build(rust): pin all product and release lanes to 1.97.1

[seonghobae]

Problem

BandScope's Rust-backed analysis build, Tauri validation, release preflight, dependency audit, and native packaging lanes must use one reviewed compiler and must not be able to manufacture compiler/test evidence from non-executing or failure-masked shell text.

Rust 1.97.1 is the reviewed repository build baseline. Floating stable selection can change scientific, security, and release evidence without a repository diff.

Exact current identity

• Protected base: develop@acdbea6344fe1231c39535b575f4de35e4c607c9.
• Exact current head: b0f8cf0de9f02ee1bed7a8ee964daed6d2063562.
• Branch: agent/rust-toolchain-refresh-2026-08-19.
• Open, Draft, mergeable, and unmerged at the latest refetch.

Current contract

• root rust-toolchain.toml pins Rust 1.97.1;
• ordinary CI, release preflight, dependency audit, and Windows/macOS amd64/arm64 packaging bind their Rust execution to that compiler;
• weekly Dependabot rust-toolchain update discovery targets protected develop;
• canonical scripts/checks/verify_rust_toolchain.py rejects floating selectors and evidence borrowed across Dependabot lanes, workflow files, sibling jobs, comments, step names, environment text, or other non-executing YAML;
• each Rust-owning job must itself execute its required compiler command;
• required command evidence may carry ordinary arguments such as --manifest-path, --locked, or explicit target triples, but may not use shell chaining/pipelines/background control operators that can replace the required command's exit status; and
• crate MSRV/downstream support promises are not widened by this repository build pin.

Test-first hardening

Earlier TDD on this branch closed cross-Dependabot-lane, comment-only field, cross-workflow, cross-native-job, non-executable-run, failure-masked shell, and workflow evidence-authority gaps. Those repairs are retained on the current branch.

The exact current CI now exposes a narrower test-contract drift rather than a production verifier defect.

Exact-current-head verification

Current exact CI evidence binds to head b0f8cf0de9f02ee1bed7a8ee964daed6d2063562:

• CI run 32597173161;
• ci / build-and-test job 97089876119;
• actual merge checkout bc81a8797006b797b71cbe258dd8e27aef40a062 against protected develop@acdbea6344fe1231c39535b575f4de35e4c607c9.

That job proves:

• repository-pinned Ruff lint and format checks pass;
• desktop tests pass and desktop owned statement/branch/function/line coverage is 100%;
• shared-types tests pass and owned coverage is 100%;
• Python coverage reaches 100%; and
• Python quickcheck has exactly seven failing tests in services/analysis-engine/tests/test_supply_chain_policy.py because those fixtures/assertions still encode obsolete cargo +stable audit text while the canonical production verifier/workflow requires cargo +1.97.1 audit.

The stale contract is limited to these seven tests: test_security_audit_workflow_keeps_dependency_vulnerability_scans, test_supply_chain_check_requires_audit_tokens_in_run_steps, test_supply_chain_check_accepts_nested_shell_audit_commands, test_supply_chain_check_rejects_noop_audit_command_spoofs, test_supply_chain_check_requires_blocking_audit_steps, test_supply_chain_check_requires_unconditional_audit_steps, and test_supply_chain_check_accepts_explicit_false_continue_on_error_audit_steps.

A fresh same-head owner-control repair request is attached to the existing PR conversation. It instructs the canonical branch writer to update only the 11 stale cargo +stable audit occurrences inside those seven test scopes to cargo +1.97.1 audit, preserve intentional floating-selector rejection cases elsewhere, keep verify_supply_chain.py unchanged, and rerun the focused file, repository-pinned Ruff check/format, and canonical quickcheck. Until a successor exact head exists and is reverified, this PR remains RED/non-ready.

Protected-base JavaScript dependency/security remediation remains canonical #783-owned. Do not copy or suppress that authority in this Rust-toolchain lane.

