fix(rust): bound validation workspace materialization

.github/workflows/release.yml

@@ -26,7 +26,7 @@ jobs:
       (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
     runs-on: ubuntu-latest
     env:
-      RELEASE_VERSION: "0.2.0"
+      RELEASE_VERSION: "0.2.1"
       NPM_TAG: latest
     steps:
       - name: Checkout
@@ -97,7 +97,7 @@ jobs:
         if: github.event_name == 'workflow_run'
         run: npm run release:publish -- --version "$RELEASE_VERSION" --tag "$NPM_TAG"
         env:
-          OPCORE_CONFIRM_PUBLISH: "0.2.0"
+          OPCORE_CONFIRM_PUBLISH: "0.2.1"
           OPCORE_REQUIRE_ALL_NATIVE_PACKAGES: "1"
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 

AGENTS.md

@@ -83,7 +83,7 @@ Opcore is the code-intelligence and robustness monorepo for graph context, edit
 - `npm run test:ci` routes through `scripts/run-test-ci.mjs`: it runs the parallel-safe Node test files first, runs `tests/validation-python.test.mjs` separately because its real subprocess fixtures can exhaust CI process slots under the parallel suite, then runs `tests/native-packaging-policy.test.mjs` separately with receipt gates skipped - WHY: Python compiler-truth tests need deterministic process availability, and the native packaging policy test intentionally mutates native package artifacts while exercising aggregate dry-run failures.
 - Graph-owned transitional `opcore graph serve --repo <repo>` starts the graph package stdio/MCP bridge over graph-core JSONL; `--repo` defaults to cwd, supports ping/status/query/search/shutdown, injects missing nested query repos, and returns typed startup/frame/provider failures.
 - #126 ships graph-core through bundled internal Opcore native packages `@the-open-engine/opcore-graph-core-darwin-arm64`, `@the-open-engine/opcore-graph-core-darwin-x64`, and `@the-open-engine/opcore-graph-core-linux-x64`; `packages/graph` resolves only matching package metadata and never probes `packages/graph/dist/native`, sibling checkouts, `.ace/runtime`, or PATH.
-- Release flow is `dev -> main`: CI runs on `dev` and `main`, PRs to `main` must come from `dev`, and `.github/workflows/release.yml` auto-publishes npm package version `0.2.0` with dist-tag `latest` after the `CI` workflow succeeds on `main`. Each release must provide readable notes at `docs/release/v<version>.md`; the workflow uses that file verbatim for the GitHub release. The CI native jobs upload tarred native package directories so `opcore-graph-core` execute bits survive artifact transfer; aggregate CI and release publish must set `OPCORE_REQUIRE_ALL_NATIVE_PACKAGES=1` after extracting all three native artifacts, and `scripts/release-dry-run.mjs` then validates package-local executable binaries/checksums without rebuilding graph-core - WHY: aggregate and publish proof must consume runnable per-target artifacts produced by native jobs, not a local Linux rebuild or non-executable download.
+- Release flow is `dev -> main`: CI runs on `dev` and `main`, PRs to `main` must come from `dev`, and `.github/workflows/release.yml` auto-publishes npm package version `0.2.1` with dist-tag `latest` after the `CI` workflow succeeds on `main`. Each release must provide readable notes at `docs/release/v<version>.md`; the workflow uses that file verbatim for the GitHub release. The CI native jobs upload tarred native package directories so `opcore-graph-core` execute bits survive artifact transfer; aggregate CI and release publish must set `OPCORE_REQUIRE_ALL_NATIVE_PACKAGES=1` after extracting all three native artifacts, and `scripts/release-dry-run.mjs` then validates package-local executable binaries/checksums without rebuilding graph-core - WHY: aggregate and publish proof must consume runnable per-target artifacts produced by native jobs, not a local Linux rebuild or non-executable download.
 - #19 keeps `OPCORE_GRAPH_WATCH_PATHS` as the only watch env default and ignores `CRG_WATCH_PATHS` - WHY: Opcore watch roots must not inherit old-tool scoping accidentally.
 - #19 graph discovery excludes generated/private/dependency roots even without repo ignore files: `.git`, `node_modules`, `.pnpm`, `vendor`, `dist`, `target`, `.ace`, `.agents`, `.claude`, `.codex`, `.gemini`, `.lattice`, `.opencode`, `.rox-cache`, and `.robustness-engine-cache` - WHY: cache/vendor/provider mirror changes must not create graph facts, freshness changes, validation input, or FTS rows.
 - #17/#19/#21 source/coverage policy is reconciled across graph-core, validation, and Opcore status/metrics: graph-extractable TypeScript, JavaScript, Python `.py`/`.pyi`, and Rust `.rs`; validation-supported TS/JS variants, Python source/stubs, Rust source/includes, and `Cargo.toml`; retained `Cargo.lock`; unsupported/degraded stacks and missing Python tools are counted honestly.
@@ -180,6 +180,7 @@ Opcore is the code-intelligence and robustness monorepo for graph context, edit
