fix(ci): clear clippy -D warnings across workspace

CI gate failed after the echobt history rewrite on doc_markdown,
map_unwrap_or, double_must_use, and related pedantic lints.
Make cargo clippy --workspace --all-targets -D warnings green again.

Author: echobt

bins/miner/src/main.rs

@@ -154,7 +154,7 @@ fn run(cli: Cli) -> Result<(), String> {
             };
             let result = deploy_or_dry_run(&params).map_err(|e| e.to_string())?;
             println!("compose-hash={}", result.compose_hash_hex);
-            println!("receipt-public-key={}", receipt_public_key_hex);
+            println!("receipt-public-key={receipt_public_key_hex}");
             println!("receipt-sk-host-path={}", receipt_sk_host_path.display());
             println!("phala_invoked={}", result.phala_invoked);
             println!("mode={mode:?}");

bins/validator/src/main.rs

@@ -29,6 +29,7 @@ use validator::{
 };
 
 #[tokio::main]
+#[allow(clippy::too_many_lines)]
 async fn main() -> ExitCode {
     if let Err(e) = telemetry::init_tracing() {
         // Subscriber may already be set; continue with best-effort logs.
@@ -177,7 +178,7 @@ fn trust_root_dir() -> PathBuf {
     PathBuf::from("/etc/gbase/config")
 }
 
-/// Load challenges + measurements; build AttestState, LocalTrustRoot, and FakeChain
+/// Load challenges + measurements; build `AttestState`, `LocalTrustRoot`, and `FakeChain`
 /// aligned with gateway (`GBASE_GATEWAY_HOTKEY` / `GBASE_FAKE_METAGRAPH_HOTKEYS`).
 fn build_runtime_trust(
     netuid: u16,
@@ -249,7 +250,7 @@ fn parse_fake_metagraph_hotkeys(owner: &[u8; 32]) -> Result<Vec<Vec<u8>>, String
     }
     let mut out = Vec::new();
     for part in raw.split(',') {
-        let h = parse_hotkey_hex(part.trim()).map_err(|e| e.to_string())?;
+        let h = parse_hotkey_hex(part.trim()).map_err(|e| e.clone())?;
         out.push(h.to_vec());
     }
     if out.is_empty() {
@@ -277,7 +278,7 @@ fn parse_hotkey_hex(s: &str) -> Result<[u8; 32], String> {
         .map_err(|v: Vec<u8>| format!("hotkey must be 32 bytes, got {}", v.len()))
 }
 
-/// Optional 32-byte validator hotkey for D10 report_data binding (hex or zeros).
+/// Optional 32-byte validator hotkey for D10 `report_data` binding (hex or zeros).
 fn validator_hotkey_from_env() -> [u8; 32] {
     parse_hotkey_env("GBASE_VALIDATOR_HOTKEY_HEX").unwrap_or([0u8; 32])
 }

crates/agent-challenge/src/epoch_loop.rs

@@ -1,6 +1,6 @@
 //! Headless epoch dispatch + single active signer (Metis N2).
 
-use std::collections::BTreeMap;
+use std::collections::{BTreeMap, BTreeSet};
 use std::sync::{Arc, Mutex};
 use std::time::{Duration, Instant};
 
@@ -96,7 +96,7 @@ pub trait EpochDispatchClient: Send + Sync + 'static {
 /// Single-active-signer registry.
 #[derive(Debug, Default)]
 pub struct ActiveSignerRegistry {
-    held: Mutex<BTreeMap<(String, u64), ()>>,
+    held: Mutex<BTreeSet<(String, u64)>>,
 }
 
 /// RAII lease.
@@ -127,13 +127,12 @@ impl ActiveSignerRegistry {
             .held
             .lock()
             .unwrap_or_else(std::sync::PoisonError::into_inner);
-        if g.contains_key(&key) {
+        if !g.insert(key.clone()) {
             return Err(EpochLoopError::SignerAlreadyActive {
                 challenge_id: challenge_id.to_owned(),
                 epoch,
             });
         }
-        g.insert(key.clone(), ());
         Ok(SignerGuard {
             reg: Arc::clone(self),
             key,
@@ -154,7 +153,7 @@ impl Drop for SignerGuard {
 /// Map graded leaves + epoch outcomes onto full `E` coverage (never silence).
 ///
 /// Prefer `graded` when present. Else: TimedOut→Timeout, Failed→MinerError,
-/// CapacityExhausted / Completed-without-grade / missing → ChallengeInternal.
+/// `CapacityExhausted` / Completed-without-grade / missing → `ChallengeInternal`.
 #[must_use]
 pub fn score_map_covering_expected(
     expected: &std::collections::BTreeSet<[u8; KEY_LEN]>,
@@ -179,7 +178,7 @@ pub fn score_map_covering_expected(
         .collect()
 }
 
