build(rust): pin all product and release lanes to 1.97.1

[seonghobae]

Problem

BandScope's Rust-backed analysis build, Tauri validation, release preflight, dependency audit, and native packaging lanes must use one reviewed compiler and must not be able to manufacture compiler/test evidence from non-executing or failure-masked shell text.

Rust 1.97.1 is the reviewed repository build baseline. Floating stable selection can change scientific, security, and release evidence without a repository diff.

Exact current identity

• Protected base at reconciliation: develop@749511c3ad4000090048718f685c6bee6b3d2c25.
• Exact current head: 926296fe8fdb145d0c7b7d0cc9c3fc41fb3cb484.
• Branch: agent/rust-toolchain-refresh-2026-08-19.
• Current compare state: 77 commits ahead / 0 behind protected develop after ordinary non-force reconciliation plus the product/technical gap baseline; no force-push or destructive rebase was used.
• Open, Draft, and unmerged pending fresh exact-head evidence and independent approval.

Current contract

• root rust-toolchain.toml pins Rust 1.97.1;
• ordinary CI, release preflight, dependency audit, and Windows/macOS amd64/arm64 packaging bind their Rust execution to that compiler;
• weekly Dependabot rust-toolchain update discovery targets protected develop;
• canonical scripts/checks/verify_rust_toolchain.py rejects floating selectors and evidence borrowed across Dependabot lanes, workflow files, sibling jobs, comments, step names, environment text, or other non-executing YAML;
• each Rust-owning job must itself execute its required compiler command;
• required command evidence may carry ordinary arguments such as --manifest-path, --locked, or explicit target triples, but may not use shell chaining/pipelines/background control operators that can replace the required command's exit status; and
• crate MSRV/downstream support promises are not widened by this repository build pin.

Test-first and concurrency repair

Earlier TDD on this branch closed cross-Dependabot-lane, comment-only field, cross-workflow, cross-native-job, non-executable-run, failure-masked shell, and workflow evidence-authority gaps.

The seven stale supply-chain policy tests that still encoded cargo +stable audit were repaired on the canonical branch at ba4e7c1508261f7478e16810f67e1b0b44768a8b: only the 11 stale audit-command occurrences in the affected test scopes were changed to cargo +1.97.1 audit, while intentional floating-selector rejection cases remained. The temporary self-modifying repair workflow/script were removed after that repair landed.

Protected develop subsequently advanced with buyer-visible first-playable-range work and npm/runtime/supply-chain hardening. Rather than overwrite that concurrent work, this branch re-fetched current develop, reconciled the five overlapping workflow/CHANGELOG files by intent, preserved the current npm 10.9.9/Corepack/tar validation and artifact-upload behavior, then appended the ordinary two-parent reconciliation commit 762cdfec70df2be27f38d263bf9a4e0c6a6063c0 with develop@749511c3ad4000090048718f685c6bee6b3d2c25 as its second parent.

docs/product-technical-gap-baseline.md was then added at the current branch tip to preserve buyer PRD/TRD, DDD context map and ubiquitous language, persistence/ERD applicability, exact-head evidence, organization naming status, current gap ledger, and security/test/operability merge conditions in repository-owned documentation.

Verification status

All predecessor-head CI evidence is stale for merge purposes. Fresh checks must bind to exact head 926296fe8fdb145d0c7b7d0cc9c3fc41fb3cb484. Any failing current-head job must be RCA'd from its exact log and repaired on this branch or its true causal owner.

Canonical JavaScript dependency/security owner #783 is already merged as 7ad56cf0065d068ec6463d92726de4855a6e201d and is an ancestor of the reconciled protected base. Its npm/PDF.js/Nanoid/Undici and lock-generator protections are therefore inherited here rather than a remaining dependency blocker.

