clippy --all-targets: repair or delete the 13-target failure population hidden from CI; execute DESIGN's named check in rust-unit-tests

.github/workflows/witnesses.yml

@@ -181,6 +181,11 @@ jobs:
         id: rust_unit_tests
         run: |
           cargo test --release -p v1-compiler --lib
+      - name: clippy, all targets
+        id: rust_clippy_all_targets
+        run: |
+          # dissolve-on: rust_clippy_all_targets_step -- hand-shell `run:` carrier for the one cargo clippy invocation gunbc.repo_self_build repo_self_clippy_command names; the argv is modeled, the step body is a foreign-executor shell line. DISSOLVES WHEN the orchestration-to-shell bash emission (v2.workflow.ci_workflow_run_emit ci_workflow_run_emit_pipeline) renders a modeled cargo Pipeline step for this command, the same capability ci_pin_rustup_default_script waits on -- at which point this data row and the concat below delete together.
+          cargo clippy --all-targets -- -D warnings
   witnesses:
     runs-on: [self-hosted, linux, arm64]
     needs: [required-witnesses-build, required-witnesses-floor]

DESIGN.md

@@ -196,7 +196,7 @@ One row per class, each carrying its recognition rule and its receipts, in [docs
 
 ## Building & checks
 
-- `cargo test --workspace` · `cargo clippy --all-targets -- -D warnings` · `cargo fmt --all --check`
+- Three local checks, each named with the CI step that executes it — a check named here with no executing step is a decoration (§4b): `cargo clippy --all-targets -- -D warnings` (`gunbc.repo_self_build` `repo_self_clippy_command`, the only command that compiles the integration-test and example targets, so a red there is invisible to every other step) and `cargo test --release -p v1-compiler --lib` (`repo_self_test_command`) run in the `rust-unit-tests` job of `gunbc.witness_floor_workflow`, which runs on every push and pull request but is not yet a `needs` of the required aggregate — promoting it is the one-row edit that job's authority names, gated on its measured wall clock; `cargo fmt --all --check` runs in the generated pre-commit hook (`gunbc.githooks_pre_commit_emit`). `cargo test --workspace` is local diligence only: no CI step executes the test targets outside `--lib`, they are compiled by the clippy step and run by nobody.
 - one-time per clone: `git config core.hooksPath .githooks` — the only documented manual seed; generated pre-commit/pre-push hooks then idempotently converge `merge.generated-artifact.driver` and re-assert `core.hooksPath` via argv derived from `gunbc.repo_local_git_config` (clones that skip hooksPath degrade to vanilla text-merge for generated-artifact paths; drift gate still guards at CI). The driver REFUSES rather than answering `true`: git reaches a low-level merge driver only when both sides changed the path since the merge base — measured on a four-case matrix, one-sided and identical changes never reach it — and taking the ours side there dropped the other side's authority-derived bytes with no conflict, twice on #7836 against the stage0 seed. It now leaves the ours side in the worktree with no conflict markers, marks the path unmerged, and prints the regeneration recipe; the class is mechanically preventable, not structural, and its next-rung trigger is the commit-writer binding rows in `gunbc.commit_workflow`
 - explicit actuator (CI / tooling): `gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/repo/repo_local_git_config.dag --function converge`
 - **CI** is one emission, `gunbc.witness_floor_workflow` → `.github/workflows/witnesses.yml`, invoking our own binary once per LANE: `claim_executor --required-ci --source-root dag --source-root src/v2 --required-lane build` and the same with `--required-lane witnesses`, in two parallel jobs, plus a third aggregating job that carries the required context. Which phases a lane owns is decided in the binary, never in the YAML — the partition is an exhaustive match, so a phase belonging to no job fails to compile. **Read the roster from the run's own announcement, not from here:** every required run prints one `phase <name>` line per phase it owns and one `ROUTED to lane <other>` line per phase it does not. Several capabilities that used to gate are currently declared rung drops — see §4b.

