chore(lint): restore god-level clippy bar as a ratchet (#61)

Cargo.toml

@@ -22,47 +22,57 @@ portable-pty = "0.9"
 vt100 = "0.16"
 
 # ============================================================
-# Bombay — god-level lint config (adopted from nexus, verbatim).
+# Bombay — god-level lint config (adopted from nexus — card #61).
 #
-# TEMPORARILY RELAXED to `allow`. The vendored bombay code (~19k LOC) is
-# not clean against this bar (1200+ findings). Rather than bury them
-# under scattered #[allow]s on code that ships *zero tests upstream*
-# (notably the `actors` crate), the bar is parked at `allow` so the
-# clippy gate passes over verbatim bombay. It will be re-tightened
-# lint-by-lint, with real fixes, as test coverage lands (M1/M7).
+# RESTORED as a lint RATCHET. The bar is DENY workspace-wide, so ALL NEW
+# code is held to the nexus/agency hygiene standard from line one. Legacy
+# vendored kameo files that predate the bar carry a documented per-file
+# `#![allow(..., reason = "…#61")]` quarantine header (zero refactor, zero
+# behaviour change on code that M1/M7 will rewrite or delete). Those headers
+# are removed file-by-file as the files are cleaned or dropped; the
+# de-quarantine checklist lives on issue #61.
 #
-# TO RESTORE the god-level bar: set the three groups below back to
-# `deny` and re-add the restriction wall preserved in the comment.
+# DEVIATION from nexus-verbatim: `disallowed_types` (the std::sync::Mutex /
+# RwLock ban) is NOT adopted — see clippy.toml for the rationale (the real
+# rule is "no lock held across .await", a per-site call, not a type ban).
 # ============================================================
 [workspace.lints.rust]
 unexpected_cfgs = { level = "warn", check-cfg = ['cfg(tokio_unstable)'] }
+# NOTE (#61 tail): the optional `[workspace.lints.rust]` tightening —
+# `unsafe_code` (kameo's `error.rs` transmute needs a per-site allow),
+# `missing_docs`, `unreachable_pub`, `dead_code` — is deferred. Turning it on
+# means covering rust-level lints in the per-file quarantine headers too.
 
 [workspace.lints.clippy]
-all = { level = "allow", priority = -1 }
-pedantic = { level = "allow", priority = -1 }
-nursery = { level = "allow", priority = -1 }
-
-# Original god-level config, to be restored as the surviving core is
-# cleaned (set the groups above to `deny` and uncomment these):
-#
-# unwrap_used = "deny"
-# expect_used = "deny"
-# panic = "deny"
-# todo = "deny"
-# unimplemented = "deny"
-# dbg_macro = "deny"
-# print_stdout = "deny"
-# print_stderr = "deny"
-# disallowed_methods = "deny"
-# disallowed_types = "deny"
-# clone_on_ref_ptr = "deny"
-# as_conversions = "deny"
-# str_to_string = "deny"
-# implicit_clone = "deny"
-# shadow_reuse = "deny"
-# shadow_same = "deny"
-# shadow_unrelated = "deny"
-# allow_attributes_without_reason = "deny"
+# 1. THE FOUNDATION
+all = { level = "deny", priority = -1 }
+pedantic = { level = "deny", priority = -1 }
+nursery = { level = "deny", priority = -1 }
+
+# 2. THE RUTHLESS RESTRICTIONS (disallowed_types omitted — see header)
+unwrap_used = "deny"
+expect_used = "deny"
+panic = "deny"
+todo = "deny"
+unimplemented = "deny"
+dbg_macro = "deny"
+print_stdout = "deny"
+print_stderr = "deny"
+disallowed_methods = "deny"
+
+# 3. MEMORY & PERFORMANCE STRICTNESS
+clone_on_ref_ptr = "deny"
+as_conversions = "deny"
+str_to_string = "deny"
+implicit_clone = "deny"
+
+# 4. VARIABLE HYGIENE
+shadow_reuse = "deny"
+shadow_same = "deny"
+shadow_unrelated = "deny"
+
+# 5. THE "NO CHEATING" RULE — every #[allow] must carry a reason.
+allow_attributes_without_reason = "deny"
 
