Harden collection authority and canonical runtime safety

.github/workflows/ci.yml

@@ -29,6 +29,17 @@ jobs:
       - name: Enforce architecture and debt budgets
         run: cargo run --locked -p mdbase-architecture-check -- .
       - run: cargo clippy --locked --workspace --all-targets --all-features -- -D warnings
+      - name: Strict canonical no-default lint gates
+        run: |
+          cargo clippy --locked -p mdbase --no-default-features --all-targets -- -D warnings
+          cargo clippy --locked -p mdbase-command --no-default-features --all-targets -- -D warnings
+          cargo clippy --locked -p mdbase-runtime --no-default-features --all-targets -- -D warnings
+          cargo clippy --locked -p mdbase-testbed-adapter --all-targets -- -D warnings
+      - run: ./scripts/check-legacy-feature-boundary.sh
+      - name: Reject legacy mutation feature in canonical resolved graphs
+        run: ./scripts/check-no-legacy-feature.sh
+      - run: cargo test --locked -p mdbase --no-default-features backfill
+      - run: cargo test --locked -p mdbase-command --no-default-features
       - run: cargo test --locked -p mdbase-runtime --no-default-features
       - run: cargo test --locked -p mdbase-runtime --no-default-features --features sqlite
       - run: cargo check --locked -p mdbase-runtime --no-default-features --features postgres
@@ -57,6 +68,9 @@ jobs:
         with:
           node-version: 22
       - uses: Swatinem/rust-cache@v2
+      - name: Compile every Windows target, including capability publication
+        if: runner.os == 'Windows'
+        run: cargo check --locked --workspace --all-targets --all-features
       - run: cargo test --locked --workspace --all-features
         env:
           MDBASE_SPEC_REPO_DIR: ${{ github.workspace }}/mdbase-spec

CHANGELOG.md

@@ -6,6 +6,12 @@ All notable changes to this project are documented in this file.
 
 ### Breaking
 
+- Context-free JSON `Collection` create/update/delete/rename/backfill/batch
+  methods are isolated behind the default-on `legacy-collection-mutation` 0.4.x
+  compatibility feature. They retain strict source compatibility, including
+  under `deny(deprecated)`, while rustdoc records their planned 0.5.0 removal.
+- Deprecated ephemeral `ExecutionOutcome::result` and `CommitRejection::result`
+  projections now have a 0.5.0 removal gate; typed callers use `operation`.
 - `Collection::build_all_files_data` now returns
   `Result<Vec<ResolvedFileData>, CollectionSnapshotError>` instead of silently
   treating discovery/read failures as an empty collection. This is a deliberate
@@ -25,6 +31,15 @@ All notable changes to this project are documented in this file.
   `Result<String, FrontmatterSerializationError>`. Callers must handle YAML
   emitter failures; serialization no longer panics or substitutes empty YAML.
 
+### Added
+
+- Added privacy-safe `legacy_journal_inventory` runtime/provider APIs so operators
+  can prove that no version-2 journals remain before the 0.5.0 decoder removal.
+- Added exact architecture ownership guards for the seven legacy Collection
+  facade definitions and internal compatibility allowlist, plus non-growing
+  guards for `OperationContext::legacy`, wire-only outcome variants/constructors,
+  and ephemeral runtime result projections.
+
 ### Fixed
 
 - Generated values now evaluate against effective defaults and dependencies,

Cargo.toml

@@ -32,10 +32,18 @@ members = [
 resolver = "2"
 
 [features]
-default = []
+# Retained for the 0.4.x source-compatibility window. Canonical hosts should
+# build with `--no-default-features`; the feature is removed in 0.5.0.
+default = ["legacy-collection-mutation"]
+legacy-collection-mutation = []
 tracing = ["dep:tracing"]
 hosted-storage-benchmark = []
 
+[[bin]]
+name = "phase0-baseline"
+path = "src/bin/phase0-baseline.rs"
+required-features = ["legacy-collection-mutation"]
+
 [dependencies]
 rusqlite = { version = "0.32", features = ["bundled"] }
 serde = { version = "1", features = ["derive"] }
@@ -64,7 +72,7 @@ cap-std = "4.0.3"
 cap-fs-ext = "4.0.3"
 