-/// One epoch: parallel dispatch, deadline → TimedOut, `|E|` outcomes.
+/// One epoch: parallel dispatch, deadline → `TimedOut`, `|E|` outcomes.
 ///
 /// # Errors
 /// Empty E/catalog, signer conflict, pack select, join panic.

crates/agent-challenge/src/expected_set.rs

@@ -1,4 +1,4 @@
-//! Expected participant set `E` sealed at `block_B` (I7 / BUNDLE_SPEC §7 / D24).
+//! Expected participant set `E` sealed at `block_B` (I7 / `BUNDLE_SPEC` §7 / D24).
 //!
 //! Derivation is pure in `(block_hash, policy, metagraph_at(block_hash))`.
 //! A moving tip is never an input — callers must pass an explicit pin.
@@ -57,7 +57,7 @@ pub struct ExpectedParticipant {
 pub struct ExpectedSet {
     /// Pin used for derivation (`block_hash`).
     pub block_hash: [u8; 32],
-    /// Participants ordered by ascending hotkey bytes (BUNDLE_SPEC §7.2).
+    /// Participants ordered by ascending hotkey bytes (`BUNDLE_SPEC` §7.2).
     pub participants: Vec<ExpectedParticipant>,
 }
 

crates/agent-challenge/src/score.rs

@@ -1,4 +1,4 @@
-//! Pure integer scoring rule (`AGENT_CHALLENGE` §5.4, scoring_version = 2).
+//! Pure integer scoring rule (`AGENT_CHALLENGE` §5.4, `scoring_version` = 2).
 //!
 //! Live path uses pack-bound v2 task identity and `answer_digest_v2(model.patch)`.
 //! v2 scores **pure correctness** only — latency decay is removed. `duration_ms` is

crates/agent-challenge/src/task_gen.rs

@@ -62,7 +62,7 @@ const TASK_ID_DOMAIN: &[u8] = b"gbase-agent-task-id-v1";
 const TASK_BLOB_DOMAIN: &[u8] = b"gbase-agent-task-blob-v1";
 const ANSWER_DOMAIN: &[u8] = b"gbase-agent-answer-v1";
 
-/// Domain tag for [`task_id_v2`] (distinct from v1 / WORK_RECEIPT / ATTEST).
+/// Domain tag for [`task_id_v2`] (distinct from v1 / `WORK_RECEIPT` / ATTEST).
 pub const TASK_ID_DOMAIN_V2: &[u8] = b"gbase-agent-task-id-v2";
 /// Domain tag for [`task_blob_v2`].
 pub const TASK_BLOB_DOMAIN_V2: &[u8] = b"gbase-agent-task-blob-v2";
@@ -99,7 +99,7 @@ pub fn answer_digest(task_blob: &[u8; 32]) -> [u8; 32] {
     finalize32(h)
 }
 
-/// v2 task id: binds netuid, epoch, hotkey, pack_id, and scoring_version.
+/// v2 task id: binds netuid, epoch, hotkey, `pack_id`, and `scoring_version`.
 ///
 /// `pack_id` is the UTF-8 pack identity bytes (same surface as receipt `pack_id`).
 #[must_use]
@@ -120,7 +120,7 @@ pub fn task_id_v2(
     finalize32(h)
 }
 
-/// v2 task blob: binds `task_id_v2`, scoring_version, and pack_id.
+/// v2 task blob: binds `task_id_v2`, `scoring_version`, and `pack_id`.
 #[must_use]
 pub fn task_blob_v2(task_id: &[u8; 32], scoring_version: u16, pack_id: &[u8]) -> [u8; 32] {
     let mut h = Sha256::new();
@@ -133,7 +133,7 @@ pub fn task_blob_v2(task_id: &[u8; 32], scoring_version: u16, pack_id: &[u8]) ->
 
 /// v2 answer digest: domain-tagged SHA-256 over returned `model.patch` bytes.
 ///
-/// Distinct from receipt `patch_sha256` (untagged) and from v1 answer (over task_blob).
+/// Distinct from receipt `patch_sha256` (untagged) and from v1 answer (over `task_blob`).
 #[must_use]
 pub fn answer_digest_v2(model_patch: &[u8]) -> [u8; 32] {
     let mut h = Sha256::new();

crates/agent-challenge/tests/epoch_loop.rs

@@ -3,6 +3,7 @@
 #![allow(clippy::unwrap_used, clippy::expect_used)]
 
 use std::collections::BTreeMap;
+use std::fmt::Write as _;
 use std::sync::atomic::{AtomicUsize, Ordering};
 use std::sync::Arc;
 use std::time::{Duration, Instant};
@@ -161,7 +162,7 @@ fn format_outcome_table(result: &EpochDispatchResult) -> String {
                 ("capacity_exhausted", pack_id.as_str())
             }
         };
-        s.push_str(&format!("{:<40} {k:<20} {p}\n", hex32(key)));
+        let _ = writeln!(s, "{:<40} {k:<20} {p}", hex32(key));
     }
     s
 }
@@ -211,7 +212,7 @@ async fn s1_epoch_fast_slow_dead_outcomes() {
     assert_eq!(client.fast_before_slow.load(Ordering::SeqCst), 1);
 }
 
