Plan: Prevention-Gate Lints (epic &63 wave 1)

Universe ≠ findings. Every gate separately reports its scan UNIVERSE (files/crates/ entries enumerated, per root) and its FINDINGS. Zero findings is a desirable state; a zero or implausibly-shrunken universe fails loudly, per root. Each gate’s floor is stated below.

Parsers get property tests (testing-discipline mandate): Gate 5’s record parser, Gate 3’s manifest interpretation, Gate 2’s cfg-test predicate detector.

Escape hatches are pinned: baseline files are bidirectional (new violation AND stale entry both fail; --bless shrinks only); comment markers require a non-empty reason and are stale-checked (a marker adjacent to nothing flaggable = violation).

B8 containment: the new run_<x>() bodies share ONE report-and-bail helper so the B8 duplicate-blocks budget (locked 204) does not trip; no --write-lock happens in this MR.

clippy_group_lint additionally matches clippy::arithmetic_side_effects;

const ARITHMETIC_BLANKET_BASELINE: &[&str] names exactly the 8 ratified files (services/craig-financial/src/lib.rs, services/craig-financial/src/main.rs, xtask/src/main.rs, services/craig-cli/src/lib.rs, services/craig-cli/src/main.rs, crates/craig-test-lib/src/lib.rs, tools/craig-seed/src/lib.rs, tools/craig-seed/src/main.rs), each entry commented with its ratification ref. Blanket present + file not in baseline → violation; baseline file with no blanket → stale entry → violation (shrink-only ratchet);

suppression-equivalent forms banned: inner cfg_attr(…​) whose predicate is not provably test-gated (test required through any all/any nesting) with a banned-group payload, and inner expect(…​) of the banned groups. Test-gated cfg_attr(test, allow(…​)) roots stay exempt;

glob set widened with brace-free pathspecs (git ls-files performs no brace expansion): plugins//src/lib.rs, plugins//src/main.rs, crates//src/main.rs, and /src/bin/*.rs variants for crates/services/tools/plugins/xtask. Coverage claim = conventional production crate roots only.

the visitor skips items whose attrs carry a cfg predicate that provably requires test (recursive through all/any; proptested); external #[cfg(test)] mod x; declarations are skipped, never scan-terminating;

call detection is path-based with an import table (grouped imports and as aliases tracked): paths resolving to reqwest::Client::{new,builder,default} or reqwest::ClientBuilder::{new,default} are flagged. Recorded false-negative: non-use aliasing (type C = reqwest::Client;);

the allowlist is (file, expected builder-site count) pairs over the 5 production files (crates/craig-common/src/http.rs, crates/craig-auth/src/oidc_discovery.rs, crates/craig-auth/src/jwks.rs, crates/craig-intake-sdk/src/client.rs, crates/craig-exchange-transport/src/egress.rs), rationale one-liners taken from each file’s own doc comments. Count above baseline = new decision; below = stale = bless down;

craig-test-lib keeps its path exemption for this gate only (test infrastructure — the production choke-point threat model does not cover it; recorded residue);

walker = the workspace-member surface (crates, services, tools, plugins, xtask src trees minus [workspace].exclude);

xtask’s reqwest::blocking builders out of scope (recorded).

membership authority = the workspace itself: expand [workspace].members globs minus [workspace].exclude (never fixed directory globs);

manifests parsed with toml for structure; exceptions live in the committed xtask/dep-inherit-exceptions.toml, keyed (manifest path, table, dependency key) with a mandatory reason — exceptions apply ONLY to check 1; checks 2-3 have no exception channel;

check 1: a dependency whose resolved package name (package = rename honored; git deps compared by name; dotted/inline/expanded forms normalized by the parser) exists in [workspace.dependencies] but is declared hardcoded → violation;

check 2: [package] version/edition/license each PRESENT and .workspace = true (omission is a violation too); rust-version out of scope (recorded);

check 3: default-features = true anywhere, or a hardcoded twin of a default-features = false workspace dep dropping the false → violation (zero today).

flags named fields of Serialize-deriving structs AND enum variants (derives detected through cfg_attr) whose field ident OR serde(rename) wire name contains one of: secret, password, token, api_key, auth_config, signing_key, client_secret, private_key, credential, bearer, verifier, nonce;

pass conditions: [serde(skip_serializing)]/[serde(skip)] on the field, or a // serialize-credential: <reason> marker on the line DIRECTLY above that field (per-field, never per-struct; association via proc-macro2 span lines). Stale markers = violation;

scope stated honestly: direct named fields only — flatten chains, manual impl Serialize (one exists, a test helper), and non-use aliasing are recorded false-negatives;

NO whole-crate test-lib exemption: FileCacheEntry.access_token / FileCache.tokens (#1163 test infra) get per-field markers and stay visible in the inventory.