chore(release): prepare public source release

crates/common/tests/ai_prompt.rs

@@ -0,0 +1,276 @@
+//! Tests for the generated Mercury Toolbox AI assets.
+
+use std::fs;
+use std::path::{Path, PathBuf};
+
+use serde_json::Value;
+
+fn workspace_root() -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("..")
+        .join("..")
+        .canonicalize()
+        .expect("workspace root")
+}
+
+fn workspace_path(root: &Path, relative_path: &[&str]) -> PathBuf {
+    relative_path
+        .iter()
+        .fold(root.to_path_buf(), |path, component| path.join(component))
+}
+
+fn read_workspace_text(root: &Path, relative_path: &[&str], label: &str) -> String {
+    fs::read_to_string(workspace_path(root, relative_path))
+        .unwrap_or_else(|error| panic!("failed to read {label}: {error}"))
+}
+
+fn toolbox_commands(root: &Path) -> Vec<String> {
+    let commands = read_workspace_text(
+        root,
+        &["scripts", "toolbox-commands.ps1"],
+        "scripts/toolbox-commands.ps1",
+    );
+    let mut in_command_list = false;
+    let mut consumed_command_list = false;
+    let mut names = commands
+        .lines()
+        .filter_map(|line| {
+            let trimmed = line.trim();
+            if trimmed == "return @(" && !in_command_list && !consumed_command_list {
+                in_command_list = true;
+                return None;
+            }
+            if in_command_list && trimmed == ")" {
+                in_command_list = false;
+                consumed_command_list = true;
+                return None;
+            }
+            if !in_command_list {
+                return None;
+            }
+            trimmed
+                .strip_prefix('\'')
+                .and_then(|rest| rest.split_once('\''))
+                .map(|(name, _)| name.to_string())
+        })
+        .collect::<Vec<_>>();
+    names.sort();
+    names.dedup();
+    names
+}
+
+fn assert_lf_only(root: &Path, relative_path: &[&str]) {
+    let path = workspace_path(root, relative_path);
+    let bytes = fs::read(&path).unwrap_or_else(|error| panic!("read {}: {error}", path.display()));
+    assert!(
+        !bytes.windows(2).any(|window| window == b"\r\n"),
+        "{} should use LF line endings",
+        path.display()
+    );
+}
+
+#[test]
+fn ai_prompt_assets_exist_and_cover_every_tool() {
+    let root = workspace_root();
+    let prompt = read_workspace_text(
+        &root,
+        &["docs", "ai", "mercury-toolbox-ai-prompt.md"],
+        "generated AI prompt",
+    );
+    let notes = read_workspace_text(
+        &root,
+        &["docs", "ai", "toolbox-ai-prompt-notes.json"],
+        "AI prompt notes",
+    );
+    let commands = toolbox_commands(&root);
+
+    assert!(prompt.contains("Mercury Toolbox"));
+    assert!(prompt.contains("PowerShell"));
+    assert!(prompt.contains("`--json`"));
+    assert!(prompt.contains("`--toon`"));
+    assert!(prompt.contains("Available tools:"));
+    assert!(prompt.contains("Rules:"));
+    assert!(prompt.contains("Pipe external JSON into `toon`"));
+    assert!(prompt.contains("Every tool has guided triage metadata"));
+    assert!(prompt.contains("Guided: answer="));
+    assert!(prompt.contains("`report_quality`"));
+    assert!(prompt.contains("`next_actions`"));
+    assert!(!prompt.contains("toon --from json --to toon"));
+    assert!(prompt.contains("Usage: `"));
+    assert!(prompt.contains("Example:"));
+    assert!(prompt.contains("msudo:"));
+    assert!(prompt.contains("Top-level high-risk command"));
+    assert!(prompt.contains(
+        "msudo status --json | ConvertFrom-Json | Select-Object ok,host,supports_runas,is_elevated"
+    ));
+    assert!(!prompt.contains("## Tool Catalog"));
+    assert!(!prompt.contains("### `"));
+    assert!(!prompt.contains("$Fence"));
+    assert!(
+        prompt.lines().count() <= 120,
+        "prompt should stay compact for AI consumption"
+    );
+
+    assert_eq!(commands.len(), 59, "toolbox command inventory changed");
+    let notes_json = serde_json::from_str::<Value>(&notes).expect("AI prompt notes JSON");
+    let tools = notes_json["tools"].as_object().expect("notes tools object");
+
+    for command in commands {
+        assert!(
+            prompt.contains(&format!("{command}:")),
+            "prompt should contain {command}"
+        );
+        assert!(
+            notes.contains(&format!("\"{command}\"")),
+            "notes should contain {command}"
+        );
+        let guided = tools
+            .get(&command)
+            .and_then(|tool| tool.get("guided_triage"))
+            .unwrap_or_else(|| panic!("notes should contain guided_triage for {command}"));
+        assert!(
+            guided["answer"]
+                .as_str()
+                .is_some_and(|value| !value.is_empty()),
+            "guided_triage.answer should be non-empty for {command}"
+        );
+        assert!(
+            guided["trust"]
+                .as_str()
+                .is_some_and(|value| !value.is_empty()),
+            "guided_triage.trust should be non-empty for {command}"
+        );
+        assert!(
