docs: add product/technical gap baseline

.github/workflows/ci.yml

@@ -13,6 +13,26 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  rust-core:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Install pinned Rust toolchain
+        run: >-
+          rustup toolchain install 1.97.1 --profile minimal
+          --component clippy --component rustfmt --component llvm-tools-preview
+      - name: Install pinned Rust coverage tool
+        run: cargo +1.97.1 install cargo-llvm-cov --locked --version 0.8.6
+      - run: cargo +1.97.1 fmt --all -- --check
+      - run: cargo +1.97.1 clippy --workspace --all-targets -- -D warnings
+      - run: >-
+          cargo +1.97.1 llvm-cov --package rankweave-core
+          --fail-under-lines 100 --fail-under-functions 100
+          --fail-under-regions 100
+
   test:
     runs-on: ubuntu-latest
     timeout-minutes: 10
@@ -27,6 +47,10 @@ jobs:
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
+      - name: Install pinned Rust toolchain
+        run: |
+          rustup toolchain install 1.97.1 --profile minimal
+          rustup default 1.97.1
       - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
           version: "0.12.1"
@@ -59,90 +83,28 @@ jobs:
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.13"
+      - name: Install pinned Rust toolchain
+        run: |
+          rustup toolchain install 1.97.1 --profile minimal
+          rustup default 1.97.1
       - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
           version: "0.12.1"
           enable-cache: false
       - run: uv sync --frozen --extra dev --python 3.13
       - run: uv build --wheel --sdist --out-dir dist
-      - name: Verify wheel contents
-        run: |
-          uv run --frozen --extra dev --python 3.13 python - <<'PY'
-          from pathlib import Path
-          from zipfile import ZipFile
-
-          wheel_path = next(Path("dist").glob("rankweave-*.whl"))
-          with ZipFile(wheel_path) as wheel_file:
-              wheel_members = set(wheel_file.namelist())
-          required_members = {
-              "rankweave/__init__.py",
-              "rankweave/__main__.py",
-              "rankweave/_validation.py",
-              "rankweave/artifact_verification.py",
-              "rankweave/cli.py",
-              "rankweave/comparison.py",
-              "rankweave/cross_validation.py",
-              "rankweave/evaluation.py",
-              "rankweave/query_normalization.py",
-              "rankweave/ranked_list_fusion.py",
-              "rankweave/report_schemas.py",
-              "rankweave/score_fusion.py",
-              "rankweave/schemas/__init__.py",
-              "rankweave/schemas/artifact-verification-v1.schema.json",
-              "rankweave/schemas/trec-comparison-v1.schema.json",
-              "rankweave/schemas/trec-comparison-v2.schema.json",
-              "rankweave/schemas/trec-family-comparison-v1.schema.json",
-              "rankweave/schemas/trec-family-comparison-v2.schema.json",
-              "rankweave/temporal_backtesting.py",
-              "rankweave/trec.py",
-              "rankweave/trec_comparison.py",
-              "rankweave/trec_family_comparison.py",
-              "rankweave/tuning.py",
-              "rankweave/py.typed",
-          }
-          missing_members = required_members - wheel_members
-          if missing_members:
-              raise SystemExit(f"wheel is missing: {sorted(missing_members)!r}")
-          PY
-      - name: Verify source distribution contents
-        run: |
-          uv run --frozen --extra dev --python 3.13 python - <<'PY'
-          from pathlib import Path
-          from tarfile import open as open_tarfile
-
-          source_distributions = tuple(
-              Path("dist").glob("rankweave-*.tar.gz")
-          )
-          if len(source_distributions) != 1:
-              raise SystemExit(
-                  "package job requires exactly one source distribution"
-              )
-          source_distribution = source_distributions[0]
-          source_root = source_distribution.name.removesuffix(".tar.gz") + "/"
-          with open_tarfile(source_distribution, "r:gz") as archive:
-              source_members = set(archive.getnames())
-          required_source_members = {
-              source_root + "pyproject.toml",
-              source_root + "README.md",
-              source_root + "CHANGELOG.md",
-              source_root + "LICENSE",
-              source_root + "src/rankweave/__init__.py",
-              source_root + "tests/test_version.py",
-          }
-          missing_source_members = required_source_members - source_members
-          if missing_source_members:
-              raise SystemExit(
-                  "source distribution is missing: "
-                  f"{sorted(missing_source_members)!r}"
-              )
-          PY
+      - name: Verify wheel and source distribution contents
+        run: >-
+          uv run --frozen --extra dev --python 3.13 python
+          scripts/verify_release_archives.py --dist-dir dist --version 0.18.0
+          --wheel-tag linux --require-sdist
       - name: Exercise release checksum handoff
         run: |
           set -euo pipefail
           mkdir -p release-handoff
           (
             cd dist
-            sha256sum *.whl *.tar.gz
+            sha256sum ./*.whl ./*.tar.gz
           ) > release-handoff/SHA256SUMS
           manifest_sha256="$(
             sha256sum release-handoff/SHA256SUMS | cut -d ' ' -f1

