chore: track the Rust workspace preview and make release docs truthful

[Patel230]

Summary

This PR puts the owner's uncommitted Rover work under version control and makes the release story true.

The owner's work included the whole Rust port workspace (9 crates, 27 ADRs, license notices and audit scripts, all previously untracked), the SDK removal, and the Rust CI/Make gates. It is committed here in coherent commits: workspace, design docs, audit tooling, Rust gates, SDK removal, docs. The findings are fixed on top, and SOURCE_MANIFEST.json is regenerated with make manifest.

Defect found and fixed in the owner's work: nine upstream license notices use CRLF, and licenses/THIRD_PARTY_NOTICES.md pins their exact SHA-256. With the global core.autocrlf=input, git stored them as LF blobs. A fresh clone, CI included, would then have failed rust_dependency_audit.py --check: the stored blob hashed to 378f…, the pinned digest is 29c9…. The new .gitattributes marks licenses/** and the Herdr manifests -text. A fresh clone now passes the audit. I also dropped the owner's sdk/ exclusion in generate_source_manifest.py, which does nothing once the deletion is committed.

Second defect, found by this PR's first hosted run: the new rust job failed make rust-clippy on ubuntu-24.04. Three pedantic lints (similar_names, question_mark, inefficient_to_string) sit in cfg(target_os = "linux") code in rover-execution/src/pty.rs, which macOS clippy never compiles. They are fixed in 9a7b8ac with no behaviour change.

To reproduce locally, I ran cargo +1.88.0 clippy --workspace --all-targets --locked --offline --target x86_64-unknown-linux-gnu -- -D warnings, with lint-only stub CC/AR for the bundled SQLite build script. It shows the same three errors on the old code and passes on the new code.

Main behaviour changes:

• The Rust preview binary is now rover-rs. Before, both the Go product and the Rust preview built a binary called rover, so one could replace the other on PATH. rover-rs --version labels itself as an unreleased preview.
• CI has two independent jobs: go (unchanged gates, 20 min) and rust (30 min, SHA-pinned Swatinem/rust-cache, only main saves the cache). The Rust SBOM is uploaded as a run artifact.
• The release workflow adds keyless GitHub build-provenance attestations (actions/attest-build-provenance, SHA-pinned) for every checksummed asset. No long-lived key is involved.
• README is rebuilt around the Go product:
  • install from source, one platform matrix, then the quickstart;
  • the Rust keybinding manual moved to docs/RUST_PREVIEW.md;
  • docs/validation/v0.0.1/REPORT.md records the tag's hosted CI run;
  • SECURITY, SUPPORT and GOVERNANCE describe the public repo as it actually is.

Findings addressed

• F062 (Rust workspace untracked): all 421 untracked paths are committed. target/ stays ignored. CRLF blob defect fixed as described above. A fresh clone passes manifest-check, version-check, the script tests, the license audit and rover doctor --verify.
• F063 (stale manifest): regenerated with make manifest (628 entries, no sdk/). --check now lists the missing, untracked and changed paths, with unit tests.
• F064 (README documented Rust-only commands and keys): the README documents only the Go product. agent session and the Ctrl-B keys live in docs/RUST_PREVIEW.md under rover-rs, with build steps.
• F065 / F275 (docs denied the public repo, CI and release):
  • README, STATUS, SECURITY, SUPPORT and GOVERNANCE now state the observed facts: public repo, hosted CI, source-only v0.0.1 release.
  • Security reports go to security@graycodeai.com.
  • SECURITY.md says plainly that GitHub private vulnerability reporting is not enabled yet (the API returns enabled:false).
• F066 (97-line README paragraph): README is restructured, and STATUS holds the Rust progress narrative without the keybinding manual.
• F067 (two binaries named rover): the Rust binary is renamed to rover-rs. It has a preview --version and a new tests/cli_identity.rs. The parity plan (P-164) records that the name changes only at cutover.
• F068 (research notes cite removed SDKs): banners on the 3 notes that cite Rover's sdk/, plus research_notes/README.md. The report's make sdk-test line is now labelled historical. The other 4 notes' "SDK" hits are about other projects.
• F069 (cold Rust build inside the single 20-min job): split into go and rust jobs, with the cache and a separate timeout. Measured on this PR (run 36279833786): the rust job took 1 min 22 s from a cold cache (319 Linux tests) and the go job 2 min 40 s. The numbers are recorded in docs/CI.md.
• F070 (Windows ConPTY claim): STATUS and RUST_PREVIEW now say Rover does not build, test or support Windows. The ConPTY backend comes from portable-pty and is not a Rover capability.
• F071 ("Current validation" pointed at 0.2.0-alpha.1):
  • README relabels that report as historical.
  • The new docs/validation/v0.0.1/REPORT.md covers tag run 35097554082. That run's setup-go 'stable' resolved to go1.27.1, and the report cites the log.
• F072 (unverified → confirmed; Rust gates undocumented, package count wrong):
  • docs/CI.md gains the Rust rows and the correct count: 24 packages, 21 with tests.
  • CONTRIBUTING, ROADMAP and AGENTS.md document the Rust toolchain and gates.
• F073 (unverified → confirmed; SBOM discarded, audit ignored CARGO): the SBOM is uploaded as an artifact. The audit script reads CARGO via shlex (with tests), and the Makefile passes it through. The Rust SBOM is deliberately not a release asset, because releases ship only Go binaries.
• F074 (platform statements disagreed): README has one matrix. Linux is validated in CI. macOS is observed and needs a from-source cgo build (cross-built darwin binaries have a stub store). Windows is unsupported. STATUS now cites the CI runs.
• F075 (docs/design/README.md called the folder historical): it is now an index. Current ADRs and plans are listed apart from the historical master plan, and ROADMAP has a Rust-port section.
• F258 (unverified → confirmed; no release provenance): release assets get provenance attestations. TestReleaseWorkflowAttestsProvenance guards the step, its permissions and its order; a mutation check confirmed the test fails when the step is removed. docs/CI.md documents gh attestation verify.
• F276 (unverified → confirmed; docs still name the SDK client): docs/ARCHITECTURE.md no longer lists a Python client, docs/SOURCES.md provenance is fixed, and STATUS marks the make sdk-test results as historical.

