Message retention and bucket ownership

.mise/config.toml

@@ -1240,12 +1240,23 @@ shell = "{{ vars.task_shell }}"
 
 [tasks.cargo-clippy-check-pkg]
 alias = ["clippy-pkg"]
-description = "cargo clippy on a single workspace package (narrow inner-loop check)"
-# Same flags as cargo-clippy-check minus --workspace.
-# Usage-spec captures the package name and exposes it as $usage_package; a missing arg fails up front with
-# mise's auto-generated usage message instead of clippy's generic "--package <SPEC> not found" error.
-run = 'cargo clippy --keep-going --all-targets -p "$usage_package"'
-usage = 'arg "<package>" help="Workspace package name (e.g. edge-toolkit)"'
+description = "cargo clippy on one or more workspace packages (narrow inner-loop check)"
+# Same flags as cargo-clippy-check minus --workspace, plus --no-deps.
+# Only the named packages are linted, not the workspace crates they depend on. Those still build, but their lints
+# are cargo-clippy-check's to report.
+# Usage-spec captures the package names and exposes them space-joined in $usage_package, split here into one `-p`
+# each; a missing arg fails up front with mise's auto-generated usage message instead of clippy's generic
+# "--package <SPEC> not found" error.
+run = """
+set --
+# shellcheck disable=SC2086 # $usage_package is a space-joined package list, split by design.
+for package in $usage_package; do
+  set -- "$@" -p "$package"
+done
+cargo clippy --keep-going --all-targets --no-deps "$@"
+"""
+shell = "{{ vars.task_shell }}"
+usage = 'arg "<package>..." var=#true help="Workspace package names (e.g. edge-toolkit et-ws-service)"'
 
 [tasks.cargo-doc-check]
 description = "Type-check rustdoc with -D warnings to fail on any doc issues"
@@ -2569,20 +2580,20 @@ description = "Regenerate HELP.md for every binary crate using clap or reading s
 run = "cargo run -q -p et-int-gen --bin et-int-gen -- help-md"
 
 [tasks."gen:checks"]
-description = "Regenerate CHECKS.md, the catalogue of every check across every MISE_ENV"
+description = "Regenerate CHECKS.md, the catalogue of every check across every MISE_ENV, stamped with today's date"
 run = "cargo run -q -p et-int-gen --bin et-int-gen -- checks"
 
+# Holds CHECKS.md to its generation date rather than re-rendering it, so it costs no build on any lane.
+# `--parser ignore` because Markdown has no parser; it hands the file over as its lines, which is all this reads.
 [tasks.checks-md-check]
+description = "Fail if CHECKS.md was last generated more than 7 days ago (run `mise run gen:checks`) (conftest)"
+run = "conftest test --combine --parser ignore --namespace checks_md -p config/conftest/policy CHECKS.md"
+
+[tasks.gen-help-check]
 # Ordered after the workspace builds so its `cargo run` reuses their artifacts.
 # Run beside them it is a fourth concurrent build, which doubled every cargo task's time on the three-core macOS
 # runner and took the macOS check lane past its budget.
 depends = ["cargo-check", "cargo-clippy-check", "cargo-doc-check", "regenerate-verification"]
-description = "Fail if CHECKS.md is stale vs the mise task tables and rule files (run `mise run gen:checks`)"
-run = "cargo run -q -p et-int-gen --bin et-int-gen -- checks --check"
-
-[tasks.gen-help-check]
-# After checks-md-check, whose et-int-gen build it reuses.
-depends = ["checks-md-check"]
 description = "Fail if any checked-in HELP.md is stale vs its clap tree or env config (run `mise run gen-help-all`)"
 run = "cargo run -q -p et-int-gen --bin et-int-gen -- help-md --check"
 

AGENTS.md

@@ -252,6 +252,17 @@ confirm you see the identical failure -> fix -> confirm the fix turns that same
 push. If you genuinely cannot reproduce locally (e.g. a lane you have no access to), say so explicitly and do not
 pass off an unverified change as a fix.
 
+That loop is for a failure whose cause the output does not settle. When you have been given the failing check's
+output and it already names the problem -- a lint at a file and line, a compile error, a failed assertion -- fix it
+first, and only then run the check, once, to confirm the fix. Running the check beforehand just to watch it fail
+again buys nothing: the checks are expensive and slow, and that run reproduces what the output already said.
+
+Once a lint fix to code is in, decide whether it could have changed what the tests see before running any. Renaming
+a constructor call, adding a justified `#[expect]` or reflowing a comment cannot fail a test; changing a signature,
+a branch or a lookup can. Run the tests only when the answer is yes, and then as a step of their own rather than
+chained onto the lint and check commands, so a slow test run never holds up the check results and a failure is
+never lost in their output.
+
 ## Keep lines <= 120 characters
 
 Assume every file you touch is bound by the 120-char limit, and keep each line under it on the first draft rather
@@ -419,11 +430,12 @@ Formatter task(s) per file type:
 env) breaks ties differently from `dprint-fmt` -- it collapses a short array onto one line where dprint leaves it
 expanded -- so a file dprint accepts can still fail `oxfmt-check` in CI.
 