Merge gate

Keep Draft and unmerged until one unchanged resulting exact head has every applicable repository and central CI/build/release/security/SAST/SBOM/supply-chain/coverage/review gate terminal-success, the Rust toolchain policy tests pass through canonical quickcheck, inherited dependency security is resolved by #783 rather than suppressed here, zero valid unresolved findings remain, a qualifying independent non-author last-push approval exists, and ordinary protected-branch rules permit merge without bypass. Queued, pending, skipped-required, failed, stale, predecessor-head, protected-base, model-only, self/author, or administrative-bypass evidence is non-passing.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 56749d25-fd10-4d45-91c8-19b7b2cc1643

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Repair the exact current-head Ruff I001 on the existing agent/rust-toolchain-refresh-2026-08-19 branch only. Current head 2aad4e01e6b0da7ca2af287833b6486f26c9944e; release run 32590078076, job 97072412623, actual checkout 37fd70dc465f1dd2c05de8c54af6de2d13f30428 proves uv run ruff check src tests fails only at services/analysis-engine/tests/test_rust_toolchain_supply_chain_contract.py:3:1 with I001. My preceding manual blank-line grouping hypothesis was falsified by this exact run; do not guess. Run the repository-pinned Ruff fixer/checker to obtain the canonical import ordering, change only that test import block, preserve all test/policy semantics and dependency ownership, then run focused Ruff check/format and applicable quickcheck and commit on this same branch. Report the exact resulting head and evidence.

[seonghobae]

@opencode-agent Repair the exact current-head BandScope-owned quickcheck failure on the existing agent/rust-toolchain-refresh-2026-08-19 branch only. Current head b0f8cf0de9f02ee1bed7a8ee964daed6d2063562; CI run 32597173161, job 97089876119, actual checkout bc81a8797006b797b71cbe258dd8e27aef40a062 merges this head into develop@acdbea6344fe1231c39535b575f4de35e4c607c9. Ruff lint/format, desktop tests and desktop/shared coverage are now GREEN; the first remaining branch-owned failure is 7 assertions/fixtures in services/analysis-engine/tests/test_supply_chain_policy.py that still encode the obsolete cargo +stable audit command while the canonical verifier/workflow now requires cargo +1.97.1 audit. Update only those stale Rust-audit fixtures/expected violation strings to the pinned command; preserve the spoof/blocking/nested-shell semantics and do not weaken verify_supply_chain.py. Run focused test_supply_chain_policy.py, Ruff check/format, then canonical quickcheck. Do not touch npm dependency/security findings; those remain #783-owned. Commit to this same branch and report resulting exact head/evidence.

[seonghobae]

@opencode-agent repair

Fresh 2026-08-25 refetch still shows the canonical branch agent/rust-toolchain-refresh-2026-08-19 exactly at b0f8cf0de9f02ee1bed7a8ee964daed6d2063562 against protected develop@acdbea6344fe1231c39535b575f4de35e4c607c9; there has been no intervening writer movement since this request. Exact CI run 32597173161, job 97089876119, actual merge checkout bc81a8797006b797b71cbe258dd8e27aef40a062 is the current RED evidence: Ruff lint/format is green, desktop/shared owned coverage is 100%, Python coverage is 100%, and exactly 7 tests in services/analysis-engine/tests/test_supply_chain_policy.py fail because their Rust-audit fixtures/assertions still encode obsolete cargo +stable audit while the canonical production verifier/workflow requires cargo +1.97.1 audit.

Update only the stale occurrences inside these seven tests:

• test_security_audit_workflow_keeps_dependency_vulnerability_scans
• test_supply_chain_check_requires_audit_tokens_in_run_steps
• test_supply_chain_check_accepts_nested_shell_audit_commands
• test_supply_chain_check_rejects_noop_audit_command_spoofs
• test_supply_chain_check_requires_blocking_audit_steps
• test_supply_chain_check_requires_unconditional_audit_steps
• test_supply_chain_check_accepts_explicit_false_continue_on_error_audit_steps

There are 11 stale cargo +stable audit fixture/expected-string occurrences inside those seven scopes. Replace those with cargo +1.97.1 audit; do not globally replace intentional floating-selector rejection cases elsewhere, do not weaken scripts/checks/verify_supply_chain.py, and do not change production/workflow/npm dependency-security authority. Preserve the spoof, blocking, unconditional, nested-shell, and explicit-false semantics.

