Add optional Rust tools and bounded native Rust beta

.github/workflows/ci.yml

@@ -206,13 +206,18 @@ jobs:
         shell: pwsh
         run: |
           $ErrorActionPreference = 'Stop'
+          .\tools\initialize-windows-sdk.ps1
           $go = '.tools\go\windows-amd64\go\bin\go.exe'
           & $go test -run '^$' ./...
           if ($LASTEXITCODE -ne 0) { throw 'Go package compilation failed.' }
           & $go test -count=1 ./internal/runner -run '^TestWindows'
           if ($LASTEXITCODE -ne 0) { throw 'Native Windows process and lock contracts failed.' }
           & $go test -count=1 ./internal/release -run '^(TestReleaseHostMatrix|TestParseLock|TestRenderLock|TestReadLock)'
           if ($LASTEXITCODE -ne 0) { throw 'Native release identity contracts failed.' }
+          & $go test -count=1 ./internal/release -run '^(TestRustBundle|TestOptionalRustInstallation|TestRustIntegrity)'
+          if ($LASTEXITCODE -ne 0) { throw 'Native optional Rust bundle contracts failed.' }
+          & $go test -count=1 ./internal/testing -run '^TestNativeRust'
+          if ($LASTEXITCODE -ne 0) { throw 'Native Rust test execution contracts failed.' }
           & $go test -count=1 ./internal/javascript -run '^TestJavaScript(ExecutableUsesNativeHostContract|BundleContainsNativeTargetPaths)$'
           if ($LASTEXITCODE -ne 0) { throw 'Native sealed JavaScript platform contract failed.' }
           & $go test -count=1 ./internal/architecture -run '^TestRuffGraphFactsAreVersionedBoundedAndPathNormalized$'

.github/workflows/release.yml

@@ -188,6 +188,8 @@ jobs:
             echo "The fresh installation did not report Code Polishy ${RELEASE_VERSION}." >&2
             exit 1
           fi
+          bash ./scripts/test-installed-release-rust.sh "${installed_root}" "${installation}/bin/code-polishy" \
+            "${publication_dir}/code-polishy-${RELEASE_VERSION}-rust-${RELEASE_HOST}.zip"
 
       - name: Build and smoke-test native archive
         if: matrix.build == 'windows'
@@ -203,6 +205,7 @@ jobs:
             throw "The runner is not the requested $env:RELEASE_HOST native host."
           }
           .\tools\install-policy-tools.ps1
+          .\tools\initialize-windows-sdk.ps1
           $publicationDir = Join-Path $env:RUNNER_TEMP "publication\$env:RELEASE_HOST"
           $rawArchive = Join-Path $env:RUNNER_TEMP 'code-polishy-release.zip'
           .\scripts\build-release.ps1 -Output $rawArchive -PublicationDirectory $publicationDir
@@ -235,6 +238,10 @@ jobs:
           if ($LASTEXITCODE -ne 0 -or $reportedVersion -ne "code-polishy $env:RELEASE_VERSION") {
             throw "The fresh installation did not report Code Polishy $env:RELEASE_VERSION."
           }
+          $bash = Join-Path $env:ProgramFiles 'Git\bin\bash.exe'
+          if (-not (Test-Path -LiteralPath $bash -PathType Leaf)) { throw 'The native Rust fixture requires Git Bash.' }
+          & $bash ./scripts/test-installed-release-rust.sh $installedRoot (Join-Path $installation 'bin\code-polishy.exe') (Join-Path $publicationDir "code-polishy-$env:RELEASE_VERSION-rust-$env:RELEASE_HOST.zip")
+          if ($LASTEXITCODE -ne 0) { throw 'The installed Rust fixture failed.' }
 
       - name: Retain native publication
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
@@ -445,8 +452,8 @@ jobs:
           fi
           printf '%s  %s\n' "${index_sha}" "$(basename "${index_path}")" >"${index_path}.sha256"
           asset_count="$(find "${release_root}" -maxdepth 1 -type f | wc -l | tr -d '[:space:]')"
-          if [[ "${asset_count}" -ne 27 ]]; then
-            echo "The complete publication must contain 27 assets, found ${asset_count}." >&2
+          if [[ "${asset_count}" -ne 32 ]]; then
+            echo "The complete publication must contain 32 assets, found ${asset_count}." >&2
             exit 1
           fi
           printf 'engine=%s\n' "${engine}" >>"${GITHUB_OUTPUT}"

