@agentsfleet/orly 0.6.8 → 0.7.0

package/.githooks/pre-commit

@@ -32,7 +32,11 @@ fi
 # that did or did not read the façade is still the session committing.
 SOURCE_PATTERN='\.(zig|ts|tsx|js|jsx|py|rs|go|sh|sql)$'
 
-if git diff --cached --name-only | grep -qE "$SOURCE_PATTERN"; then
+# Governance paths join the source list here: dispatch/edit_rules.sh declares
+# the corpus scope, so a staged rule edit now has a façade to have read. The
+# check itself stays the arbiter — a path outside every leaf's globs still
+# reports "nothing staged triggers a façade" and costs one grep.
+if git diff --cached --name-only | grep -qE "$SOURCE_PATTERN|$GOVERNANCE_PATTERN"; then
   if ! bash audits/doc-read.sh check; then
     echo "pre-commit: a triggered façade went unread — read it, or record why" >&2
     exit 1

package/audits/agents-md.md

@@ -81,8 +81,8 @@ The questionnaire is organised by scenario. Each scenario corresponds to a momen
 | 4.9 (Shell) | Must `gitleaks` pass before any commit/push? | YES |
 | 4.10 (CI) | Are CI/CD edits (`.github/workflows/**`, deploy configs) **forbidden without explicit user approval** even in auto mode? | YES |
 | 4.11 (Bun) | For `*.ts`/`*.tsx`/`*.js`/`*.jsx` edits, does AGENTS.md route to `dispatch/write_ts_adhere_bun.md` (TS FILE SHAPE DECISION at PLAN, const/import/Bun-primitive discipline)? | YES |
-| 4.12 (Logging) | For every Edit/Write that adds/removes/changes a log emit (Zig `std.log.*`/`std.debug.print`/`obs.scoped`, TS/JS `console.*`/custom logger, shell `echo` to `&2`), does LOGGING GATE require reading `docs/LOGGING_STANDARD.md` and printing the per-edit gate block citing §3 (wire format) / §4 (severity) / §5 (error codes) / §6 (PII) / §10A (tightenings)? | YES |
-| 4.13 (Logging) | Is `std.debug.print` in non-test source AND `console.log` in `agentsfleet/src/**` an automatic blocking violation, with no "temporary" carve-out? | YES |
+| 4.12 (Logging) | For every Edit/Write that adds/removes/changes a log emit (Zig `std.log.*`/`std.debug.print`/`obs.scoped`, Rust `tracing::*`/print macros under `rustd/`, TS/JS `console.*`/custom logger, shell `echo` to `&2`), does LOGGING GATE require reading `docs/LOGGING_STANDARD.md` and printing the per-edit gate block citing §3 (wire format) / §4 (severity) / §5 (error codes) / §6 (PII) / §7, §8, or §8A (language binding) / §10A (tightenings)? | YES |
+| 4.13 (Logging) | Are `std.debug.print`, Rust `println!`/`eprintln!`/`dbg!`, Rust tracing without `event` or with positional formatting, and `console.log` in their non-test production scopes automatic blocking violations, with no "temporary" carve-out? | YES |
 | 4.14 (Logging) | Must a new registry-scheme `error_code` reference (agentsfleet: `UZ-XXX-NNN`) land in the same commit as its registry entry (used-but-undeclared = blocking)? | YES |
 | 4.15 (Lifecycle) | For every Edit/Write that adds/reshapes a lifecycle method in `*.zig` (`pub fn init|deinit|close|release|destroy|shutdown|dispose|free`) or an `errdefer`/`defer` adjacent to allocation, does LIFECYCLE GATE require reading `docs/LIFECYCLE_PATTERNS.md` and printing the per-edit gate block? | YES |
 | 4.16 (Lifecycle) | Is `defer X.free(Y)` + `errdefer X.free(Y)` on the same allocation in the same scope a blocking violation? | YES |

package/audits/doc-read.sh

@@ -94,19 +94,21 @@ content_hash() {
   git -C "$LEDGER_ROOT" hash-object "$LEDGER_ROOT/$1" 2>/dev/null || printf ''
 }
 