-For Rust inner-loop iteration on a single crate, use `mise run cargo-clippy-check-pkg <package>` (alias
-`clippy-pkg`) instead of `cargo-clippy-check` -- it runs `cargo clippy --keep-going --tests -p <package>` so you
-only compile that crate plus its deps, not the whole workspace. Same lint config; just narrower scope. Switch back
-to `cargo-clippy-check` for the final verification pass before declaring done, since cross-crate
-`feature-unification` differences can fire workspace-wide lints that don't fire on a single `-p` build.
+For Rust inner-loop iteration, use `mise run cargo-clippy-check-pkg <package>...` (alias `clippy-pkg`) instead of
+`cargo-clippy-check`, naming the workspace package of every crate you changed in one call -- it compiles only those
+packages plus their deps, not the whole workspace, and lints only the named packages, not the workspace packages
+they depend on. Same lint config; just narrower scope. Switch back to `cargo-clippy-check` for the final
+verification pass before declaring done: it is the pass that lints a package you edited but did not name, and
+cross-crate `feature-unification` differences can fire workspace-wide lints that don't fire on a narrower `-p` build.
 
 ## Architecture
 

CHANGELOG.md

@@ -43,6 +43,8 @@ Changelog 1.1.0.
   storage, so an upload through one hub reads back through any other. `services.backplane` and `services.storage`
   take `limits:` for the two. `secrets.env` carries the store's secret as `AWS_SECRET_ACCESS_KEY` and
   `RUSTFS_SECRET_KEY`. A scenario without `services.hub.machines` renders as before.
+- `WS_MESSAGE_RETENTION=all` makes the hub keep every unacknowledged direct message a recipient has from a sender,
+  rather than only the newest. The default, `latest-per-sender`, behaves as before.
 
 ### Changed
 
@@ -59,6 +61,12 @@ Changelog 1.1.0.
 - **Breaking:** `et-ws-server` takes no command-line arguments. Its one flag, `-a` / `--agent-registry`, is now the
   `WS_AGENT_REGISTRY` environment variable, still defaulting to `registry.yaml`, and `et_ws_server::cli` is gone.
   Generated k3s manifests set the variable instead of overriding the container's `command` and `args`.
+- **Breaking:** `PUT /storage/{agent_id}/{filename}` accepts a write only while the agent is connected, and only
+  from the address it is connected from; anything else is answered `403`. An upload made on an agent's behalf must
+  now come from the agent's own host while it is connected.
+- **Breaking:** `AgentRegistry::queue_direct` and `NatsBackplane::queue` take a `MessageRetention`.
+  `Backplane::knows` is replaced by `Backplane::presence`, and `Presence::Connected` carries the agent's
+  `last_known_ip`.
 
 ## [0.3.0] - 2026-10-15
 

CHECKS.md

@@ -1,16 +1,18 @@
 # Checks
 
+- **Generated:** 2026-10-27
 - **Checks:** 75
 - **Tools:** 47
 - **Shell-script checks:** 10
 - **Checks with a repair pass:** 21
-- **Rules:** 343 custom local rules, or non-default strict linter settings
+- **Rules:** 349 custom local rules, or non-default strict linter settings
 
 Every check is listed across every `MISE_ENV`, filed under the tool it runs. Each entry names the env whose config
 declares it, the aggregate that runs it as part of `mise run check`, the `fix` or `fmt` pass that repairs what it
 reports, where one does, and the config files it reads. `mise run fix` runs every such pass. Generated by `mise run
 gen:checks` from the task tables in `.mise/config*.toml`, the rule files under `config/` and the `[workspace.lints]` in
-`Cargo.toml`; `mise run checks-md-check` fails when this file drifts from them.
+`Cargo.toml`. It is not held to them on every change: `mise run checks-md-check` fails only once the generation date
+above is more than 7 days old.
 