 [workspace.metadata.crane]
 name = "bombay"

README.md

@@ -45,7 +45,7 @@ Everything below is re-exported from `bombay::prelude`:
 
 - **Actor** — `#[derive(Actor)]` or `impl Actor` by hand. Lifecycle hooks: `on_start`, `on_panic`, `on_link_died`, `on_stop`. Spawn with `Actor::spawn`, `spawn_with_mailbox`, `spawn_in_thread`, or build one with `prepare` and run it later.
 - **Messages** — `impl Message<M> for A { type Reply; async fn handle(&mut self, msg, ctx) -> Reply }`. The `Context` exposes the actor's own `ActorRef`, the reply channel (`reply_sender`), `forward`/`try_forward` to another actor, and `attach_stream` for `StreamMessage`.
-- **ActorRef** — `ask` (request/reply) and `tell` (fire-and-forget), each a builder: `.mailbox_timeout(..)`, `.reply_timeout(..)`, `.send()` / `.try_send()` / `.blocking_send()`, `tell`'s `.send_after(..)`, `.forward(..)`, or `await` it directly (`IntoFuture`). Plus `downgrade()` → `WeakActorRef`, strong/weak reference counts, `link`/`unlink`, and type-erased `Recipient` / `ReplyRecipient`.
+- **`ActorRef`** — `ask` (request/reply) and `tell` (fire-and-forget), each a builder: `.mailbox_timeout(..)`, `.reply_timeout(..)`, `.send()` / `.try_send()` / `.blocking_send()`, `tell`'s `.send_after(..)`, `.forward(..)`, or `await` it directly (`IntoFuture`). Plus `downgrade()` → `WeakActorRef`, strong/weak reference counts, `link`/`unlink`, and type-erased `Recipient` / `ReplyRecipient`.
 - **Reply** — any `Reply` type, including `Result<T, E>` and infallible scalars/collections. `ForwardedReply`, `DelegatedReply`, and a single-use `ReplySender` for replying out-of-band.
 - **Supervision** — `RestartPolicy` (`Permanent` / `Transient` / `Never`), `SupervisionStrategy` (`OneForOne` / `OneForAll` / `RestForOne`), restart-intensity limits (max restarts within a sliding window), and death-watch via links + `on_link_died`.
 - **Registry** — a process-local `ActorRegistry`: register an actor under a name, look it up, remove it.

actors/src/broker.rs

@@ -1,3 +1,31 @@
+// --- #61 quarantine (vendored kameo, pre-god-level-bar) -------------------
+// This file predates the workspace god-level clippy bar (root Cargo.toml).
+// It is held at the prior standard and is cleaned or deleted file-by-file
+// under M1/M7. NEW code is NOT exempt — remove this block when the file is
+// brought up to the bar or dropped. De-quarantine checklist: issue #61.
+#![allow(
+    clippy::all,
+    clippy::pedantic,
+    clippy::nursery,
+    clippy::unwrap_used,
+    clippy::expect_used,
+    clippy::panic,
+    clippy::todo,
+    clippy::unimplemented,
+    clippy::dbg_macro,
+    clippy::print_stdout,
+    clippy::print_stderr,
+    clippy::disallowed_methods,
+    clippy::clone_on_ref_ptr,
+    clippy::as_conversions,
+    clippy::str_to_string,
+    clippy::implicit_clone,
+    clippy::shadow_reuse,
+    clippy::shadow_same,
+    clippy::shadow_unrelated,
+    clippy::allow_attributes_without_reason,
+    reason = "Vendored kameo predating the #61 god-level clippy bar; held at the prior standard, cleaned or deleted file-by-file under M1/M7. New code is not exempt. See #61."
+)]
 //! Provides a topic-based message broker for the actor system.
 //!
 //! The `broker` module implements a flexible topic-based publish/subscribe mechanism that allows

