Purge deprecated toolchain and enforce strict self-validation

.github/workflows/ci.yml

@@ -69,6 +69,17 @@ jobs:
         with:
           targets: x86_64-unknown-linux-musl
 
+      - name: Provision pinned cargo-udeps proof artifact
+        run: |
+          rustup toolchain install nightly-2026-07-27 --profile minimal
+          cargo +nightly-2026-07-27 install cargo-udeps --version 0.1.61 --locked
+          test "$(cargo +nightly-2026-07-27 udeps --version)" = "cargo-udeps 0.1.61"
+
+      - name: Provision pinned Rust function-metrics proof artifact
+        run: |
+          cargo install rust-code-analysis-cli --version 0.0.25 --locked
+          test "$(rust-code-analysis-cli --version)" = "rust-code-analysis-cli 0.0.25"
+
       - name: Setup Linux musl toolchain
         run: sudo apt-get update && sudo apt-get install -y musl-tools
 
@@ -83,6 +94,8 @@ jobs:
 
       - name: Check
         run: npm run ci
+        env:
+          OPCORE_RUST_NIGHTLY_TOOLCHAIN: nightly-2026-07-27
 
       - name: Prove authoritative mypy after-state execution
         run: npm run python:mypy-authority-proof

.gitignore

@@ -2,18 +2,15 @@ node_modules/
 dist/
 *.tsbuildinfo
 target/
-.ace/
 .agents/
 .claude/
 .codex/
 .gemini/
 .opencode/
-.code-review-graph/
-.rox-cache/
-.robustness-engine-cache/
 .zeroshot/*
 !.zeroshot/settings.json
-.opcore/
+.opcore/*
+!.opcore/config
 .asp/
 coverage/
 *.tgz

.opcore/config

@@ -0,0 +1,85 @@
+{
+  "validation": {
+    "adapters": [
+      "typescript",
+      "rust",
+      "python",
+      "docs",
+      "clone"
+    ],
+    "pathPolicy": {
+      "exclude": [
+        "packages/fixtures/",
+        "tests/fixtures/",
+        "packages/opcore-graph-core-darwin-arm64/",
+        "packages/opcore-graph-core-darwin-x64/",
+        "packages/opcore-graph-core-linux-x64/"
+      ]
+    },
+    "checks": {
+      "packs": [],
+      "disabled": [],
+      "defaults": [
+        "typescript.syntax",
+        "typescript.types",
+        "typescript.lint",
+        "typescript.import-graph",
+        "typescript.dead-code",
+        "typescript.function-metrics",
+        "typescript.relevant-tests",
+        "typescript.file-length",
+        "rust.source-hygiene",
+        "rust.fmt",
+        "rust.cargo-check",
+        "rust.clippy",
+        "rust.rustdoc",
+        "rust.import-graph",
+        "rust.dead-code",
+        "rust.graph-signals",
+        "rust.unused-deps",
+        "rust.file-length",
+        "rust.function-metrics",
+        "python.syntax",
+        "python.source-hygiene",
+        "python.ruff-lint",
+        "python.ruff-format",
+        "python.types",
+        "python.import-graph",
+        "python.dead-code",
+        "python.relevant-tests",
+        "python.pytest",
+        "docs.existence",
+        "docs.staleness",
+        "docs.freshness",
+        "docs.length",
+        "docs.dry",
+        "docs.content-quality",
+        "docs.code-blocks",
+        "docs.rules-why",
+        "docs.hub-coverage",
+        "docs.subtree-coverage",
+        "clone.duplication"
+      ],
+      "typescript": {
+        "fileLength": {
+          "maxFileLines": 300
+        },
+        "functionMetrics": {
+          "maxFunctionLines": 80,
+          "maxComplexity": 10,
+          "maxParams": 4
+        }
+      },
+      "rust": {
+        "fileLength": {
+          "maxFileLines": 500
+        },
+        "functionMetrics": {
+          "maxFunctionLines": 80,
+          "maxComplexity": 10,
+          "maxParams": 4
+        }
+      }
+    }
+  }
+}

.zeroshot/settings.json

@@ -5,7 +5,7 @@
   "worktree": {
     "baseRef": "origin/dev",
     "setup": [
-      "npm run setup"
+      "npm ci"
     ]
   },
   "ship": {

crates/graph-core/src/clone/mod.rs

@@ -257,17 +257,25 @@ fn validate_positive_option(label: &str, value: Option<usize>) -> Result<(), Clo
 }
 