Merge gate

Keep Draft and unmerged until one unchanged exact head has every applicable repository and central CI/build/release/security/SAST/SBOM/supply-chain/coverage/review gate terminal-success, zero valid unresolved findings remain, a qualifying independent non-author approval is current for the last push, and ordinary protected-branch rules permit merge without bypass. Queued, pending, skipped-required, failed, stale, predecessor-head, protected-base, model-only, self/author, or administrative-bypass evidence is non-passing.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Repair the exact current-head BandScope-owned quickcheck failure on the existing agent/rust-toolchain-refresh-2026-08-19 branch only. Current head b0f8cf0de9f02ee1bed7a8ee964daed6d2063562; CI run 32597173161, job 97089876119, actual checkout bc81a8797006b797b71cbe258dd8e27aef40a062 merges this head into develop@acdbea6344fe1231c39535b575f4de35e4c607c9. Ruff lint/format, desktop tests and desktop/shared coverage are now GREEN; the first remaining branch-owned failure is 7 assertions/fixtures in services/analysis-engine/tests/test_supply_chain_policy.py that still encode the obsolete cargo +stable audit command while the canonical verifier/workflow now requires cargo +1.97.1 audit. Update only those stale Rust-audit fixtures/expected violation strings to the pinned command; preserve the spoof/blocking/nested-shell semantics and do not weaken verify_supply_chain.py. Run focused test_supply_chain_policy.py, Ruff check/format, then canonical quickcheck. Do not touch npm dependency/security findings; those remain #783-owned. Commit to this same branch and report resulting exact head/evidence.

[seonghobae]

@opencode-agent repair

Fresh 2026-08-25 refetch still shows the canonical branch agent/rust-toolchain-refresh-2026-08-19 exactly at b0f8cf0de9f02ee1bed7a8ee964daed6d2063562 against protected develop@acdbea6344fe1231c39535b575f4de35e4c607c9; there has been no intervening writer movement since this request. Exact CI run 32597173161, job 97089876119, actual merge checkout bc81a8797006b797b71cbe258dd8e27aef40a062 is the current RED evidence: Ruff lint/format is green, desktop/shared owned coverage is 100%, Python coverage is 100%, and exactly 7 tests in services/analysis-engine/tests/test_supply_chain_policy.py fail because their Rust-audit fixtures/assertions still encode obsolete cargo +stable audit while the canonical production verifier/workflow requires cargo +1.97.1 audit.

Update only the stale occurrences inside these seven tests:

• test_security_audit_workflow_keeps_dependency_vulnerability_scans
• test_supply_chain_check_requires_audit_tokens_in_run_steps
• test_supply_chain_check_accepts_nested_shell_audit_commands
• test_supply_chain_check_rejects_noop_audit_command_spoofs
• test_supply_chain_check_requires_blocking_audit_steps
• test_supply_chain_check_requires_unconditional_audit_steps
• test_supply_chain_check_accepts_explicit_false_continue_on_error_audit_steps

There are 11 stale cargo +stable audit fixture/expected-string occurrences inside those seven scopes. Replace those with cargo +1.97.1 audit; do not globally replace intentional floating-selector rejection cases elsewhere, do not weaken scripts/checks/verify_supply_chain.py, and do not change production/workflow/npm dependency-security authority. Preserve the spoof, blocking, unconditional, nested-shell, and explicit-false semantics.

Then run the focused test_supply_chain_policy.py, repository-pinned Ruff check and format check, and canonical quickcheck. Commit only to this same branch and report the new exact head plus focused/full evidence. #783 continues to own npm dependency/security state.

[seonghobae]

@opencode-agent repair

Fresh writer-lease refetch: PR #944 is still exactly agent/rust-toolchain-refresh-2026-08-19@b0f8cf0de9f02ee1bed7a8ee964daed6d2063562; target file blob is still services/analysis-engine/tests/test_supply_chain_policy.py@ab43df89f8dafde4a9d5f7fb8744e76975c14d76. There has been no intervening branch mutation since the prior request, so execute the existing canonical repair now rather than re-diagnosing.

Current exact RED remains CI run 32597173161, job 97089876119, actual merge checkout bc81a8797006b797b71cbe258dd8e27aef40a062: Ruff lint/format, desktop/shared owned coverage and Python coverage are green; the first branch-owned failure is exactly the seven stale test scopes below, whose fixtures/assertions still encode cargo +stable audit while the production workflow/verifier on this branch requires cargo +1.97.1 audit:

• test_security_audit_workflow_keeps_dependency_vulnerability_scans
• test_supply_chain_check_requires_audit_tokens_in_run_steps
• test_supply_chain_check_accepts_nested_shell_audit_commands
• test_supply_chain_check_rejects_noop_audit_command_spoofs
• test_supply_chain_check_requires_blocking_audit_steps
• test_supply_chain_check_requires_unconditional_audit_steps
• test_supply_chain_check_accepts_explicit_false_continue_on_error_audit_steps

Change only the 11 cargo +stable audit occurrences inside those seven function scopes to cargo +1.97.1 audit. Do not globally replace intentional floating-selector rejection fixtures elsewhere; do not change scripts/checks/verify_supply_chain.py, workflow behavior, dependency/security authority, or unrelated files. Preserve nested-shell, no-op-spoof, blocking, unconditional, and explicit-false semantics.