+            guided["next_actions"]
+                .as_array()
+                .is_some_and(|items| items.len() >= 2
+                    && items
+                        .iter()
+                        .all(|item| item.as_str().is_some_and(|value| !value.is_empty()))),
+            "guided_triage.next_actions should list at least two actions for {command}"
+        );
+    }
+
+    assert!(
+        notes.contains("msudo status --json | ConvertFrom-Json | Select-Object ok,host,supports_runas,is_elevated"),
+        "notes should document the stable msudo status discovery fields"
+    );
+}
+
+#[test]
+fn ai_skill_assets_exist_and_cover_every_tool() {
+    let root = workspace_root();
+    let skill = read_workspace_text(
+        &root,
+        &["skills", "mercury-toolbox", "SKILL.md"],
+        "generated skill",
+    );
+    let catalog = read_workspace_text(
+        &root,
+        &[
+            "skills",
+            "mercury-toolbox",
+            "references",
+            "command-catalog.md",
+        ],
+        "generated skill catalog",
+    );
+    let openai_yaml = read_workspace_text(
+        &root,
+        &["skills", "mercury-toolbox", "agents", "openai.yaml"],
+        "generated openai.yaml",
+    );
+
+    assert!(skill.contains("Mercury Toolbox"));
+    assert!(skill.contains("Prefer Mercury readers over `Get-Content`"));
+    assert!(skill.contains("## Modern Pairings"));
+    assert!(skill.contains("## Job Routing"));
+    assert!(skill.contains("Windows driver: start with `drvshape <SYS>`"));
+    assert!(skill.contains("`report_quality` and `next_actions`"));
+    assert!(skill.contains("Use `rg` over recursive `grep`"));
+    assert!(skill.contains("Treat `msudo` as the top-level high-risk toolbox command"));
+    assert!(skill.contains("`msudo status --json`"));
+    assert!(skill.contains("references/command-catalog.md"));
+    assert!(skill.contains("switch to `--toon` or `--format toon`"));
+    assert!(!skill.contains("toon --from json --to toon"));
+    assert!(skill.lines().count() <= 95, "skill should stay concise");
+
+    assert!(catalog.contains("# Mercury Toolbox Command Catalog"));
+    assert!(catalog.contains("Keep output compact"));
+    assert!(catalog.contains("TOON example:"));
+    assert!(catalog.contains("Guided answer:"));
+    assert!(catalog.contains("Trust basis:"));
+    assert!(catalog.contains("Next actions:"));
+    assert!(catalog.contains("--toon"));
+    assert!(!catalog.contains("toon --from json --to toon"));
+    assert!(catalog.contains("### `msudo`"));
+    assert!(catalog.contains("Top-level high-risk command"));
+    assert!(catalog.contains(
+        "msudo status --json | ConvertFrom-Json | Select-Object ok,host,supports_runas,is_elevated"
+    ));
+    assert!(
+        catalog.lines().count() <= 520,
+        "catalog should stay compact"
+    );
+
+    assert!(openai_yaml.contains("display_name: \"Mercury Toolbox\""));
+    assert!(openai_yaml.contains("icon_small: \"./assets/logo.png\""));
+    assert!(openai_yaml.contains("icon_large: \"./assets/logo.png\""));
+    assert!(openai_yaml.contains("brand_color: \"#35C2FF\""));
+    assert!(openai_yaml.contains("default_prompt: \"Use $mercury-toolbox first"));
+    assert!(
+        root.join("skills")
+            .join("mercury-toolbox")
+            .join("assets")
+            .join("logo.png")
+            .is_file(),
+        "generated skill should include its logo asset"
+    );
+
+    for command in toolbox_commands(&root) {
+        assert!(
+            catalog.contains(&format!("### `{command}`")),
+            "catalog should contain {command}"
+        );
+    }
+}
+
+#[test]
+fn generated_ai_markdown_assets_use_lf_line_endings() {
+    let root = workspace_root();
+    assert_lf_only(&root, &["docs", "ai", "mercury-toolbox-ai-prompt.md"]);
+    assert_lf_only(&root, &["skills", "mercury-toolbox", "SKILL.md"]);
+    assert_lf_only(
+        &root,
+        &[
+            "skills",
+            "mercury-toolbox",
+            "references",
+            "command-catalog.md",
+        ],
+    );
+}
+
+#[test]
+fn readme_tool_map_covers_every_toolbox_command() {
+    let root = workspace_root();
+    let readme = read_workspace_text(&root, &["README.md"], "README.md");
+
+    assert!(readme.contains("### Tool Map"));
+    assert!(readme.contains("## Which Tool First"));
+    assert!(readme.contains("Safe starter commands"));
+    assert!(readme.contains("Every command has guided triage notes"));
+    assert!(readme.contains("`report_quality` and `next_actions`"));
+    assert!(readme.contains("Every command supports `--help`"));
+    for command in toolbox_commands(&root) {
+        assert!(
+            readme.contains(&format!("| `{command}` |")),
+            "README tool map should contain {command}"
+        );
+    }
+
+    assert!(readme.contains("### `asmflow`"));
+    assert!(readme.contains("### `unityasset`"));
+    assert!(readme.contains("### `unityprobe`"));
+    assert!(readme.contains("### `unitydiag`"));
+}

crates/common/tests/contract.rs

@@ -0,0 +1,150 @@
+//! Contract tests for shared CLI helpers.