.github/workflows/create-release.yml

@@ -37,6 +37,10 @@ jobs:
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.13"
+      - name: Install pinned Rust toolchain
+        run: |
+          rustup toolchain install 1.97.1 --profile minimal
+          rustup default 1.97.1
       - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
           version: "0.12.1"
@@ -224,24 +228,12 @@ jobs:
           uv run --frozen --extra dev --python 3.13 \
             python -m coverage report
           uv build --wheel --sdist --out-dir dist
-
-          version="$RELEASE_VERSION"
-          wheel_paths=(dist/rankweave-*.whl)
-          source_paths=(dist/rankweave-*.tar.gz)
-          if [[ ${#wheel_paths[@]} -ne 1 || ${#source_paths[@]} -ne 1 ]]; then
-            echo "release requires exactly one wheel and one source distribution" >&2
-            exit 1
-          fi
-          expected_wheel="rankweave-${version}-py3-none-any.whl"
-          expected_source="rankweave-${version}.tar.gz"
-          if [[ "${wheel_paths[0]##*/}" != "$expected_wheel" ]]; then
-            echo "unexpected wheel name: ${wheel_paths[0]##*/}" >&2
-            exit 1
-          fi
-          if [[ "${source_paths[0]##*/}" != "$expected_source" ]]; then
-            echo "unexpected source distribution: ${source_paths[0]##*/}" >&2
-            exit 1
-          fi
+          uv run --frozen --extra dev --python 3.13 python \
+            scripts/verify_release_archives.py \
+            --dist-dir dist \
+            --version "$RELEASE_VERSION" \
+            --wheel-tag linux \
+            --require-sdist
       - name: Extract deterministic release notes
         env:
           RELEASE_VERSION: ${{ steps.identity.outputs.release_version }}

