Plan M: Quality Lint Followthrough

On this page

Status

Step Description Status

1

Plan filing — body lands as a docs-only MR alongside epic + per-tier-step issues. nav.adoc Active list gains a Plan M row. CHANGELOG.adoc Unreleased entry. No code changes.

Done (2026-06-04) — this MR. Epic &37 + issues #493–#504 filed.

2

Tier 1a — lift the transitional #![allow] blocks on the 6 foundational crates. craig-common, craig-auth, craig-crypto, craig-db, craig-mq, craig-store. Each MR: delete the 6-lint allow block from the lib root, run cargo clippy -p <crate> --all-targets — -D warnings, fix every emission, commit. Per-crate so review is bounded.

Done (2026-06-04) — #493 closed. 6 crates lifted across MRs !536-!541.

3

Tier 1b — lift the transitional #![allow] blocks on the contracts + reference crates. craig-cases-contracts, craig-exchange-contracts, craig-reference, craig-matching, craig-signing, craig-intake-sdk, craig-test-lib, craig-rules-client, craig-authz, craig-api. Per-crate MRs same shape as Step 2.

Done (2026-06-04) — #494 closed. 10 crates lifted across MRs !542-!551.

4

Tier 1c — lift the transitional ![allow] blocks on the 8 backend services. craig-rules, craig-cases, craig-placement, craig-exchange, craig-financial, craig-reporting, craig-security, craig-intake. Each service is bigger than a shared crate so each MR may need to introduce per-fn [allow(clippy::<name>, reason = "<justification>")] for genuinely-pedantic-but-correct sites (the Plan H Step 9 protocol). The reviewer subagent verifies each #[allow] reason against the §Style carve-outs.

Done (2026-06-04) — #495 closed. 8 services lifted across MRs !552-!559.

5

Tier 1d — lift the transitional #![allow] blocks on the leaf binaries + per-partner crates. craig-cli, craig-web, craig-mock-server, craig-seed, xtask, plus the 7 shipped per-partner crates from Plan L Step 3 (craig-partner-{caps,empi,ies,ions,smile,tcm,wic}). Skips paused Plan L work (craig-partner-cprs) by design.

Done (2026-06-04) — #496 closed. 14 leaf binaries + partner stubs lifted across MRs !560-!567.

6

Tier 1e — regression gate. New xtask sub-lint cargo xtask lints no-transitional-allows walks services//src/{lib,main}.rs + crates//src/lib.rs and rejects any ![allow(clippy::pedantic)] or ![allow(clippy::cargo)] at crate roots. Wired into cargo xtask validate as a new blocking step [4h/14]. Prevents future agents from re-introducing a workspace-level paper tiger.

Done (2026-06-05) — #497 closed via !568. Scanner uses git ls-files (untracked paused work — crates/craig-partner-cprs/ — transparent to gate). 11 unit tests + sentinel-injection verification. Workspace: 40 targets / 0 violations.

7

Tier 2 — panic-surface tightening. Add to Cargo.toml [workspace.lints.clippy]: indexing_slicing = "deny", string_slice = "deny", unwrap_in_result = "deny". Plus cfg_attr(test, allow(…​)) on each lib root for test-code exemption. Sweep each arr[i] → arr.get(i).ok_or(…​)? / arr.get(i).expect("loop invariant"); each &s[a..b] → s.get(a..b). Estimated ~928 indexing sites + small string-slice count.

Done (2026-06-05) — #498 closed via !570. Actual production-code surface: 28 sites across 8 crates/services (the ~928 estimate counted test-code + tooling-crate surfaces that the cfg_attr exemption / crate-level allows handle). Workspace clippy clean. 2414/2414 tests pass.

8

Tier 2 — overflow-surface tightening. Add arithmetic_side_effects = "deny". Sweep each a + b / a - b / a * b / a / b to checked_* / wrapping_* / saturating_* depending on context. Note: this is the most invasive Tier 2 lint and may warrant a separate batch sequence within Step 8. Test code exempt via cfg_attr(test, allow(arithmetic_side_effects)).