Then run the focused test_supply_chain_policy.py, repository-pinned Ruff check and format check, and canonical quickcheck. Commit only to this same branch and report the new exact head plus focused/full evidence. #783 continues to own npm dependency/security state.

[seonghobae]

@opencode-agent repair

Fresh writer-lease refetch: PR #944 is still exactly agent/rust-toolchain-refresh-2026-08-19@b0f8cf0de9f02ee1bed7a8ee964daed6d2063562; target file blob is still services/analysis-engine/tests/test_supply_chain_policy.py@ab43df89f8dafde4a9d5f7fb8744e76975c14d76. There has been no intervening branch mutation since the prior request, so execute the existing canonical repair now rather than re-diagnosing.

Current exact RED remains CI run 32597173161, job 97089876119, actual merge checkout bc81a8797006b797b71cbe258dd8e27aef40a062: Ruff lint/format, desktop/shared owned coverage and Python coverage are green; the first branch-owned failure is exactly the seven stale test scopes below, whose fixtures/assertions still encode cargo +stable audit while the production workflow/verifier on this branch requires cargo +1.97.1 audit:

• test_security_audit_workflow_keeps_dependency_vulnerability_scans
• test_supply_chain_check_requires_audit_tokens_in_run_steps
• test_supply_chain_check_accepts_nested_shell_audit_commands
• test_supply_chain_check_rejects_noop_audit_command_spoofs
• test_supply_chain_check_requires_blocking_audit_steps
• test_supply_chain_check_requires_unconditional_audit_steps
• test_supply_chain_check_accepts_explicit_false_continue_on_error_audit_steps

Change only the 11 cargo +stable audit occurrences inside those seven function scopes to cargo +1.97.1 audit. Do not globally replace intentional floating-selector rejection fixtures elsewhere; do not change scripts/checks/verify_supply_chain.py, workflow behavior, dependency/security authority, or unrelated files. Preserve nested-shell, no-op-spoof, blocking, unconditional, and explicit-false semantics.

Verification-before-completion: run the focused services/analysis-engine/tests/test_supply_chain_policy.py, repository-pinned Ruff check and format check, then canonical quickcheck. Commit only to this same branch, then report the successor exact head and focused/full evidence. If live head/blob moves before write, stop that exact write, refetch, and remap instead of overwriting concurrent work.

[seonghobae]

@OpenCode Use superpowers:using-superpowers, systematic-debugging, test-driven-development, and verification-before-completion. Work ONLY canonical branch agent/rust-toolchain-refresh-2026-08-19 at exact head b0f8cf0de9f02ee1bed7a8ee964daed6d2063562; live protected base is now develop@749511c3ad4000090048718f685c6bee6b3d2c25. Refetch head/base/blob/review state immediately before writing and adapt if either ref moves. Do not create a competing PR or force-push.

This exact head still has the BandScope-owned deterministic quickcheck defect already proven by CI run 32597173161, ci / build-and-test job 97089876119, actual checkout bc81a8797006b797b71cbe258dd8e27aef40a062: 7 tests in services/analysis-engine/tests/test_supply_chain_policy.py encode obsolete cargo +stable audit while the production verifier/workflow requires cargo +1.97.1 audit. Repository-pinned Ruff, desktop tests/coverage, shared-types coverage, and Python coverage had already passed before this failure. The prior exact-head owner request never produced a successor head or agent receipt; central .github/main has since moved to 31e5f5337d8a8d844c456fe03f123c51b62416c9, so this is a fresh actionable retry rather than evidence reuse.

Repair only the stale test contract in the seven known scopes: replace only their obsolete Rust-audit fixture/expected-violation occurrences with cargo +1.97.1 audit. Preserve intentional floating-selector rejection fixtures elsewhere, nested-shell/spoof/blocking/unconditional/continue-on-error semantics, and keep scripts/checks/verify_supply_chain.py unchanged. Run the focused policy test file, repository-pinned Ruff check/format, then canonical quickcheck/full applicable validation. Commit only if GREEN on this branch, refetch exact successor head/live base, and report exact evidence. Do not touch dependency/security findings owned by already-integrated #783 or weaken any gate.