+
+use common::{
+    CliError, ColorChoice, CommonArgs, ExitCode, InputFormat, RenderMode, emit_json,
+    emit_structured, formats, map_result_count, parse_color_choice, parse_format_choice,
+    parse_input_format, should_read_stdin,
+};
+use serde::Serialize;
+use serde_json::{Map, Value, json};
+
+#[test]
+fn parses_shared_choice_values() {
+    let parsed = CommonArgs {
+        json: true,
+        format: None,
+        input_format: parse_input_format("jsonl").expect("input format"),
+        color: parse_color_choice("never").expect("color choice"),
+        quiet: false,
+    };
+
+    assert!(parsed.json);
+    assert_eq!(parsed.input_format, InputFormat::Jsonl);
+    assert_eq!(parsed.color, ColorChoice::Never);
+    assert_eq!(parsed.render_mode(), RenderMode::Json);
+    assert_eq!(
+        parse_format_choice("toon").expect("format choice"),
+        RenderMode::Toon
+    );
+
+    let input_error = parse_input_format("yaml").expect_err("invalid input format");
+    let color_error = parse_color_choice("always").expect_err("invalid color choice");
+    let format_error = parse_format_choice("yaml").expect_err("invalid format choice");
+    assert!(matches!(input_error, CliError::Usage(_)));
+    assert!(matches!(color_error, CliError::Usage(_)));
+    assert!(matches!(format_error, CliError::Usage(_)));
+}
+
+#[test]
+fn auto_stdin_reads_only_without_explicit_input_and_when_not_terminal() {
+    assert!(should_read_stdin(false, false));
+    assert!(!should_read_stdin(false, true));
+    assert!(!should_read_stdin(true, false));
+}
+
+#[test]
+fn maps_result_count_to_exit_code() {
+    assert_eq!(map_result_count(1), ExitCode::Success);
+    assert_eq!(map_result_count(0), ExitCode::NoResults);
+}
+
+#[test]
+fn emits_single_json_document() {
+    #[derive(Serialize)]
+    struct Demo<'a> {
+        name: &'a str,
+    }
+
+    let rendered = emit_json(&Demo { name: "jsonlgrep" }).expect("json output");
+
+    assert_eq!(rendered, "{\"name\":\"jsonlgrep\"}\n");
+}
+
+#[test]
+fn emits_structured_toon_document() {
+    #[derive(Serialize)]
+    struct Demo<'a> {
+        name: &'a str,
+        count: u8,
+    }
+
+    let rendered = emit_structured(
+        &Demo {
+            name: "jsonlgrep",
+            count: 2,
+        },
+        RenderMode::Toon,
+    )
+    .expect("toon output");
+
+    let lines = rendered.lines().collect::<Vec<_>>();
+    assert_eq!(lines.len(), 2);
+    assert!(lines.contains(&"name: jsonlgrep"));
+    assert!(lines.contains(&"count: 2"));
+    assert!(rendered.ends_with('\n'));
+}
+
+#[test]
+fn structured_toon_render_rejects_values_past_explicit_depth_limit() {
+    let error = emit_structured(&deeply_nested_value(260), RenderMode::Toon)
+        .expect_err("deep TOON encode should fail");
+
+    assert!(matches!(
+        error,
+        CliError::Runtime(message) if message.contains("maximum TOON encoding depth")
+    ));
+}
+
+#[test]
+fn exposes_json_family_format_modules() {
+    let records = vec![json!({"id": "user-1", "active": true})];
+
+    let ison = formats::ison::encode_records(&records, "record").expect("ison records");
+    assert!(ison.contains("object.record|"));
+    assert!(ison.contains("id:str"));
+    assert!(ison.contains("active:bool"));
+    assert_eq!(
+        formats::ison::decode_record_line(&ison, 1).expect("ison decode"),
+        records[0]
+    );
+
+    let zon = formats::zon::encode_value(&records[0]).expect("zon");
+    assert!(zon.contains("id:\"user-1\""));
+    assert_eq!(
+        formats::zon::decode_str(&zon).expect("zon decode"),
+        records[0]
+    );
+
+    let tonl = formats::tonl::encode_documents(&records).expect("tonl");
+    assert!(tonl.contains("id = \"user-1\""));
+    assert_eq!(
+        formats::tonl::decode_documents(&tonl).expect("tonl decode"),
+        records
+    );
+}
+
+fn deeply_nested_value(depth: usize) -> Value {
+    let mut value = json!(1);
+    for index in 0..depth {
+        let mut object = Map::new();
+        object.insert(format!("k{index}"), value);
+        value = Value::Object(object);
+    }
+    value
+}
+
+#[test]
