Lightweight Assurance 1: Define and enforce the Rust assurance baseline

.devcontainer/scripts/check-code.sh

@@ -0,0 +1,31 @@
+#!/bin/bash -i
+# SPDX-FileCopyrightText: 2026 Sequent Tech Inc <legal@sequentech.io>
+#
+# SPDX-License-Identifier: AGPL-3.0-only
+
+set -e -o pipefail
+
+source .devcontainer/.env
+
+# check hasura formatting (prettier --check)
+cd hasura/
+yarn && yarn prettify
+
+# check rust formatting
+cd ../packages/
+cargo fmt -- --check
+
+# clippy for sequent-core (all features; warnings allowed)
+export CARGO_TARGET_DIR="$(pwd)/rust-local-target"
+cd ./sequent-core/
+cargo clippy --no-deps --all-features -- -A warnings
+
+# check Typescript lint & formatting
+cd ..
+yarn
+yarn lint
+yarn prettify
+
+# check java formatting (spotless)
+cd ./keycloak-extensions
+mvn invoker:run@run-spotless-check

.github/workflows/documentation.yml

@@ -19,6 +19,9 @@ on:
       - 'docs/docusaurus/**'
       - 'docs/api/graphql/**'
       - 'packages/graphql.schema.json'
+      - 'packages/**'
+      - '**/Cargo.toml'
+      - '**/Cargo.lock'
     branches:
       - main
       - release/*
@@ -32,6 +35,9 @@ permissions:
 jobs:
   build:
     runs-on: gcp-selfhosted-ubuntu24
+    env:
+      CARGO_TARGET_DIR: rust-local-target
+
     steps:
       - uses: actions/checkout@v4
         with:
@@ -41,7 +47,15 @@ jobs:
         uses: actions/setup-node@v3
         with:
           node-version: 22.x
-
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Generate cargo docs for sequent-core
+        working-directory: ./packages
+        run: |
+          cargo doc -p sequent-core --all-features --no-deps
+
       - name: Set BASE_URL and Build Docusaurus Preview
         id: build_docusaurus
         working-directory: ./docs/docusaurus
@@ -64,7 +78,14 @@ jobs:
           yarn install --frozen-lockfile
           yarn generate-full-docs
           ls -lah docs/
-          cp -r docs ../../docusaurus/build/graphql
+          mkdir -p ../../docusaurus/build/graphql
+          cp -r docs/* ../../docusaurus/build/graphql/
+
+      - name: Copy cargo doc output into published site
+        run: |
+          mkdir -p ./docs/docusaurus/build/rust
+          cp -r ./packages/${CARGO_TARGET_DIR}/doc/* ./docs/docusaurus/build/rust/
+          ls -lah ./docs/docusaurus/build/rust
 
       - name: Install rsync
         run: sudo apt-get update && sudo apt-get install -y rsync

.github/workflows/lint_prettify.yml

@@ -77,7 +77,7 @@ jobs:
           dir: hasura/
 
   rust-fmt:
-    name: Check Rust format 
+    name: Check Rust format and linting
     runs-on: gcp-selfhosted-ubuntu24
     steps:
       - name: Check out code
@@ -87,11 +87,14 @@ jobs:
         uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: 1.90.0
-          components: rustfmt
+          components: rustfmt,clippy
           targets: x86_64-unknown-linux-musl
 
       - name: Check Rust code formatting
         run: cd packages/ && cargo fmt -- --check
+
+      - name: Check Rust Sequent Core Clippy
+        run: cd packages/sequent-core && cargo clippy --no-deps --all-features -- -A warnings
 
   java-spotless:
     name: Check Java format

.vscode/tasks.shared.json

@@ -1071,6 +1071,30 @@
             },
             "problemMatcher": []
         },
+        {
+            "label": "check.code",
+            "command": "devenv",
+            "args": [
+                "shell",
+                "bash",
+                "--",
+                "-c",
+                "./.devcontainer/scripts/check-code.sh"
+            ],
+            "presentation": {
+                "echo": true,
+                "reveal": "always",
+                "focus": false,
+                "panel": "dedicated",
+                "showReuseMessage": true,
+                "clear": false
+            },
+            "isBackground": false,
+            "runOptions": {
+                "runOn": "default"
+            },
+            "problemMatcher": []
+        },
         {
             "label": "build.sequent-core",
             "type": "shell",

README.md

@@ -390,3 +390,117 @@ when running in the terminal `devenv shell` or in the `Rebuild Container` vscode
 