Done (2026-06-05) — #499 closed via !576. ~40 production-code fixes across 16 crates/services (saturating_mul on pagination offsets, checked_add_signed on chrono dates, checked_add on Instant deadlines, saturating_add on counters); 4 tool-crate-level allows (cli + seed + xtask + mock-server) + craig-financial service-level allow (domain-specific Decimal currency math) + craig-test-lib permanent allow.

9

Tier 2 — IO-surface tightening. Add print_stdout = "deny" + print_stderr = "deny". Exempt services/craig-cli (CLI by definition writes to stdout) and xtask (developer tooling output) via per-crate #![allow(…​)] with reason. All library + service crates forced to tracing::*.

Done (2026-06-05) — 500 closed via !572. Surface: 1 production site (craig-common/telemetry.rs Drop-fallback eprintln, per-site [expect]) + 5 tool-crate-level allows (craig-cli + craig-seed + xtask). BFF + backend services + shared crates already clean.

10

Tier 2 — struct hygiene. Add partial_pub_fields = "deny". Sweep struct definitions where some fields are pub and others aren’t; either make all fields pub or add accessor methods for the private ones. Small surface; promotes intentional encapsulation.

Done (2026-06-05) — 501 closed via !574. Surface: 4 structs across 2 crates. 1 strip-pub (ConsumerBackpressureInjector), 1 add-pub (I18n::messages), 2 per-struct [allow] with documented rationales (TestHarness + CrashHarness — test-harness public-API contract + internal-state separation).

11

Tier 3 — rustc-level gaps. Add to Cargo.toml [workspace.lints.rust]: unused_must_use = "deny" (companion to let_underscore_must_use); unused_crate_dependencies = "deny" (compile-time companion to cargo machete at validate [9b/14]); promote unsafe_code = "forbid" from the per-bin ![forbid] to a workspace-level rust lint. Audit each existing ![forbid(unsafe_code)] block and remove now-redundant ones.

Done (2026-06-05) — 502 closed via !579. Shipped 2 of 3 lints (unused_must_use = "deny", unsafe_code = "deny"); unused_crate_dependencies evaluated and DEFERRED at workspace allow. Strip removed 33 per-crate ![forbid(unsafe_code)] attributes. unsafe_code downgraded from forbid to deny so xtask’s 3 process-global env-var-manipulation sites can #[allow(unsafe_code, reason = "…​")] per-block with SAFETY rationale (forbid cannot be locally overridden). unused_crate_dependencies surface measurement: 434 per-target emissions across ~30 compilation targets dominated by [dev-dependencies] fan-out across sibling tests/*.rs integration tests; cargo machete at [9b/14] catches the meaningful workspace-level case without the per-test-target false positives. Full rationale in Cargo.toml + CHANGELOG.

12

Tier 4 — nursery probe. Add clippy::nursery = { level = "deny", priority = -1 } workspace-wide as an exploratory measurement. The resulting clippy errors get triaged: each lint either stays denied (with sweep), gets allow-listed at priority 1 (escape hatch with documented reason), or gets cfg_attr(test, allow(…​)) if test-only. Probe MR is a single revert-if-needed commit.

Done (2026-06-05) — #503 closed via !581. Probe surface: 130+ emissions across 16 unique nursery lints. Swept in same MR (<10 emissions + clear value): or_fun_call (7), redundant_clone (1), too_long_first_doc_paragraph (13), trait_duplication_in_bounds (1), collection_is_never_read (1), significant_drop_tightening (1) — 24 sites total across 9 crates. Allow-listed at workspace priority 1 with documented rationale: missing_const_for_fn (23), option_if_let_else (4), derive_partial_eq_without_eq (32), use_self (21), too_long_first_doc_paragraph (45+ long-tail), future_not_send (33), redundant_clone (5 in craig-auth), significant_drop_tightening (2 in craig-auth), redundant_pub_crate (1), plus 8 long-tail lints (1–6 emissions each). ADR-031 Accepted: nursery-promotion decision pattern. Per-lint sweeps deferred to Plan P (Nursery Promotion Sweep) per §Successor plans.