-# Façade pages the staged files trigger, one per line. Same glob map the
-# reachability report uses: a façade's scope is its dispatch_init line, so this
-# check and the ledger can never disagree about what fires.
+# Façade pages the staged files trigger, one per line. Scope comes from
+# ledger_facade_scope — the page's own oracle-scope tag, else its leaf's
+# dispatch_init — which is the SAME resolver the ledger's reachability report
+# uses, so this check and the ledger can never disagree about what fires.
+# Iterating pages rather than leaves is the point: a façade without a
+# deterministic leaf still has a trigger surface, and used to be unaskable.
 expected_facade_pages() {
-  local staged="$1" script stem globs
-  while IFS= read -r script; do
-    [ -n "$script" ] || continue
-    stem="$(basename "$script" .sh)"
-    [ -f "$LEDGER_ROOT/dispatch/$stem.md" ] || continue
-    globs="$(ledger_facade_globs "$script")"
-    [ -n "$globs" ] || continue
-    [ "$(ledger_match_count "$globs" < "$staged")" -gt 0 ] && printf 'dispatch/%s.md\n' "$stem"
-  done < <(ledger_facade_scripts)
+  local staged="$1" page stem scope
+  while IFS= read -r page; do
+    [ -n "$page" ] || continue
+    scope="$(ledger_facade_scope "$page")"
+    [ -n "$scope" ] || continue
+    stem="$(basename "$page" .md)"
+    [ "$(ledger_match_count "$scope" < "$staged")" -gt 0 ] && printf 'dispatch/%s.md\n' "$stem"
+  done < <(ledger_facade_pages)
 }
 
 json_unescape() {

package/audits/logging.sh

@@ -9,7 +9,7 @@
 #   - agentsfleet scope-prefix format from LOGGING_STANDARD §7 (the
 #     `log.scoped(...)` API path under `src/logging/`)
 #   - `UZ-XXX-NNN` as the `error_code=` substring per LOGGING_STANDARD §5
-#   - `src/` + `agentsfleet/src/` as the scan roots
+#   - `src/` + `rustd/` + `agentsfleet/src/` as the scan roots
 # A parameterised version that reads prefix + scope-api path + scan
 # roots from a per-project config is the right long-term shape; not
 # done yet. Today, this script lives in dotfiles so the gate body and
@@ -18,6 +18,8 @@
 # Two severity tiers:
 #   BLOCK  — exits 1, must fix:
 #            - `std.debug.print(` in non-test source under src/.
+#            - `println!` / `eprintln!` / `dbg!`, missing `event`, or positional
+#              tracing formatting in non-test Rust source under rustd/.
 #            - `console.log/debug/info/warn/error` in agentsfleet/src outside tests.
 #   INFO   — surfaced for reviewer/agent attention, doesn't block:
 #            - `std.log.scoped(...)` outside `src/logging/` (LOGGING_STANDARD §7
@@ -29,7 +31,7 @@
 #
 # Modes:
 #   --staged   diff-scope: only files in `git diff --cached`
-#   --all      (default) full src/ + agentsfleet/src/ scan
+#   --all      (default) full src/ + rustd/ + agentsfleet/src/ scan
 #   --strict   promote every INFO finding to BLOCK (post-migration use)
 #
 # Exits 0 clean, 1 on BLOCK findings.
@@ -79,6 +81,13 @@ is_test_zig() {
   return 1
 }
 
+is_test_rust_path() {
+  case "$1" in
+    */tests/*|*/benches/*) return 0 ;;
+  esac
+  return 1
+}
+
 # ---------------------------------------------------------------------------
 # 1. Gather files in scope.
 # ---------------------------------------------------------------------------
@@ -86,11 +95,12 @@ gather_paths() {
   case "$MODE" in
     --staged)
       git diff --cached --name-only --diff-filter=ACMRT \
-        | grep -E '^(src/.*\.zig$|agentsfleet/src/.*\.(js|jsx|ts|tsx)$)' || true
+        | grep -E '^(src/.*\.zig$|rustd/.*\.rs$|agentsfleet/src/.*\.(js|jsx|ts|tsx)$)' || true
       ;;
     --all)
-      find src -type f -name '*.zig' 2>/dev/null
-      find agentsfleet/src -type f \( -name '*.js' -o -name '*.jsx' -o -name '*.ts' -o -name '*.tsx' \) 2>/dev/null
+      find src -type f -name '*.zig' 2>/dev/null || true
+      find rustd -type f -name '*.rs' 2>/dev/null || true
+      find agentsfleet/src -type f \( -name '*.js' -o -name '*.jsx' -o -name '*.ts' -o -name '*.tsx' \) 2>/dev/null || true
       ;;
   esac
 }
@@ -105,11 +115,15 @@ fi
 # previously ran 3–4 forks × N files; M70 perf pass batches them into
 # single awk/grep passes.
 zig_nontest=()
+rust_nontest=()
 js_nontest=()
 for f in "${FILES[@]}"; do
   if [[ "$f" == *.zig ]] && ! is_test_zig "$f"; then
     zig_nontest+=("$f")
   fi
+  if [[ "$f" == *.rs ]] && ! is_test_rust_path "$f"; then
+    rust_nontest+=("$f")
+  fi
   case "$f" in
     agentsfleet/src/*.test.*|agentsfleet/src/*.spec.*|agentsfleet/src/tests/*) ;;
     agentsfleet/src/*.js|agentsfleet/src/*.jsx|agentsfleet/src/*.ts|agentsfleet/src/*.tsx)
@@ -140,7 +154,146 @@ if [[ ${#zig_nontest[@]} -gt 0 ]]; then
 fi
 
