Production hardening round 4: max_tokens bug, overflow hardening, honesty pass, CI

.github/workflows/ci.yml

@@ -1,9 +1,12 @@
 name: CI
 on: [push, pull_request]
+
 jobs:
   test:
+    name: Test & lint (${{ matrix.rust }})
     runs-on: ubuntu-latest
     strategy:
+      fail-fast: false
       matrix:
         rust: [stable, beta]
     steps:
@@ -12,6 +15,23 @@ jobs:
         with:
           toolchain: ${{ matrix.rust }}
           components: rustfmt, clippy
-      - run: cargo fmt --all -- --check
-      - run: cargo test --verbose
-      - run: cargo clippy -- -D warnings
+      - name: Format check
+        run: cargo fmt --all -- --check
+      - name: Clippy (all targets, all features)
+        run: cargo clippy --all-targets --all-features -- -D warnings
+      - name: Test (default features)
+        run: cargo test --verbose
+      - name: Test (all features)
+        run: cargo test --all-features --verbose
+
+  wasm:
+    name: wasm32 build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: stable
+          targets: wasm32-unknown-unknown
+      - name: Build for wasm32-unknown-unknown
+        run: cargo build --target wasm32-unknown-unknown --verbose

Cargo.toml

@@ -8,7 +8,7 @@ description = "FLUX bytecode conservation-law enforcement for LLM outputs (Rust)
 repository = "https://github.com/SuperInstance/conservation-enforcer-rs"
 homepage = "https://github.com/SuperInstance/conservation-enforcer-rs"
 keywords = ["flux", "conservation", "llm", "policy", "bytecode"]
-categories = ["no-std", "embedded", "wasm"]
+categories = ["wasm"]
 
 [lib]
 name = "conservation_enforcer"

README.md

@@ -2,8 +2,7 @@
 
 ![Crates.io](https://img.shields.io/crates/v/si-conservation-enforcer)
 ![Rust](https://img.shields.io/badge/rust-stable-orange)
-![Tests](https://img.shields.io/badge/tests-95%2B-brightgreen)
-![no_std](https://img.shields.io/badge/no__std-compatible-blue)
+![Tests](https://img.shields.io/badge/tests-150%2B-brightgreen)
 ![License](https://img.shields.io/github/license/SuperInstance/conservation-enforcer-rs)
 
 **FLUX bytecode conservation-law enforcement for LLM outputs.**
@@ -27,13 +26,18 @@ User Request → LLM Call → [FLUX Conservation Validator] → Response
 
 ## Why Rust?
 
-| Property | Benefit |
-|----------|---------|
-| **Zero-cost abstractions** | The entire VM, assembler, and enforcement layer adds negligible overhead |
-| **`no_std` compatible** | Works in embedded, WASM, and kernel contexts (`default-features = false`) |
-| **Zero external dependencies** | The entire crate is self-contained — no transitive dependency risk |
-| **Memory safe** | Rust's ownership model guarantees no UB in the policy VM |
-| **Deterministic** | Same input + bytecode = same output, every time |
+- **Zero-cost abstractions** — The entire VM, assembler, and enforcement layer adds negligible overhead
+- **WASM-ready** — Builds unmodified for `wasm32-unknown-unknown` with the default `std` feature
+- **No external dependencies** — The entire crate is self-contained
+- **Memory safe** — Rust's ownership model guarantees no UB in the policy VM
+- **Deterministic** — Same input + bytecode = same output, every time
+
+> **`no_std` status:** The crate is annotated with `#![cfg_attr(not(feature = "std"), no_std)]`
+> and has scaffolding for a `no_std`/embedded port, but building with
+> `--no-default-features` does **not** currently compile (the implementation uses
+> `String`/`Vec`/`format!` and `std::collections::HashMap`). Treat `no_std`/embedded
+> support as a stated goal, not a working configuration. The `wasm32-unknown-unknown`
+> target (with `std`) is supported.
 
 ## Installation
 
@@ -289,6 +293,16 @@ The assembler supports higher-level pseudo-instructions that expand to multiple
 | `audit` | ❌ | JSON Lines audit logging to files |
 | `metrics` | ❌ | Metrics collection and export |
 
+> **Note:** A `no_std`/embedded build (`default-features = false`) is a stated
+> goal but does **not** currently compile (see `no_std` status above). The
+> snippet below is the intended usage once that port lands; it is not functional today.
+>
+> ```toml
+> [dependencies]
+> # Not yet working — requires the unfinished no_std port.
+> si-conservation-enforcer = { version = "0.1", default-features = false }
+> ```
+
 ### Audit Logging
 
 ```rust
@@ -317,6 +331,14 @@ let snapshot = metrics.snapshot();
 println!("Block rate: {:.1}%", snapshot.block_rate * 100.0);
 ```
 
+This crate is a Rust implementation of the same FLUX ISA and policy
+semantics as the [Python conservation-enforcer](https://github.com/SuperInstance/conservation-enforcer).
+It is **not** a verified line-by-line port: the two implementations are maintained
+independently, this Rust suite is its own test suite (not a replication of the
+Python suite), and cross-implementation bytecode compatibility is a design goal
+that is **not** currently verified by CI or tests. Treat the table below as a
+component mapping, not a parity guarantee.
+
 ## Architecture
 
 ```
@@ -337,6 +359,9 @@ src/
     ├── policies (7 pre-built conservation policies)
     ├── audit (JSONL audit log, feature-gated)
     └── metrics (MetricsCollector, feature-gated)
+
+tests/
+└── integration.rs  Integration test suite (~80 tests; 150+ tests total with unit + doc tests)
 ```
 
 ### No External Dependencies
@@ -346,7 +371,7 @@ The entire crate — VM, assembler, enforcer, policies, audit, metrics — has *
 ## Testing
 
 ```bash
-# Run all 95+ tests
+# Run all 150+ tests
 cargo test
 
 # Run with output