 ## `action-validator`
 
@@ -235,6 +237,12 @@ Rules, from `config/ast-grep/rules`:
 - `no-string-new` -- `String::new()` is banned (`DeepSource RS-W1079`): construct empty strings with `String::default()`
   instead, so the zero value routes through the `Default` impl like every other default-constructed value in the
   codebase.
+- `no-test-in-python-docstrings` -- Docstring in non-test code mentions tests. Document what the code does for every
+  caller; why a test needs it belongs in the test that relies on it. A name containing it (`test`, `ws-test-server`,
+  `ET_TEST_X`) is allowed.
+- `no-test-in-rust-docs` -- Doc comment in non-test code mentions tests. Document what the item does for every caller;
+  why a test needs it belongs in the test that relies on it. A name containing it (`test`, `ws-test-server`,
+  `ET_TEST_X`) is allowed.
 - `no-uds-listener` -- HTTP servers here listen on TCP only. A Unix-domain-socket listener gives requests no peer
   address, and the handlers take the client address from the socket peer rather than from client-supplied `Forwarded` /
   `X-Forwarded-For` headers -- so `ws_handler` refuses every request arriving on one. Bind a TCP address instead.
@@ -307,8 +315,8 @@ Rules, from `config/ast-grep/rules`:
 
 - `cargo-clippy-check` (`default` env; run by `check:rust`). Repaired by `cargo-clippy-fix`. Config: `Cargo.toml`,
   `config/clippy.toml`.
-- `cargo-clippy-check-pkg` (`default` env; not run by `mise run check`) -- cargo clippy on a single workspace package
-  (narrow inner-loop check). Config: `Cargo.toml`, `config/clippy.toml`.
+- `cargo-clippy-check-pkg` (`default` env; not run by `mise run check`) -- cargo clippy on one or more workspace
+  packages (narrow inner-loop check). Config: `Cargo.toml`, `config/clippy.toml`.
 
 Rules, from `Cargo.toml`:
 
@@ -505,6 +513,8 @@ Rules, from `Cargo.toml`:
 
 ## `conftest`
 
+- `checks-md-check` (`default` env; run by `check:rust`) -- Fail if CHECKS.md was last generated more than 7 days ago
+  (run `mise run gen:checks`) (conftest). Config: `config/conftest/policy`.
 - `conftest-check-checks-badge` (`default` env; run by `conftest-check`) -- Check the README checks badge keeps step
   with CHECKS.md's rules count (conftest). Config: `config/conftest/policy`.
 - `conftest-check-dockerfile` (`default` env; run by `conftest-check`) -- Cross-check Dockerfiles against mise [tools]
@@ -566,6 +576,11 @@ Rules, from `config/conftest/policy`:
   - CHECKS.md must record its rules count, which the badge is held to.
   - README.md must define the checks badge.
   - The checks badge records the rules count rounded down to a multiple of 20, so it moves with every 20 rules added.
+- `checks_md` (`config/conftest/policy/checks_md/checks_md.rego`):
+  - CHECKS.md must say when it was generated, which only the generator writes.
+  - A document stamped more than once was not written by the generator, which stamps it exactly once.
+  - The document is regenerated at least once every `max_age_days` days.
+  - The generator stamps today's UTC date, so a later one was written by hand.
 - `checksums` (`config/conftest/policy/checksums/checksums.rego`):
   - Every `_asset` var in the mise configs must have an [asset] table in config/upstream-cache/data.toml.
   - Every [asset] table in config/upstream-cache/data.toml must be referenced by a mise `_asset` var.
@@ -686,8 +701,6 @@ Rules, from `config/conftest/policy`:
 
 ## `et-int-gen`
 
-- `checks-md-check` (`default` env; run by `check:rust`) -- Fail if CHECKS.md is stale vs the mise task tables and rule
-  files (run `mise run gen:checks`).
 - `gen-help-all` (`default` env; run by `check:rust`) -- Regenerate HELP.md for every binary crate using clap or reading
   serde-env config.
 - `gen-help-check` (`default` env; run by `check:rust`) -- Fail if any checked-in HELP.md is stale vs its clap tree or

config/ast-grep/rules/no-test-in-python-docstrings.yaml

@@ -0,0 +1,21 @@
+id: no-test-in-python-docstrings
+language: Python
+severity: error
+message: |
+  Docstring in non-test code mentions tests. Document what the code does for every caller; why a test needs it
+  belongs in the test that relies on it. A name containing it (`test`, `ws-test-server`, `ET_TEST_X`) is allowed.
+rule:
+  kind: string
+  regex: "(?i)(^|[^`\\w-])test(s|ed|ing|able)?([^`\\w-]|$)"
+  inside:
+    kind: expression_statement
+    nthChild: 1
+    inside:
+      any:
+        - kind: module
+        - kind: block
+ignores:
+  - generated/**
+  - "**/tests/**"
+  - "**/*_tests/**"
+  - "**/test_*.py"