🛡️introduce extremely strict checks and rules

.claude/skills/rust/SKILL.md

@@ -150,3 +150,8 @@ fn validate(pos: usize, bytes: &[u8]) -> Option<Boundary> { ... }  // checks inv
 ### Test-first for bugs
 
 When hitting a bug, write a failing test that reproduces it first. Only then write the fix. Tests document the exact failure mode and prevent regressions.
+
+
+### Lints and allows
+
+Do not introduce new `allow` annotations unless absolutely necessary. If a lint or rule is disabled, add a comment explaining why.

Cargo.toml

@@ -6,6 +6,12 @@ resolver = "2"
 version = "0.2.7"
 edition = "2024"
 rust-version = "1.92"
+description = "APX application framework"
+repository = "https://github.com/databricks-solutions/apx"
+license = "Databricks License"
+readme = "README.md"
+keywords = ["databricks", "apps", "framework"]
+categories = ["development-tools"]
 
 [workspace.dependencies]
 # Internal crates
@@ -103,6 +109,103 @@ tempfile = "3.15"
 # Embedded resources
 which = "7"
 
+[workspace.lints.rust]
+unsafe_code = "forbid"
+warnings = "deny"
+
+# Correctness
+unused_must_use = "deny"
+dead_code = "deny"
+unused_imports = "deny"
+unused_variables = "deny"
+unused_qualifications = "deny"
+unused_extern_crates = "deny"
+# unreachable_pub = "deny"  # too many existing items to fix at once
+
+# API hygiene
+missing_docs = "deny"
+missing_debug_implementations = "deny"
+missing_copy_implementations = "deny"
+
+# Safety paranoia
+trivial_casts = "deny"
+trivial_numeric_casts = "deny"
+elided_lifetimes_in_paths = "deny"
+explicit_outlives_requirements = "deny"
+
+# Idioms
+rust_2018_idioms = { level = "deny", priority = -1 }
+
+[workspace.lints.clippy]
+
+# Base strictness
+all = { level = "deny", priority = -1 }
+pedantic = { level = "deny", priority = -1 }
+nursery = { level = "deny", priority = -1 }
+cargo = { level = "deny", priority = -1 }
+
+# Transitive dependency version conflicts we cannot control
+multiple_crate_versions = "allow"
+
+# Panic policy
+unwrap_used = "deny"
+expect_used = "deny"
+panic = "deny"
+panic_in_result_fn = "deny"
+
+# Debug leftovers
+todo = "deny"
+unimplemented = "deny"
+dbg_macro = "deny"
+
+# API discipline
+# missing_const_for_fn = "deny"
+# missing_panics_doc = "deny"
+# missing_errors_doc = "deny"
+
+# Performance paranoia
+implicit_clone = "deny"
+inefficient_to_string = "deny"
+redundant_clone = "deny"
+large_enum_variant = "deny"
+
+# Complexity
+cognitive_complexity = "allow"  # many existing functions exceed threshold; refactor incrementally
+# too_many_lines = "deny"
+# too_many_arguments = "deny"
+
+# Pedantic lints that are too noisy for this codebase
+module_name_repetitions = "allow"
+similar_names = "allow"
+significant_drop_tightening = "allow"
+doc_markdown = "allow"           # 129 items — too pervasive to fix at once
+missing_errors_doc = "allow"     # 126 items — add incrementally
+must_use_candidate = "allow"     # 66 items — add incrementally
+return_self_not_must_use = "allow"
+missing_const_for_fn = "allow"   # 30 items — add incrementally
+redundant_closure_for_method_calls = "allow"  # 36 items — stylistic preference
+option_if_let_else = "allow"     # 18 items — often less readable
+unnecessary_wraps = "allow"
+items_after_statements = "allow"
+unnecessary_box_returns = "allow" # 26 items — deliberate design choice
+cast_possible_wrap = "allow"     # integer casts are intentional
+cast_possible_truncation = "allow"
+cast_sign_loss = "allow"
+cast_precision_loss = "allow"
+struct_field_names = "allow"     # same as module_name_repetitions for fields
+pub_use = "allow"
+use_self = "allow"               # 30 items — Self vs TypeName is stylistic
+case_sensitive_file_extension_comparisons = { level = "allow", priority = 1 } # not relevant on our target platforms
+too_many_lines = "allow"
+missing_fields_in_debug = "allow" # deliberate Debug impls that hide fields
+needless_pass_by_value = "allow" # 3 items — often needed for API compatibility
+trivial_regex = "allow"
+needless_raw_string_hashes = "allow"   # cosmetic; many test strings use r#"..."#
+iter_without_into_iter = "allow"
+
+# Style
+wildcard_imports = "deny"
+
 [profile.release]
 lto = "thin"
 codegen-units = 1

crates/agent/Cargo.toml

@@ -3,6 +3,15 @@ name = "apx-agent"
 version = "0.3.6"
 edition.workspace = true
 rust-version.workspace = true
+description.workspace = true
+repository.workspace = true
+license.workspace = true
+readme.workspace = true
+keywords.workspace = true
+categories.workspace = true
+
+[lints]
+workspace = true
 
 [[bin]]
 name = "apx-agent"

crates/agent/src/lib.rs

@@ -1,18 +1,7 @@
-#![forbid(unsafe_code)]
-#![deny(warnings, unused_must_use, dead_code, missing_debug_implementations)]
-#![deny(
-    clippy::unwrap_used,
-    clippy::expect_used,
-    clippy::panic,
-    clippy::todo,
-    clippy::unimplemented,
-    clippy::dbg_macro
-)]
-
 //! APX Agent - Standalone OTLP log collector
 //!
 //! This crate provides the `apx-agent` binary, a standalone OpenTelemetry
-//! log collector that receives OTLP logs and stores them in SQLite.
+//! log collector that receives OTLP logs and stores them in `SQLite`.
 
 pub mod server;