dag/extdeps/exec/command.dag

@@ -74,6 +74,7 @@ fn argv_command(program: NonEmptyStr, arguments: List<String>) -> ArgvCommand
     decl_ref(module_path: "extdeps.tools.curl", decl_name: "curl_download_command"),
     decl_ref(module_path: "extdeps.tools.tar", decl_name: "tar_extract_command"),
     decl_ref(module_path: "extdeps.tools.make", decl_name: "make_command"),
+    decl_ref(module_path: "extdeps.cargo_build", decl_name: "cargo_clippy_command"),
     decl_ref(module_path: "extdeps.tools.sed", decl_name: "sed_in_place_command"),
     decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "cp_command"),
     decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "cat_command"),

dag/extdeps/rust/cargo_build.dag

@@ -3,6 +3,7 @@ module extdeps.cargo_build
 import std.types { FilePath, NonEmptyStr }
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }
+import extdeps.exec.command { ArgvCommand, argv_command }
 
 data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
   uri: Uri {
@@ -15,6 +16,26 @@ data cargo_compile_env: Map<String, String> = empty_map()
 
 data cargo_test_with_cwd_env_note: String = "cargo.Build.TestWithCwdEnv: env composes cwd (-C) and process env vars (leading VAR=val argv words) into ONE argv vector, matching the shell.Find.Files precedent of argv-native env -C workdir substitution — no shell is needed to chain a cd/export prefix onto a cargo invocation (SHELL-DAG dissolution of the interpreter_dispatch_bijection_real_roster_transport retained_foreign multi-line script: set -euo pipefail; cd; export; two cargo test invocations, now two sequential typed calls with caller-side short-circuit)."
 
+// PATH-resolved program name, deliberately, for the reason extdeps.exec.command
+// program_spelling_is_an_observation_claim records once: an absolute path is a filesystem
+// observation this repository has not made about the host the command runs on.
+data cargo_program: NonEmptyStr = "cargo"
+
+// THE ONE PLACE THE CLIPPY VERB AND ITS LINT SEPARATOR ARE SPELLED. The Clippy operation below
+// carries the same shape fused to `transport shell`, which is unreachable from any expression --
+// the fork repo_self_build_authority_note measured and named. This builder is the first step of the
+// de-fusion that note declares as its dissolution trigger: the operation's argv shape, expressed
+// once as a value, so a SECOND realization of it (a workflow YAML line) is a projection of this
+// node rather than a second spelling of cargo's vocabulary in a consumer. `--` is part of the
+// operation and not the caller's, because it is what separates cargo's own arguments from the lint
+// levels rustc receives, and a caller free to omit it would hand `-D warnings` to cargo.
+fn cargo_clippy_command(extra_args: List<String>, lint_args: List<String>) -> ArgvCommand {
+  argv_command(
+    program: cargo_program,
+    arguments: append(append(["clippy"], items: extra_args), items: append(["--"], items: lint_args))
+  )
+}
+
 fn cargo_build_jobs_flag(count: Int) -> List<String> {
   ["--jobs", to_string(count)]
 }