actors/src/lib.rs

@@ -7,11 +7,11 @@
 //! - `pool`: Actor pool for managing concurrent task execution
 //! - `pubsub`: Publish-subscribe pattern implementation for actor communication
 //!
-//! # When to use MessageBus vs Broker vs PubSub
+//! # When to use `MessageBus` vs `Broker` vs `PubSub`
 //!
-//! - Use **MessageBus** when you want to route messages based on their type without explicit topics.
-//! - Use **Broker** when you need hierarchical topics, pattern-based subscriptions, or explicit routing.
-//! - Use **PubSub** when you need simple broadcast to all listeners with optional predicate-based filtering.
+//! - Use `MessageBus` when you want to route messages based on their type without explicit topics.
+//! - Use `Broker` when you need hierarchical topics, pattern-based subscriptions, or explicit routing.
+//! - Use `PubSub` when you need simple broadcast to all listeners with optional predicate-based filtering.
 
 use std::time::Duration;
 

actors/src/message_bus.rs

@@ -1,3 +1,31 @@
+// --- #61 quarantine (vendored kameo, pre-god-level-bar) -------------------
+// This file predates the workspace god-level clippy bar (root Cargo.toml).
+// It is held at the prior standard and is cleaned or deleted file-by-file
+// under M1/M7. NEW code is NOT exempt — remove this block when the file is
+// brought up to the bar or dropped. De-quarantine checklist: issue #61.
+#![allow(
+    clippy::all,
+    clippy::pedantic,
+    clippy::nursery,
+    clippy::unwrap_used,
+    clippy::expect_used,
+    clippy::panic,
+    clippy::todo,
+    clippy::unimplemented,
+    clippy::dbg_macro,
+    clippy::print_stdout,
+    clippy::print_stderr,
+    clippy::disallowed_methods,
+    clippy::clone_on_ref_ptr,
+    clippy::as_conversions,
+    clippy::str_to_string,
+    clippy::implicit_clone,
+    clippy::shadow_reuse,
+    clippy::shadow_same,
+    clippy::shadow_unrelated,
+    clippy::allow_attributes_without_reason,
+    reason = "Vendored kameo predating the #61 god-level clippy bar; held at the prior standard, cleaned or deleted file-by-file under M1/M7. New code is not exempt. See #61."
+)]
 //! Provides a type-based message bus for the actor system.
 //!
 //! The `message_bus` module implements a type-based publish/subscribe mechanism that allows

actors/src/message_queue.rs

@@ -1,3 +1,31 @@
+// --- #61 quarantine (vendored kameo, pre-god-level-bar) -------------------
+// This file predates the workspace god-level clippy bar (root Cargo.toml).
+// It is held at the prior standard and is cleaned or deleted file-by-file
+// under M1/M7. NEW code is NOT exempt — remove this block when the file is
+// brought up to the bar or dropped. De-quarantine checklist: issue #61.
+#![allow(
+    clippy::all,
+    clippy::pedantic,
+    clippy::nursery,
+    clippy::unwrap_used,
+    clippy::expect_used,
+    clippy::panic,
+    clippy::todo,
+    clippy::unimplemented,
+    clippy::dbg_macro,
+    clippy::print_stdout,
+    clippy::print_stderr,
+    clippy::disallowed_methods,
+    clippy::clone_on_ref_ptr,
+    clippy::as_conversions,
+    clippy::str_to_string,
+    clippy::implicit_clone,
+    clippy::shadow_reuse,
+    clippy::shadow_same,
+    clippy::shadow_unrelated,
+    clippy::allow_attributes_without_reason,
+    reason = "Vendored kameo predating the #61 god-level clippy bar; held at the prior standard, cleaned or deleted file-by-file under M1/M7. New code is not exempt. See #61."
+)]
 //! Provides an AMQP-style message queue system for the actor system.
 //!
 //! The `message_queue` module implements a flexible message queue system inspired by AMQP, with

