chore: god-level clippy — adopt nexus elite lint config

[joeldsouzax]

Adopt nexus's elite ("god-level") clippy config verbatim so Bombay holds the same hygiene bar as nexus/agency. It is two cooperating files: clippy.toml (thresholds + banned methods/types) and [workspace.lints.clippy] in the root Cargo.toml (the 5-group ruthless block). Every member crate opts in with [lints] workspace = true.

clippy.toml (Bombay)

# Bombay — Elite Clippy Configuration (from nexus)
allow-unwrap-in-tests = true
allow-expect-in-tests = true

# 1. BRAIN-CAPACITY LIMITS
cognitive-complexity-threshold = 9
too-many-arguments-threshold = 5
too-many-lines-threshold = 80

# 2. BAN DANGEROUS METHODS
[[disallowed-methods]]
path = "std::process::exit"
reason = "Return a `Result` or `ExitCode` from main instead."

[[disallowed-methods]]
path = "std::thread::spawn"
reason = "Use `std::thread::scope` or an async runtime like Tokio."

# 3. BAN DANGEROUS TYPES
[[disallowed-types]]
path = "std::sync::Mutex"
reason = "Use `tokio::sync::Mutex` or `parking_lot::Mutex`."

[[disallowed-types]]
path = "std::sync::RwLock"
reason = "Use `tokio::sync::RwLock` or `parking_lot::RwLock`."

Root Cargo.toml

[workspace.lints.clippy]
# 1. THE FOUNDATION
all      = { level = "deny", priority = -1 }
pedantic = { level = "deny", priority = -1 }
nursery  = { level = "deny", priority = -1 }

# 2. THE RUTHLESS RESTRICTIONS
unwrap_used        = "deny"
expect_used        = "deny"
panic              = "deny"
todo               = "deny"
unimplemented      = "deny"
dbg_macro          = "deny"
print_stdout       = "deny"
print_stderr       = "deny"
disallowed_methods = "deny"
disallowed_types   = "deny"

# 3. MEMORY & PERFORMANCE STRICTNESS
clone_on_ref_ptr = "deny"
as_conversions   = "deny"
str_to_string    = "deny"
implicit_clone   = "deny"

# 4. VARIABLE HYGIENE
shadow_reuse     = "deny"
shadow_same      = "deny"
shadow_unrelated = "deny"

# 5. THE "NO CHEATING" RULE
allow_attributes_without_reason = "deny"

Every member crate

[lints]
workspace = true

Optional: also adopt agency's [workspace.lints.rust]

nexus ships clippy-only; agency additionally denies rust lints. Recommended for Bombay too, but unsafe_code is the catch (see below):

[workspace.lints.rust]
unsafe_code     = "deny"   # see phasing note — kameo uses unsafe transmute
missing_docs    = "warn"
unreachable_pub = "deny"
dead_code       = "deny"

CRITICAL: phasing (do NOT apply atomically to the fork)

Forked kameo will fail thousands of these immediately. Concretely:

• unsafe_code = "deny" — kameo has std::mem::transmute in error.rs (the error-hook fn-ptr). Either keep unsafe_code = "warn" initially, or #[allow(unsafe_code, reason="…")] that one site.
• disallowed_types std::sync::Mutex — kameo uses it in links.rs:38. This lint is the M7 cleanup: parking_lot for the supervision link graph #52 migration (swap to parking_lot). The linter enforces the de-handroll.
• unwrap_used/expect_used/panic = deny — many call sites; aligns with adopting thiserror (cleanup: adopt thiserror for local error enums #50) and terrors (cleanup: terrors OneOf for nested error unions #53).
• as_conversions, too_many_lines = 80, cognitive_complexity = 9 — will flag large files like actor_ref.rs (2,980 LOC) and supervision.rs (1,976 LOC) heavily.