+fn isonl_roundtrips_pipe_inside_quoted_string() {
+    let records = vec![json!({"message": "left|right", "ok": true})];
+
+    let ison = formats::ison::encode_records(&records, "record").expect("ison records");
+
+    assert_eq!(
+        formats::ison::decode_record_line(ison.trim_end(), 1).expect("ison decode"),
+        records[0]
+    );
+    assert_eq!(
+        formats::ison::decode_records(&ison).expect("ison batch decode"),
+        records
+    );
+}

crates/common/tests/jade_workspace.rs

@@ -0,0 +1,484 @@
+//! Workspace policy tests for Jade Discipline.
+
+use std::fs;
+use std::path::PathBuf;
+
+fn workspace_root() -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("..")
+        .join("..")
+        .canonicalize()
+        .expect("workspace root")
+}
+
+fn workspace_path(components: &[&str]) -> PathBuf {
+    components
+        .iter()
+        .fold(workspace_root(), |path, component| path.join(component))
+}
+
+fn script_path(script_name: &str) -> PathBuf {
+    workspace_path(&["scripts", script_name])
+}
+
+fn read_workspace_text(components: &[&str], label: &str) -> String {
+    fs::read_to_string(workspace_path(components))
+        .unwrap_or_else(|error| panic!("failed to read {label}: {error}"))
+}
+
+#[test]
+fn workspace_cargo_toml_publishes_jade_lints_and_profiles() {
+    let cargo_toml = read_workspace_text(&["Cargo.toml"], "Cargo.toml");
+
+    for required_line in [
+        "rust-version = \"1.86\"",
+        "missing_docs = \"deny\"",
+        "pedantic = { level = \"deny\", priority = -3 }",
+        "nursery = { level = \"deny\", priority = -2 }",
+        "[profile.release-fast]",
+        "lto = \"fat\"",
+        "[profile.release-size]",
+        "opt-level = \"z\"",
+    ] {
+        assert!(
+            cargo_toml.contains(required_line),
+            "Cargo.toml should contain {required_line:?}"
+        );
+    }
+
+    for forbidden_line in [
+        "missing_copy_implementations",
+        "implicit_return",
+        "missing_const_for_fn",
+        "module_name_repetitions",
+        "multiple_crate_versions",
+        "must_use_candidate",
+        "needless_pass_by_value",
+    ] {
+        assert!(
+            !cargo_toml.contains(forbidden_line),
+            "Cargo.toml should not contain {forbidden_line:?}"
+        );
+    }
+}
+
+#[test]
+fn cargo_config_and_jade_docs_exist() {
+    let config = read_workspace_text(&[".cargo", "config.toml"], ".cargo/config.toml");
+    assert!(config.contains("git-fetch-with-cli = true"));
+    assert!(config.contains("rustflags = [\"-Dwarnings\"]"));
+    assert!(config.contains("frequency = \"always\""));
+    assert!(workspace_path(&["justfile"]).is_file(), "missing justfile");
+    assert!(
+        workspace_path(&["bacon.toml"]).is_file(),
+        "missing bacon.toml"
+    );
+
+    let docs = read_workspace_text(&["docs", "jade-discipline.md"], "jade discipline docs");
+    let maintainer_notes =
+        read_workspace_text(&["docs", "maintainer-notes.md"], "maintainer notes");
+    assert!(docs.contains("Jade Discipline"));
+    assert!(docs.contains("cargo clippy --all-targets --all-features -- -D warnings -W clippy::pedantic -W clippy::nursery"));
+    assert!(docs.contains("Miri, fuzzing, sanitizer, no-panic, and Loom checks are Jade gates"));
+    assert!(docs.contains(
+        "Missing tools, missing harnesses, or platform discomfort are failures by default"
+    ));
+    assert!(docs.contains("Global `allow` is reserved for two cases only"));
+    assert!(docs.contains("smallest code-local scope"));
+    assert!(docs.contains("Install"));
+    assert!(docs.contains("just"));
+    assert!(docs.contains("bacon"));
+    assert!(maintainer_notes.contains("Jade has no optional safety tier"));
+    assert!(maintainer_notes.contains("Every JSON-capable Mercury tool"));
+    assert!(maintainer_notes.contains("is the shared AST/indexing engine"));
+}
+
+#[test]
+fn release_packaging_scripts_and_docs_exist() {
+    for script_name in [
+        "package-toolbox.ps1",
+        "install-package-toolbox.ps1",
+        "uninstall-package-toolbox.ps1",
+        "generate-ai-skill.ps1",
+        "check-ai-skill.ps1",