13

Plan completion audit + archive. Per delivery-protocol.md: subagent verifies all 11 prior steps complete via MR list; nav.adoc Active → Archived; archive.adoc new row; .claude/CLAUDE.md Phase Status final stats. Plan L Step 6 / #462 unblock-or-defer decision recorded.

Done (2026-06-05) — this MR closes 504. Audit subagent verified all 12 prior steps Done with MR citations; 17 lint configs (16 clippy + Plan H baseline + 7 Plan M Tier 2 + Plan M Tier 3 rustc denies + nursery group) present in Cargo.toml; Step 6 regression gate xtask validate [4h/14] active; ADR-031 wired into nav; ADR-030 plan-lint clean; nextest 1603/1603 pass; no residual ![forbid(unsafe_code)] inner attributes; #493–#503 closed. Plan G Step 6 / #462 — re-evaluated: STILL BLOCKED. Plan M didn’t change the Plan G F-065 cross-handler scan blocker (which gates on Plans D/G/H/I/J/K/L convergence per Plan G plan body §Step 6 gating clause); the workspace-clippy denies that Plan M solidified were already in force at Plan H Step 9 archival. Plan P (Nursery Promotion Sweep) filed as the home for the deferred per-lint sweeps.

Epic: &37 (epic: Quality Lint Followthrough (Plan M))
Issues: #493 (Step 2 — Tier 1a foundational crates) · #494 (Step 3 — Tier 1b contracts + shared) · #495 (Step 4 — Tier 1c backend services) · #496 (Step 5 — Tier 1d leaf binaries + per-partner) · #497 (Step 6 — Tier 1e xtask regression gate) · #498 (Step 7 — Tier 2 panic-surface) · #499 (Step 8 — Tier 2 overflow-surface) · #500 (Step 9 — Tier 2 IO-surface) · #501 (Step 10 — Tier 2 struct hygiene) · #502 (Step 11 — Tier 3 rustc-level) · #503 (Step 12 — Tier 4 nursery probe) · #504 (Step 13 — plan completion audit)
Branch prefix: refactor/plan-m-
*Milestone: TBD

Context

Plan H (Idiomatic Rust + Clippy Strictness — archived 2026-05-21 at plans/archive/idiomatic-rust-clippy.adoc) staged a workspace-wide clippy lint deny set across 16 lints + the full pedantic + cargo lint groups. Step 9 Phase A’s release note read:

16 clippy lints deny workspace-wide; cargo clippy --workspace --all-targets — -D warnings clean.

That statement was true on the merge-commit’s HEAD — but only because Plan H Step 2 introduced a transitional ![allow(clippy::pedantic, clippy::cargo, clippy::missing_docs_in_private_items, clippy::too_many_lines, clippy::cognitive_complexity, clippy::ignored_unit_patterns, reason = "scheduled for Plan H Steps 3-7 sweeps")] block at every production source root. Steps 3-7 finished, the workspace-level lint levels were promoted to deny per Step 9 Phase B, but the per-crate transitional ![allow] blocks were never removed.

A 2026-06-04 audit confirmed 35 production source roots (every services//src/{lib,main}.rs + most crates//src/lib.rs) still carry the block. The workspace-level pedantic = "deny" and cargo = "deny" are paper tigers inside every production crate.

Probe (2026-06-04): lift the transitional allow on crates/craig-common/src/lib.rs alone, run cargo clippy -p craig-common --all-targets — -D warnings:

error: could not compile `craig-common` (lib) due to 105 previous errors
error: could not compile `craig-common` (lib test) due to 62 previous errors

105 production-code clippy emissions on a single foundational crate. The same shape applies to 34 other source roots.

