feat(core): establish Rust workspace quality foundation

.config/nextest.toml

@@ -0,0 +1,6 @@
+[profile.default]
+fail-fast = false
+retries = 0
+status-level = "fail"
+final-status-level = "fail"
+slow-timeout = { period = "60s", terminate-after = 2 }

.coveragerc

@@ -0,0 +1,14 @@
+[run]
+branch = True
+relative_files = True
+source =
+    scripts.check_workspace_contract
+    scripts.check_docstrings
+    scripts.check_coverage
+
+[report]
+fail_under = 100
+show_missing = True
+skip_covered = False
+exclude_lines =
+    pragma: no cover

.github/workflows/ci.yml

@@ -0,0 +1,172 @@
+name: Rust Foundation CI
+
+on:
+  pull_request:
+    paths:
+      - "Cargo.toml"
+      - "rust-toolchain.toml"
+      - "deny.toml"
+      - "requirements-quality.txt"
+      - ".coveragerc"
+      - ".config/**"
+      - "crates/**"
+      - "scripts/**"
+      - "tests/quality/**"
+      - ".github/workflows/ci.yml"
+  push:
+    branches:
+      - main
+    paths:
+      - "Cargo.toml"
+      - "rust-toolchain.toml"
+      - "deny.toml"
+      - "requirements-quality.txt"
+      - ".coveragerc"
+      - ".config/**"
+      - "crates/**"
+      - "scripts/**"
+      - "tests/quality/**"
+      - ".github/workflows/ci.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: tepp-rust-foundation-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+  RUSTFLAGS: -Dwarnings
+  RUSTDOCFLAGS: -Dwarnings
+  CARGO_NEXTEST_VERSION: "0.9.140"
+  CARGO_DENY_VERSION: "0.19.7"
+  CARGO_LLVM_COV_VERSION: "0.8.6"
+
+jobs:
+  repository-contracts:
+    name: Repository contracts and Python branch coverage
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout exact head
+        uses: actions/checkout@631c942040754b6e095e929c1677c07e10ed4f87
+        with:
+          persist-credentials: false
+      - name: Install pinned Python quality dependency
+        run: python3 -m pip install --disable-pip-version-check --no-deps -r requirements-quality.txt
+      - name: Exercise repository tooling with branch coverage
+        run: python3 -m coverage run --branch -m unittest discover -s tests/quality -p 'test_*.py'
+      - name: Enforce repository tooling coverage
+        run: python3 -m coverage report --fail-under=100 --show-missing
+      - name: Validate workspace contract
+        run: python3 scripts/check_workspace_contract.py
+      - name: Validate Rust documentation contract
+        run: python3 scripts/check_docstrings.py
+
+  rust-quality:
+    name: Format, lint, test, rustdoc, and dependency policy
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout exact head
+        uses: actions/checkout@631c942040754b6e095e929c1677c07e10ed4f87
+        with:
+          persist-credentials: false
+      - name: Install pinned Rust toolchain
+        run: rustup toolchain install 1.97.1 --profile minimal --component clippy --component rustfmt
+      - name: Restore pinned Rust quality tools
+        id: rust-tools-cache
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: |
+            ~/.cargo/bin/cargo-nextest
+            ~/.cargo/bin/cargo-deny
+          key: ${{ runner.os }}-${{ runner.arch }}-tepp-rust-tools-nextest-${{ env.CARGO_NEXTEST_VERSION }}-deny-${{ env.CARGO_DENY_VERSION }}
+      - name: Install cargo-nextest
+        if: steps.rust-tools-cache.outputs.cache-hit != 'true'
+        run: cargo install cargo-nextest --locked --version "$CARGO_NEXTEST_VERSION"
+      - name: Install cargo-deny
+        if: steps.rust-tools-cache.outputs.cache-hit != 'true'
+        run: cargo install cargo-deny --locked --version "$CARGO_DENY_VERSION"
+      - name: Verify pinned Rust quality tool versions
+        run: |
+          cargo nextest --version | grep -F "$CARGO_NEXTEST_VERSION"
+          cargo deny --version | grep -F "$CARGO_DENY_VERSION"
+      - name: Check formatting
+        run: cargo fmt --all -- --check
+      - name: Compile all targets
+        run: cargo check --workspace --all-targets --all-features