 # ---------------------------------------------------------------------------
-# 3. BLOCKING: console.log/debug/info/warn/error in agentsfleet/src non-test.
+# 3. BLOCKING: unstructured or event-less tracing in non-test Rust source.
+#    The awk tracker excludes complete items annotated with #[cfg(test)].
+# ---------------------------------------------------------------------------
+rust_direct_hits=0
+rust_missing_event_hits=0
+rust_positional_hits=0
+if [[ ${#rust_nontest[@]} -gt 0 ]]; then
+  while IFS='|' read -r kind f ln; do
+    [[ -z "$kind" ]] && continue
+    case "$kind" in
+      direct)
+        fail "$f:$ln — direct Rust diagnostic macro in non-test source (LOGGING_STANDARD §8A)"
+        rust_direct_hits=$((rust_direct_hits + 1))
+        ;;
+      event)
+        fail "$f:$ln — \`tracing\` emit without \`event = ...\` (LOGGING_STANDARD §8A)"
+        rust_missing_event_hits=$((rust_missing_event_hits + 1))
+        ;;
+      positional)
+        fail "$f:$ln — positional formatting in \`tracing\` emit (LOGGING_STANDARD §8A)"
+        rust_positional_hits=$((rust_positional_hits + 1))
+        ;;
+    esac
+  done < <(awk '
+    function count_char(text, char, copy, count) {
+      copy = text
+      count = gsub(char, "", copy)
+      return count
+    }
+    function code_only(text, output, cursor, char, escaped, quoted) {
+      output = ""
+      escaped = 0
+      quoted = 0
+      for (cursor = 1; cursor <= length(text); cursor++) {
+        char = substr(text, cursor, 1)
+        if (quoted) {
+          if (escaped) escaped = 0
+          else if (char == "\\") escaped = 1
+          else if (char == "\"") quoted = 0
+          continue
+        }
+        if (char == "\"") {
+          quoted = 1
+          continue
+        }
+        if (char == "/" && substr(text, cursor + 1, 1) == "/") break
+        output = output char
+      }
+      return output
+    }
+    function without_comment(text, output, cursor, char, escaped, quoted) {
+      output = ""
+      escaped = 0
+      quoted = 0
+      for (cursor = 1; cursor <= length(text); cursor++) {
+        char = substr(text, cursor, 1)
+        if (quoted) {
+          output = output char
+          if (escaped) escaped = 0
+          else if (char == "\\") escaped = 1
+          else if (char == "\"") quoted = 0
+          continue
+        }
+        if (char == "\"") {
+          quoted = 1
+          output = output char
+          continue
+        }
+        if (char == "/" && substr(text, cursor + 1, 1) == "/") break
+        output = output char
+      }
+      return output
+    }
+    function check_emit() {
+      if (emit_code !~ /event[[:space:]]*=/ && emit_code !~ /[(,][[:space:]]*event[[:space:]]*[,)]/)
+        printf "event|%s|%d\n", FILENAME, emit_line
+      if (emit_source ~ /"[^"\n]*\{[^"\n]*\}[^"\n]*"/)
+        printf "positional|%s|%d\n", FILENAME, emit_line
+      emit_code = ""
+      emit_source = ""
+      in_emit = 0
+    }
+    FNR == 1 {
+      depth = 0
+      test_depth = 0
+      cfg_test = 0
+      in_emit = 0
+      emit_parens = 0
+      emit_code = ""
+      emit_source = ""
+    }
+    {
+      code = code_only($0)
+      if (!in_emit && code ~ /^[[:space:]]*$/) next
+      opens = count_char(code, "\\{")
+      closes = count_char(code, "\\}")
+      if (test_depth > 0) {
+        depth += opens - closes
+        if (depth < test_depth) test_depth = 0
+        next
+      }
+      if (code ~ /^[[:space:]]*#\[cfg\(test\)\]/) {
+        if (opens > 0) {
+          test_depth = depth + 1
+          depth += opens - closes
+          if (depth < test_depth) test_depth = 0
+        } else cfg_test = 1
+        next
+      }
+      if (cfg_test) {
+        if (opens > 0) {
+          test_depth = depth + 1
+          depth += opens - closes
+          if (depth < test_depth) test_depth = 0
+          cfg_test = 0
+        } else if (code ~ /;/) cfg_test = 0
+        next
+      }
+      if (code ~ /(^|[^[:alnum:]_])(println|eprintln|dbg)!/)
+        printf "direct|%s|%d\n", FILENAME, FNR
+      if (!in_emit && match(code, /tracing::(error|warn|info|debug|trace)!/)) {
+        in_emit = 1
+        emit_line = FNR
+        emit_code = code
+        emit_source = without_comment($0)
+        macro = substr(code, RSTART)
+        emit_parens = count_char(macro, "\\(") - count_char(macro, "\\)")
+      } else if (in_emit) {
+        emit_code = emit_code " " code
+        emit_source = emit_source " " without_comment($0)
+        emit_parens += count_char(code, "\\(") - count_char(code, "\\)")
+      }
+      if (in_emit && emit_parens <= 0) check_emit()
+      depth += opens - closes
+    }
+  ' "${rust_nontest[@]}")
+fi
+
+# ---------------------------------------------------------------------------
+# 4. BLOCKING: console.log/debug/info/warn/error in agentsfleet/src non-test.
 # ---------------------------------------------------------------------------
 console_hits=0
 if [[ ${#js_nontest[@]} -gt 0 ]]; then
@@ -155,7 +308,7 @@ if [[ ${#js_nontest[@]} -gt 0 ]]; then
 fi
 