actors/src/pool.rs

@@ -1,3 +1,31 @@
+// --- #61 quarantine (vendored kameo, pre-god-level-bar) -------------------
+// This file predates the workspace god-level clippy bar (root Cargo.toml).
+// It is held at the prior standard and is cleaned or deleted file-by-file
+// under M1/M7. NEW code is NOT exempt — remove this block when the file is
+// brought up to the bar or dropped. De-quarantine checklist: issue #61.
+#![allow(
+    clippy::all,
+    clippy::pedantic,
+    clippy::nursery,
+    clippy::unwrap_used,
+    clippy::expect_used,
+    clippy::panic,
+    clippy::todo,
+    clippy::unimplemented,
+    clippy::dbg_macro,
+    clippy::print_stdout,
+    clippy::print_stderr,
+    clippy::disallowed_methods,
+    clippy::clone_on_ref_ptr,
+    clippy::as_conversions,
+    clippy::str_to_string,
+    clippy::implicit_clone,
+    clippy::shadow_reuse,
+    clippy::shadow_same,
+    clippy::shadow_unrelated,
+    clippy::allow_attributes_without_reason,
+    reason = "Vendored kameo predating the #61 god-level clippy bar; held at the prior standard, cleaned or deleted file-by-file under M1/M7. New code is not exempt. See #61."
+)]
 //! Provides a pool of actors for task distribution and load balancing.
 //!
 //! The `pool` module offers the ability to manage a group of actors that work together to process tasks.

actors/src/pubsub.rs

@@ -1,3 +1,31 @@
+// --- #61 quarantine (vendored kameo, pre-god-level-bar) -------------------
+// This file predates the workspace god-level clippy bar (root Cargo.toml).
+// It is held at the prior standard and is cleaned or deleted file-by-file
+// under M1/M7. NEW code is NOT exempt — remove this block when the file is
+// brought up to the bar or dropped. De-quarantine checklist: issue #61.
+#![allow(
+    clippy::all,
+    clippy::pedantic,
+    clippy::nursery,
+    clippy::unwrap_used,
+    clippy::expect_used,
+    clippy::panic,
+    clippy::todo,
+    clippy::unimplemented,
+    clippy::dbg_macro,
+    clippy::print_stdout,
+    clippy::print_stderr,
+    clippy::disallowed_methods,
+    clippy::clone_on_ref_ptr,
+    clippy::as_conversions,
+    clippy::str_to_string,
+    clippy::implicit_clone,
+    clippy::shadow_reuse,
+    clippy::shadow_same,
+    clippy::shadow_unrelated,
+    clippy::allow_attributes_without_reason,
+    reason = "Vendored kameo predating the #61 god-level clippy bar; held at the prior standard, cleaned or deleted file-by-file under M1/M7. New code is not exempt. See #61."
+)]
 //! Provides a publish-subscribe (pubsub) mechanism for actors.
 //!
 //! The `pubsub` module allows actors to broadcast messages to multiple subscribers. It offers

actors/src/scheduler.rs

@@ -1,3 +1,31 @@
+// --- #61 quarantine (vendored kameo, pre-god-level-bar) -------------------
+// This file predates the workspace god-level clippy bar (root Cargo.toml).
+// It is held at the prior standard and is cleaned or deleted file-by-file
+// under M1/M7. NEW code is NOT exempt — remove this block when the file is
+// brought up to the bar or dropped. De-quarantine checklist: issue #61.
+#![allow(
+    clippy::all,
+    clippy::pedantic,
+    clippy::nursery,
+    clippy::unwrap_used,
+    clippy::expect_used,
+    clippy::panic,
+    clippy::todo,
+    clippy::unimplemented,
+    clippy::dbg_macro,
+    clippy::print_stdout,
+    clippy::print_stderr,
+    clippy::disallowed_methods,
+    clippy::clone_on_ref_ptr,
+    clippy::as_conversions,
+    clippy::str_to_string,
+    clippy::implicit_clone,
+    clippy::shadow_reuse,
+    clippy::shadow_same,
+    clippy::shadow_unrelated,
+    clippy::allow_attributes_without_reason,
+    reason = "Vendored kameo predating the #61 god-level clippy bar; held at the prior standard, cleaned or deleted file-by-file under M1/M7. New code is not exempt. See #61."
+)]
 //! Sends messages to actors at scheduled timeouts/intervals.
 //!
 //! Its common for actors to need to run code at some interval or after a delay. The [`Scheduler`] actor handles this

