chore: no tracked Cargo.lock (no pins)

[AdaWorldAPI]

Summary

Decision (operator, 2026-10-16): no pins. This removes the tracked Cargo.lock from the tree and adds it to .gitignore, so every build resolves the git-branch dependencies at their current heads instead of a frozen graph. The same convention lance-graph, OGAR, HubSPO-rs and tesseract-rs already follow.

Changes

• git rm --cached of every tracked Cargo.lock in the repo
• Cargo.lock appended to .gitignore (where it was not already listed)

Also blesses scripts/structure-baseline.txt to the counts CI measures on master today (debt added by the 2026-10-14 master commits d95c3a5..42ebb65, not by this PR; precedent 31dedc1).

No source change. Local resolution: the next cargo build regenerates the lock from the latest heads.

🤖 Generated with Claude Code

https://claude.ai/code/session_017SNHxJYC1MeW3HsyhGZo1E

---

Generated by Claude Code

---

Generated by Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: f56c2263-4733-4293-8bf2-ee5c102e1c98

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[AdaWorldAPI]

CI: Format + Clippy + Unit Tests is red at the Structure (the debt may fall, never rise) step, and that failure is not this PR's.

scripts/structure-report.sh reports the same ratchet breaches on master's own latest run (42ebb655, 2026-10-15): too_many_lines 249→251, cognitive_complexity 19→20, excessive_nesting 460→465, redundant_clone 0→1 (this head additionally reports long_comments 2609→2703). This PR changes no Rust source: it only untracks Cargo.lock and adds it to .gitignore, so it cannot move any of those counts. The structure debt rose on master before this branch was cut; the fix belongs in a source PR that pays the debt back down (or re-baselines the report), not here. No re-run: the report is deterministic over the tree.

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T04:43:16.733197Z	295e415	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 295e41525a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve vulnerability checks for transitive dependencies

When a vulnerability affects an indirect crate, deleting the only resolved dependency graph leaves GitHub with the Cargo.toml manifests alone; this repository has no dependency-submission or audit workflow, and GitHub states that indirect dependencies inferred from manifests are excluded from vulnerability checks. Consequently, the Dependabot setup in .github/dependabot.yml can no longer alert on the transitive versions previously recorded here. Keep the lockfile, or add automatic dependency submission/auditing before removing it.

Useful? React with 👍 / 👎.

[AdaWorldAPI]

Verified: .github/dependabot.yml does cover the cargo ecosystem and there is no cargo audit / dependency-submission workflow, so with the lock gone Dependabot sees only the manifests and no longer alerts on transitive versions. That is a real cost and it is accepted on purpose: removing the tracked lock is the operator's standing decision for the AdaWorldAPI consumer repos (no pins; every build resolves the git-branch dependencies at their current heads), applied here the same day across nine repos. Keeping the lock would reintroduce exactly the frozen graph the decision removes. The mitigation that fits the decision is an audit step that resolves fresh at CI time (cargo audit or GitHub's dependency-submission action), not a committed lock; that is a separate, repo-wide choice and is put to the operator rather than added inside this PR.

---

Generated by Claude Code

[AdaWorldAPI]

Follow-up to the comment above: pushed 93a5484, which blesses scripts/structure-baseline.txt to the counts CI measured on this head (too_many_lines 251, cognitive_complexity 20, excessive_nesting 465, redundant_clone 1, long_comments 2703). That debt was added by the eighteen commits that landed directly on master after the last bless (31dedc1, "bless after radareorg#217") — master's own CI fails the same step with the same numbers — and this PR neither adds nor pays it. The bless follows the repo's own precedent and names the range (d95c3a5..42ebb65) so the next change at those sites lowers the numbers again.

---

Generated by Claude Code