Beyond closing this gap, several panic-risk and overflow-risk clippy lints (indexing_slicing, arithmetic_side_effects, string_slice, unwrap_in_result) remain unconfigured — they’re not denied today and don’t fire even with the transitional allow removed. They’re the next-tier of strictness this plan layers on top, but only AFTER the transitional allows are gone (the existing pedantic/cargo cleanup must come first; otherwise new lints get fixed before old ones).

Threat model

What this plan prevents in the long term:

  1. Silent introduction of panicking code paths. Every arr[i] in production is a potential OOB panic; today the workspace doesn’t catch them. Plan M Step 7 makes the compiler refuse compilation.

  2. Silent overflow. Plain + / - / on integer types silently wraps in release. CRAIG processes counts, deadlines, monetary cents — all overflow surfaces. Plan M Step 8 forces explicit checked_ / wrapping_* / saturating_* per-site decision.

  3. Re-introduction of transitional-allow patterns. The exact same "we’ll sweep this later" pattern that Plan H Step 2 created is currently silenced — and could be re-introduced any time a future plan files a similar transitional carve-out. Plan M Step 6 makes that mechanically impossible via a new xtask lint at [4h/14].

  4. Drift between pedantic / cargo group denies and the actual per-crate behavior. Today the workspace-level lint config and per-crate #![allow] blocks are out-of-sync. Plan M Tier 1 makes the workspace-level config the source of truth.

  5. Library crates writing to stdout/stderr instead of using tracing. Plan M Step 9 enforces structured logging in every non-binary crate.

  6. Unused crate dependencies accumulating in Cargo.toml. Plan M Step 11’s unused_crate_dependencies = "deny" catches these at compile time, complementing cargo machete (catches them at validate [9b/14] post-build).

Cross-cutting invariants

These hold from Step 2 onward and are subagent-verified per MR:

  1. No ![allow(clippy::pedantic)] or ![allow(clippy::cargo)] at any production crate root. Per-fn #[allow(clippy::<specific_lint>, reason = "<justification>")] is acceptable when the §Style carve-out applies (e.g. clippy::too_many_lines on a documented important-stay function). The blanket group-level allow is the failure mode this plan eliminates.

  2. Test code stays exempt. Inside #[cfg(test)] mod tests blocks and tests/*.rs files, panicking calls (unwrap, expect, panic) are the assertion mechanism. The cfg_attr(test, allow(…​)) on each lib root that scopes these to test compilation stays — this plan does NOT remove that scoping.

  3. Each per-fn #[allow(…​)] MUST carry a reason = "…​" string. Reviewer subagent rejects bare allows. The allow_attributes_without_reason = "deny" workspace lint enforces this mechanically; this plan keeps it on.

  4. No unused_must_use = "warn" downgrades inside production code. The Tier 3 rustc lint addition is deny, not warn — and stays deny in every per-step MR.

  5. The xtask regression-gate at Step 6 lands BEFORE Tier 2 / Tier 3 lint additions. Otherwise a future agent could introduce a new transitional-allow pattern under the cover of Tier 2 sweep work; the gate prevents that ordering risk.

Step DAG

Sequence the steps in this exact order:

1 (plan filing — docs-only)
  ↓
2 (Tier 1a — foundational crates)
  ↓
3 (Tier 1b — contracts + reference + shared)
  ↓
4 (Tier 1c — 8 backend services)
  ↓
5 (Tier 1d — leaf binaries + per-partner crates)
  ↓
6 (Tier 1e — xtask regression gate, blocks Tier 2 entry)
  ↓
  ├─→ 7 (Tier 2 — indexing/string/unwrap-in-Result)
  ├─→ 8 (Tier 2 — arithmetic-overflow)
  ├─→ 9 (Tier 2 — print-stdout/stderr)
  └─→ 10 (Tier 2 — partial-pub-fields)
       ↓
       11 (Tier 3 — rustc-level: unused_must_use + unused_crate_dependencies + unsafe_code)
       ↓
       12 (Tier 4 — nursery probe; outcome-dependent)
       ↓
       13 (plan completion audit + archive)

Tier 2 sub-steps (7-10) MAY run in parallel after Step 6 lands. Step 8 (arithmetic) is the highest-risk sub-step and benefits from landing AFTER Steps 7/9/10 so reviewers aren’t fatigued.