 # ---------------------------------------------------------------------------
-# 4. INFO: std.log.scoped outside src/logging/ (pre-migration to the named
+# 5. INFO: std.log.scoped outside src/logging/ (pre-migration to the named
 #    `log` module's scoped API). The audit no longer carves out src/auth/ —
 #    the named module is import-able from layer-isolated trees, so the
 #    portability exception is gone.
@@ -180,7 +333,7 @@ if [[ ${#scoped_eligible[@]} -gt 0 ]]; then
 fi
 
 # ---------------------------------------------------------------------------
-# 5. INFO: err/warn logs without `error_code=` substring on the same line.
+# 6. INFO: err/warn logs without `error_code=` substring on the same line.
 #    Heuristic — captures the common case where an err/warn line should
 #    embed UZ-XXX-NNN per LOGGING_STANDARD §5.
 # ---------------------------------------------------------------------------
@@ -198,16 +351,16 @@ if [[ ${#zig_nontest[@]} -gt 0 ]]; then
 fi
 
 # ---------------------------------------------------------------------------
-# 6. Promote INFO to BLOCK in --strict mode.
+# 7. Promote INFO to BLOCK in --strict mode.
 # ---------------------------------------------------------------------------
 if [[ $STRICT -eq 1 && $INFO_COUNT -gt 0 ]]; then
   fail "--strict: $INFO_COUNT informational findings promoted to blocking"
 fi
 
 # ---------------------------------------------------------------------------
-# 7. Verdict.
+# 8. Verdict.
 # ---------------------------------------------------------------------------
-ok "scanned ${#FILES[@]} files; std.debug.print=$debug_print_hits console.*=$console_hits std.log.scoped=$scoped_hits missing-error_code=$missing_code_hits"
+ok "scanned ${#FILES[@]} files; std.debug.print=$debug_print_hits rust-direct=$rust_direct_hits rust-missing-event=$rust_missing_event_hits rust-positional=$rust_positional_hits console.*=$console_hits std.log.scoped=$scoped_hits missing-error_code=$missing_code_hits"
 if [[ $FAIL -ne 0 ]]; then
   printf "\n🔴 LOGGING GATE: blocking violations. See dispatch/write_any.md (Logging Gate).\n" >&2
   exit 1

package/audits/rule-ledger-lib.sh

@@ -187,6 +187,40 @@ ledger_has_prefix() {
 DISPATCH_LIB_BASENAME="lib.sh"
 
