[hartsock]

Part of #23 (Epic 0 — Foundations), item F5. Does not close it: F2–F4 remain.

Summary

The justfile and the pre-push hook have each claimed
PIPELINE PARITY: mirrors .github/workflows/ci.yml for their entire
existence — against a file that did not exist. Two starter-template
workflows were added yesterday, neither of which is that file, and one of
which is red on main right now.

This makes the claim true.

The governing decision: CI invokes the just recipes rather than re-typing
the cargo commands into YAML. Parity then holds by construction instead of by
comment, and the 78% coverage floor lives in exactly one place. Every
duplicated command string is a future drift bug; the repo already had three.

What changes

File	Action
.github/workflows/ci.yml	new — three jobs: gate, msrv, coverage
.github/workflows/rust.yml	deleted
.github/workflows/generator-generic-ossf-slsa3-publish.yml	deleted
justfile	check split into callable recipes; --locked; new test-features
.githooks/pre-push	parity comments now point at a file that exists
Cargo.toml	rust-version 1.85 → 1.88

Three findings that changed the work

1. A vacuous green on security code

monitor-station/tests/identity.rs is #![cfg(feature = "newt")], and the
crate declares default = []. So cargo test --workspace never compiles it —
the file is not even listed in the test output.

Four tests covering read-only object-capability key minting and caveat
attenuation have never run under any gate, local or CI. They pass when asked
(cargo test -p monitor-station --features newt → 4 passed). They were
simply never asked. New just test-features recipe, wired into both gates.

2. The declared MSRV was false

rust-version = "1.85" (which I introduced in #22, taking it from
content-addressable's declared floor rather than the resolved graph). A clean
rust:1.85-bookworm container refuses outright:

error: rustc 1.85.1 is not supported by the following packages:
  darling@0.23.0 requires rustc 1.88.0
  built@0.8.1 requires rustc 1.87
  icu_collections@2.2.0 requires rustc 1.86

A transitive dep raised the real floor and nothing caught it, because nothing
had ever built at the floor. Corrected to 1.88, and the new msrv job closes
the hole permanently.

3. The SLSA workflow could never have worked

Beyond attesting two files created by echo artifact1 > artifact1: the build
job declares outputs: digests: ${{ steps.hash.outputs.digests }} while the
step writes hashes= to $GITHUB_OUTPUT. base64-subjects arrives empty.
Anyone who "just swaps in the real binary" inherits a workflow that still
fails. There is also no tag, no release, and no LICENSE file. Deleted;
re-add provenance inside a real release.yml when there is something to
attest.

Evidence, not assumption

System dependencies are libasound2-dev + pkg-config and nothing else,
established two independent ways that agree:

• cargo tree -i pkg-config → exactly two consumers (alsa-sys, wayland-sys)
• a clean rust:1.88-bookworm container runs fmt + clippy -D warnings + all
  24 test suites green with only those installed

No X11/GTK/GL/xkbcommon packages: wayland-sys resolves with dlopen,
x11-dl maps a pkg-config miss to None, and glutin/glow load GL at runtime.
eframe's reputation says otherwise; this dependency tree does not. alsa-sys
is the hard blocker — its build.rs probes pkg-config and panics, which is
exactly what killed run 34062498409.

Details worth reviewing

• pull_request: carries no branches: filter, on purpose. Under
  branches: [main], a stacked PR matches neither trigger, runs nothing, and
  GitHub still reports mergeStateStatus=CLEAN. "No checks ran" must never
  render as green.
• cargo-llvm-cov is pinned to 0.8.7. newt-agent #100 found 0.8.5 silently
  exiting 0 when --fail-under-lines is combined with --lcov --output-path —
  the coverage gate stops gating and nobody notices. An unpinned upgrade could
  reintroduce that.
• --locked everywhere. Cargo.lock is committed but no gate honoured it,
  so CI could resolve newer deps than the hook validated. Verified clean today.
• if: always() between sibling gate steps, so a fmt failure cannot mask a
  clippy failure.

Test plan

just check and just cov-ci both pass locally, and the pre-push hook (which
runs both) accepted this branch. The CI run on this PR is the real test —
it is the first time this pipeline has ever executed.

⚠️ Known tight margin: coverage is 78.06% against a 78% floor —
about three uncovered lines of headroom across 4741. If CI lands at 77.9x,
do not lower the floor (the justfile documents it as a one-way ratchet, and
it went 76 → 78 only one PR ago). Add a test instead; the largest gap is
monitor-gui/src/lib.rs at 58%.

Deliberately not in this PR

Secret scanning (#20) — the repo currently leaks 192.168.0.104 three times
in README.md, the real nuc address, in a public repo. That is a
remediation change to the tree, not a CI-parity change, and it deserves its own
PR rather than being buried in this one. Flagged separately.

🤖 Generated with Claude Code