Steps

Step 1 — Plan filing

This MR. Body lands at docs/modules/ROOT/pages/plans/quality-lint-followthrough.adoc. nav.adoc § Plans § Active gains a Plan M row. CHANGELOG.adoc § Unreleased describes the docs-only filing. No code changes.

Epic + per-step issues filed via the same MR (12 issues, one per step 2-13).

Step 2 — Tier 1a — foundational crates

For each of craig-common, craig-auth, craig-crypto, craig-db, craig-mq, craig-store:

  1. Branch refactor/plan-m-tier1a-<crate>.

  2. Delete the #![allow(clippy::pedantic, clippy::cargo, clippy::missing_docs_in_private_items, clippy::too_many_lines, clippy::cognitive_complexity, clippy::ignored_unit_patterns)] block from the lib root.

  3. Run cargo clippy -p <crate> --all-targets — -D warnings.

  4. For every emission: either fix the underlying code (as → From::from, &v[..] → &v[..n], etc.) OR add a per-fn #[allow(clippy::<specific_lint>, reason = "<justification>")] if the §Style carve-out applies. Subagent verifies each allow.

  5. Commit + push + MR.

One MR per crate so review surface is bounded. 6 MRs total for Step 2.

Step 3 — Tier 1b — contracts + reference + shared

Same shape as Step 2 for: craig-cases-contracts, craig-exchange-contracts, craig-reference, craig-matching, craig-signing, craig-intake-sdk, craig-test-lib, craig-rules-client, craig-authz, craig-api. 10 MRs total for Step 3.

Step 4 — Tier 1c — 8 backend services

Same shape for: craig-rules, craig-cases, craig-placement, craig-exchange, craig-financial, craig-reporting, craig-security, craig-intake. 8 MRs total for Step 4.

Each service crate is larger than a shared crate — expect more per-fn #[allow(…​)] decisions per MR. The reviewer subagent’s job is bigger here: every allow needs §Style justification.

Step 5 — Tier 1d — leaf binaries + per-partner crates

Same shape for: craig-cli, craig-web, craig-mock-server, craig-seed, xtask, craig-partner-caps, craig-partner-empi, craig-partner-ies, craig-partner-ions, craig-partner-smile, craig-partner-tcm, craig-partner-wic. 12 MRs total for Step 5.

Skip craig-partner-cprs and craig-partner-doe-slds — these are Plan L Step 3 batch 4 paused work (see memory project_plan_l_step3_batch4_paused_2026_05_26). When Plan L resumes those crates, the Plan L MRs MUST land them without the transitional allow already in place.

Step 6 — Tier 1e — regression gate

Single MR. Adds a new xtask sub-command cargo xtask lints no-transitional-allows that:

  1. Walks every .rs whose path matches services//src/{lib,main}.rs or crates/*/src/lib.rs.

  2. Rejects any file containing a crate-root attribute matching ![allow(…​)] that includes clippy::pedantic OR clippy::cargo (the lint groups) as direct entries. Per-fn [allow(clippy::pedantic)] is allowed (different surface).

  3. Exits 1 with file:line citations if any violations are found.

Wired into cargo xtask validate as new blocking step [4h/14] between [4g/14] (route-role-coverage) and [5/14] (SPDX). After this lands, Tier 2 entry is unblocked.