 # The executable façades: dispatch/*.sh minus the shared library.
+# A façade's trigger surface, declared where it belongs: in the façade. The tag
+# is one HTML comment, invisible in rendered markdown, e.g.
+#   <!-- oracle-scope: *.rs -->
+# Scope used to be readable ONLY from a leaf's dispatch_init line, so the five
+# façades carrying deterministic checks had a voice and the other fourteen had
+# none — a Rust author was never asked to read the Rust rules, because
+# write_rust.md has no .sh. The page wins; the leaf remains the fallback so the
+# mechanised façades keep the scope they already declare, in one place.
+FACADE_SCOPE_TAG='^[[:space:]]*<!--[[:space:]]*oracle-scope:[^>]*-->[[:space:]]*$'
+
+ledger_facade_pages() {
+  local file
+  for file in "$LEDGER_ROOT"/dispatch/*.md; do
+    [ -f "$file" ] || continue
+    printf '%s\n' "$file"
+  done
+}
+
+# Space-separated, trailing space — same shape ledger_facade_globs returns, so
+# ledger_match_count reads either without knowing which declared it.
+ledger_facade_scope() {
+  local page="$1" tag stem leaf
+  tag="$(grep -hE "$FACADE_SCOPE_TAG" "$page" 2>/dev/null | head -1)"
+  if [ -n "$tag" ]; then
+    printf '%s' "$tag" \
+      | sed -e 's/.*oracle-scope:[[:space:]]*//' -e 's/[[:space:]]*-->.*//' \
+            -e 's/[[:space:]][[:space:]]*/ /g' -e 's/[[:space:]]*$/ /'
+    return 0
+  fi
+  stem="$(basename "$page" .md)"
+  leaf="$(dirname "$page")/$stem.sh"
+  [ -f "$leaf" ] && ledger_facade_globs "$leaf"
+}
+
 ledger_facade_scripts() {
   local file
   for file in "$LEDGER_ROOT"/dispatch/*.sh; do
@@ -208,7 +242,16 @@ ledger_facade_globs() {
 # is the match itself — the same expansion dispatch_resolve_files applies to
 # explicit file arguments, so a fire count means what the dispatcher means.
 ledger_match_count() {
-  local globs="$1" path glob matches=0
+  local globs="$1" path glob matches=0 reglob=""
+  # `for glob in $globs` needs WORD SPLITTING and must not get PATHNAME
+  # EXPANSION: unguarded, bash expands each pattern against the real tree
+  # first, so a façade declaring 'src/*' iterates the 33 files that happen to
+  # exist there and then compares them as literals — src/foo.rs matches
+  # nothing and core/* "matches" only because it expanded to the one file in
+  # core/. Latent while every leaf declared extension globs ('*.zig') that
+  # match nothing at the root and so survive expansion unchanged; the first
+  # path-glob façade turns it into a scope that silently reads wrong.
+  case "$-" in *f*) ;; *) reglob="yes"; set -f ;; esac
   while IFS= read -r path; do
     [ -n "$path" ] || continue
     for glob in $globs; do
@@ -216,6 +259,7 @@ ledger_match_count() {
       case "$path" in $glob) matches=$((matches + 1)); break ;; esac
     done
   done
+  [ -n "$reglob" ] && set +f
   printf '%d' "$matches"
 }
 

package/audits/rule-ledger.sh

@@ -101,12 +101,24 @@ check_registry_parity() {
 # is answerable from the tree — unlike "has this fired lately", which depends on
 # what happened to get committed recently and gates nothing.
 check_facade_scopes() {
-  local script stem
+  local script stem page
+  # Iterates LEAVES, not pages: a leaf is a promise that something mechanical
+  # fires, so one declaring no scope is dead weight whether or not a page sits
+  # beside it. A façade with no leaf and no tag is situational — a lifecycle
+  # stage transition, a "tests pass" claim, writing a PR body — and has no
+  # staged-diff trigger to declare, so it is not a finding.
   while IFS= read -r script; do
     [ -n "$script" ] || continue
-    [ -n "$(ledger_facade_globs "$script")" ] && continue
     stem="$(basename "$script" .sh)"
-    fail "facade=$stem declares no dispatch_init scope — dispatch/$stem.sh (nothing it carries can ever fire)"
+    page="$LEDGER_ROOT/dispatch/$stem.md"
+    # Either surface may carry the scope; ledger_facade_scope prefers the page
+    # and falls back to this leaf, so both spellings satisfy the same check.
+    if [ -f "$page" ]; then
+      [ -n "$(ledger_facade_scope "$page")" ] && continue
+    else
+      [ -n "$(ledger_facade_globs "$script")" ] && continue
+    fi
+    fail "facade=$stem declares no scope — no oracle-scope tag in dispatch/$stem.md and no dispatch_init in dispatch/$stem.sh (nothing it carries can ever fire)"
   done < <(ledger_facade_scripts)
 }
 