.github/workflows/hourly-commercialization-loop.yml

@@ -129,18 +129,46 @@ jobs:
           set -euo pipefail
           venv="/tmp/rankweave-automation-venv-${GITHUB_RUN_ID}"
           sudo rm -rf "$venv"
+          rustup toolchain install 1.97.1 --profile minimal
+          rustup default 1.97.1
+          cargo +1.97.1 fetch --locked
           python -m venv "$venv"
           "$venv/bin/python" -m pip install --upgrade pip
-          "$venv/bin/python" -m pip install -e ".[dev]" hatchling
+          "$venv/bin/python" -m pip install -e ".[dev]" maturin==1.14.1
+          native_cores=(src/rankweave/_rankweave_core*.so)
+          if [[ "${#native_cores[@]}" -ne 1 || ! -f "${native_cores[0]}" ]]; then
+            echo "trusted editable install did not produce exactly one native core" >&2
+            exit 1
+          fi
+          native_core_name="$(basename "${native_cores[0]}")"
+          trusted_native_core="${RUNNER_TEMP}/rankweave-trusted-native-core.so"
+          sudo install -o root -g root -m 0555 \
+            "${native_cores[0]}" "$trusted_native_core"
           sudo chown -R root:root "$venv"
           sudo chmod -R a-w "$venv"
           sandbox_uid="$(id -u nobody)"
           sandbox_gid="$(id -g nobody)"
+          sandbox_rust="/tmp/rankweave-rust-${GITHUB_RUN_ID}"
+          cargo_home="${CARGO_HOME:-$HOME/.cargo}"
+          rust_sysroot="$(rustc +1.97.1 --print sysroot)"
+          sudo rm -rf "$sandbox_rust"
+          sudo mkdir -p "$sandbox_rust/cargo" "$sandbox_rust/toolchain"
+          sudo cp -a "$cargo_home/registry" "$sandbox_rust/cargo/registry"
+          sudo cp -a "$rust_sysroot/." "$sandbox_rust/toolchain/"
+          sudo chown -R "$sandbox_uid:$sandbox_gid" "$sandbox_rust/cargo"
+          sudo chown -R root:root "$sandbox_rust/toolchain"
+          sudo chmod -R a+rX,go-w "$sandbox_rust/toolchain"
           command -v setpriv >/dev/null
-          echo "AUTOMATION_VENV=$venv" >>"$GITHUB_ENV"
-          echo "AUTOMATION_BASE_SHA=$(git rev-parse HEAD)" >>"$GITHUB_ENV"
-          echo "SANDBOX_UID=$sandbox_uid" >>"$GITHUB_ENV"
-          echo "SANDBOX_GID=$sandbox_gid" >>"$GITHUB_ENV"
+          {
+            echo "AUTOMATION_VENV=$venv"
+            echo "AUTOMATION_NATIVE_CORE_NAME=$native_core_name"
+            echo "AUTOMATION_TRUSTED_NATIVE_CORE=$trusted_native_core"
+            echo "AUTOMATION_BASE_SHA=$(git rev-parse HEAD)"
+            echo "SANDBOX_UID=$sandbox_uid"
+            echo "SANDBOX_GID=$sandbox_gid"
+            echo "SANDBOX_CARGO_HOME=$sandbox_rust/cargo"
+            echo "SANDBOX_RUST_TOOLCHAIN=$sandbox_rust/toolchain"
+          } >>"$GITHUB_ENV"
           {
             echo "/opencode.json"
             echo "/.agent-red-output.txt"
@@ -244,7 +272,8 @@ jobs:
           any file outside tests/ and docs/superpowers/specs/.
 
           The tests must express the buyer-visible contract, preserve RankWeave's
-          standard-library-only runtime, deterministic and immutable evidence,
+          no-third-party Python runtime dependency, one Rust calculation core,
+          deterministic and immutable evidence,
           fail-closed validation, Python 3.10+ compatibility, and modular standalone
           plus naruon-import use. The workflow will execute the test suite after this
           phase and requires a genuine test failure before implementation begins.
@@ -279,6 +308,10 @@ jobs:
           set -euo pipefail
           rm -f opencode.json
           git clean -fdX
+          cp "$AUTOMATION_TRUSTED_NATIVE_CORE" \
+            "src/rankweave/$AUTOMATION_NATIVE_CORE_NAME"
+          test "$(sha256sum "$AUTOMATION_TRUSTED_NATIVE_CORE" | cut -d " " -f1)" = \
+            "$(sha256sum "src/rankweave/$AUTOMATION_NATIVE_CORE_NAME" | cut -d " " -f1)"
           "$AUTOMATION_VENV/bin/python" - <<'PY'
           from __future__ import annotations
 
@@ -374,7 +407,7 @@ jobs:
             --noprofile
             --norc
             -c
-            'cd "$WORKSPACE" && python -m pytest -q -p no:cacheprovider'
+            "cd \"$GITHUB_WORKSPACE\" && python -m pytest -q -p no:cacheprovider"
           )
           set +e
           "${red_sandbox[@]}" "${red_environment[@]}" >"$red_output" 2>&1
@@ -462,7 +495,8 @@ jobs:
           environment variables, or paths outside the repository.
 