+      - name: Run Clippy
+        run: cargo clippy --workspace --all-targets --all-features -- -D warnings
+      - name: Run test suite without retries
+        run: cargo nextest run --workspace --all-features
+      - name: Run doctests separately
+        run: cargo test --doc --workspace --all-features
+      - name: Build warning-free documentation
+        run: cargo doc --workspace --all-features --no-deps
+      - name: Enforce dependency, license, advisory, and source policy
+        run: cargo deny check
+
+  line-coverage:
+    name: Production line coverage
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - name: Checkout exact head
+        uses: actions/checkout@631c942040754b6e095e929c1677c07e10ed4f87
+        with:
+          persist-credentials: false
+      - name: Install pinned Rust toolchain with LLVM tools
+        run: rustup toolchain install 1.97.1 --profile minimal --component llvm-tools-preview
+      - name: Restore pinned cargo-llvm-cov
+        id: llvm-cov-cache
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.cargo/bin/cargo-llvm-cov
+          key: ${{ runner.os }}-${{ runner.arch }}-tepp-cargo-llvm-cov-${{ env.CARGO_LLVM_COV_VERSION }}
+      - name: Install cargo-llvm-cov
+        if: steps.llvm-cov-cache.outputs.cache-hit != 'true'
+        run: cargo install cargo-llvm-cov --locked --version "$CARGO_LLVM_COV_VERSION"
+      - name: Verify pinned cargo-llvm-cov version
+        run: cargo llvm-cov --version | grep -F "$CARGO_LLVM_COV_VERSION"
+      - name: Generate exact line coverage
+        id: line-report
+        run: cargo llvm-cov --workspace --all-features --json --summary-only --output-path coverage.json
+      - name: Enforce complete line coverage
+        run: python3 scripts/check_coverage.py coverage.json --kind lines
+      - name: Show exact missing line diagnostics
+        if: ${{ failure() && steps.line-report.outcome == 'success' }}
+        run: cargo llvm-cov report --text --show-missing-lines
+
+  branch-coverage:
+    name: Production branch coverage on pinned nightly
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - name: Checkout exact head
+        uses: actions/checkout@631c942040754b6e095e929c1677c07e10ed4f87
+        with:
+          persist-credentials: false
+      - name: Install pinned nightly with LLVM tools
+        run: rustup toolchain install nightly-2026-08-01 --profile minimal --component llvm-tools-preview
+      - name: Restore pinned cargo-llvm-cov
+        id: llvm-cov-cache
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.cargo/bin/cargo-llvm-cov
+          key: ${{ runner.os }}-${{ runner.arch }}-tepp-cargo-llvm-cov-${{ env.CARGO_LLVM_COV_VERSION }}
+      - name: Install cargo-llvm-cov
+        if: steps.llvm-cov-cache.outputs.cache-hit != 'true'
+        run: cargo install cargo-llvm-cov --locked --version "$CARGO_LLVM_COV_VERSION"
+      - name: Verify pinned cargo-llvm-cov version
+        run: cargo llvm-cov --version | grep -F "$CARGO_LLVM_COV_VERSION"
+      - name: Generate exact branch coverage
+        id: branch-report
+        run: cargo +nightly-2026-08-01 llvm-cov --branch --workspace --all-features --json --summary-only --output-path coverage-branches.json
+      - name: Enforce complete branch coverage
+        run: python3 scripts/check_coverage.py coverage-branches.json --kind branches
+      - name: Show exact missing branch diagnostics
+        if: ${{ failure() && steps.branch-report.outcome == 'success' }}
+        run: cargo +nightly-2026-08-01 llvm-cov report --branch --text --show-missing-lines

.gitignore

@@ -0,0 +1,8 @@
+/target/
+/coverage/
+/.coverage
+coverage.json
+coverage-branches.json
+__pycache__/
+*.py[cod]
+.pytest_cache/

ARCHITECTURE.md

@@ -43,6 +43,43 @@ flowchart LR
 
 Every boundary must be independently usable and expose versioned contracts for integration with organization repositories, `naruon`, and `contextual-orchestrator`.
 
