib . --lib deps/ESPressio-Security
+          --project-option="build_flags=-std=gnu++17"
+          --project-option="build_unflags=-std=gnu++11 -fno-rtti"

CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.4.0 — 2026-08-20
+
+### Added
+- Added opt-in ESPressio Security integration targeting Security >= 0.1.0 < 1.0.0.
+- Added `SocketSecuritySession` for TCP/TLS/WebSocket-style byte streams with explicit protected-frame length framing and arbitrary receive chunking.
+- Added `SocketSecurityDatagram` for UDP/message-oriented carriers with one ESPressio Security envelope per datagram.
+- Added authenticated receive callbacks and security-failure observation without exposing key material.
+- Added support for Security sender IDs, authenticated session epochs, key IDs, AEAD algorithm abstraction and replay protection.
+- Added secure TCP client example and host tests for fragmented/coalesced stream frames, frame limits, datagram protection, and replay rejection.
+
+### Changed
+- Bumped package/component/public version metadata to 0.4.0.
+- Kept Security optional; the normal `ESPressio_Sockets.hpp` umbrella does not include Security-dependent headers.
+- Existing Event, Command, Timing, TCP/UDP/TLS/WebSocket/MQTT functionality remains source-compatible.
+- Documented ESPressio Security as independent from TLS and usable either alone or as defense-in-depth.
+
+### Compatibility
+- Existing 0.3.x applications continue to operate unchanged when Security integration is not selected.
+- Security does not become a mandatory dependency of core Sockets.
+
 ## 0.3.0 — 2026-08-20
 
 ### Added