dag/gunbc/design_document.dag

@@ -184,7 +184,7 @@ fn building_checks_blocks() -> List<MarkdownBlock> {
   [
     h2(text: "Building & checks"),
     ul(items: [
-      li(text: "`cargo test --workspace` · `cargo clippy --all-targets -- -D warnings` · `cargo fmt --all --check`"),
+      li(text: "Three local checks, each named with the CI step that executes it — a check named here with no executing step is a decoration (§4b): `cargo clippy --all-targets -- -D warnings` (`gunbc.repo_self_build` `repo_self_clippy_command`, the only command that compiles the integration-test and example targets, so a red there is invisible to every other step) and `cargo test --release -p v1-compiler --lib` (`repo_self_test_command`) run in the `rust-unit-tests` job of `gunbc.witness_floor_workflow`, which runs on every push and pull request but is not yet a `needs` of the required aggregate — promoting it is the one-row edit that job's authority names, gated on its measured wall clock; `cargo fmt --all --check` runs in the generated pre-commit hook (`gunbc.githooks_pre_commit_emit`). `cargo test --workspace` is local diligence only: no CI step executes the test targets outside `--lib`, they are compiled by the clippy step and run by nobody."),
       li(text: "one-time per clone: `git config core.hooksPath .githooks` — the only documented manual seed; generated pre-commit/pre-push hooks then idempotently converge `merge.generated-artifact.driver` and re-assert `core.hooksPath` via argv derived from `gunbc.repo_local_git_config` (clones that skip hooksPath degrade to vanilla text-merge for generated-artifact paths; drift gate still guards at CI). The driver REFUSES rather than answering `true`: git reaches a low-level merge driver only when both sides changed the path since the merge base — measured on a four-case matrix, one-sided and identical changes never reach it — and taking the ours side there dropped the other side's authority-derived bytes with no conflict, twice on #7836 against the stage0 seed. It now leaves the ours side in the worktree with no conflict markers, marks the path unmerged, and prints the regeneration recipe; the class is mechanically preventable, not structural, and its next-rung trigger is the commit-writer binding rows in `gunbc.commit_workflow`"),
       li(text: "explicit actuator (CI / tooling): `gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/repo/repo_local_git_config.dag --function converge`"),
       li(text: "**CI** is one emission, `gunbc.witness_floor_workflow` → `.github/workflows/witnesses.yml`, invoking our own binary once per LANE: `claim_executor --required-ci --source-root dag --source-root src/v2 --required-lane build` and the same with `--required-lane witnesses`, in two parallel jobs, plus a third aggregating job that carries the required context. Which phases a lane owns is decided in the binary, never in the YAML — the partition is an exhaustive match, so a phase belonging to no job fails to compile. **Read the roster from the run's own announcement, not from here:** every required run prints one `phase <name>` line per phase it owns and one `ROUTED to lane <other>` line per phase it does not. Several capabilities that used to gate are currently declared rung drops — see §4b."),

dag/gunbc/repo/repo_self_build.dag

@@ -2,6 +2,8 @@ module gunbc.repo_self_build
 
 import std.types { String, List, NonEmptyStr }
 import gunbc.stage0_crate_partition_generated { generated_partition_crate_rows }
+import extdeps.cargo_build { cargo_clippy_command }
+import extdeps.exec.command { argv_words }
 
 // THE SINGLE POINT THROUGH WHICH THIS REPOSITORY BUILDS ITS OWN BINARIES.
 // Before this module the same operation was spelled independently in three
@@ -81,6 +83,30 @@ fn repo_self_test_command() -> String {
   )
 }
 
+// THE LINT PASS OVER EVERY TARGET, as the one invocation DESIGN's "Building & checks" names.
+// `--all-targets` is the whole point: the test and example targets outside `--lib` and `--bins`
+// are compiled by no build command above and executed by no test command, so before this row
+// they were compiled by nobody -- and on 2026-08-30 twelve of them were red on main (E0603s from
+// the cli_run decomposition, an E0063 from a Node field, an include_str! of a deleted fixture,
+// a retired dispatch family, two lints) while every required phase stayed green. This is the
+// workspace-wide form, not `-p v1-compiler`: the partition crates and the receipt fixture are
+// targets too, and a lint gate scoped to one package would re-open exactly the blind spot the
+// partition-crates command below closes for the build.
+// NO CARGO ARGV WORD IS SPELLED HERE, which repo_self_build_authority_note requires of any NEW
+// command this module renders: the verb, the program and the `--` lint separator come from
+// extdeps.cargo_build cargo_clippy_command, and this module contributes only the two facts that are
+// genuinely its own -- that the lint pass covers every target, and that a warning is an error. The
+// String is the workflow-text realization of that node, derived by the shared argv_words fold, not
+// a second spelling of it.
+fn repo_self_clippy_command() -> String {
+  join(
+    argv_words(
+      command: cargo_clippy_command(extra_args: ["--all-targets"], lint_args: ["-D", "warnings"])
+    ),
+    " "
+  )
+}
+
 // THE DERIVED STAGE0 PARTITION CRATES, WHICH THE PACKAGE-AS-DATA DECISION ABOVE DOES NOT REACH.
 // repo_self_build_package is one package because that was the whole repository's compiler for as
 // long as this module existed. The stage0 partition splits that compiler across seven SIBLING