+    ] {
+        assert!(
+            script_path(script_name).is_file(),
+            "missing packaging script {script_name}"
+        );
+    }
+
+    let readme = read_workspace_text(&["README.md"], "README.md");
+    assert!(readme.contains("just"));
+    assert!(readme.contains("bacon"));
+    assert!(readme.contains("## Portable Package"));
+    assert!(readme.contains(r".\scripts\package-toolbox.ps1"));
+    assert!(readme.contains("install-package-toolbox.ps1"));
+    assert!(readme.contains("mercury-toolbox-package.json"));
+    assert!(readme.contains("SHA256SUMS.txt"));
+    assert!(readme.contains("generate-ai-skill.ps1"));
+    assert!(readme.contains(r".\skills\mercury-toolbox\"));
+    assert!(readme.contains("### `msudo`"));
+    assert!(readme.contains("HIGH RISK"));
+    assert!(readme.contains("top-level high-risk toolbox command"));
+    assert!(readme.contains("msudo status --json"));
+    assert!(readme.contains("Select-Object ok,host,supports_runas,is_elevated"));
+    assert!(readme.contains("msudo --help"));
+    assert!(readme.contains("msudo run --help"));
+}
+
+#[test]
+#[allow(clippy::too_many_lines)]
+fn powershell_gate_assets_and_docs_exist() {
+    let root = workspace_root();
+    assert!(
+        script_path("check-powershell.ps1").is_file(),
+        "missing PowerShell gate script"
+    );
+    assert!(
+        script_path("cargo-flamegraph-windows.ps1").is_file(),
+        "missing Windows flamegraph wrapper script"
+    );
+    assert!(
+        workspace_path(&["PSScriptAnalyzerSettings.psd1"]).is_file(),
+        "missing PowerShell analyzer settings"
+    );
+
+    let check_jade = read_workspace_text(&["scripts", "check-jade.ps1"], "scripts/check-jade.ps1");
+    assert!(check_jade.contains("check-powershell.ps1"));
+    assert!(check_jade.contains("check-ai-skill.ps1"));
+    assert!(check_jade.contains("check-jade-hardening.ps1"));
+    assert!(
+        check_jade.contains("Invoke-TimedNativeWithEnvironment"),
+        "Jade coverage gate should be able to isolate cargo-llvm-cov environment"
+    );
+    assert!(
+        check_jade.contains("CARGO_INCREMENTAL") && check_jade.contains("RUSTC_WRAPPER"),
+        "Jade coverage gate should disable incremental and rustc-wrapper for cargo-llvm-cov"
+    );
+    assert!(
+        check_jade.contains("CARGO_TARGET_DIR")
+            && check_jade.contains("mercury-jade-llvm-cov")
+            && check_jade.contains("cargo llvm-cov clean")
+            && check_jade
+                .contains("Invoke-TimedNativeWithEnvironment -Name 'cargo llvm-cov clean'"),
+        "Jade coverage gate should use a per-run isolated cargo target dir for clean and nextest"
+    );
+    assert!(
+        check_jade.contains("MERCURY_JADE_COVERAGE_ROOT")
+            && check_jade.contains("C:\\tmp")
+            && check_jade.contains("'mtcov'")
+            && check_jade.contains(".Substring(0, 8)"),
+        "Jade coverage target dir should stay short enough for Windows llvm-cov object argv"
+    );
+    assert!(
+        check_jade.contains(
+            "'llvm-cov',\n            '--jobs',\n            '1',\n            'nextest'"
+        ),
+        "Jade coverage gate should limit cargo-llvm-cov build jobs before the nextest subcommand"
+    );
+
+    assert_justfile_test_recipes(&root);
+
+    let ecosystem = read_workspace_text(
+        &["scripts", "check-ecosystem.ps1"],
+        "ecosystem check script",
+    );
+    assert!(
+        ecosystem.contains("toolbox:all-binaries-report-version")
+            && ecosystem.contains("Test-ToolboxBinaryVersions"),
+        "ecosystem gate should prove every toolbox binary reports --version"
+    );
+    assert!(
+        ecosystem.contains("toolbox:all-binaries-no-args-contract")
+            && ecosystem.contains("Test-ToolboxNoArgsContracts"),
+        "ecosystem gate should prove every toolbox binary has bounded no-args behavior"
+    );
+    assert!(
+        ecosystem.contains("toolbox:all-binaries-invalid-flag-contract")
+            && ecosystem.contains("Test-ToolboxInvalidFlagContracts"),