 - #26 adds the validation-owned GraphProvider consumer boundary: `ValidationGraphProviderClient`, cached `ValidationGraphQuerySession`, graph requirement preloading, status/query failure mapping, and helper access for metadata, file checksums, IMPORTS_FROM, CALLS, and TESTED_BY facts.
 - #57 adds the TypeScript validation adapter: `@the-open-engine/opcore-validation-typescript` exports package-owned syntax, type, import-graph, dead-code, and relevant-tests check definitions. Syntax/type checks use the validation file view and an overlay-aware compiler host, including tsconfig path aliases for repo files and deterministic node_modules/package declaration resolution for external package imports; graph checks require #26 graph sessions and batched IMPORTS_FROM, CALLS, and TESTED_BY fact requirements.
 - #20 adds the Rust validation adapter: `@the-open-engine/opcore-validation-rust` exports package-owned source hygiene, fmt, cargo-check, clippy, rustdoc, import-graph, dead-code, graph-signals, unused-deps, file-length, and function-metrics checks. `rust.graph-signals` is graph-provider-backed evidence from `ValidationGraphProviderClient` only (untested public Rust surface, dead public exports, module orphans/cycles); it does not replace mechanical cargo/rustdoc/clippy/Rox guardrails. #61 makes the five retained Rust rows native when supporting tools are available: rustdoc diagnostics block through `cargo doc`, import-graph reports unresolved modules/use paths/orphans/cycles from fileView, dead-code combines Cargo `dead_code` with orphan-source evidence, unused-deps parses cargo-udeps with workspace/package scoping, and function-metrics parses rust-code-analysis JSON object/array output. Missing `rustdoc`, `cargo-depgraph`, `cargo-udeps`, or `rust-code-analysis-cli` stays degraded or unsupported with `requiredTool` and retained `currentUsage`; no generic retained row remains for available tools. Rust checks materialize temporary workspaces from `ValidationCheckContext.fileView` after-state content for Cargo tools, add no validation daemon or hidden cache, never shell out to Rox, and keep current external Rust guardrails active until #29/#30 accept replacement receipts. #138 shares cargo-check JSON with dead-code, forbids a second dead-code cargo compile or `-Ddead_code` cache-busting flags, and injects a persistent `CARGO_TARGET_DIR` outside the worktree through `runTool`; cache keys must derive from generic repo, scope, overlay, platform, and toolchain inputs and cleanup must remain TTL/size bounded - WHY: Rust validation must be fast without leaking hypothetical after-state into real worktrees or tuning behavior to one repository.
+- Rust Cargo/native checks share one environment-keyed materialized workspace per validation file-view state through runner-owned disposable resources; the runner removes it on every exit - WHY: exact staged/tree/overlay semantics require state isolation, while per-check whole-repo copies create unbounded filesystem-event churn.
 - #151/#214 adds clone detection through the existing `opcore-graph-core` binary as a `clone` subcommand plus `@the-open-engine/opcore-validation-clone`. `CloneAnalysisRequest`/`CloneAnalysisResult` use `opcore.clone.v1`; committed analysis may refresh `.opcore/clone/clone.db`, while scoped or hypothetical analysis is ephemeral. The sparse request shape sends committed candidates as `paths`/`sourcePaths` plus `sourceReadMode`/`sourceTreeRef`, with full content only in write overlays. `clone.duplication` is a validation adapter check with injected native invocation, no graph requirement, no line-level identity, no daemon, and no SAST/security or score claim.
 - #27 adds canonical validation CLI surfaces: `opcore check` implements `files`, `staged`, `changed`, `tree`, `all`, and `manifest`; `tree` reads committed Git tree content from `--tree <ref>` and scopes files from `--changed-from <ref>` without consuming dirty worktree files. `opcore validate` implements `--request-file`, `hypothetical --request-file`, `pre-write --request-file --timeout-ms --json`, and `manifest`; runtime-owned `opcore status --json` includes `repoState`, while `opcore doctor --json` includes typed `runtimeInfo`, `opcoreDoctor`, and transitional `validationStatus` payloads with adapter routes, check ids, manifest entries, graph status, and daemon readiness metadata. #58 defines `opcore validate pre-write --request-file <validation-request.json> --timeout-ms 30000 --json` as the hook-safe, fail-closed pre-write contract with typed `PreWriteValidationReceipt` output.
 - #69 removes public runtime lifecycle command groups: top-level start and stop are unsupported unless a later architecture decision adopts them. Runtime readiness remains `opcore status` and `opcore doctor`; graph daemon lifecycle/status remains graph-owned under `opcore graph`.