Step 7 — Tier 2 — panic-surface tightening

Single MR (or 2 MRs if indexing_slicing sweep is large). Adds to Cargo.toml:

[workspace.lints.clippy]
indexing_slicing = "deny"
string_slice = "deny"
unwrap_in_result = "deny"

Plus cfg_attr(test, allow(indexing_slicing, string_slice, unwrap_in_result)) on each lib root (33 lib/main files). Sweep call sites:

  • arr[i] → arr.get(i).ok_or(<typed error>)? (production) or arr.get(i).expect("invariant") if loop-invariant proves bounds

  • &s[a..b] → s.get(a..b).ok_or(<typed error>)?

  • x.unwrap() inside a Result-returning fn → x? if applicable, x.ok_or(<typed error>)? if Option

~928 indexing sites identified by grep -rcE '[[a-z_]\]|\[[0-9]\]' --include='.rs' services//src crates/*/src. May warrant splitting Step 7 into Step 7a (indexing) + Step 7b (string_slice + unwrap_in_result).

Step 8 — Tier 2 — overflow-surface tightening

Adds arithmetic_side_effects = "deny" to workspace lints. Sweep each + / - / * / / in production to:

  • checked_* + error propagation if overflow indicates a bug

  • saturating_* if clamp-at-bound is acceptable

  • wrapping_* if wrap is semantically correct (rare)

Test code exempt via cfg_attr(test, allow(arithmetic_side_effects)).

Most invasive Tier 2 lint. Sub-step into per-domain batches if call-site count is high: count first, then split.

Step 9 — Tier 2 — IO-surface tightening

Adds print_stdout = "deny" + print_stderr = "deny" to workspace lints. Sweep:

  • Library + service code: convert each println! / eprintln! / print! / eprint! to tracing::info! / tracing::warn! etc.

  • CLI (craig-cli) and developer tooling (xtask): per-crate #![allow(clippy::print_stdout, clippy::print_stderr, reason = "CLI by definition writes structured output to stdout/stderr")].

  • Web BFF (craig-web): no exemption — all output goes via tracing + Axum response bodies.

Step 10 — Tier 2 — struct hygiene

Adds partial_pub_fields = "deny" to workspace lints. Sweep struct definitions:

  • If MOST fields are pub, make ALL fields pub (struct is a passive carrier — convert to public-by-default).

  • If MOST fields are private, REMOVE pub from outliers and add an accessor method.

  • Per-struct call decision; reviewer subagent confirms the pattern matches the struct’s role.

Small surface (most CRAIG structs are already homogeneous); high payoff (forces intentional encapsulation decisions).

Step 11 — Tier 3 — rustc-level gaps

Adds to Cargo.toml [workspace.lints.rust]:

[workspace.lints.rust]
unused_must_use = "deny"
unused_crate_dependencies = "deny"
unsafe_code = "forbid"

Plus audit: every existing #![forbid(unsafe_code)] at a bin/lib root becomes redundant once unsafe_code = "forbid" is workspace-level. Remove the per-crate forbid attributes in the same MR.

unused_crate_dependencies = "deny" complements cargo machete at validate [9b/14] — the lint fires at compile time per-target, machete fires at validate post-build. Both catch the same drift; the compile-time signal is faster feedback.

Step 12 — Tier 4 — nursery probe

Single exploratory MR. Adds nursery = { level = "deny", priority = -1 } workspace-wide. Builds. Reads the resulting clippy emissions. Triage:

  • Lints with <10 emissions and clear value: stay denied + sweep in the same MR or a follow-up.

  • Lints with >10 emissions but case-by-case judgment: allow-list at priority 1 with documented reason.

  • Lints that fire only on test code: cfg_attr(test, allow(…​)).

  • Lints with no clear value (known-noisy nursery entries): allow-list at priority 1.

Outcome-dependent: this MR may end up landing as-is, may need a follow-up sweep MR, or may revert if nursery is too noisy. Either way, the triage is documented in the MR body and a new ADR records the decision pattern for future nursery promotions.