dag/gunbc/witness/witness_floor_workflow.dag

@@ -4,7 +4,7 @@ import extdeps.languages.yaml.types { yaml_string, yaml_int, yaml_bool, kv, Yaml
 import gunbc.roadmap_execution_contract {
   CargoCapability, RustcCapability, RustfmtCapability, RustupCapability,
 }
-import gunbc.repo_self_build { repo_self_build_command, repo_self_build_all_bins_command, repo_self_build_partition_crates_command, repo_self_test_command }
+import gunbc.repo_self_build { repo_self_build_command, repo_self_build_all_bins_command, repo_self_build_partition_crates_command, repo_self_test_command, repo_self_clippy_command }
 import gunbc.workflow_capability_closure {
   CapabilityAnnotatedStep,
   StepCapabilityRole,
@@ -18,6 +18,7 @@ import v2.std.algebra { list_map }
 import extdeps.languages.yaml.emit { serialize_yaml }
 import extdeps.languages.yaml.gha_workflow { project_workflow_to_yaml }
 import v2.workflow.ci_workflow_run_emit { ci_toolchain_homes_isolated_or_refuse_command }
+import std.dissolution { DissolutionCondition, unbound_dissolution, dissolution_description }
 import gunbc.toolchain_home_standing {
   admit_workflow_toolchain_homes,
   WorkflowToolchainHomesAdmitted,
@@ -1248,6 +1249,31 @@ fn rust_unit_tests_step() -> Step {
   }
 }
 
+// THE ALL-TARGETS LINT PASS, IN THE SAME JOB. `cargo clippy --all-targets -- -D warnings` is the
+// check DESIGN names, and until this step it ran on no CI path either: the required build lane
+// builds `--bins` and the partition crates, the unit-test step compiles `--lib`, and the
+// integration-test and example targets were compiled by nobody -- which is how twelve of them
+// sat red on main (2026-08-30) behind a green required run. Ordered after the unit tests so a
+// red test verdict is never hidden behind a lint verdict in the same job.
+data rust_clippy_all_targets_shell_emit_dissolution_trigger: DissolutionCondition = unbound_dissolution(description: "dissolve-on: rust_clippy_all_targets_step -- hand-shell `run:` carrier for the one cargo clippy invocation gunbc.repo_self_build repo_self_clippy_command names; the argv is modeled, the step body is a foreign-executor shell line. DISSOLVES WHEN the orchestration-to-shell bash emission (v2.workflow.ci_workflow_run_emit ci_workflow_run_emit_pipeline) renders a modeled cargo Pipeline step for this command, the same capability ci_pin_rustup_default_script waits on -- at which point this data row and the concat below delete together.")
+
+fn rust_clippy_all_targets_step() -> Step {
+  RunStep {
+    name: Present { value: "clippy, all targets" },
+    id: Present { value: "rust_clippy_all_targets" },
+    run: concat(
+      concat("# ", concat(dissolution_description(condition: rust_clippy_all_targets_shell_emit_dissolution_trigger), "\n")),
+      concat(repo_self_clippy_command(), "\n")
+    ),
+    shell: none,
+    env: none,
+    working_directory: none,
+    if_condition: none,
+    continue_on_error: none,
+    timeout_minutes: none
+  }
+}
+
 fn rust_unit_tests_bound_steps() -> List<WitnessFloorBoundStep> {
   [
     WitnessFloorBoundStep {
@@ -1277,6 +1303,11 @@ fn rust_unit_tests_bound_steps() -> List<WitnessFloorBoundStep> {
       role: consumes_only(capabilities: [CargoCapability]),
       step_name: "v1-compiler unit tests",
     },
+    WitnessFloorBoundStep {
+      step: rust_clippy_all_targets_step(),
+      role: consumes_only(capabilities: [CargoCapability]),
+      step_name: "clippy, all targets",
+    },
   ]
 }