Not reproduced / deferred

• F065 (part): I did not enable GitHub private vulnerability reporting. That is a repository-settings change for the owner, so SECURITY.md describes the current state.
• F070 (part): I did not add a Windows CI job, because I cannot verify a Windows build from this macOS host. I took the documentation fix instead (the finding's second option).
• F258 (part): the attestation step runs only when the owner dispatches a release, so it has not run yet.

Verification

All commands below ran from the branch checkout on darwin/arm64 (go1.26.6, cargo 1.88.0) with a clean tree at f31320b. After the lint fix, make rust-check and make manifest-check were re-run at 43eea4a: both exit 0, 317 tests passed.

Command	Result
make check	exit 0; 21 packages ok
make race	exit 0; 21 packages ok
make version-check	exit 0
make manifest-check	exit 0 (4 new unit tests plus the check)
make rust-check CARGO='cargo +1.88.0'	exit 0: fmt, clippy -D warnings, 317 cargo tests passed / 0 failed, 19 script tests OK, "Rust dependency licenses and bundled notices match Cargo.lock."
GOFLAGS=-buildvcs=false make demo	exit 0; "12 smoke scenarios passed"
GOFLAGS=-buildvcs=false make demo-extended	exit 0; "16 extended CLI scenarios passed"
make fuzz	exit 0; 5 fuzzers
make rust-sbom CARGO='cargo +1.88.0'	"Wrote 180 Rust SBOM components"
actionlint .github/workflows/*.yml	exit 0
Linux-target clippy (stub C tools, see Summary)	exit 0 after 9a7b8ac; the 3 CI errors reproduce on the previous code
Fresh git clone of the branch	manifest-check, version-check, script tests and license audit pass; rover doctor --verify --json → "verified": true

Baseline on the owner's uncommitted tree before any change: make manifest-check failed ("SOURCE_MANIFEST.json is stale"). make rust-check passed with 315 tests.

Not run locally: make vulncheck (needs network) and make cross-build. The hosted go job runs both.

Hosted CI on this PR:

• At f31320b, go passed and rust failed: 3 Linux-only clippy lints, fixed in 9a7b8ac.
• At 43eea4a, both jobs passed on the push and pull_request runs (36279833786, 36279837334). The rust job ran 319 cargo tests with 0 failures, the 19 script tests, the license audit, and the SBOM artifact upload.
• At the final head 39026d4 (a docs-only change recording those timings), both jobs passed on the push and pull_request runs (36280024936, 36280027435).

Follow-ups

1. Owner: enable private vulnerability reporting (gh api -X PUT repos/GrayCodeAI/rover/private-vulnerability-reporting), then change SECURITY.md to list it as live.
2. Optionally record the warm-cache rust job duration after the first cache save on main.
3. Add a Windows cargo check job only if Windows support is pursued (parity task P-156).
4. The next release dispatch exercises the attestation step; confirm gh attestation verify on one asset.
5. The Rust crates are version 0.1.0 while Rover is 0.0.1. Align them when the Rust port is first released. Also consider publish = false on the workspace crates.
6. Confirm the security@graycodeai.com and hello@graycodeai.com mailboxes are monitored.

🤖 Generated with Claude Code