-/// S2 — hang past deadline → TimedOut; epoch still completes with |E|.
+/// S2 — hang past deadline → `TimedOut`; epoch still completes with |E|.
 #[tokio::test]
 async fn s2_deadline_timeout_epoch_completes() {
     let expected = ExpectedSet {
@@ -258,7 +259,7 @@ async fn s3_second_signer_refused() {
     let _g2 = signers.try_acquire("agent-v1", 99).expect("after drop");
 }
 
-/// S3b — run_epoch_dispatch refuses when lease already held.
+/// S3b — `run_epoch_dispatch` refuses when lease already held.
 #[tokio::test]
 async fn s3b_run_epoch_refuses_second_signer() {
     let expected = ExpectedSet {
@@ -278,7 +279,7 @@ async fn s3b_run_epoch_refuses_second_signer() {
     assert!(matches!(err, EpochLoopError::SignerAlreadyActive { .. }));
 }
 
-/// S4 — abort in-flight JoinSet without leak.
+/// S4 — abort in-flight `JoinSet` without leak.
 #[tokio::test]
 async fn s4_cancel_aborts_inflight() {
     let expected = ExpectedSet {
@@ -298,7 +299,7 @@ async fn s4_cancel_aborts_inflight() {
     assert!(err.is_cancelled());
 }
 
-/// Capacity gate: free_slots==0 → CapacityExhausted, no run_pack.
+/// Capacity gate: `free_slots==0` → `CapacityExhausted`, no `run_pack`.
 #[tokio::test]
 async fn capacity_exhausted_skips_run() {
     let expected = ExpectedSet {

crates/agent-challenge/tests/fixtures_f1_f11.rs

@@ -1,8 +1,8 @@
-//! Fixture-driven offline tests F1–F11 v2 successors (`AGENT_CHALLENGE` scoring_version = 2).
+//! Fixture-driven offline tests F1–F11 v2 successors (`AGENT_CHALLENGE` `scoring_version` = 2).
 //!
 //! Each F1–F11 case is a named v2 successor. Latency decay is removed: correct answers
 //! always score `SCORE_MAX` regardless of `duration_ms`. Digests match
-//! `tests/fixtures/v2_*.hex` (pack-fixture-001 + FIXTURE_MODEL_PATCH).
+//! `tests/fixtures/v2_*.hex` (pack-fixture-001 + `FIXTURE_MODEL_PATCH`).
 
 #![allow(clippy::unwrap_used, clippy::expect_used)]
 
@@ -12,13 +12,13 @@ use agent_challenge::{
     FIXTURE_MODEL_PATCH, FIXTURE_PACK_ID, SCORE_MAX, SCORING_VERSION,
 };
 
-/// F1 v2 successor — miner 0x11 task_id golden.
+/// F1 v2 successor — miner 0x11 `task_id` golden.
 const F1_V2_TASK_ID: &str = "b1c18e56abe993e20e8dadcb72c7a7cadee8975e5741d15d1acb37f5ea367644";
-/// F1 v2 successor — task_blob golden.
+/// F1 v2 successor — `task_blob` golden.
 const F1_V2_TASK_BLOB: &str = "c563caca4fa3a7c5e834a88b0dae9eb1ef87f90fcddc9973e38d2730b347c441";
-/// F1/F11 v2 successor — answer_digest_v2(model.patch) golden (patch-only preimage).
+/// F1/F11 v2 successor — `answer_digest_v2(model.patch)` golden (patch-only preimage).
 const F1_V2_ANSWER: &str = "703b806158d655e5d37a5b45e3cbdf1e04735517805377199d108ae2a45ead5d";
-/// F11 v2 successor — miner 0x22 task_id golden.
+/// F11 v2 successor — miner 0x22 `task_id` golden.
 const F11_V2_TASK_ID: &str = "b99762643336fbf7abeb2c07085ff3d64ee1fd8d1c98b149c57a36ec0396228f";
 
 fn miner11() -> [u8; 32] {
@@ -77,7 +77,7 @@ fn f1_v2_digests_and_score_max() {
     );
 }
 
-/// F2 v2 — duration_ms=0 still full credit (latency ignored).
+/// F2 v2 — `duration_ms=0` still full credit (latency ignored).
 #[test]
 fn f2_v2_duration_zero_score_max() {
     assert_eq!(
@@ -103,7 +103,7 @@ fn f3_v2_duration_ignored_full_credit() {
     );
 }
 
