build(rust): pin all product and release lanes to 1.97.1

.github/dependabot.yml

@@ -1,5 +1,15 @@
 version: 2
 updates:
+  - package-ecosystem: "rust-toolchain"
+    directory: "/"
+    target-branch: "develop"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 1
+    labels:
+      - "dependencies"
+      - "rust"
+
   - package-ecosystem: "npm"
     directory: "/"
     target-branch: "develop"

.github/workflows/build-baseline.yml

@@ -47,10 +47,10 @@ jobs:
         with:
           version: "0.8.6"
           enable-cache: false
-      - name: Install Rust stable
-        run: rustup toolchain install stable --profile minimal
+      - name: Install Rust 1.97.1
+        run: rustup toolchain install 1.97.1 --profile minimal
       - name: Add Windows target
-        run: rustup target add $env:BANDSCOPE_TARGET_TRIPLE --toolchain stable
+        run: rustup target add $env:BANDSCOPE_TARGET_TRIPLE --toolchain 1.97.1
       - name: Verify Windows antivirus baseline
         shell: pwsh
         run: |
@@ -146,10 +146,10 @@ jobs:
         with:
           version: "0.8.6"
           enable-cache: false
-      - name: Install Rust stable
-        run: rustup toolchain install stable --profile minimal
+      - name: Install Rust 1.97.1
+        run: rustup toolchain install 1.97.1 --profile minimal
       - name: Add Windows arm target
-        run: rustup target add $env:BANDSCOPE_TARGET_TRIPLE --toolchain stable
+        run: rustup target add $env:BANDSCOPE_TARGET_TRIPLE --toolchain 1.97.1
       - name: Verify Windows antivirus baseline
         shell: pwsh
         run: |
@@ -256,10 +256,10 @@ jobs:
         with:
           version: "0.8.6"
           enable-cache: false
-      - name: Install Rust stable
-        run: rustup toolchain install stable --profile minimal
+      - name: Install Rust 1.97.1
+        run: rustup toolchain install 1.97.1 --profile minimal
       - name: Add macOS Intel target
-        run: rustup target add "$BANDSCOPE_TARGET_TRIPLE" --toolchain stable
+        run: rustup target add "$BANDSCOPE_TARGET_TRIPLE" --toolchain 1.97.1
       - name: Install create-dmg
         run: brew install create-dmg
       - name: Activate and verify pinned npm runtime
@@ -318,10 +318,10 @@ jobs:
         with:
           version: "0.8.6"
           enable-cache: false
-      - name: Install Rust stable
-        run: rustup toolchain install stable --profile minimal
+      - name: Install Rust 1.97.1
+        run: rustup toolchain install 1.97.1 --profile minimal
       - name: Add macOS arm target
-        run: rustup target add "$BANDSCOPE_TARGET_TRIPLE" --toolchain stable
+        run: rustup target add "$BANDSCOPE_TARGET_TRIPLE" --toolchain 1.97.1
       - name: Install create-dmg
         run: brew install create-dmg
       - name: Activate and verify pinned npm runtime

.github/workflows/ci.yml

@@ -68,8 +68,8 @@ jobs:
         run: npm ci
       - name: Sync Python dependencies
         run: uv sync --project services/analysis-engine --group dev --frozen
-      - name: Install stable Rust toolchain
-        run: rustup toolchain install stable --profile minimal
+      - name: Install Rust 1.97.1 toolchain
+        run: rustup toolchain install 1.97.1 --profile minimal
       - name: Build and install Rust numeric extension
         run: |
           VENV_PY="$PWD/services/analysis-engine/.venv/bin/python"
@@ -99,13 +99,15 @@ jobs:
         run: |
           test "$(npm --version)" = "$EXPECTED_NPM_VERSION"
           npm run check:npm-runtime
-      - name: Install stable Rust toolchain
-        run: rustup toolchain install stable --profile minimal
+      - name: Install Rust 1.97.1 toolchain
+        run: rustup toolchain install 1.97.1 --profile minimal
       - name: Install node dependencies
         run: npm ci
       - name: Build frontend
         run: npm run build --workspace @bandscope/desktop
       - name: Check Tauri shell
-        run: cargo +stable check --manifest-path apps/desktop/src-tauri/Cargo.toml --locked
+        run: cargo +1.97.1 check --manifest-path apps/desktop/src-tauri/Cargo.toml --locked
       - name: Test Tauri shell
-        run: cargo +stable test --manifest-path apps/desktop/src-tauri/Cargo.toml --locked
+        run: cargo +1.97.1 test --manifest-path apps/desktop/src-tauri/Cargo.toml --locked
+      - name: Test desktop core integration contracts
+        run: cargo +1.97.1 test --manifest-path apps/desktop/core/Cargo.toml --locked

.github/workflows/release.yml

@@ -42,8 +42,8 @@ jobs:
         with:
           version: "0.8.6"
           enable-cache: false
-      - name: Install Rust stable
-        run: rustup toolchain install stable --profile minimal
+      - name: Install Rust 1.97.1
+        run: rustup toolchain install 1.97.1 --profile minimal
       - name: Activate and verify pinned npm runtime
         run: |
           corepack enable npm