 fn validate_request_paths(request: &CloneAnalysisRequest) -> Result<(), CloneError> {
-    for path in &request.paths {
-        normalize_repo_relative_path(path, "clone request path")
-            .map_err(|message| CloneError::InvalidRequest(message.to_string()))?;
-    }
+    validate_normalized_paths(&request.paths, "clone request path")?;
     if let Some(paths) = &request.source_paths {
-        for path in paths {
-            normalize_repo_relative_path(path, "clone request source path")
-                .map_err(|message| CloneError::InvalidRequest(message.to_string()))?;
-        }
+        validate_normalized_paths(paths, "clone request source path")?;
+    }
+    validate_partitions(&request.partitions)?;
+    validate_patterns(&request.exclude, "clone exclude pattern")?;
+    validate_overlay_paths(&request.overlays)
+}
+
+fn validate_normalized_paths(paths: &[String], label: &str) -> Result<(), CloneError> {
+    for path in paths {
+        normalize_repo_relative_path(path, label)
+            .map_err(|message| CloneError::InvalidRequest(message.to_string()))?;
     }
-    for (index, partition) in request.partitions.iter().enumerate() {
+    Ok(())
+}
+
+fn validate_partitions(partitions: &[Vec<String>]) -> Result<(), CloneError> {
+    for (index, partition) in partitions.iter().enumerate() {
         if partition.is_empty() {
             return Err(CloneError::InvalidRequest(format!(
                 "partitions[{index}] must not be empty"
@@ -277,10 +285,18 @@ fn validate_request_paths(request: &CloneAnalysisRequest) -> Result<(), CloneErr
             validate_clone_pattern(pattern, "clone partition pattern")?;
         }
     }
-    for pattern in &request.exclude {
-        validate_clone_pattern(pattern, "clone exclude pattern")?;
+    Ok(())
+}
+
+fn validate_patterns(patterns: &[String], label: &str) -> Result<(), CloneError> {
+    for pattern in patterns {
+        validate_clone_pattern(pattern, label)?;
     }
-    for overlay in &request.overlays {
+    Ok(())
+}
+
+fn validate_overlay_paths(overlays: &[CloneOverlay]) -> Result<(), CloneError> {
+    for overlay in overlays {
         normalize_repo_relative_path(overlay.path(), "clone overlay path")
             .map_err(|message| CloneError::InvalidRequest(message.to_string()))?;
     }

crates/graph-core/src/clone/store.rs

@@ -1,6 +1,6 @@
 use super::analysis::{CloneClass, CloneSource};
 use super::{CloneError, CLONE_PROTOCOL, CLONE_STORE_SCHEMA_VERSION};
-use rusqlite::{params, Connection};
+use rusqlite::{params, Connection, Transaction};
 use std::path::{Path, PathBuf};
 
 pub(super) fn persist_clone_index(
@@ -14,9 +14,22 @@ pub(super) fn persist_clone_index(
     let mut connection = Connection::open(&db_path)?;
     initialize_clone_schema(&connection)?;
     let transaction = connection.transaction()?;
+    reset_clone_index(&transaction)?;
+    write_clone_metadata(&transaction)?;
+    write_clone_sources(&transaction, sources)?;
+    write_clone_classes(&transaction, classes)?;
+    transaction.commit()?;
+    Ok(db_path)
+}
+
+fn reset_clone_index(transaction: &Transaction<'_>) -> Result<(), CloneError> {
     transaction.execute("delete from clone_occurrences", [])?;
     transaction.execute("delete from clone_files", [])?;
     transaction.execute("delete from clone_metadata", [])?;
+    Ok(())
+}
+
+fn write_clone_metadata(transaction: &Transaction<'_>) -> Result<(), CloneError> {
     transaction.execute(
         "insert into clone_metadata(key, value) values ('protocol', ?1)",
         params![CLONE_PROTOCOL],
@@ -25,12 +38,26 @@ pub(super) fn persist_clone_index(
         "insert into clone_metadata(key, value) values ('schema_version', ?1)",
         params![CLONE_STORE_SCHEMA_VERSION.to_string()],
     )?;
+    Ok(())
+}
+
+fn write_clone_sources(
+    transaction: &Transaction<'_>,
+    sources: &[CloneSource],
+) -> Result<(), CloneError> {
     for source in sources {
         transaction.execute(
             "insert into clone_files(path, language, sha256) values (?1, ?2, ?3)",
             params![source.path, source.language, source.sha256],
         )?;
     }
+    Ok(())
+}
+
+fn write_clone_classes(
+    transaction: &Transaction<'_>,
+    classes: &[CloneClass],
+) -> Result<(), CloneError> {
     for class in classes {
         for occurrence in &class.occurrences {
             transaction.execute(
@@ -45,8 +72,7 @@ pub(super) fn persist_clone_index(
             )?;
         }
     }
-    transaction.commit()?;
-    Ok(db_path)
+    Ok(())
 }
 
 fn initialize_clone_schema(connection: &Connection) -> Result<(), CloneError> {

crates/graph-core/src/daemon/tests.rs

@@ -3,9 +3,10 @@ use crate::protocol::{
     GraphFactQueryKind, GraphFactQueryRequest, GraphFactQuerySelector, GraphImpactRequest,
     GraphProviderMode, GraphSearchRequest, RepoIdentity,
 };
+use crate::test_support::wave1_fixture_root;
 use serde_json::{json, Value};
 use std::fs;
-use std::path::{Path, PathBuf};
+use std::path::Path;
 use std::time::Duration;
 use tempfile::TempDir;
 
@@ -383,12 +384,6 @@ fn copied_wave1_fixture() -> Result<TempDir, std::io::Error> {
     Ok(destination)
 }
 
-fn wave1_fixture_root() -> Result<PathBuf, std::io::Error> {
-    PathBuf::from(env!("CARGO_MANIFEST_DIR"))
-        .join("../../packages/fixtures/source-extraction/wave1")
-        .canonicalize()
-}
-
 fn copy_dir(source: &Path, destination: &Path) -> Result<(), std::io::Error> {
     let mut pending = vec![(source.to_path_buf(), destination.to_path_buf())];
     while let Some((from_dir, to_dir)) = pending.pop() {