Verification-before-completion: run the focused services/analysis-engine/tests/test_supply_chain_policy.py, repository-pinned Ruff check and format check, then canonical quickcheck. Commit only to this same branch, then report the successor exact head and focused/full evidence. If live head/blob moves before write, stop that exact write, refetch, and remap instead of overwriting concurrent work.

[seonghobae]

@OpenCode Use superpowers:using-superpowers, systematic-debugging, test-driven-development, and verification-before-completion. Work ONLY canonical branch agent/rust-toolchain-refresh-2026-08-19 at exact head b0f8cf0de9f02ee1bed7a8ee964daed6d2063562; live protected base is now develop@749511c3ad4000090048718f685c6bee6b3d2c25. Refetch head/base/blob/review state immediately before writing and adapt if either ref moves. Do not create a competing PR or force-push.

This exact head still has the BandScope-owned deterministic quickcheck defect already proven by CI run 32597173161, ci / build-and-test job 97089876119, actual checkout bc81a8797006b797b71cbe258dd8e27aef40a062: 7 tests in services/analysis-engine/tests/test_supply_chain_policy.py encode obsolete cargo +stable audit while the production verifier/workflow requires cargo +1.97.1 audit. Repository-pinned Ruff, desktop tests/coverage, shared-types coverage, and Python coverage had already passed before this failure. The prior exact-head owner request never produced a successor head or agent receipt; central .github/main has since moved to 31e5f5337d8a8d844c456fe03f123c51b62416c9, so this is a fresh actionable retry rather than evidence reuse.

Repair only the stale test contract in the seven known scopes: replace only their obsolete Rust-audit fixture/expected-violation occurrences with cargo +1.97.1 audit. Preserve intentional floating-selector rejection fixtures elsewhere, nested-shell/spoof/blocking/unconditional/continue-on-error semantics, and keep scripts/checks/verify_supply_chain.py unchanged. Run the focused policy test file, repository-pinned Ruff check/format, then canonical quickcheck/full applicable validation. Commit only if GREEN on this branch, refetch exact successor head/live base, and report exact evidence. Do not touch dependency/security findings owned by already-integrated #783 or weaken any gate.

[seonghobae]

Fresh cross-lane evidence for this PR's canonical Rust CI/test ownership: exact #1040 head 38800928585595806279b923cce13d3798f93591 added a real native integration regression apps/desktop/core/tests/drop_plan_contract.rs::project_contract_round_trips_optional_shared_role_fields, while current native RehearsalRolePayload still rejects the corresponding valid shared optional fields under deny_unknown_fields. Yet #1040 exact-head repository checks completed without failure because current protected CI does not execute that core integration target.

First causal boundary on current protected workflow: .github/workflows/ci.yml gate / ci / rust-check runs cargo +stable test --manifest-path apps/desktop/src-tauri/Cargo.toml --locked; Cargo does not execute dependency-crate integration tests from apps/desktop/core/tests. scripts/harness/quickcheck.sh only calls check_rust.sh when BANDSCOPE_ENABLE_RUST_CHECK=1, and check_rust.sh performs cargo check only. Thus a RED native contract regression can be present while required CI remains green.

This is a BandScope-owned Rust evidence gap, and #944 already owns .github/workflows/ci.yml, scripts/harness/quickcheck.sh, and Rust execution-policy verification. Do not patch #1040's product branch just to manufacture CI success. When the current #944 writer lane is safe to extend, add a regression that proves the core integration suite is executed by the canonical Rust gate, then minimally make the Rust gate execute cargo test --manifest-path apps/desktop/core/Cargo.toml --locked (or an equivalent package/workspace invocation that demonstrably runs apps/desktop/core/tests/*) in addition to the Tauri shell tests. Preserve compiler-pin authority and do not weaken any existing test/gate. Acceptance: deliberately failing core integration test must fail the gate; restored test must pass; #1040's drop_plan_contract must be observable in hosted test output after its production fix. This handoff is evidence only; no duplicate agent dispatch is being sent while #944's existing same-head owner repair is active.