CLAUDE.md

@@ -83,7 +83,7 @@ Opcore is the code-intelligence and robustness monorepo for graph context, edit
 - `npm run test:ci` routes through `scripts/run-test-ci.mjs`: it runs the parallel-safe Node test files first, runs `tests/validation-python.test.mjs` separately because its real subprocess fixtures can exhaust CI process slots under the parallel suite, then runs `tests/native-packaging-policy.test.mjs` separately with receipt gates skipped - WHY: Python compiler-truth tests need deterministic process availability, and the native packaging policy test intentionally mutates native package artifacts while exercising aggregate dry-run failures.
 - Graph-owned transitional `opcore graph serve --repo <repo>` starts the graph package stdio/MCP bridge over graph-core JSONL; `--repo` defaults to cwd, supports ping/status/query/search/shutdown, injects missing nested query repos, and returns typed startup/frame/provider failures.
 - #126 ships graph-core through bundled internal Opcore native packages `@the-open-engine/opcore-graph-core-darwin-arm64`, `@the-open-engine/opcore-graph-core-darwin-x64`, and `@the-open-engine/opcore-graph-core-linux-x64`; `packages/graph` resolves only matching package metadata and never probes `packages/graph/dist/native`, sibling checkouts, `.ace/runtime`, or PATH.
-- Release flow is `dev -> main`: CI runs on `dev` and `main`, PRs to `main` must come from `dev`, and `.github/workflows/release.yml` auto-publishes npm package version `0.2.0` with dist-tag `latest` after the `CI` workflow succeeds on `main`. Each release must provide readable notes at `docs/release/v<version>.md`; the workflow uses that file verbatim for the GitHub release. The CI native jobs upload tarred native package directories so `opcore-graph-core` execute bits survive artifact transfer; aggregate CI and release publish must set `OPCORE_REQUIRE_ALL_NATIVE_PACKAGES=1` after extracting all three native artifacts, and `scripts/release-dry-run.mjs` then validates package-local executable binaries/checksums without rebuilding graph-core - WHY: aggregate and publish proof must consume runnable per-target artifacts produced by native jobs, not a local Linux rebuild or non-executable download.
+- Release flow is `dev -> main`: CI runs on `dev` and `main`, PRs to `main` must come from `dev`, and `.github/workflows/release.yml` auto-publishes npm package version `0.2.1` with dist-tag `latest` after the `CI` workflow succeeds on `main`. Each release must provide readable notes at `docs/release/v<version>.md`; the workflow uses that file verbatim for the GitHub release. The CI native jobs upload tarred native package directories so `opcore-graph-core` execute bits survive artifact transfer; aggregate CI and release publish must set `OPCORE_REQUIRE_ALL_NATIVE_PACKAGES=1` after extracting all three native artifacts, and `scripts/release-dry-run.mjs` then validates package-local executable binaries/checksums without rebuilding graph-core - WHY: aggregate and publish proof must consume runnable per-target artifacts produced by native jobs, not a local Linux rebuild or non-executable download.
 - #19 keeps `OPCORE_GRAPH_WATCH_PATHS` as the only watch env default and ignores `CRG_WATCH_PATHS` - WHY: Opcore watch roots must not inherit old-tool scoping accidentally.
 - #19 graph discovery excludes generated/private/dependency roots even without repo ignore files: `.git`, `node_modules`, `.pnpm`, `vendor`, `dist`, `target`, `.ace`, `.agents`, `.claude`, `.codex`, `.gemini`, `.lattice`, `.opencode`, `.rox-cache`, and `.robustness-engine-cache` - WHY: cache/vendor/provider mirror changes must not create graph facts, freshness changes, validation input, or FTS rows.
 - #17/#19/#21 source/coverage policy is reconciled across graph-core, validation, and Opcore status/metrics: graph-extractable TypeScript, JavaScript, Python `.py`/`.pyi`, and Rust `.rs`; validation-supported TS/JS variants, Python source/stubs, Rust source/includes, and `Cargo.toml`; retained `Cargo.lock`; unsupported/degraded stacks and missing Python tools are counted honestly.
@@ -180,6 +180,7 @@ Opcore is the code-intelligence and robustness monorepo for graph context, edit
 - #26 adds the validation-owned GraphProvider consumer boundary: `ValidationGraphProviderClient`, cached `ValidationGraphQuerySession`, graph requirement preloading, status/query failure mapping, and helper access for metadata, file checksums, IMPORTS_FROM, CALLS, and TESTED_BY facts.