 [target.'cfg(windows)'.dependencies]
-windows-sys = { version = "0.61", features = ["Win32_Storage_FileSystem"] }
+windows-sys = { version = "0.61", features = ["Wdk_Storage_FileSystem", "Win32_Foundation", "Win32_Storage_FileSystem", "Win32_System_IO"] }
 
 [workspace.package]
 edition = "2021"

config/architecture-budgets.json

@@ -1,30 +1,35 @@
 {
-  "rustSourceFileCountMax": 171,
-  "rustSourceLineCountMax": 93200,
+  "rustSourceFileCountMax": 173,
+  "rustSourceLineCountMax": 100297,
   "rustSourceFileMaxLines": 1000,
   "legacyFileLineBudgets": {
-    "crates/mdbase-command/src/lib.rs": 1816,
-    "crates/mdbase-command/src/profile.rs": 1348,
+    "crates/mdbase-architecture-check/src/main.rs": 1188,
+    "crates/mdbase-command/src/lib.rs": 1968,
+    "crates/mdbase-command/src/profile.rs": 1382,
     "crates/mdbase-runtime/src/engine.rs": 1270,
     "src/bin/phase0-baseline.rs": 1164,
-    "src/data_contracts.rs": 1075,
+    "src/data_contracts.rs": 1124,
     "src/expressions/evaluator.rs": 3390,
-    "src/links/resolver.rs": 1040,
+    "src/links/resolver.rs": 1201,
     "src/query/engine.rs": 1086,
-    "src/runtime/filesystem.rs": 1333,
-    "src/runtime/hosted_base.rs": 1943,
+    "src/runtime/filesystem.rs": 1435,
+    "src/runtime/canonical_operation.rs": 1410,
+    "src/runtime/hosted_base.rs": 1968,
     "src/runtime/hosted_mutation.rs": 1200,
     "src/runtime/hosted_query.rs": 3400,
     "src/runtime/hosted_resource.rs": 1040,
-    "src/runtime/tests.rs": 3964,
-    "src/transactions.rs": 1015,
-    "src/transactions/runtime.rs": 1294,
-    "src/v03/batch.rs": 1365,
-    "src/v03/collection_setup.rs": 1479,
-    "src/v03/type_pack.rs": 2110,
+    "src/runtime/provider.rs": 1020,
+    "src/runtime/record_resolution.rs": 1393,
+    "src/runtime/tests.rs": 4372,
+    "src/api/typed.rs": 1075,
+    "src/transactions.rs": 1029,
+    "src/transactions/runtime.rs": 2625,
+    "src/v03/batch.rs": 1519,
+    "src/v03/collection_setup.rs": 1508,
+    "src/v03/type_pack.rs": 2135,
     "src/views/execute.rs": 1376,
     "src/views/expression.rs": 2965,
-    "src/watch/real.rs": 3143
+    "src/watch/real.rs": 3220
   },
   "deadCodeAllowancesByFile": {
     "crates/mdbase-command/src/lib.rs": 1,
@@ -34,10 +39,73 @@
     "src/matching/engine.rs": 1,
     "src/runtime/outcome.rs": 2,
     "src/runtime/provider.rs": 2,
+    "src/runtime/snapshot.rs": 1,
+    "src/snapshot.rs": 2,
+    "src/snapshot/discovery.rs": 1,
     "src/cel.rs": 2
   },
+  "ambientIoAllowlist": {
+    "crates/mdbase-command/src/lib.rs": {"std::fs": 4},
+    "crates/mdbase-command/src/profile.rs": {"std::fs": 14},
+    "crates/mdbase-testbed-adapter/src/main.rs": {"std::fs": 4},
+    "src/bin/phase0-baseline.rs": {"std::fs": 15},
+    "src/cache/mod.rs": {"std::fs": 2},
+    "src/cache/sqlite.rs": {"std::fs": 3, "std::fs::File": 2, "std::fs::OpenOptions": 2},
+    "src/collection_root.rs": {"cap_std::ambient-acquisition": 2, "std::fs": 3, "std::fs::File": 2, "tempfile": 4},
+    "src/compat/v02_migration.rs": {"std::fs": 5, "tempfile": 1},
+    "src/config/mod.rs": {"std::fs": 2},