.github/workflows/security-audit.yml

@@ -49,10 +49,10 @@ jobs:
         run: uv sync --project services/analysis-engine --group dev --frozen
       - name: Audit Python dependencies
         run: uv run --project services/analysis-engine --with pip-audit==2.8.0 pip-audit --local --strict
-      - name: Install stable Rust toolchain
-        run: rustup toolchain install stable --profile minimal
+      - name: Install Rust 1.97.1 toolchain
+        run: rustup toolchain install 1.97.1 --profile minimal
       - name: Install cargo-audit
-        run: cargo +stable install cargo-audit --locked
+        run: cargo +1.97.1 install cargo-audit --locked
       - name: Audit Rust dependencies
         working-directory: apps/desktop/src-tauri
-        run: cargo +stable audit
+        run: cargo +1.97.1 audit

CHANGELOG.md

@@ -11,6 +11,7 @@
 ### Changed
 
 - Pinned npm `10.9.9` as the approved lockfile generator, activated it through Node-bundled Corepack before dependency consumption, and fail closed unless its bundled `tar` is at least `7.5.19`; primary CI still consumes the committed lock only through frozen `npm ci` validation, rejects mutable npm resolution in the lock gate, requires integrity evidence for public-registry lock entries, and preserves generator-sensitive root `@esbuild/*` peer metadata.
+- Pin repository-owned Rust build, audit, release, and native packaging evidence to Rust 1.97.1, and fail closed when required Rust commands are hidden in non-executing text, borrowed from another workflow/job, or chained through shell control flow that can mask their exit status.
 
 ### Fixed
 
@@ -74,4 +75,4 @@
 
 - `ChordsFeature` (코드 분석) 화면에서 각 파트(Role)의 `transpositionPlan`(이조/조옮김 계획)을 표시하는 기능을 추가했습니다.
 - `RangesFeature` (음역대 분석) 화면에서 겹침 경고(Overlap warning) 외에 해당 파트의 채보(Transcription) 가능 노드 수를 요약하여 보여주는 기능을 추가했습니다.
-- 신규 UI 요소에 대한 단위 테스트를 추가했습니다 (`apps/desktop/src/features/chords/index.test.tsx`, `apps/desktop/src/features/ranges/index.test.tsx`).
+- 신규 UI 요소에 대한 단위 테스트를 추가했습니다 (`apps/desktop/src/features/chords/index.test.tsx`, `apps/desktop/src/features/ranges/index.test.tsx`).

docs/doctoring/rust-toolchain-freshness.md

@@ -0,0 +1,51 @@
+# Rust toolchain freshness and reproducibility
+
+## Decision
+
+BandScope pins Rust `1.97.1` as the repository build compiler. The root
+`rust-toolchain.toml`, product CI, release preflight, dependency audit, and
+Windows/macOS amd64/arm64 packaging workflows all use that exact point release.
+A floating `stable` selector is not accepted because it can change scientific,
+security, and release evidence without a repository diff.
+
+The compiler pin does not add or raise `package.rust-version` in the workspace.
+This change governs BandScope's reviewed build environment; it does not create a
+new downstream minimum-supported-Rust promise for reusable crates.
+
+GitHub Dependabot monitors the root manifest through the `rust-toolchain`
+ecosystem against the protected `develop` branch. GitHub documents this
+integration as a Dependabot version-update capability rather than a Rust
+security-update feed. A future compiler update must therefore arrive as a
+reviewable pull request and pass the unchanged-head Windows, macOS,
+analysis-engine, Tauri, release-preflight, audit, coverage, and supply-chain
+gates. GitHub's platform-level default cooldown for Dependabot version updates
+is additional noise control; it is not treated as a repository security or
+freshness guarantee.
+
+`scripts/checks/verify_rust_toolchain.py` runs in the canonical quickcheck and
+fails when any executable workflow reintroduces `rustup toolchain install
+stable`, `cargo +stable`, or `--toolchain stable`. The same guard binds
+`directory`, target branch, and schedule evidence to the actual
+`rust-toolchain` Dependabot lane so an unrelated ecosystem entry cannot satisfy
+the compiler-update policy.
+
+Required Rust command evidence is also bound to one inline executable `run:`
+step whose exit status cannot be replaced by shell chaining, pipelines, or
+background control operators. Arguments such as `--manifest-path`, `--locked`,
+and an explicit target triple remain valid, but forms such as `|| true`,
+`| cat`, or `; true` fail closed. This prevents an unsuccessfully installed,
+checked, tested, or audited Rust toolchain from becoming success-shaped policy
+evidence merely because a later shell command returns zero.
+
+## References
+
+GitHub. (2025, August 19). *Dependabot now supports Rust toolchain updates*.
+GitHub Changelog.
+https://github.blog/changelog/2025-08-19-dependabot-now-supports-rust-toolchain-updates/
+
+GitHub. (2026, July 14). *Dependabot version updates introduce default package
+cooldown*. GitHub Changelog.
+https://github.blog/changelog/2026-07-14-dependabot-version-updates-introduce-default-package-cooldown/
+
+The Rust Release Team. (2026, July 16). *Announcing Rust 1.97.1*. Rust Blog.
+https://blog.rust-lang.org/2026/07/16/Rust-1.97.1/