+        "ecosystem gate should prove every toolbox binary has bounded invalid-flag diagnostics"
+    );
+    assert!(
+        ecosystem.contains("toolbox:all-binaries-structured-output-help")
+            && ecosystem.contains("Test-ToolboxStructuredOutputHelpContracts"),
+        "ecosystem gate should prove every toolbox binary exposes structured output help"
+    );
+    assert!(
+        ecosystem.contains("toolbox:malformed-jsonl-stdin-contract")
+            && ecosystem.contains("Test-ToolboxMalformedJsonlStdinContracts"),
+        "ecosystem gate should prove malformed JSONL stdin is bounded for input-format commands"
+    );
+    assert!(
+        ecosystem.contains("toolbox:valid-jsonl-path-stream-smokes"),
+        "ecosystem gate should prove representative positive JSONL path-stream behavior"
+    );
+    assert!(
+        ecosystem.contains("toolbox:functional-toon-smokes"),
+        "ecosystem gate should prove representative functional TOON output smokes"
+    );
+
+    let check_hardening = read_workspace_text(
+        &["scripts", "check-jade-hardening.ps1"],
+        "scripts/check-jade-hardening.ps1",
+    );
+    for required_gate in [
+        "cargo miri setup",
+        "NightlyToolchain",
+        "'fuzz'",
+        "'run'",
+        "json_family_decode",
+        "-Zsanitizer=address",
+        "check-no-panic.ps1",
+        "loom_capture",
+        "Mode 'hardening'",
+        "ValidateRange(1, 3600)",
+        "Only = 'All'",
+    ] {
+        assert!(
+            check_hardening.contains(required_gate),
+            "hardening script should contain {required_gate:?}"
+        );
+    }
+    assert!(check_hardening.contains("exemption requires a non-empty reason"));
+
+    let jade_install = read_workspace_text(
+        &["scripts", "install-jade-tooling.ps1"],
+        "scripts/install-jade-tooling.ps1",
+    );
+    assert!(jade_install.contains("PSScriptAnalyzer"));
+    assert!(jade_install.contains("cargo-binstall"));
+    assert!(jade_install.contains("\"just\", \"bacon\""));
+    assert!(jade_install.contains("\"component\", \"add\", \"miri\""));
+    assert!(jade_install.contains("\"cargo-udeps\", \"cargo-llvm-cov\""));
+    assert!(jade_install.contains("\"install\", \"cargo-fuzz\""));
+
+    let docs = read_workspace_text(&["docs", "jade-discipline.md"], "jade discipline docs");
+    assert!(docs.contains("PowerShell Gate"));
+    assert!(docs.contains("check-powershell.ps1"));
+    assert!(docs.contains("check-ai-skill.ps1"));
+    assert!(docs.contains("PSScriptAnalyzer"));
+    assert!(docs.contains("cargo-flamegraph-windows.ps1"));
+
+    let readme = read_workspace_text(&["README.md"], "README.md");
+    assert!(readme.contains("cargo-flamegraph-windows.ps1"));
+}
+
+fn assert_justfile_test_recipes(root: &std::path::Path) {
+    let justfile = fs::read_to_string(root.join("justfile")).expect("justfile");
+    assert!(
+        justfile.contains("coverage:\n    cargo llvm-cov nextest --all-features --summary-only"),
+        "just coverage should keep a fast local coverage path without forcing Jade's serial coverage gate"
+    );
+    assert!(
+        !justfile.contains("coverage:\n    cargo llvm-cov clean --workspace"),
+        "just coverage should not pre-clean coverage artifacts on every local iteration"
+    );
+    assert!(
+        justfile.contains("test:\n    cargo nextest run --all-features"),
+        "just test should keep the fast incremental nextest path for local iteration"
+    );
+    assert!(
+        justfile.contains("stable-test:")
+            && justfile.contains(
+                "CARGO_INCREMENTAL = '0'; cargo nextest run --all-features --run-ignored all",
+            ),
+        "stable-test should keep the non-incremental Windows cleanup-race path and slow integration coverage"
+    );
+}
+
+#[test]
+#[allow(clippy::too_many_lines)]
+fn repo_temp_paths_are_audited_and_use_exclusive_writes() {
+    let root = workspace_root();
+    let production_temp_dir_hits = production_source_hits(
+        &root,
+        &[
+            "std::env::temp_dir()",
+            "env::temp_dir()",
+            "tempfile::",
+            "NamedTempFile",