 [cargo workspace]: https://doc.rust-lang.org/cargo/reference/workspaces.html
 [yarn workspace]: https://yarnpkg.com/features/workspaces
+
+
+## 🧹 Linting & Code Quality Guide
+
+This project enforces strict linting rules using Rust built-in lints and Clippy to ensure high code quality, safety, and maintainability.
+
+### 🚀 Running Clippy
+
+Run lint checks locally with:
+
+```bash
+cargo clippy --no-deps --all-features -- -A warnings
+```
+
+Explanation
+--no-deps: Lints only this workspace (skips dependencies)
+--all-features: Ensures all feature-gated code is checked
+-- -A warnings: Allows warnings (only errors will fail)
+
+- Note: This is convenient for development, but CI should be stricter.
+
+### Lint Configuration
+
+Lint rules are defined in Cargo.toml under [lints.*].
+
+#### Rustdoc Lints
+
+The `[lints.rustdoc]` section enforces documentation quality and correctness.
+
+- `missing_crate_level_docs = "deny"`  
+  Requires top-level crate documentation (e.g. `//!` or `#![doc = include_str!(...)]`).
+
+- `broken_intra_doc_links = "deny"`  
+  Prevents broken links between documentation items (e.g. invalid `[`TypeName`]` references).
+
+#### Rust Lints
+
+The `[lints.rust]` section configures core compiler lints to enforce safety, correctness, and good API design.
+
+- `missing_docs = "deny"`  
+  Requires documentation for all public items (structs, enums, functions, etc.).
+
+- `unsafe_code = "forbid"`  
+  Completely disallows usage of `unsafe` code anywhere in the crate.
+
+- `private_interfaces = "warn"`  
+  Warns when a public item exposes private types in its interface.
+
+- `private_bounds = "warn"`  
+  Warns when trait bounds reference private types that are not accessible to users.
+
+- `unnameable_types = "warn"`  
+  Warns when types are exposed that cannot be named or used properly outside the crate.
+
+- `unexpected_cfgs = { level = "warn", check-cfg = ['cfg(coverage,coverage_nightly)'] }`  
+  Warns about unknown or unexpected `cfg` conditions and ensures only allowed configuration flags (like `coverage`) are used.
+
+#### Clippy Lints
+
+The `[lints.clippy]` section configures additional lint rules provided by Clippy. In this project, these rules are set very strictly to enforce safer, clearer, and more maintainable Rust code.
+
+- `missing_docs_in_private_items = "deny"`  
+  Requires documentation not only for public items, but also for private structs, enums, functions, constants, and fields.
+
+- `missing_errors_doc = "deny"`  
+  Requires a `# Errors` section in the documentation of functions that return `Result`.
+
+- `missing_panics_doc = "deny"`  
+  Requires a `# Panics` section in the documentation of functions that may panic.
+
+- `doc_markdown = "deny"`  
+  Enforces proper Markdown formatting in documentation comments.
+
+- `unwrap_used = "deny"`  
+  Disallows use of `.unwrap()` because it may panic.
+
+- `panic = "deny"`  
+  Disallows explicit `panic!()` calls.
+
+- `shadow_unrelated = "deny"`  
+  Disallows reusing variable names in unrelated scopes when it may reduce readability.
+
+- `print_stdout = "deny"`  
+  Disallows `println!` and similar macros for standard output.
+
+- `print_stderr = "deny"`  
+  Disallows `eprintln!` and similar macros for standard error output.
+
+- `indexing_slicing = "deny"`  
+  Disallows direct indexing and slicing like `arr[i]` because they may panic at runtime.
+
+- `missing_const_for_fn = "deny"`  
+  Requires functions to be marked `const` when they can be.
+
+- `future_not_send = "deny"`  
+  Warns when async code creates futures that are not `Send`, which can break multi-threaded async execution.
+
+- `arithmetic_side_effects = "deny"`  
+  Flags arithmetic operations that may overflow or have unintended side effects.
+
+- `suspicious = "deny"`  
+  Enables Clippy’s suspicious code lints to catch code that is likely incorrect.
+
+- `complexity = "deny"`  
+  Enables lints that detect overly complex code patterns and suggests simpler alternatives.
+
+- `style = "deny"`  
+  Enforces idiomatic Rust style.
+
+- `perf = "deny"`  
+  Enables performance-related lints to catch inefficient code patterns.
+
+- `pedantic = "deny"`  
+  Enables a very strict set of extra Clippy lints for code quality, readability, and correctness. These are more opinionated than the default lints.

docs/docusaurus/docs/rust-docs.md

@@ -0,0 +1,25 @@
+---
+id: rust_docs
+title: Rust Docs
+sidebar_position: -1
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+<!--
+-- SPDX-FileCopyrightText: 2026 Sequent Tech Inc <legal@sequentech.io>
+SPDX-License-Identifier: AGPL-3.0-only
+-->
+
+export const RustCrateLink = ({ path, children }) => {
+  const url = useBaseUrl(path);
+  return (
+    <a href={url} target="_blank" rel="noreferrer noopener">
+      {children}
+    </a>
+  );
+};
+
+### Crates
+
+- <RustCrateLink path="/rust/sequent_core/index.html">sequent-core</RustCrateLink>

docs/docusaurus/docusaurus.config.js

@@ -37,6 +37,33 @@ const config = {
           sidebarPath: require.resolve('./sidebars.js'),
           editUrl:
             'https://github.com/sequentech/step/edit/main/docs/docusaurus',
+          async sidebarItemsGenerator({
+            defaultSidebarItemsGenerator,
+            ...args
+          }) {
+            const sidebarItems = await defaultSidebarItemsGenerator(args);
+
+            function removeDoc(items) {
+              return items
+                .filter((item) => {
+                  if (item.type === 'doc' && item.id === 'rust_docs') {
+                    return false;
+                  }
+                  return true;
+                })
+                .map((item) => {
+                  if (item.type === 'category' && item.items) {
+                    return {
+                      ...item,
+                      items: removeDoc(item.items),
+                    };
+                  }
+                  return item;
+                });
+            }
+
+            return removeDoc(sidebarItems);
+          },
         },
         // completely remove the blog
         blog: false,
@@ -78,6 +105,12 @@ const config = {
             position: 'left',
             target: '_blank',
           },
+          {
+            type: 'doc',
+            docId: 'rust_docs',
+            label: 'Rust Docs',
+            position: 'left',
+          },
           {
             href: 'https://github.com/sequentech',
             label: 'GitHub',