.gitignore

@@ -1,6 +1,7 @@
 .DS_Store
 .tools/
 internal/pythonfacts/.venv/
+internal/rustfacts/.venv/
 /.code-polishy-reports/
 /.code-polishy-artifacts/
 __pycache__/

CHANGELOG.md

@@ -2,6 +2,25 @@
 
 ## Unreleased
 
+## 0.29.0-beta.1 - 2026-10-15
+
+- Add native Rust beta support for contained Cargo projects: discovery,
+  selected formatting, compiler and Clippy diagnostics, written-source quality
+  and architecture checks, Cargo dependency policy, native tests and doctests.
+  Unsupported macro expansion, configuration and source resolution remain
+  blocking coverage findings; this beta does not claim general Rust parity.
+- Keep the Rust SDK and Nextest out of the default portable installation.
+  `install-rust` installs or repairs the official companion authenticated by
+  the core release. Missing or altered tools cannot disable required checks.
+- Validate Cargo's actual workspace, lock and source containment before native
+  test execution or receipt reuse. Require nonempty structured test outcomes
+  and preserve compiler, test, timeout and operational failure distinctions.
+- Carry upstream Rust notices and reviewed Nextest source license evidence.
+  Native transitive SBOM composition remains explicitly incomplete; target
+  dependency checks remain mandatory.
+- Adopt aged brace-expansion fixes in both JavaScript dependency graphs and
+  fast-uri 3.1.8 in the JavaScript provider, removing obsolete assessments.
+
 ## 0.28.3 - 2026-10-09
 
 - Build and ship Go 1.26.9 to fix the reported standard-library vulnerabilities,

README.md

@@ -80,6 +80,13 @@ Code Polishy keeps its built-in tools fixed until you upgrade, so local and CI
 checks stay consistent. Built-in support covers Go, JavaScript, TypeScript,
 Python, and shell scripts.
 
+This branch also includes **Rust beta support** for contained Cargo projects.
+Rust tools install separately with `./code-polishyw install-rust`; repositories
+without Rust avoid the SDK and Nextest payload. The beta covers the supported
+formatting, compiler, source-analysis, dependency and native-test paths.
+Unsupported semantics produce blocking findings. Read the
+[Rust beta scope](docs/installation.md#rust-beta-scope) before adopting it.
+
 - **Go, JavaScript, and TypeScript:** Formats code and catches likely bugs,
   type errors, unused code, and overly complex functions. Locked dependencies
   are checked for known vulnerabilities.

VERSION

@@ -1 +1 @@
-0.28.3
+0.29.0-beta.1

cmd/code-polishy-launcher/main_test.go

@@ -52,7 +52,7 @@ func (installed store) install(t *testing.T, revision, engine string) release.Lo
 		Tools: release.Tools{
 			Go: "1.26.6", Govulncheck: "1.3.0", Node: "24.18.0", OSVScanner: "2.4.0",
 			PNPM: "11.13.0", Packaging: "26.3", Python: "3.12.13+20260728", Ruff: "0.16.0", Shellcheck: "0.11.0", Staticcheck: "0.7.0",
-			Ty: "0.0.65", Vulture: "2.16",
+			Ty: "0.0.65", Vulture: "2.16", Rust: "1.97.1", Nextest: "0.9.138",
 		},
 		Entries: []release.Entry{
 			{Path: bundleLink, Symlink: "../.pnpm/tool"},

