fix(sdd-execute): --locked Rust gate (closes #318) + raise wall-clock budget to 90m

[norrietaylor]

Two execute-fragment fixes, deployed together via retag.

1. --locked Rust Pre-PR gate (closes #318)

The Rust consumer-verify gate ran cargo build/clippy/test without --locked, so lockfile drift passed the gate and only surfaced as a --locked exit 101 on consumer CI after the PR was open (a Cargo.toml dep add without a lock regen shipped a red PR). Now: run the gate with --locked, and regenerate + commit Cargo.lock when the task changes a Cargo.toml (mirrors the Node frozen-lockfile rule).

2. Raise wall-clock budget 60m → 90m

60m proved too tight for the larger multi-crate tasks (egress/ingress policy enforcement, *.localhost registry), which timed out mid-run. timeout-minutes raised to 90 across all execute tiers.

Prompt-only + timeout-minutes frontmatter; recompiled locks (contract check passes, 0 compile errors). After merge: retag v0.3.0.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

No new commits to review since the last review.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 065b379f-a4eb-4b84-a858-34b77ca99beb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The Rust pre-PR CI gate instructions embedded in the sdd-execute workflow prompts for all three agent tiers (haiku, sonnet, opus) are updated to run cargo build, cargo clippy, and cargo test with --locked, and to require regenerating and committing Cargo.lock when Cargo.toml changes. Execution timeouts are increased from 60 to 90 minutes across all tiers. The three compiled .lock.yml artifacts are regenerated accordingly, with heredoc identifiers rotated and, for the opus tier, protected_files_policy: "fallback-to-issue" added to the safe-outputs config.

Changes

Rust --locked pre-PR gate and compiled artifact refresh

Layer / File(s)	Summary
Rust gate source instructions and timeouts updated across all tiers .github/workflows/sdd-execute-haiku.md, .github/workflows/sdd-execute-opus.md, .github/workflows/sdd-execute-sonnet.md	timeout-minutes increased from 60 to 90. Replaces unlocked cargo build/cargo clippy/cargo test with --locked variants and adds an explicit rule requiring Cargo.lock regeneration and commit whenever Cargo.toml is modified, mirroring the existing Node frozen-lockfile discipline.
Compiled .lock.yml artifacts regenerated for all three tiers .github/workflows/sdd-execute-haiku.lock.yml, .github/workflows/sdd-execute-opus.lock.yml, .github/workflows/sdd-execute-sonnet.lock.yml	All three compiled workflow files are regenerated: metadata hashes and heredoc identifiers are rotated throughout the prompt assembly blocks, timeout-minutes and GH_AW_TIMEOUT_MINUTES increase from 60 to 90, the embedded Rust gate text reflects the --locked and lockfile-commit rules, and for the opus tier the safe-outputs config.json gains protected_files_policy: "fallback-to-issue" under create_pull_request and push_to_pull_request_branch.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• norrietaylor/spectacles#212: Introduced the Rust "Pre-PR CI gate" instructions in the same sdd-execute-{haiku,sonnet,opus} workflow prompts that this PR tightens with --locked enforcement.
• norrietaylor/spectacles#260: Also updates the in-sandbox Pre-PR CI gate text in the same .md prompt and .lock.yml compiled artifacts, extending gate coverage to Node/stack-neutral commands.
• norrietaylor/spectacles#306: Previously increased the agent job wall-clock timeout-minutes and matching GH_AW_TIMEOUT_MINUTES value in the same sdd-execute-* workflows that this PR further extends from 60 to 90.

Poem

🐇 Hop hop, no drifting lock shall slip through!
--locked now guards what cargo must do.
If Cargo.toml dares to change its tune,
regenerate the lock, commit it soon.
No silent rewrites under the moon —
the rabbit checks twice, every afternoon. 🔒

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the two main changes: adding --locked Rust gate validation (referencing issue #318) and raising the wall-clock timeout budget to 90 minutes.
Description check	✅ Passed	The description relates directly to the changeset, explaining both fixes (--locked Rust gate and timeout increase) with concrete context about why each change was needed.
Linked Issues check	✅ Passed	The PR directly addresses issue #318 by implementing --locked enforcement in the Rust Pre-PR gate and automatically regenerating/committing Cargo.lock on Cargo.toml changes, matching the issue's requirements.
Out of Scope Changes check	✅ Passed	All changes are scoped to the two stated objectives: adding --locked flags to Rust commands and raising timeout values from 60 to 90 minutes across all execute tiers.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/execute-locked-cargo-gate

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/sdd-execute-opus.lock.yml:
- Line 2101: The push_to_pull_request_branch configuration is missing the
protected_files_policy setting that exists in create_pull_request. Locate the
push-to-pull-request-branch section in the source markdown file and add the
protected_files_policy field with value "fallback-to-issue" to match the policy
defined in create_pull_request. After making this change, recompile the workflow
using the gh aw compile command to regenerate the lock file and ensure the
configuration is properly propagated to all handler instances including the one
at line 3511.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 82a03fab-2bd6-464d-b4ca-b1f0297d0c67

📥 Commits

Reviewing files that changed from the base of the PR and between 44b9cb8 and 4e3559a.

📒 Files selected for processing (6)

• .github/workflows/sdd-execute-haiku.lock.yml
• .github/workflows/sdd-execute-haiku.md
• .github/workflows/sdd-execute-opus.lock.yml
• .github/workflows/sdd-execute-opus.md
• .github/workflows/sdd-execute-sonnet.lock.yml
• .github/workflows/sdd-execute-sonnet.md

[norrietaylor]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.