+## Implemented foundation topology
+
+Task 1 materializes the first storage-independent workspace boundaries. The
+crate names are stable implementation identifiers, while the broader service
+boundaries above remain the target modular MSA architecture.
+
+| Rust crate | Initial responsibility |
+|---|---|
+| `evidence_core` | immutable evidence domain primitives |
+| `temporal_core` | typed clocks, intervals, and temporal reasoning |
+| `event_core` | event instances, mentions, roles, and provenance |
+| `relation_graph` | typed relations and forward-transition validation |
+| `membership_core` | time-varying cross-classified multiple membership |
+| `persistence_postgres` | PostgreSQL repositories and migrations |
+| `corpus_split` | cutoff-safe, relation-aware partitioning |
+| `tepp_simulation` | known-truth temporal/event data generation |
+| `validation_core` | RMSE, bias, coverage, graph, and Monte Carlo metrics |
+| `tepp_api` | versioned DTO, schema, and export contracts |
+
+No crate exposes placeholder production behavior in Task 1. This prevents an
+empty façade from becoming a de facto public API before its invariants and tests
+exist.
+
+## Quality architecture
+
+The workspace centralizes package metadata and Rust/Clippy lints. Every member
+inherits `unsafe_code = "forbid"`, `missing_docs = "deny"`, and warning denial.
+Repository contract scripts independently verify the approved crate set,
+workspace inheritance, action SHA pinning, absence of LLM credentials from
+ordinary CI, and complete Rust documentation.
+
+Stable Rust 1.97.1 is the compile, lint, test, and line-coverage reference.
+Branch coverage runs in a pinned nightly lane because LLVM branch coverage
+remains unstable in Rust. `cargo-nextest` runs tests without retries, while
+doctests remain a separate `cargo test --doc` gate. `cargo-deny` enforces
+advisory, license, ban, and source policy.
+
 ## Temporal invariants
 
 TEPP stores event/valid time, assertion time, document time, system time, available time, and knowledge cutoff independently. A historical analysis may include a document only when:

CHANGELOG.md

@@ -15,17 +15,27 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang
 - Topic correlation, consensus clustering, TDT, CHRONOS, and evidence-grounded LLM interpretation requirements.
 - APA 7th research traceability, source archive manifests, ADRs, governance, security, and contribution contracts.
 - Hourly centralized PR-maintenance workflow and a documented requirement for a future credential-separated NVIDIA NIM/OpenCode product-development loop.
+- Rust 1.97.1 virtual Cargo workspace with ten explicit modular foundation crates.
+- Repository contract, public-rustdoc, line-coverage, and nightly branch-coverage gates.
+- Pinned `cargo-nextest` 0.9.140, `cargo-llvm-cov` 0.8.6, `cargo-deny` 0.19.7, and Coverage.py 7.15.2 quality tooling.
+- Task 1 architecture decision and workspace-foundation validation report.
+- Version-keyed, executable-only GitHub Actions caches for pinned Rust quality tools.
 
 ### Security
 
 - Prohibited `COPILOT_GITHUB_TOKEN` and reserved `NVIDIA_NIM_API_KEY` for approved LLM test and development workflows.
 - Removed the bootstrap branch's credential-co-resident OpenCode workflow: no model process may receive repository-write authority, and scheduled product development remains disabled until proposal, independent verification, and late publication authority are separated across fresh jobs.
 - Removed completed bootstrap materializers, encoded payload fragments, readiness sentinels, and push probes from the reviewable tree.
 - Required full-commit GitHub Action pins, minimum permissions, concurrency controls, immutable audit evidence, SBOM, and provenance.
+- Kept ordinary Rust CI free of LLM and reviewer credentials and disabled persisted checkout credentials.
+- Refused to cache mutable Cargo registry, Git source, or target trees; cached quality binaries are keyed and checked by exact version.
 
 ### Quality
 
 - Required 100% production line and branch coverage and complete public API docstrings.
 - Required true-parameter recovery, RMSE, bias, interval coverage, temporal leakage, graph recovery, invariance, and CPU/GPU parity evidence.
+- Added 100% statement and branch coverage for the repository quality-gate scripts.
+- Made a zero executable-code coverage denominator explicit for the skeleton-only slice rather than treating it as evidence of implemented behavior.
+- Denied warnings, missing public documentation, and unsafe Rust across the workspace.
 