           Make the smallest coherent production change that turns the red tests
-          green. Preserve the standard-library-only runtime, store-agnostic modular
+          green. Preserve the no-third-party Python runtime dependency, one Rust
+          calculation core, store-agnostic modular
           architecture, deterministic behavior, immutable audit records, fail-closed
           input contracts, Python 3.10+ compatibility, full production docstrings,
           and standalone plus naruon-import use. Do not edit anything under .github/
@@ -474,6 +508,11 @@ jobs:
           statistical or standards claim without a primary source already recorded in
           the repository. Figma is not applicable because RankWeave has no UI.
 
+          This autonomous lane is Python-only. Do not edit Rust source, Cargo
+          manifests, build configuration, or Python build metadata. A Rust-core
+          increment requires a separately authored and reviewed maintainer pull
+          request.
+
           Do not commit, push, open, approve, merge, publish, or release anything;
           the workflow performs deterministic validation and packages one protected
           pull request with maintainer-owned metadata.
@@ -510,6 +549,10 @@ jobs:
           set -euo pipefail
           rm -f opencode.json .agent-red-output.txt
           git clean -fdX
+          cp "$AUTOMATION_TRUSTED_NATIVE_CORE" \
+            "src/rankweave/$AUTOMATION_NATIVE_CORE_NAME"
+          test "$(sha256sum "$AUTOMATION_TRUSTED_NATIVE_CORE" | cut -d " " -f1)" = \
+            "$(sha256sum "src/rankweave/$AUTOMATION_NATIVE_CORE_NAME" | cut -d " " -f1)"
           "$AUTOMATION_VENV/bin/python" - <<'PY'
           from __future__ import annotations
 
@@ -568,20 +611,23 @@ jobs:
               ".gitmodules",
               "AGENTS.md",
               "CODEOWNERS",
+              "pyproject.toml",
               "SECURITY.md",
           }
-          forbidden_prefixes = (".github/", ".git/")
+          forbidden_prefixes = (".github/", ".git/", "crates/")
           allowed_exact = {
               "CHANGELOG.md",
               "README.md",
-              "pyproject.toml",
           }
-          allowed_prefixes = ("src/rankweave/", "tests/", "docs/")
+          allowed_prefixes = (
+              "src/rankweave/",
+              "tests/",
+              "docs/",
+          )
           allowed_suffixes = {
               ".json",
               ".md",
               ".py",
-              ".toml",
               ".txt",
               ".yaml",
               ".yml",
@@ -644,7 +690,7 @@ jobs:
               )
 
           metadata = tomllib.loads(Path("pyproject.toml").read_text(encoding="utf-8"))
-          if metadata["build-system"]["build-backend"] != "hatchling.build":
+          if metadata["build-system"]["build-backend"] != "maturin":
               raise SystemExit("build backend may not change")
           if metadata["project"].get("dependencies") != []:
               raise SystemExit("RankWeave runtime dependencies must remain empty")
@@ -745,14 +791,19 @@ jobs:
           )
           validation_environment=(
             env -i
-            "PATH=${AUTOMATION_VENV}/bin:/usr/bin:/bin"
+            "PATH=${AUTOMATION_VENV}/bin:${SANDBOX_RUST_TOOLCHAIN}/bin:/usr/bin:/bin"
             "HOME=$validation_home"
             "WORKSPACE=$GITHUB_WORKSPACE"
             "PYTHONPATH=$GITHUB_WORKSPACE/src"
             "DIST=$validation_dist"
             "SMOKE=$validation_smoke"
             "COVERAGE_FILE=$validation_coverage"
             "RUFF_CACHE_DIR=$ruff_cache"
+            "CARGO_HOME=$SANDBOX_CARGO_HOME"
+            "CARGO_TARGET_DIR=$validation_home/cargo-target"
+            "CARGO_NET_OFFLINE=true"
+            "RUSTC=$SANDBOX_RUST_TOOLCHAIN/bin/rustc"
+            "RUSTDOC=$SANDBOX_RUST_TOOLCHAIN/bin/rustdoc"
             PYTHONDONTWRITEBYTECODE=1
             PIP_DISABLE_PIP_VERSION_CHECK=1
             PIP_NO_INDEX=1