[failproofaid] Split failproofai into a CLI + Rust background daemon

.failproofai/policies/workflow-policies.mjs

@@ -92,8 +92,7 @@ customPolicies.add({
       "Before creating the PR, ensure CHANGELOG.md entries land under a versioned section so the PR ships release-ready:\n" +
       "  1. Read `version` from package.json (e.g. `0.0.10-beta.10`).\n" +
       "  2. Ensure your changelog entries are under a `## <version> — <today's date in YYYY-MM-DD>` heading. If that heading does not exist yet, create it above the previous version's section. There is NO `## Unreleased` section — entries always go under a dated, versioned heading.\n" +
-      "  3. If you are on a `luv-cut-X.Y.Z` branch, the cut PR handles version bump itself.\n" +
-      "  4. Do NOT bump `package.json`'s `version` outside of `luv-cut-*` branches — that is enforced by `block-version-bumps`."
+      "  3. If you are on a `luv-cut-X.Y.Z` branch, the cut PR handles version bump itself."
     );
   },
 });

.github/dependabot.yml

@@ -22,3 +22,20 @@ updates:
       interval: weekly
       day: monday
     open-pull-requests-limit: 5
+
+  # The Rust workspace. Absent until the daemon shipped, so `Cargo.lock` was
+  # updated only by hand — for a dependency tree that includes the TLS stack
+  # compiled into a root-installed system service.
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    groups:
+      # One PR for the whole tree rather than five a week: these crates are
+      # verified together by `cargo test --workspace`, and splitting them means
+      # each PR rebuilds the same lockfile the others just changed.
+      rust-dependencies:
+        patterns:
+          - "*"

.github/workflows/build-daemon.yml

@@ -60,10 +60,19 @@ jobs:
           # architectures (including a native arm64 runner) rather than
           # `cross`/Docker cross-compilation — a real linker for the target
           # triple, no QEMU emulation overhead.
-          - target: x86_64-unknown-linux-gnu
+          #
+          # musl, NOT gnu: a glibc build links against the runner's own libc,
+          # and `ubuntu-latest` is 24.04 (glibc 2.39), so the 1.0.0-beta.0
+          # binaries refused to start on Ubuntu 22.04, Debian 12, RHEL 9 and
+          # Amazon Linux 2023 with `version GLIBC_2.39 not found` — measured,
+          # not predicted. Pinning an older runner would only move the floor
+          # (22.04 is glibc 2.35, still above RHEL 9's 2.34); a static musl
+          # binary has no floor at all. The daemon is a socket supervisor with
+          # no NSS or dlopen use, which is what makes static linking safe here.
+          - target: x86_64-unknown-linux-musl
             os: ubuntu-latest
             platform: linux-x64
-          - target: aarch64-unknown-linux-gnu
+          - target: aarch64-unknown-linux-musl
             os: ubuntu-24.04-arm
             platform: linux-arm64
           # macOS cannot be cross-compiled reliably from Linux (system
@@ -90,6 +99,14 @@ jobs:
 
       - run: rustup target add ${{ matrix.target }}
 
+      # `rustup target add` ships the musl std library but not a musl linker;
+      # without musl-tools the leg fails at link time with
+      # `linker 'musl-gcc' not found`. Both Linux runners are native to their
+      # own target, so the distro package is the right linker for the triple.
+      - name: Install the musl toolchain
+        if: contains(matrix.target, 'musl')
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq musl-tools
+
       # Split restore/save rather than `actions/cache@v6`, which does both.
       # This job runs on `pull_request` AND on the release path (via
       # `workflow_call` from publish.yml, where `github.event_name` is the
@@ -139,10 +156,22 @@ jobs:
         run: |
           BIN="target/${{ matrix.target }}/release/failproofaid"
           "$BIN" --version
+          # A dynamically linked "static" build would reintroduce the glibc
+          # floor silently — the binary still runs here, on the runner that
+          # built it, and only fails on the users' older distros. Assert the
+          # property on the artifact itself.
+          if [[ "${{ matrix.target }}" == *musl* ]]; then
+            file "$BIN"
+            if ldd "$BIN" 2>&1 | grep -qv "not a dynamic executable\|statically linked"; then
+              echo "::error::${{ matrix.platform }} is not statically linked — it would inherit the runner's glibc floor"
+              ldd "$BIN" || true
+              exit 1
+            fi
+          fi
           gzip -9 -c "$BIN" > "failproofaid-${{ matrix.platform }}.gz"
           ls -l "failproofaid-${{ matrix.platform }}.gz"
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: failproofaid-${{ matrix.platform }}
           path: failproofaid-${{ matrix.platform }}.gz

.github/workflows/build-image.yml

@@ -47,7 +47,7 @@ jobs:
         uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Log in to GHCR
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/ci.yml