-/// F4 v2 — former hard boundary (10_000 ms) is full credit under correctness-only.
+/// F4 v2 — former hard boundary (`10_000` ms) is full credit under correctness-only.
 #[test]
 fn f4_v2_duration_ignored_full_credit() {
     assert_eq!(
@@ -296,7 +296,7 @@ fn reference_assertions_section_5_7_v2() {
     );
 }
 
-/// Retired v1 echo fixture must not validate under live scoring_version 2.
+/// Retired v1 echo fixture must not validate under live `scoring_version` 2.
 #[test]
 fn f_echo_retired_v1_answer_does_not_validate() {
     let m = miner11();

crates/agent-challenge/tests/full_local_e2e.rs

@@ -62,8 +62,7 @@ fn now_iso() -> String {
         .output()
         .ok()
         .and_then(|o| String::from_utf8(o.stdout).ok())
-        .map(|s| s.trim().to_owned())
-        .unwrap_or_else(|| "unknown".into())
+        .map_or_else(|| "unknown".into(), |s| s.trim().to_owned())
 }
 
 fn sk() -> [u8; KEY_LEN] {
@@ -284,9 +283,10 @@ fn harbor_enabled() -> bool {
 }
 
 fn pack_dir() -> PathBuf {
-    std::env::var("GBASE_VERIFY_PACK")
-        .map(PathBuf::from)
-        .unwrap_or_else(|_| PathBuf::from("/tmp/da_m18c_hf_pull/tasks/realpr-more-itertools-1136"))
+    std::env::var("GBASE_VERIFY_PACK").map_or_else(
+        |_| PathBuf::from("/tmp/da_m18c_hf_pull/tasks/realpr-more-itertools-1136"),
+        PathBuf::from,
+    )
 }
 
 fn docker_base() -> String {
@@ -340,6 +340,7 @@ fn try_harbor_grade() -> Option<(u8, String)> {
 
 /// S1 — runner epoch → intake/grade → |E| leaves → seal → validator Match.
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[allow(clippy::too_many_lines)]
 async fn s1_full_local_epoch_match_and_seal() {
     // --- 1. Runner epoch dispatch (fake miners, real loop) ---
     let expected = expected_set();
@@ -368,9 +369,10 @@ async fn s1_full_local_epoch_match_and_seal() {
     ));
 
     // --- 2. Intake + grade (real grade path; optional Harbor) ---
-    let harbor_note = try_harbor_grade()
-        .map(|(_, n)| n)
-        .unwrap_or_else(|| "harbor_skipped (set GBASE_E2E_HARBOR=1 for live pack grade)".into());
+    let harbor_note = try_harbor_grade().map_or_else(
+        || "harbor_skipped (set GBASE_E2E_HARBOR=1 for live pack grade)".into(),
+        |(_, n)| n,
+    );
     let grade_calls = Arc::new(AtomicU32::new(0));
     let verifier = FixtureVerifier {
         calls: Arc::clone(&grade_calls),

crates/agent-challenge/tests/gateway_submit_e2e.rs

@@ -1,4 +1,4 @@
-//! Todo 28: emit_signed_leaf_set → GatewayClient POST /v1/weights/raw → seal → /v1/weights/latest.
+//! Todo 28: `emit_signed_leaf_set` → `GatewayClient` POST /v1/weights/raw → seal → /v1/weights/latest.
 #![allow(clippy::unwrap_used, clippy::expect_used)]
 
 use std::collections::{BTreeMap, BTreeSet};
@@ -116,6 +116,7 @@ fn gw_client(base: &str) -> GatewayClient {
 
 /// S1: emit |E| → POST raw → seal → GET /v1/weights/latest 200 with |E| leaves.
 #[tokio::test]
+#[allow(clippy::too_many_lines)]
 async fn s1_emit_submit_seal_latest_serves_bundle() {
     let secret = sk();
     let pk = public_key_from_secret(&secret).unwrap();
@@ -232,7 +233,7 @@ async fn s1_emit_submit_seal_latest_serves_bundle() {
     let _ = shutdown.send(());
 }
 
-/// S2: bad challenge_sig / untrusted key rejected; 5xx retry does not double-count.
+/// S2: bad `challenge_sig` / untrusted key rejected; 5xx retry does not double-count.
 #[tokio::test]
 async fn s2_bad_sig_rejected_and_retry_no_duplicate() {
     let secret = sk();
@@ -340,6 +341,5 @@ fn chrono_like_now() -> String {
         .output()
         .ok()
         .and_then(|o| String::from_utf8(o.stdout).ok())
-        .map(|s| s.trim().to_owned())
-        .unwrap_or_else(|| "unknown".into())
+        .map_or_else(|| "unknown".into(), |s| s.trim().to_owned())
 }