cmd/code-polishy/help.go

@@ -144,6 +144,15 @@ var commandHelpPages = []commandHelpPage{
 		exits:       []string{"0 plan recorded or upgrade applied", "2 invalid usage, stale evidence, unacknowledged findings, or operational failure"},
 		examples:    []string{"code-polishy upgrade plan --index https://example.invalid/code-polishy-release-index.json --sha256 DIGEST", "code-polishy upgrade apply --plan .code-polishy-reports/capability-upgrades/DIGEST/plan.json"},
 	},
+	{
+		name:        "install-rust",
+		summary:     "Install the selected release's authenticated optional Rust tools.",
+		syntax:      []string{"code-polishy install-rust [--source ARCHIVE]"},
+		selectors:   []string{"--source ARCHIVE supplies a local companion ZIP; otherwise download the companion from the locked publication.", "The selected core release fixes the complete accepted tool inventory."},
+		sideEffects: []string{"Stages and verifies the bundle, then installs or repairs the shared release's Rust tools. Required Rust checks remain mandatory when tools are absent."},
+		exits:       []string{"0 tools installed", "2 invalid usage, missing release authority, or installation failure"},
+		examples:    []string{"code-polishy install-rust", "code-polishy install-rust --source ./code-polishy-VERSION-rust-HOST.zip"},
+	},
 	{
 		name:    "install-bundle",
 		summary: "Install a verified native release archive.",
@@ -166,6 +175,8 @@ var commandHelpPages = []commandHelpPage{
 			"code-polishy release-manifest satisfies-lock --root PATH",
 			"code-polishy release-manifest materialize --source PATH --destination PATH",
 			"code-polishy release-manifest archive --root PATH --output PATH",
+			"code-polishy release-manifest rust-archive --root PATH --output PATH",
+			"code-polishy release-manifest rust-notices --root PATH",
 			"code-polishy release-manifest publish --archive PATH --destination PATH",
 			"code-polishy release-manifest index --artifact-descriptor PATH... --output PATH",
 			"code-polishy release-manifest oci-context --descriptor PATH --template PATH --destination PATH",

cmd/code-polishy/help_test.go

@@ -16,7 +16,7 @@ import (
 
 func TestEveryCommandHelpPageHasCompleteContract(t *testing.T) {
 	publicCommands := []string{
-		"version", "docs", "pack", "agents", "lock", "upgrade", "release-manifest", "change-boundary", "task-session",
+		"version", "docs", "install-rust", "pack", "agents", "lock", "upgrade", "release-manifest", "change-boundary", "task-session",
 		"check", "gate", "checkpoint-gate", "merge-gate", "behavior-review", "regression-proof",
 		"test", "test-plan", "test-levels", "test-receipts", "verify", "architecture", "supply-chain",
 		"dependency-review", "artifact-security", "doctor", "design-context", "format", "fix", "list-files",

cmd/code-polishy/install_rust_meta.go

@@ -0,0 +1,35 @@
+package main
+
+import (
+	"context"
+	"flag"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/riteofstring/code-polishy/internal/release"
+)
+
+func handleInstallRustMeta(invocation invocation) int {
+	flags := flag.NewFlagSet("install-rust", flag.ContinueOnError)
+	flags.SetOutput(os.Stderr)
+	source := flags.String("source", "", "local Rust companion archive")
+	if err := flags.Parse(invocation.arguments); err != nil {
+		return commandUsageError("install-rust", err.Error())
+	}
+	if flags.NArg() != 0 || invocation.configPath != "" {
+		return commandUsageError("install-rust", "install-rust accepts only --source PATH")
+	}
+	if *source != "" {
+		absolute, err := filepath.Abs(*source)
+		if err != nil {
+			return operationalError(err)
+		}
+		*source = absolute
+	}
+	if err := release.InstallRustBundle(context.Background(), invocation.repoRoot, invocation.policyRoot, *source); err != nil {
+		return operationalError(err)
+	}
+	fmt.Println("Installed the selected release's verified Rust tools.")
+	return 0
+}

cmd/code-polishy/install_rust_meta_test.go

@@ -0,0 +1,16 @@
+package main
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestRustInstallerRequiresInstalledReleaseAuthority(t *testing.T) {
+	root := t.TempDir()
+	status, stdout, stderr := captureRunOutput(t, []string{
+		"--repo-root", root, "--policy-root", root, "install-rust",
+	})
+	if status != 2 || stdout != "" || !strings.Contains(stderr, "has no release-manifest.json") {
+		t.Fatalf("Rust setup did not enforce installed authority: status=%d stdout=%q stderr=%q", status, stdout, stderr)
+	}
+}