@@ -55,6 +55,24 @@ jobs:
               MISMATCH=1
             fi
           done
+          # The daemon binaries DO ship as npm platform packages
+          # (@failproofai/failproofaid-<os>-<arch>), but their pins are injected
+          # into package.json at publish time by
+          # scripts/build-daemon-packages.mjs — the same invocation that
+          # publishes them, so they cannot drift — and are deliberately absent
+          # from the committed tree. Nothing to check here.
+          #
+          # The Cargo version still has to match, because the release tag the
+          # CLI builds its download URL from is the npm version, and the binary
+          # at that URL reports the Cargo one.
+          # Check the Cargo workspace version (failproofaid) against root package.json
+          if [ -f Cargo.toml ]; then
+            CARGO_VERSION=$(grep -m1 '^version = ' Cargo.toml | sed -E 's/version = "(.*)"/\1/')
+            if [ "$CARGO_VERSION" != "$ROOT_VERSION" ]; then
+              echo "::error file=Cargo.toml::Version mismatch: Cargo.toml has $CARGO_VERSION, expected $ROOT_VERSION"
+              MISMATCH=1
+            fi
+          fi
           if [ "$MISMATCH" -eq 1 ]; then
             echo "::error::Version mismatch detected across package.json files"
             exit 1
@@ -75,6 +93,85 @@ jobs:
           timeout_minutes: 5
           command: bunx tsc --noEmit
 
+  rust-quality:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7.0.1
+        with:
+          # This job runs `cargo clippy`/`cargo test` over the full
+          # dependency tree, executing third-party build scripts. The
+          # default (`true`) would leave GITHUB_TOKEN in .git/config where
+          # any of them could read it; nothing here needs push access.
+          persist-credentials: false
+
+      # Stage 1 lands an empty Cargo workspace (zero crates/*/Cargo.toml) so
+      # the CI plumbing itself can go green before any Rust code exists.
+      # `cargo build/clippy/test --workspace` (and even `cargo fmt --all`)
+      # all hard-error on a zero-member workspace ("the workspace has no
+      # members"), so every real step below is gated on at least one crate
+      # being present rather than relying on any of them to no-op cleanly.
+      - name: Detect crates
+        id: crates
+        run: |
+          if ls crates/*/Cargo.toml >/dev/null 2>&1; then
+            echo "present=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "present=false" >> "$GITHUB_OUTPUT"
+            echo "No crates/*/Cargo.toml yet — rust-quality has nothing to check."
+          fi
+
+      - if: steps.crates.outputs.present == 'true'
+        run: rustup show
+
+      # cargo test spawns the real TS worker via `bun bin/failproofai-worker.mjs`
+      # (crates/failproofaid/src/server.rs's live end-to-end test) — bun has to
+      # be on PATH for that test, not just for the TS-side jobs.
+      - if: steps.crates.outputs.present == 'true'
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      # …and bun on PATH is not enough on its own. That worker runs the raw
+      # TypeScript, so it resolves the handler's real dependency tree at
+      # runtime rather than a bundle's. The moment anything under src/hooks
+      # imports a third-party package, this job fails with a bun ENOENT that
+      # reads like a Rust problem — the failure surfaces as "worker process
+      # exited before creating its socket". Production is unaffected, because
+      # dist/worker.mjs bundles those deps; only this path needs them on disk.
+      - if: steps.crates.outputs.present == 'true'
+        uses: actions/cache@v6
+        with:
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: bun-${{ runner.os }}-
+
+      - if: steps.crates.outputs.present == 'true'
+        name: Install worker dependencies
+        run: bun install --frozen-lockfile --ignore-scripts
+
+      - if: steps.crates.outputs.present == 'true'
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+            target
+          key: cargo-${{ runner.os }}-${{ hashFiles('rust-toolchain.toml', 'Cargo.lock', 'crates/*/Cargo.toml') }}
+          restore-keys: cargo-${{ runner.os }}-
+
+      - name: cargo fmt --check
+        if: steps.crates.outputs.present == 'true'
+        run: cargo fmt --all -- --check
+
+      - name: cargo clippy
+        if: steps.crates.outputs.present == 'true'
+        run: cargo clippy --workspace --all-targets -- -D warnings
+
+      - name: cargo test
+        if: steps.crates.outputs.present == 'true'
+        run: cargo test --workspace
+
   test:
     runs-on: ubuntu-latest
     strategy:

.github/workflows/osv-scanner.yml

@@ -41,8 +41,13 @@ jobs:
         with:
           # No git ops after checkout; don't leave the token in .git/config.
           persist-credentials: false
-      - name: Scan bun.lock for known-vulnerable / malicious dependencies
+      # Both lockfiles, in one scan. `Cargo.lock`'s 238 packages were covered by
+      # nothing at all — not this job, which was only ever given `bun.lock`, and
+      # not Dependabot, which had no `cargo` ecosystem — for a TLS stack that
+      # compiles into a root-installed system service.
+      - name: Scan bun.lock and Cargo.lock for known-vulnerable / malicious dependencies
         uses: google/osv-scanner-action/osv-scanner-action@9fd1bcce27f67e3bd819a0a7620e332803dc43bc # v2.3.8
         with:
           scan-args: |-
             --lockfile=bun.lock
+            --lockfile=Cargo.lock