+    "src/data_contracts.rs": {"std::fs": 3, "tempfile": 1, "walkdir": 2},
+    "src/init.rs": {"std::fs": 6},
+    "src/mutation/shadow.rs": {"std::fs": 3, "tempfile": 2},
+    "src/operations/mod.rs": {"std::fs": 2, "std::fs::File": 1},
+    "src/operations/type_file.rs": {"std::fs": 2, "tempfile": 1},
+    "src/record_load.rs": {"std::fs": 3, "std::fs::File": 3},
+    "src/runtime/catalog.rs": {"tempfile": 1},
+    "src/runtime/hosted_mutation.rs": {"std::fs": 11, "tempfile": 1},
+    "src/runtime/hosted_resource.rs": {"std::fs": 6, "tempfile": 3, "walkdir": 1},
+    "src/runtime/hosted_validation.rs": {"std::fs": 3, "tempfile": 1},
+    "src/transactions.rs": {"std::fs::File": 3},
+    "src/types/loader.rs": {"std::fs": 5, "tempfile": 1},
+    "src/v03/batch.rs": {"std::fs": 6, "tempfile": 1},
+    "src/v03/collection_setup.rs": {"std::fs": 5},
+    "src/v03/mod.rs": {"std::fs": 4, "walkdir": 4},
+    "src/v03/type_pack.rs": {"std::fs": 6},
+    "src/watch/mod.rs": {"std::fs": 25},
+    "src/watch/real.rs": {"std::fs": 1}
+  },
   "transitionalReferenceBudgets": {
     "uncheckedCollectionScans": 0,
-    "v03OperationFacade": 26
+    "v03OperationFacade": 26,
+    "legacyCollectionFacadeDefinitions": [
+      "backfill",
+      "batch_delete",
+      "batch_update",
+      "create",
+      "delete",
+      "rename",
+      "update"
+    ],
+    "legacyCompatibilityAllowlist": {
+      "src/api/operations.rs": ["CreateInput", "CreateOutput", "DeleteInput", "DeleteOutput", "RenameInput", "UpdateInput", "UpdateOutput"],
+      "src/compat/legacy_mutation.rs": ["backfill_legacy", "batch_delete_legacy", "batch_update_legacy", "create_legacy", "delete_legacy", "rename_legacy", "update_legacy"],
+      "src/compat/mod.rs": ["legacy_mutation"],
+      "src/operations/backfill.rs": ["backfill_legacy"],
+      "src/operations/batch.rs": ["batch_delete_legacy", "batch_update_legacy", "delete_legacy"],
+      "src/operations/create.rs": ["CreateInput", "CreateOutput", "create_legacy"],
+      "src/operations/delete.rs": ["DeleteInput", "DeleteOutput", "delete_legacy"],
+      "src/operations/migrate.rs": ["backfill_legacy"],
+      "src/operations/rename/mod.rs": ["RenameInput", "rename_legacy"],
+      "src/operations/update.rs": ["UpdateInput", "UpdateOutput", "update_legacy"]
+    },
+    "operationContextLegacyProduction": 0,
+    "operationContextLegacySupport": 170,
+    "wireOnlyVariants": ["TypeResource", "Validation", "ViewResource"],
+    "wireOnlyConstructorAllowlist": {
+      "src/runtime/canonical_operation.rs": {"type_wire": 2, "validation_wire": 1, "view_wire": 2, "wire_only": 4},
+      "src/runtime/filesystem.rs": {"wire_only": 1},
+      "src/v03/batch.rs": {"wire_only": 1}
+    },
+    "ephemeralResultProduction": 0,
+    "ephemeralResultSupport": 4
   }
 }

crates/mdbase-architecture-check/Cargo.toml

@@ -8,7 +8,9 @@ repository.workspace = true
 publish = false
 
 [dependencies]
+proc-macro2 = "1"
 regex = "1"
 serde = { workspace = true, features = ["derive"] }
 serde_json.workspace = true
+syn = { version = "2", features = ["full", "visit"] }
 walkdir = "2"