 [Unreleased]: https://github.com/ContextualWisdomLab/TEPP/compare/HEAD...HEAD

Cargo.toml

@@ -0,0 +1,53 @@
+[workspace]
+resolver = "2"
+members = [
+    "crates/evidence_core",
+    "crates/temporal_core",
+    "crates/event_core",
+    "crates/relation_graph",
+    "crates/membership_core",
+    "crates/persistence_postgres",
+    "crates/corpus_split",
+    "crates/tepp_simulation",
+    "crates/validation_core",
+    "crates/tepp_api",
+]
+default-members = [
+    "crates/evidence_core",
+    "crates/temporal_core",
+    "crates/event_core",
+    "crates/relation_graph",
+    "crates/membership_core",
+    "crates/persistence_postgres",
+    "crates/corpus_split",
+    "crates/tepp_simulation",
+    "crates/validation_core",
+    "crates/tepp_api",
+]
+
+[workspace.package]
+version = "0.1.0"
+edition = "2024"
+rust-version = "1.97.1"
+license = "Apache-2.0"
+authors = ["Contextual Wisdom Lab"]
+repository = "https://github.com/ContextualWisdomLab/TEPP"
+homepage = "https://github.com/ContextualWisdomLab/TEPP"
+readme = "README.md"
+keywords = ["psychometrics", "temporal", "events", "topic-modeling", "rust"]
+categories = ["science", "algorithms"]
+
+[workspace.lints.rust]
+unsafe_code = "forbid"
+missing_docs = "deny"
+warnings = "deny"
+rust_2018_idioms = { level = "deny", priority = -1 }
+unused_lifetimes = "deny"
+unused_qualifications = "deny"
+
+[workspace.lints.clippy]
+all = { level = "deny", priority = -1 }
+pedantic = { level = "deny", priority = -1 }
+cargo = { level = "deny", priority = -1 }
+multiple_crate_versions = "allow"
+module_name_repetitions = "allow"

README.md

@@ -1,3 +1,58 @@
 # TEPP
 
-Temporal Event Psychometrics Platform repository initialization.
+TEPP is the **Temporal Event Psychometrics Platform**: a multilingual, temporal,
+relational measurement system whose statistical and psychometric arithmetic is
+implemented in Rust.
+
+## Current implementation state
+
+This branch establishes the Task 1 Rust workspace and quality-gate foundation.
+The ten bounded crates compile independently but intentionally expose no
+placeholder production APIs. Domain behavior begins in Task 2 with immutable
+evidence identifiers and source records.
+
+```text
+crates/evidence_core
+crates/temporal_core
+crates/event_core
+crates/relation_graph
+crates/membership_core
+crates/persistence_postgres
+crates/corpus_split
+crates/tepp_simulation
+crates/validation_core
+crates/tepp_api
+```
+
+## Local verification
+
+```bash
+python3 scripts/check_workspace_contract.py
+python3 scripts/check_docstrings.py
+python3 -m coverage run --branch -m unittest discover -s tests/quality -p 'test_*.py'
+python3 -m coverage report --fail-under=100 --show-missing
+
+cargo fmt --all -- --check
+cargo check --workspace --all-targets --all-features
+cargo clippy --workspace --all-targets --all-features -- -D warnings
+cargo nextest run --workspace --all-features
+cargo test --doc --workspace --all-features
+cargo doc --workspace --all-features --no-deps
+cargo deny check
+```
+
+Stable Rust line coverage is measured with `cargo-llvm-cov`. Branch coverage is
+measured in a separately pinned nightly lane because Rust branch coverage remains
+an unstable compiler capability. A zero denominator is reported explicitly for
+this skeleton-only slice; it must never conceal uncovered production behavior.
+
+## Normative documents
+
+- `AGENTS.md`
+- `ARCHITECTURE.md`
+- `docs/product/prd-v0.4-approved.md`
+- `docs/superpowers/plans/2026-08-05-temporal-event-foundation.md`
+- `docs/research/standards-and-literature.md`
+
+No release, production-readiness, GPU, database, or statistical-recovery claim is
+made by this foundation slice.