+            "TempDir::new",
+            "tempdir()",
+        ],
+    );
+    assert_eq!(
+        production_temp_dir_hits,
+        [
+            "crates\\argv\\src\\lib.rs:std::env::temp_dir().join(format!(",
+            "crates\\envdiff\\src\\lib.rs:std::env::temp_dir().join(format!(",
+            "crates\\msudo\\src\\lib.rs:let temp_dir = std::env::temp_dir();",
+            "crates\\runtimekit\\src\\lib.rs:std::env::temp_dir().join(format!(\"{prefix}-{unique}.{extension}\"))",
+        ],
+        "production temp root use must stay explicitly audited"
+    );
+
+    for (path, required) in [
+        (
+            "crates/runtimekit/src/lib.rs",
+            &[
+                "fn write_shell_wrapper_file",
+                ".create_new(true)",
+                "refusing to replace existing shell wrapper",
+            ][..],
+        ),
+        (
+            "crates/argv/src/lib.rs",
+            &[
+                "fn write_cmd_wrapper_file",
+                ".create_new(true)",
+                "refusing to replace existing cmd inspect wrapper",
+            ][..],
+        ),
+        (
+            "crates/envdiff/src/lib.rs",
+            &[
+                "fn write_temp_file_exclusive",
+                ".create_new(true)",
+                "fn create_temp_dir_exclusive",
+                "fs::create_dir(path)",
+            ][..],
+        ),
+        (
+            "crates/msudo/src/lib.rs",
+            &[
+                "fn write_relay_exit_status",
+                ".create_new(true)",
+                "failed to create relay exit status",
+            ][..],
+        ),
+        (
+            "crates/runprobe/src/lib.rs",
+            &[
+                "fn write_log_file_exclusive",
+                ".create_new(true)",
+                "refusing to replace existing runprobe log",
+            ][..],
+        ),
+        (
+            "crates/windowsupport/src/sudo.rs",
+            &[
+                "fn create_relay_output_file",
+                ".create_new(true)",
+                "FILE_FLAG_OPEN_REPARSE_POINT",
+            ][..],
+        ),
+    ] {
+        let body = fs::read_to_string(root.join(path)).unwrap_or_else(|error| {
+            panic!("failed to read {path}: {error}");
+        });
+        for needle in required {
+            assert!(
+                body.contains(needle),
+                "{path} should keep temp/log output guard {needle:?}"
+            );
+        }
+    }
+}
+
+fn production_source_hits(root: &std::path::Path, needles: &[&str]) -> Vec<String> {
+    let mut hits = Vec::new();
+    collect_production_source_hits(&root.join("crates"), root, needles, &mut hits);
+    hits.sort();
+    hits
+}
+
+fn collect_production_source_hits(
+    directory: &std::path::Path,
+    root: &std::path::Path,
+    needles: &[&str],
+    hits: &mut Vec<String>,
+) {
+    for entry in fs::read_dir(directory).unwrap_or_else(|error| {
+        panic!("failed to read {}: {error}", directory.display());
+    }) {
+        let path = entry.expect("directory entry").path();
+        if path.is_dir() {
+            if path.file_name().and_then(|name| name.to_str()) != Some("tests") {
+                collect_production_source_hits(&path, root, needles, hits);
+            }
+            continue;
+        }
+        if path.extension().and_then(|extension| extension.to_str()) != Some("rs") {
+            continue;
+        }
+        collect_file_hits(&path, root, needles, hits);
+    }
+}
+
+fn collect_file_hits(
+    path: &std::path::Path,
+    root: &std::path::Path,
+    needles: &[&str],
+    hits: &mut Vec<String>,
+) {
+    let body = fs::read_to_string(path).unwrap_or_else(|error| {
+        panic!("failed to read {}: {error}", path.display());
+    });
+    let mut in_test_region = path.components().any(|component| {
+        component
+            .as_os_str()
+            .to_string_lossy()
+            .eq_ignore_ascii_case("tests")
+    });
+    for line in body.lines() {
+        let trimmed = line.trim();
+        if trimmed == "#[cfg(test)]" || trimmed.starts_with("#[test]") {
+            in_test_region = true;