[seonghobae]

@OpenCode Use superpowers:using-superpowers, systematic-debugging, test-driven-development, and verification-before-completion. Work ONLY canonical branch agent/rust-toolchain-refresh-2026-08-19 after refetching its exact head. Fresh writer-lease evidence immediately before this dispatch: PR #944 head is 52bfe4c14e88553e0d46392656b83f7a67f49124, live protected base is develop@749511c3ad4000090048718f685c6bee6b3d2c25, and services/analysis-engine/tests/test_supply_chain_policy.py is still blob ab43df89f8dafde4a9d5f7fb8744e76975c14d76. If any of those move, inspect the delta and adapt rather than overwriting concurrent work. Do not force-push or create another PR.

This writer has now repaired the previously identified Rust evidence gap on the same branch: scripts/checks/verify_rust_toolchain.py requires, and .github/workflows/ci.yml executes, cargo +1.97.1 test --manifest-path apps/desktop/core/Cargo.toml --locked; the exact current head includes the regression test_rust_toolchain_policy_requires_desktop_core_integration_suite.

The remaining known deterministic BandScope-owned quickcheck defect is the old test-contract drift in services/analysis-engine/tests/test_supply_chain_policy.py. Production .github/workflows/security-audit.yml at the current head executes cargo +1.97.1 audit, but exactly these seven tests still encode obsolete cargo +stable audit: test_security_audit_workflow_keeps_dependency_vulnerability_scans, test_supply_chain_check_requires_audit_tokens_in_run_steps, test_supply_chain_check_accepts_nested_shell_audit_commands, test_supply_chain_check_rejects_noop_audit_command_spoofs, test_supply_chain_check_requires_blocking_audit_steps, test_supply_chain_check_requires_unconditional_audit_steps, and test_supply_chain_check_accepts_explicit_false_continue_on_error_audit_steps. Replace ONLY the 11 obsolete Rust-audit fixture/expected-string occurrences inside those seven scopes with cargo +1.97.1 audit. Preserve intentional floating-selector rejection fixtures elsewhere, nested-shell/no-op/blocking/unconditional/explicit-false semantics, and leave scripts/checks/verify_supply_chain.py unchanged.

TDD/verification: first show the focused stale assertions fail against the pinned production workflow if still reproducible; apply only the scoped test repair; run the focused policy test file, test_rust_toolchain_policy_execution.py, repository-pinned Ruff check and format check, then canonical quickcheck and the Rust core/Tauri test commands where available. Commit only GREEN changes to this existing branch. Refetch the resulting exact head/live base and report exact test/check evidence. Do not touch dependency/security authority owned elsewhere and do not weaken any gate.

[seonghobae]

@opencode-agent Repair and restack the existing canonical Rust-toolchain branch only; do not create a new PR and do not force-push. Fresh authority: protected develop@749511c3ad4000090048718f685c6bee6b3d2c25; exact PR #944 head 52bfe4c14e88553e0d46392656b83f7a67f49124; GitHub compare is diverged (ahead_by=61, behind_by=2, merge base acdbea6344fe1231c39535b575f4de35e4c607c9) and PR mergeability is currently false. First preserve the current Rust 1.97.1 semantic delta and ordinary-merge current protected develop into this branch, resolving the overlapping workflow/CHANGELOG changes rather than dropping either side. Then reproduce current quickcheck on the resulting exact head. The known branch-owned stale contract is services/analysis-engine/tests/test_supply_chain_policy.py: update only the stale cargo +stable audit fixtures/expected strings in the seven Rust-audit test scopes to cargo +1.97.1 audit, preserving intentional floating-selector rejection cases and leaving scripts/checks/verify_supply_chain.py strict. Run the focused test file, repository-pinned Ruff check/format, canonical quickcheck, and applicable Rust/toolchain tests. If the restack exposes a different first causal failure, fix that failure at its owner rather than weakening a gate. Commit normally on this same branch and report the resulting exact head plus commands/results. Predecessor checks/reviews do not transfer.