Phasing plan:

1. Land clippy.toml + [workspace.lints.clippy] with the foundation groups at warn first (all/pedantic/nursery = warn), get a baseline count.
2. Flip the ruthless restrictions (unwrap/expect/panic/dbg) to deny as the code is cleaned crate-by-crate.
3. Flip all/pedantic/nursery to deny last, once the fork compiles clean.
4. Track allow-with-reason exceptions; allow_attributes_without_reason = deny forces every #[allow] to justify itself.

Cross-links

• Enforces cleanup: parking_lot for the supervision link graph #52 (parking_lot — the std::sync::Mutex ban).
• Pairs with cleanup: adopt thiserror for local error enums #50 (thiserror) and cleanup: terrors OneOf for nested error unions #53 (terrors) for the no-panic/no-unwrap goal.
• Lives with the Nix harness chore: Nix build harness — crane + fenix on STABLE Rust #60 (nix flake check runs cargo clippy --deny warnings).

Acceptance

clippy.toml + [workspace.lints.clippy] (+ optional rust lints) checked in; every crate has [lints] workspace = true; nix flake check clippy step is green at the current phase; no blanket #[allow] without a reason.

[joeldsouzax]

The bar is live (PR #111). The god-level clippy config is restored as a ratchet: deny workspace-wide, gate re-enabled in flake.nix (scoped to lib + bins). All new production code is now held to the nexus bar. This issue stays open for the de-quarantine tail below.

Decisions baked in

• Dropped disallowed_types Mutex/RwLock ban — per-site rule (no lock across .await, cleanup: parking_lot for the supervision link graph #52), not a type ban; 0 std::sync::Mutex in prod today.
• Gate = lib + bins, not --all-targets — test/example/bench surface (~60 files, 2k+ style findings) kept on the lighter bar already implied by allow-unwrap/expect-in-tests.
• No -- --deny warnings — the deny bar gates; rust-level warnings stay non-blocking for now.

Tail 1 — de-quarantine (remove the #![allow(…#61…)] header as each file is cleaned or deleted)

Leaves automatically in M1 (Zenoh replaces src/remote/) — no cleanup needed:

• src/remote.rs · src/remote/_internal.rs · src/remote/behaviour.rs · src/remote/messaging.rs · src/remote/registry.rs · src/remote/swarm.rs
• macros/src/remote_message.rs · macros/src/derive_remote_actor.rs

Clean under test protection (M7 / when next touched):

• core: src/actor.rs · src/actor/actor_ref.rs · src/actor/id.rs · src/actor/kind.rs · src/actor/spawn.rs · src/mailbox.rs · src/message.rs · src/reply.rs · src/request.rs · src/request/ask.rs · src/request/tell.rs · src/links.rs · src/supervision.rs · src/error.rs
• console: src/console.rs · src/console/demo.rs · src/console/registry.rs · src/console/server.rs · console/src/main.rs · console/src/poller.rs · console/src/tui.rs
• actors: actors/src/broker.rs · actors/src/message_bus.rs · actors/src/message_queue.rs · actors/src/pool.rs · actors/src/pubsub.rs · actors/src/scheduler.rs
• macros: macros/src/derive_actor.rs · macros/src/derive_reply.rs · macros/src/messages.rs

Tail 2 — optional tightening (separate PRs)

• [workspace.lints.rust]: unsafe_code (kameo's error.rs transmute needs a per-site allow), dead_code, unreachable_pub, missing_docs. Requires covering rust-level lints in the quarantine headers too.
• Decide whether to gate the test/example/bench surface (would add ~60 quarantine headers or a bulk cleanup).

[joeldsouzax]

Closing — the god-level clippy bar is restored and live (PR #111, auto-merging on green CI). The primary deliverable of this card is done.

The de-quarantine tail and optional tightening (rust-lints, test-surface gating) are preserved in the checklist comment above; they ride along with M1/M7 as files are rewritten (each quarantine header references #61). Spin a fresh card if/when the optional tightening is picked up.