+        }
+        if !in_test_region && needles.iter().any(|needle| trimmed.contains(needle)) {
+            let relative = path.strip_prefix(root).unwrap_or(path);
+            hits.push(format!("{}:{}", relative.display(), trimmed));
+        }
+    }
+}
+
+#[test]
+fn deny_advisory_ignores_carry_review_evidence() {
+    let deny = read_workspace_text(&["deny.toml"], "deny.toml");
+    let advisory = "RUSTSEC-2024-0436";
+    let offset = deny
+        .find(advisory)
+        .unwrap_or_else(|| panic!("deny.toml should mention {advisory}"));
+    let context_start = deny[..offset]
+        .rfind("[advisories]")
+        .expect("advisories section");
+    let context = &deny[context_start..offset];
+
+    for required in [
+        "Package:",
+        "Reachability:",
+        "Reviewed:",
+        "Upgrade/follow-up:",
+    ] {
+        assert!(
+            context.contains(required),
+            "advisory ignore {advisory} should document {required}"
+        );
+    }
+}
+
+#[test]
+fn ai_asset_checks_self_heal_generated_drift_before_failing() {
+    for script_name in ["check-ai-prompt.ps1", "check-ai-skill.ps1"] {
+        let script = read_workspace_text(&["scripts", script_name], script_name);
+        assert!(
+            script.contains("Invoke-GeneratorCheck"),
+            "{script_name} should use the shared check/regenerate/recheck helper"
+        );
+        assert!(
+            script.contains("Invoke-GeneratorWrite"),
+            "{script_name} should regenerate stale generated assets automatically"
+        );
+        assert!(
+            script.contains("still out of date after regeneration"),
+            "{script_name} should only ask for manual intervention after regeneration fails"
+        );
+    }
+
+    let docs = read_workspace_text(&["docs", "jade-discipline.md"], "jade docs");
+    assert!(
+        docs.contains("self-heal generated asset drift"),
+        "Jade docs should describe the AI asset gate's self-healing behavior"
+    );
+}

crates/common/tests/miri_json_family.rs

@@ -0,0 +1,63 @@
+//! Miri regression coverage for compact JSON-family parsers.
+
+use common::formats::toon::{DecodeOptions, EncodeOptions};
+use common::formats::{ison, tonl, toon, zon};
+use serde_json::json;
+
+#[test]
+fn toon_roundtrip_exercises_nested_and_tabular_paths() {
+    for value in [
+        json!({
+            "meta": {
+                "ok": true,
+                "count": 2
+            },
+            "items": [
+                {"id": 1, "name": "Ada"},
+                {"id": 2, "name": "Bob"}
+            ],
+            "literal.path": "quoted when encoded"
+        }),
+        json!([1, 2, 3]),
+        json!([{"id": 1}, {"id": 2}]),
+        json!("plain"),
+    ] {
+        let encoded = toon::encode_value(&value, EncodeOptions::default()).expect("TOON encode");
+        let decoded = toon::decode_str(&encoded, DecodeOptions::default());
+
+        assert_eq!(decoded.expect("TOON decode"), value);
+    }
+}
+
+#[test]
+fn toon_decoder_rejects_malformed_counts_and_path_conflicts() {
+    let bad_count = toon::decode_str("[3]: a,b\n", DecodeOptions::default());
+    assert!(bad_count.is_err());
+
+    let path_conflict = toon::decode_str(
+        "a: 1\na.b: 2\n",
+        DecodeOptions {
+            expand_paths: common::formats::toon::SafeMode::Safe,
+            ..DecodeOptions::default()
+        },
+    );
+    assert!(path_conflict.is_err());
+}
+
+#[test]
+fn record_formats_decode_without_panicking() {
+    let records = vec![json!({"id": 1, "name": "Ada", "active": true})];
+    let isonl = ison::encode_records(&records, "user").expect("ISONL encode");
+    assert_eq!(ison::decode_records(&isonl).expect("ISONL decode"), records);
+
+    assert_eq!(
+        zon::decode_str("id:1\nname:\"Ada\"\nactive:true\n").expect("ZON decode"),
+        json!({"id": 1, "name": "Ada", "active": true})
+    );
+
+    let tonl = tonl::encode_documents(&[json!({"id": 1, "name": "Ada"})]).expect("TONL encode");
+    assert_eq!(
+        tonl::decode_documents(&tonl).expect("TONL decode"),
+        vec![json!({"id": 1, "name": "Ada"})]
+    );
+}