package/dispatch/edit_rules.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# dispatch/edit_rules.sh — the rule-corpus dispatch, DETERMINISTIC façade.
+#
+# Pairs with dispatch/edit_rules.md (the LATENT façade — prose the agent reads).
+#
+# This leaf exists for the reason RULE UFS exists in the Rust pack: a façade
+# that declares its scope in PROSE declares it to nobody. edit_rules.md has
+# always named its trigger surface — core/**, packs/**, schemas/**, src/**,
+# registry.json, governance hooks (edit_rules.md:15, and the same row in
+# docs/EXECUTE_DOC_READS.md) — but audits/doc-read.sh derives what fires from
+# `dispatch_init` globs in a leaf, and this façade had no leaf. So every
+# governance edit reported "nothing staged triggers a façade" and the DOC READ
+# GATE could not fire on the one surface whose edits change the rules
+# themselves. The globs below ARE that scope, now in a form a gate can read.
+#
+#   dispatch/edit_rules.sh <file> [...]   # explicit targets (EXECUTE)
+#   dispatch/edit_rules.sh --staged       # staged corpus files (CONFORM, pre-commit)
+#
+# Layering:  AGENTS.md → edit_rules.md (latent) → edit_rules.sh (this) → audits/*.sh
+# Signals:   🟢 pass · 🔴 fail (blocks) · 🤔 DECIDE (judgment; blocks the TURN, not the script)
+# Exit:      0 = mechanical gates pass · 1 = ≥1 failed · 2 = usage error.
+
+source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+# Scope mirrors docs/EXECUTE_DOC_READS.md's governance row and edit_rules.md:15.
+# Kept in one order with them: a glob here that the row does not name is a leaf
+# reading more than the façade declares, which is the same drift inverted.
+# ONE LINE, deliberately: ledger_facade_globs reads `head -1` of the
+# dispatch_init line, so a backslash continuation declares an EMPTY scope and
+# the façade silently stops firing — the exact failure this leaf exists to end.
+dispatch_init "RULES" 'core/*' 'packs/*' 'schemas/*' 'src/*' 'registry.json' 'dispatch/*' 'audits/*' '.githooks/*' 'AGENTS.md' 'AGENTS.orly.md'
+dispatch_resolve_files "$@"
+dispatch_header
+
+# ── deterministic gates ────────────────────────────────────────────
+# Rule prose carries no milestone ids — the packs say so themselves ("never a
+# memory file, never a milestone cite"), and until now nothing read the corpus
+# for them. Same leaf write_any already wires, so no new code enters the gloss.
+dispatch_run_helper "MSID" "msid-ui.sh" "--staged"
+
+dispatch_verdict

package/dispatch/write_any.md

@@ -127,6 +127,7 @@ shebang and is the authoritative check.
 **Triggers** — every `Edit`/`Write` that adds, removes, or changes a log emit:
 
 - `*.zig` outside `vendor/`/`third_party/`/`.zig-cache/`/`*_test.zig` — `std.log.*`, `std.debug.print`, raw stderr writes, calls into the `log` named module (source: `src/logging/mod.zig`).
+- `*.rs` under `rustd/` outside `tests/`, `benches/`, and `#[cfg(test)]` items — `tracing::*`, `println!`, `eprintln!`, and `dbg!`.
 - `*.ts`/`*.tsx`/`*.js`/`*.jsx` outside `vendor/`/`node_modules/`/`*.test.*`/`*.spec.*` — `console.*`, custom logger calls.
 - `*.sh` outside generated dirs — `echo`/`printf` to `&2`.
 