 - #57 adds the TypeScript validation adapter: `@the-open-engine/opcore-validation-typescript` exports package-owned syntax, type, import-graph, dead-code, and relevant-tests check definitions. Syntax/type checks use the validation file view and an overlay-aware compiler host, including tsconfig path aliases for repo files and deterministic node_modules/package declaration resolution for external package imports; graph checks require #26 graph sessions and batched IMPORTS_FROM, CALLS, and TESTED_BY fact requirements.
 - #20 adds the Rust validation adapter: `@the-open-engine/opcore-validation-rust` exports package-owned source hygiene, fmt, cargo-check, clippy, rustdoc, import-graph, dead-code, graph-signals, unused-deps, file-length, and function-metrics checks. `rust.graph-signals` is graph-provider-backed evidence from `ValidationGraphProviderClient` only (untested public Rust surface, dead public exports, module orphans/cycles); it does not replace mechanical cargo/rustdoc/clippy/Rox guardrails. #61 makes the five retained Rust rows native when supporting tools are available: rustdoc diagnostics block through `cargo doc`, import-graph reports unresolved modules/use paths/orphans/cycles from fileView, dead-code combines Cargo `dead_code` with orphan-source evidence, unused-deps parses cargo-udeps with workspace/package scoping, and function-metrics parses rust-code-analysis JSON object/array output. Missing `rustdoc`, `cargo-depgraph`, `cargo-udeps`, or `rust-code-analysis-cli` stays degraded or unsupported with `requiredTool` and retained `currentUsage`; no generic retained row remains for available tools. Rust checks materialize temporary workspaces from `ValidationCheckContext.fileView` after-state content for Cargo tools, add no validation daemon or hidden cache, never shell out to Rox, and keep current external Rust guardrails active until #29/#30 accept replacement receipts. #138 shares cargo-check JSON with dead-code, forbids a second dead-code cargo compile or `-Ddead_code` cache-busting flags, and injects a persistent `CARGO_TARGET_DIR` outside the worktree through `runTool`; cache keys must derive from generic repo, scope, overlay, platform, and toolchain inputs and cleanup must remain TTL/size bounded - WHY: Rust validation must be fast without leaking hypothetical after-state into real worktrees or tuning behavior to one repository.
+- Rust Cargo/native checks share one environment-keyed materialized workspace per validation file-view state through runner-owned disposable resources; the runner removes it on every exit - WHY: exact staged/tree/overlay semantics require state isolation, while per-check whole-repo copies create unbounded filesystem-event churn.
 - #151/#214 adds clone detection through the existing `opcore-graph-core` binary as a `clone` subcommand plus `@the-open-engine/opcore-validation-clone`. `CloneAnalysisRequest`/`CloneAnalysisResult` use `opcore.clone.v1`; committed analysis may refresh `.opcore/clone/clone.db`, while scoped or hypothetical analysis is ephemeral. The sparse request shape sends committed candidates as `paths`/`sourcePaths` plus `sourceReadMode`/`sourceTreeRef`, with full content only in write overlays. `clone.duplication` is a validation adapter check with injected native invocation, no graph requirement, no line-level identity, no daemon, and no SAST/security or score claim.
 - #27 adds canonical validation CLI surfaces: `opcore check` implements `files`, `staged`, `changed`, `tree`, `all`, and `manifest`; `tree` reads committed Git tree content from `--tree <ref>` and scopes files from `--changed-from <ref>` without consuming dirty worktree files. `opcore validate` implements `--request-file`, `hypothetical --request-file`, `pre-write --request-file --timeout-ms --json`, and `manifest`; runtime-owned `opcore status --json` includes `repoState`, while `opcore doctor --json` includes typed `runtimeInfo`, `opcoreDoctor`, and transitional `validationStatus` payloads with adapter routes, check ids, manifest entries, graph status, and daemon readiness metadata. #58 defines `opcore validate pre-write --request-file <validation-request.json> --timeout-ms 30000 --json` as the hook-safe, fail-closed pre-write contract with typed `PreWriteValidationReceipt` output.
 - #69 removes public runtime lifecycle command groups: top-level start and stop are unsupported unless a later architecture decision adopts them. Runtime readiness remains `opcore status` and `opcore doctor`; graph daemon lifecycle/status remains graph-owned under `opcore graph`.

Cargo.toml

@@ -3,7 +3,7 @@ members = ["crates/graph-core"]
 resolver = "2"
 
 [workspace.package]
-version = "0.2.0"
+version = "0.2.1"
 edition = "2021"
 license = "MIT"
 repository = "https://github.com/the-open-engine/opcore"