clippy.toml

@@ -1,41 +1,40 @@
 # ============================================================
-# Bombay — Elite Clippy Configuration (adopted from nexus, verbatim — card #61)
+# Bombay — Elite Clippy Configuration (adopted from nexus — card #61)
 #
-# TEMPORARILY PARKED alongside the relaxed `[workspace.lints.clippy]` bar
-# in Cargo.toml. kameo's `src/lib.rs` carries `#![warn(clippy::all)]`,
-# which a source attribute keeps active even with the workspace groups set
-# to `allow`; this file's `disallowed-*` entries and tightened thresholds
-# are what make that re-enabled `clippy::all` bite on verbatim kameo
-# (e.g. its `std::sync::Mutex`/`RwLock` use). With them gone, kameo passes
-# `clippy::all` cleanly, as it does upstream.
+# RESTORED (was parked): pairs with the god-level `[workspace.lints.clippy]`
+# wall in Cargo.toml. Legacy/vendored kameo files that fail the bar carry a
+# documented per-file `#![allow(..., reason = "…#61")]` quarantine header;
+# they are re-linted file-by-file or deleted under M1/M7. NEW code is never
+# exempt — it is born under the full bar.
 #
-# TO RESTORE the god-level bar: re-enable the `[workspace.lints.clippy]`
-# wall in Cargo.toml AND uncomment the config below.
+# DELIBERATE DEVIATION from nexus-verbatim: the `disallowed-types` ban on
+# `std::sync::Mutex` / `RwLock` is NOT adopted. That ban encodes a false
+# premise — the real rule is "never hold a lock across `.await`", not "never
+# use a std mutex". A short synchronous critical section is *correctly* a
+# `std::sync`/`parking_lot` mutex; `tokio::sync::Mutex` is for guards held
+# across await points. The choice is per-site (see card #52), which a blanket
+# type-ban cannot express. Bombay has zero `std::sync::Mutex` in production
+# today, so the ban would only forbid a future-correct use.
 # ============================================================
 
-# Tests get escape hatches for unwrap/expect (the only mercy)
-# allow-unwrap-in-tests = true
-# allow-expect-in-tests = true
+# Tests get escape hatches for unwrap/expect (the only mercy).
+allow-unwrap-in-tests = true
+allow-expect-in-tests = true
 
-# 1. BRAIN-CAPACITY LIMITS
-# cognitive-complexity-threshold = 9
-# too-many-arguments-threshold = 5
-# too-many-lines-threshold = 80
+# 1. BRAIN-CAPACITY LIMITS (these lints live in pedantic/nursery groups).
+cognitive-complexity-threshold = 9
+too-many-arguments-threshold = 5
+too-many-lines-threshold = 80
 
 # 2. BAN DANGEROUS METHODS
-# [[disallowed-methods]]
-# path = "std::process::exit"
-# reason = "Return a `Result` or `ExitCode` from main instead."
-#
-# [[disallowed-methods]]
-# path = "std::thread::spawn"
-# reason = "Use `std::thread::scope` or an async runtime like Tokio."
+[[disallowed-methods]]
+path = "std::process::exit"
+reason = "Return a `Result` or `ExitCode` from main instead."
 
-# 3. BAN DANGEROUS TYPES
-# [[disallowed-types]]
-# path = "std::sync::Mutex"
-# reason = "Use `tokio::sync::Mutex` or `parking_lot::Mutex`."
-#
-# [[disallowed-types]]
-# path = "std::sync::RwLock"
-# reason = "Use `tokio::sync::RwLock` or `parking_lot::RwLock`."
+[[disallowed-methods]]
+path = "std::thread::spawn"
+reason = "Use `std::thread::scope` or an async runtime like Tokio."
+
+# 3. BAN DANGEROUS TYPES — intentionally omitted (see header). The
+#    std::sync::Mutex / RwLock ban is a per-site judgment (card #52), not a
+#    type-level rule.