@@ -145,10 +146,11 @@ shebang and is the authoritative check.
 | Pattern | Rule |
 |---|---|
 | New `logging.scoped(.tag)` call | Scope is a Zig enum literal — adding a new tag is freeform. `event` must be snake_case `verb_noun`. |
+| New Rust `tracing::<level>!` call | `event = "verb_noun"` or the equivalent `event` field shorthand is mandatory; values are structured fields hoisted into locals. |
 | New `err`/`warn` log mapping to a domain failure | registry-scheme `error_code=` field required (agentsfleet: `UZ-XXX-NNN`). Registry entry must land in same commit. |
 | Per-iteration / hot-loop log | Use `debug` (hidden by default), not `info`. |
-| `info` level | No allow-list — `info` is open (§4 rule 2). Two checks instead: a boundary-crossing operation needs its `_started`/`_completed`\|`_failed` pair on every exit path (rule 1), and a per-iteration path is `debug` (rule 3). |
-| `console.log`/`std.debug.print` in non-test source | Forbidden. Convert to logger or delete before commit. |
+| `info` level | No allow-list — `info` is open (§4 rule 2). Two checks instead: a boundary-crossing operation needs its `_started`/`_completed`\|`_failed` pair on every exit path (rule 1), and a per-iteration path is `debug` (rule 3). Hot-poll boundary pairs remain complete but use `debug`. |
+| `console.log`/`std.debug.print`/Rust print macro in non-test source | Forbidden. Convert to the structured logger or delete before commit. |
 | `std.log.scoped` outside `src/logging/` | Migration target. The `log` named module's `scoped` API is the only non-test entry point; flip the file's alias and migrate every call site in the same commit. |
 | `msg=` field | ≤ 300 chars. Stack traces emit as separate `event=stack_trace` debug record. |
 | Multi-line values | Newlines must be `\n` literal (two chars), not raw newline byte. |
@@ -173,7 +175,7 @@ Full multi-line block fires when a sub-rule reports a violation:
 
 ```
 LOGGING GATE: <file>
-  docs/LOGGING_STANDARD.md sections consulted: §3 (wire format), §4 (severity), §5 (error codes), §6 (PII), §7 (zig binding) | §8 (TS binding), §10A (tightenings)
+  docs/LOGGING_STANDARD.md sections consulted: §3 (wire format), §4 (severity), §5 (error codes), §6 (PII), §7 (Zig binding) | §8 (TS binding) | §8A (Rust binding), §10A (tightenings)
   Wire format: <logfmt ✓ | violation: <where>>
   Required keys: <ts_ms,level,scope,event present ✓ | violation: <missing>>
   Severity choice: <within rules ✓ | violation: <e.g. info on per-iteration path>>
@@ -188,13 +190,13 @@ LOGGING GATE: <file>
 
 > [DETERMINISTIC → LOG]
 
-`logging.sh` walks the **full `src/` + `agentsfleet/src/` working tree** via `git ls-files`. The index includes staged-but-not-yet-committed content, so a fix staged in pre-commit satisfies the check on the same hook run. `--staged` is preserved as an opt-in narrowing mode for iterative dev.
+`logging.sh` walks the **full `src/` + `rustd/` + `agentsfleet/src/` working tree**. The staged mode reads the index, so a fix staged in pre-commit satisfies the check on the same hook run. `--staged` is preserved as an opt-in narrowing mode for iterative dev.
 
 #### End-of-turn audit
 
 > [DETERMINISTIC → LOG]
 
-`audits/logging.sh` runs as part of `make lint`. It greps `std.log.*`, `console.*` and raw stderr writes — it does NOT see calls through the `log` named module's `scoped()`, which is where every structured emit in `agentsfleet` goes, so a clean run is not evidence that §4/§5 hold. Mechanical today: `std.debug.print`/`console.log` presence, `std.log.scoped` outside `src/lib/logging/`, msg-length. Reviewer-side: severity choice, entry/exit pairing, `error_code` on scoped-logger calls, and PII spot-checks.
+`audits/logging.sh` runs as part of `make lint`. It greps `std.log.*`, Rust `tracing` and direct-print macros, `console.*`, and raw stderr writes. It does NOT see calls through the Zig `log` named module's `scoped()`, so a clean run is not evidence that §4/§5 hold everywhere. Mechanical today: direct Zig/Rust/TypeScript diagnostics, Rust's required `event` field and positional-format ban, `std.log.scoped` outside `src/lib/logging/`, and legacy Zig error-code hints. Reviewer-side: severity choice, entry/exit pairing, registry applicability, inline Rust expression hoisting, and Personally Identifiable Information (PII) spot-checks.
 
 #### Family
 
@@ -736,6 +738,34 @@ Every triggered consult is logged in the active spec's **Discovery** section, or
 
 NLR is the cleanup-on-touch arm; NLG bans new legacy framing pre-v2.0.0; this guard covers the harder judgment calls ("should this whole subsystem exist") that need the user's input.
 
+## Porting a codebase between languages (RULE PORT)
+
+> [JUDGMENT → NEW:PORT]
+
+A port is a REWRITE with a conformance test, never a transliteration.
+
+Before porting a construct, ask what it was working AROUND, not what it was.
+A thread with a stop flag is usually the absence of async. A registration map
+with generation counters is usually the absence of structured cancellation. A