cmd/code-polishy/main.go

@@ -25,11 +25,12 @@ Commands:
   capabilities [--query TEXT] [--format human|json]
   task-start (--files PATH... | --module NAME...) [--intent-file PATH|-] [--feature NAME] [--situation NAME] [--format human|json]
   docs <list|find|read>
+  install-rust [--source ARCHIVE]
   pack <install|verify|root>
   agents <install|sync|check>
   lock --index URL --sha256 DIGEST
   upgrade <plan|apply> [options]
-  release-manifest <write|verify|satisfies-lock|materialize|archive|publish|index|oci-context> [options]
+  release-manifest <write|verify|satisfies-lock|materialize|archive|rust-archive|rust-notices|publish|index|oci-context> [options]
   change-boundary --base COMMIT --module NAME... [--allow-path PATH...] [--allow-new-path PATH...]
   task-session --module NAME... [options] -- COMMAND [ARG...]
   check [--git-changes|--staged|--all|--files PATH...|--module NAME...|--name NAME...]
@@ -196,17 +197,19 @@ func handleCoreMetaCommand(invocation invocation) (int, bool) {
 	case "install-bundle":
 
 		return handleInstallBundleMeta(invocation), true
+	case "install-rust":
+		return handleInstallRustMeta(invocation), true
 	case "release-manifest":
 		return handleReleaseManifestMeta(invocation), true
-	case "change-boundary":
-		return handleChangeBoundaryMeta(invocation), true
 	default:
 		return 0, false
 	}
 }
 
 func handleWorkflowMetaCommand(invocation invocation) (int, bool) {
 	switch invocation.command {
+	case "change-boundary":
+		return handleChangeBoundaryMeta(invocation), true
 	case "task-session":
 		return handleTaskSessionWorkflowMeta(invocation), true
 	case "task-session-artifacts":

cmd/code-polishy/main_test.go

@@ -770,7 +770,7 @@ func installedRelease(t *testing.T, revision string) string {
 		Tools: release.Tools{
 			Go: "1.26.6", Govulncheck: "1.3.0", Node: "24.18.0", OSVScanner: "2.4.0",
 			PNPM: "11.13.0", Packaging: "26.3", Python: "3.12.13+20260728", Ruff: "0.16.0", Shellcheck: "0.11.0", Staticcheck: "0.7.0",
-			Ty: "0.0.65", Vulture: "2.16",
+			Ty: "0.0.65", Vulture: "2.16", Rust: "1.97.1", Nextest: "0.9.138",
 		},
 		CapabilityCatalogSHA256: hex.EncodeToString(catalogDigest[:]),
 		Entries: []release.Entry{

cmd/code-polishy/release_manifest_meta.go

@@ -65,15 +65,37 @@ func handleReleasePublicationMeta(mode string, options releaseManifestOptions) i
 	switch mode {
 	case "archive":
 		return archiveReleaseManifest(options)
+	case "rust-archive":
+		return archiveRustReleaseManifest(options)
+	case "rust-notices":
+		if options.root == "" || !releaseManifestOptionsEmpty(options, "root") {
+			return commandUsageError("release-manifest", "release-manifest rust-notices requires --root PATH")
+		}
+		if err := release.MaterializeRustNotices(options.root); err != nil {
+			return operationalError(err)
+		}
+		return 0
 	case "publish":
 		return publishReleaseManifest(options)
 	case "index":
 		return indexReleaseManifest(options)
 	case "oci-context":
 		return ociContextReleaseManifest(options)
 	default:
-		return commandUsageError("release-manifest", "release-manifest requires write, verify, satisfies-lock, materialize, archive, publish, index, or oci-context")
+		return commandUsageError("release-manifest", "release-manifest requires write, verify, satisfies-lock, materialize, archive, rust-archive, rust-notices, publish, index, or oci-context")
+	}
+}
+
+func archiveRustReleaseManifest(options releaseManifestOptions) int {
+	if options.root == "" || options.output == "" || !releaseManifestOptionsEmpty(options, "root", "output") {
+		return commandUsageError("release-manifest", "release-manifest rust-archive requires --root PATH and --output PATH")
 	}
+	digest, err := release.WriteRustArchive(options.root, options.output)
+	if err != nil {
+		return operationalError(err)
+	}
+	fmt.Println(digest)
+	return 0
 }
 