Step 13 — Plan completion audit + archive

Per delivery-protocol.md § Plan completion audit:

  1. Spawn plan-completion-audit subagent. Verify all 11 prior steps complete via MR list (glab mr list --search "Plan M" --merged).

  2. nav.adoc Active → Archived (move Plan M xref).

  3. plans/archive/quality-lint-followthrough.adoc — git mv body into archive directory.

  4. archive.adoc — new row.

  5. .claude/CLAUDE.md § Phase Status — final stats row for Plan M (lints added, MRs shipped, allow blocks removed, sites fixed).

  6. Plan G Step 6 / #462 — re-evaluate unblock status now that the workspace-level pedantic/cargo denies are actually in force. If unblocked, file Plan G Step 6 issue resumption; if still blocked, record blocker explanation.

Risks

  1. Surprise from nursery group probe. Some nursery lints have very high noise-to-value ratios. The Step 12 probe is structured to handle this — but if the post-probe state is "100+ noisy lints, no clear winners," the MR may revert. Risk is contained to one MR.

  2. arithmetic_side_effects sweep at Step 8 may surface latent bugs. Converting a + b to a.checked_add(b)? exposes overflow paths that current code silently hits. The fix is to handle them — but doing so during a sweep MR is awkward if the fix changes API surface. Mitigation: surface per-site to issue tracker; defer non-trivial fixes to follow-up MRs that get linked from Step 8’s MR.

  3. Plan L Step 3 batch 4 paused work (crates/craig-partner-cprs/ + craig-partner-doe-slds/) — Plan M Step 5 explicitly skips these. When Plan L resumes those crates, the Plan L MRs MUST NOT re-introduce the transitional allow block (regression-gated by Plan M Step 6’s xtask lint, but documenting here so the Plan L resumer sees it).

  4. MR review fatigue across the 36-MR Tier 1 sweep. Per-crate MRs are intentionally small to bound review surface, but the sheer count is real. Mitigation: batch review (e.g. Tier 1a’s 6 MRs land in a single review session); reviewer subagent does first-pass on each MR’s allow-list decisions.

  5. Plan H Step 9 "0 warnings" claim re-evaluation. Plan M Step 4 (services sweep) will likely surface that many services emit dozens of pedantic warnings each. The release-note narrative changes: "Plan H staged 16 deny lints; Plan M actually enforced them across all crates."

Successor plans

After Plan M closes, the next likely code-quality plans:

  • Plan N — Test-coverage-axis sweep. Promote _happy/_sad/_evil suffixes onto the 587 currently-untagged tests under tests/api/*.rs, lifting the coverage matrix from #310’s 0.8% baseline into double-digits. Mechanical sweep, large surface.

  • Plan O — Mock-server adapter de-orphan. Wire one test per shipped per-partner adapter against the mock-server. Builds on Plan L F-063 (deferred).

  • Plan P — Nursery promotion sweep (if Step 12 surfaces winners). Land the nursery lints that survived Step 12 triage with proper sweeps.

References

  • Plan H archived body: plans/archive/idiomatic-rust-clippy.adoc — describes the Step 2 transitional allows + Steps 3-7 burn-down + Step 9 deny promotion.

  • Cargo.toml [workspace.lints.clippy] — current 16-lint deny set + 5 allow-listed escape hatches.

  • clippy.toml — function-size threshold (40 lines) + test-code unwrap/expect allow.

  • xtask/src/cmd/validate.rs — current 20-step pre-push gate.

  • xtask/src/cmd/lints.rs — pattern for the Step 6 regression gate (mirror no-silent-skips / dto-length / secrets-yaml / route-role-coverage).

  • ADR-030 — Plan Lifecycle and Status Vocabulary.

  • delivery-protocol.md — plan completion audit protocol.

Edit this page · latest