+defer chain is usually the absence of ownership. Port the GUARANTEE; delete the
+workaround, and write down which guarantee replaced it.
+
+Every construct carried over needs one sentence: "kept because <the target
+language has no better mechanism>". If that sentence cannot be written
+honestly, it is transliteration.
+
+Conformance is on OBSERVABLE behaviour — wire bytes, rows, status codes, money,
+exit codes. Never on internal shape. A test that pins internal shape freezes
+the source language's debt into the target.
+
+Read the reference implementations the spec names before designing. Take the
+SHAPE and reject the specifics.
+
+Name the tech debt you are NOT carrying over, and where it went.
+
+A milestone titled "parity" means behavioural parity. It never licenses a
+one-to-one file, type, or thread mapping.
+
 ## Comment Voice — New to the Codebase, Familiar with the Goal
 
 > [JUDGMENT → NEW:CMT]

package/dispatch/write_go.md

@@ -1,5 +1,7 @@
 # Go authoring
 
+<!-- oracle-scope: *.go -->
+
 Return errors, do not panic across a package boundary. Wrap with `%w` so the
 caller can still match the cause, and add context the caller does not already
 have — never re-wrap the same fact twice.

package/dispatch/write_mdx.md

@@ -1,5 +1,7 @@
 # Markdown JSX authoring
 
+<!-- oracle-scope: *.mdx -->
+
 Treat Markdown JSX (MDX) as a language, not generic prose. Validate front matter,
 component nesting, links, code fences, and accessible image descriptions.
 

package/dispatch/write_python.md

@@ -1,5 +1,7 @@
 # Python authoring
 
+<!-- oracle-scope: *.py -->
+
 Use standard-library parsers for structured input. Keep resource ownership in
 context managers. Validate data at parse boundaries and preserve specific
 exception classes until the caller can decide how to respond.

package/dispatch/write_rust.md

@@ -1,5 +1,7 @@
 # Rust authoring
 
+<!-- oracle-scope: *.rs -->
+
 Use ownership and borrowing to make resource lifetime visible. Keep `unsafe`
 blocks small and state the invariant they rely on. Preserve error variants until
 the caller has enough information to decide whether to retry or stop.

package/dispatch/write_shell.md

@@ -1,5 +1,7 @@
 # Shell authoring
 
+<!-- oracle-scope: *.sh -->
+
 Quote expansions, use arrays for argument lists, and clean temporary files on
 every exit path. Avoid `eval` for external input. Match the repository's required
 shell and macOS Bash compatibility level.

package/docs/EXECUTE_DOC_READS.md

@@ -10,10 +10,13 @@ Every triggered document requires one `📖 DOC READ: <path>` proof-line **per t
 | `core/**`, `packs/**`, `schemas/**`, `src/**`, `registry.json`, agent-home instruction links, repository rules synchronization, or governance hooks | `dispatch/edit_rules.md` + `docs/ORLY_ARCHITECTURE.md` — canonical sources, profiles, snapshots, refusal boundaries, and evidence. | <!-- oracle-packs:workflow.governance -->
 | Lifecycle stage transition (CHORE(open)/PLAN/CHORE(close)/LAND, worktree setup, milestone bootstrap) | `dispatch/lifecycle.md` — the entered stage's runbook section only (section-scan; fires on the transition itself, not on an Edit/Write). |
 | Any source file (cross-cutting authoring) | `dispatch/write_any.md` — length, logging, milestone-id, error-registry, UFS, greptile read, legacy-workaround family. |
+| Porting a codebase, module, or subsystem from another language | `dispatch/write_any.md` §Porting a codebase between languages — a port is a rewrite with a conformance test: port the guarantee, delete the workaround, conform on observable behaviour, name the debt not carried over. |
 | Spec's "Applicable Rules" | Each rule (canonical). Missing → the cross-cutting codes of `dispatch/write_any.md` are the floor; surface omission. |
 | `*.zig` | `dispatch/write_zig.md`. ZIG GATE per edit. |
 | `*.ts`/`*.tsx`/`*.js`/`*.jsx` | `dispatch/write_ts_adhere_bun.md` — TS FILE SHAPE DECISION (§1) at PLAN, const/import/Bun-primitive discipline, anti-patterns. |
 | `*.rs` | `dispatch/write_rust.md` — ownership, error variants, feature combinations, and contention tests. | <!-- oracle-packs:language.rust -->
+| Rust error type, `Result` alias, or any fallible signature | `dispatch/write_rust.md` §Error discipline — one error per crate, one `Result` alias, `#[from]` composition, `source()` never returns self. | <!-- oracle-packs:language.rust -->
+| Designing a Rust function, type, or module; writing `match` on a `Result`/`Option`; any production `unwrap()` | `dispatch/write_rust.md` §Functional design — Result pipelines over control-flow trees, illegal states unrepresentable, bind once, `unwrap` needs a proved invariant. | <!-- oracle-packs:language.rust -->
 | `*.py` | `dispatch/write_python.md` — parsing boundaries, resource ownership, and specific exceptions. |
 | `*.sh` | `dispatch/write_shell.md` — quoting, array arguments, cleanup, input safety, and shell compatibility. |
 | `*.mdx` | `dispatch/write_mdx.md` — structure, front matter, links, code fences, accessibility, and Mintlify isolation. | <!-- oracle-packs:language.mdx -->