 func releaseManifestOptionsEmpty(options releaseManifestOptions, allowed ...string) bool {

docs/README.md

@@ -79,6 +79,12 @@ and aliases. Search is local, bounded, and deterministic.
 - [Source Comment Policy Design](design/source-comment-policy.md) explains the
   default-preserving switch and the rationale for repositories that select the
   strict no-comment boundary.
+- [Rust and Shader Input Coverage](design/rust-inputs.md) defines Rust control
+  inputs, WGSL ownership, and the current analysis boundary.
+- [Native Rust Test Evidence](design/rust-tests.md) defines Cargo selectors,
+  managed Nextest results, retries and reusable test receipts.
+- [Rust Support Plan](plans/code-polishy-rust-support-plan.md) tracks the beta
+  implementation and the remaining requirements for first-class Rust support.
 - [Source Provenance](source-provenance.md) records public design references,
   toolchain origins, and implementation boundaries.
 - [Release Checklist](release-checklist.md) defines immutable tags and the

docs/ai-adoption.md

@@ -358,13 +358,13 @@ ordinary full behavior suite as described in
 
 ## 5. Reuse policy-owned tools and add only project-specific providers
 
-Allow source and dependency evidence to activate the shared Go, Shell, Ruff,
+Allow source and dependency evidence to activate the shared Go, Rust, Shell, Ruff,
 Vulture, `ty`, Node/TypeScript, React, Electron, and OSV behavior. Do not copy
 equivalent commands into target JSON.
 
 Add target `checks` only for facts that cannot be shared safely, such as:
 
-- an alias-aware non-Go architecture graph;
+- architecture facts beyond native or installed language-pack analysis;
 - a production build;
 - a frozen workspace install or generated-lock consistency check;
 - a domain-specific content/schema validator;
@@ -376,12 +376,27 @@ the modules and capability it covers, have a bounded timeout, and fail when its
 evidence is missing. It must not auto-install packages during a policy check.
 
 The installed release supplies the Go toolchain, ShellCheck, staticcheck,
-govulncheck, Ruff, Vulture, its carried CPython runtime, `ty`, OSV-Scanner, and
+govulncheck, Rust/Cargo/rustfmt/Clippy, Nextest, Ruff, Vulture, its carried CPython runtime, `ty`, OSV-Scanner, and
 the sealed JavaScript tooling. Do not add target-local copies of those tools or
 ask a target dependency to satisfy shared coverage. A missing or corrupted
 shared tool means the locked release must be installed or repaired; it is not a
 target dependency gap.
 
+For governed Rust inputs, run `./code-polishyw install-rust` to install the
+exact optional tools selected by the existing core release. An absent installation
+blocks required Rust checks; do not add exclusions, replacements, or relaxed
+policy to avoid setup.
+
+For Rust unit and integration suites, use the native `rust` selector described in
+[Rust test evidence](design/rust-tests.md). Preserve Cargo workspace default
+members and features unless the suite deliberately selects alternatives. Prepare
+the reviewed Cargo lock and dependency cache before frozen checks or tests. Native
+unit/integration evidence does not establish doctest coverage: declare a separate
+suite with `rust.doctests: true` for compiler-owned documentation examples. It
+preserves compile-fail, compile-only, expected-panic and ignored semantics.
+Benchmark and live-provider workflows still need their own explicit evidence and
+authorization.
+
 Use existing target tools where honest for genuinely project-specific
 providers. If such a provider requires a new or updated target dependency,
 that dependency change is not authorized by the adoption request. First show:

docs/capabilities.json

@@ -171,6 +171,16 @@
       "enforcement": ["explicit"],
       "workflows": ["docs/agent-workflows.md"]
     },
+    {
+      "name": "install-rust",
+      "kind": "command",
+      "description": "Install the exact optional Rust tools authenticated by the selected core release.",
+      "aliases": ["Rust tool setup"],
+      "paths": [],
+      "modules": [],
+      "enforcement": ["explicit"],
+      "workflows": ["docs/installation.md"]
+    },
     {
       "name": "lock",
       "kind": "command",