fix(ufs): the gate reads Rust and Go, and drift stops being silent

[indykish]

The bug

dispatch/write_any.sh has declared *.rs and *.go for as long as those packs have existed. audits/ufs.sh read neither — its is_source listed zig/ts/tsx/js/jsx only.

So the façade fired on a Rust file, printed a green UFS row, and handed off to a leaf that filtered the file out before reading a line of it. Not an absent gate — a green light over an unscanned file.

The missing coverage and the silence are separate bugs, so this fixes both.

Checked against the actual incident

agentsfleet's rustd workspace, at 4f6afd6ba~1 — the commit before its literals were bound by hand. The new lane catches all 20:

rustd/crates/afd_redis/src/streams.rs   "XADD" 3       → became CMD_XADD
rustd/crates/afd_redis/src/client.rs    "PING" 3       → became CMD_PING
rustd/crates/afd_db/src/migrate/lock.rs "migrate.acquire_lock" 2  → became OP_ACQUIRE
… plus "EVAL" ×2, "SET" ×3, "GET", "HSET", "HLEN", "HRANDFIELD",
        "XACK", "XGROUP", "XREADGROUP", "PUBLISH", "migrate.load_failures" ×4

That is the CMD_XADD / OP_ACQUIRE set, exactly — the work that had to be found by hand-rolling a script because no gate would do it. At the commit after the cleanup: 1 remains, and it is a fair finding (see below).

tree	before	after
agentsfleet rustd (74 .rs, pre-cleanup)	—	20 caught
agentsfleet rustd (77 .rs, post-cleanup)	—	1
agentsfleet zig/ts (2192 files)	—	byte-identical to before
cache-kit.rs (52 files)	240 raw	30, all real
extended-ceph-exporter (11 .go)	17 raw	16, all real

The leaf reads Rust and Go

One rule, but each language hides its literals differently, so each gets a lane rather than a wider glob. Every carve-out is for what the language makes unfixable — not permission.

Lane	Held out, and why
Rust	#[cfg(test)] / #[test] blocks — unit tests live inside the file they cover
Rust	feature-gated test seams — #[cfg(feature = "test-util")], for a helper that must compile into the crate so a sibling integration test can call it
Rust	#[…] attribute literals — #[serde(rename = "…")] takes a literal token by language rule; no const is legal there
Rust	static bindings, beside const
Rust	crate-root tests/ and benches/ — the old \/tests\/ form needed a parent directory and walked straight past them
Go	const ( … ) members — the keyword is stated once, on the opening line
Go	backtick struct tags — json:"id" is read by reflection; a const cannot appear inside one

The test-seam carve-out came directly out of checking against rustd: 26 files there use #[cfg(feature = "test-util")], and 8 of 9 residual hits were one one_of_each_kind error-surface enumerator. Unfixable by any rename, and exactly the noise that teaches people to stop reading a gate.

It is matched narrowly — test as a whole word or a -/_ segment — so #[cfg(feature = "redis")] still counts and "latest" is not mistaken for a seam.

Drift stops being silent

evals/dispatch/coverage.sh gains check (h): every extension a façade fires on is read by its leaf, or carries a written reason it is not. Reverting the scope line turns it red — that is the signal that was missing.

(h) write_any façade extension → audits/ufs.sh is_source (silent-green scope hole)
    🔴 .rs — write_any.sh fires on it, audits/ufs.sh cannot read it, and no
             UFS_OUT_OF_SCOPE row says why (silent green over an unscanned file)

Check (b)'s fixture extractor was also pinned to .zig, so a fixture in any other language was invisible to it. Widened.

.py and .sh are named out of scope, with reasons

Declared, not forgotten, each with the measurement behind it:

• .py — ~14% of literals in a real tree are single-quoted, which this matcher does not read. It also needs # stripping, """ docstring tracking, and a module-const model. Partial coverage reported as full is the exact bug this PR exists to fix.
• .sh — a repeated "$var" is interpolation, not a magic string: 59% of hits on a real tree, and shell has no const to bind to.

Both need a lane built before the glob widens. .mdx is not code.

Fixtures pin every lane

Five new fixtures. Each is load-bearing — disabling the matching carve-out flips it:

carve-out disabled	result
rust #[cfg(test)] block skip	ufs_ok.rs → red
rust #[cfg(feature = "test-util")] seam skip	ufs_ok.rs → red
rust #[attribute] carve-out	ufs_ok.rs → red
static binding carve-out	ufs_ok.rs → red
go grouped const ( … ) tracking	ufs_ok.go → red
go backtick struct-tag strip	ufs_ok.go → red
seam pattern widened to any feature	ufs_feature_gate.rs → green (caught)

That last row is the one that matters most: ufs_feature_gate.rs's only violation sits inside a production #[cfg(feature = "wire")] block, so a carve-out that quietly eats production code fails it. A scope hole wearing a carve-out costume is still a scope hole.

Touch-it-fix-it: the UFS card stopped shipping one repo's layout

The Triggers line this branch edited named agentsfleet/src/, agentsfleet/test/ and seven ui/packages/* prefixes — one repository's directory tree, in a card shipped by the generic universal.authoring pack. Same defect 09bf3a6 fixed for make targets, in path form. The Pre-edit checks below it also told a single-runtime crate to "grep all three runtimes".

Both now say what the surface is — the repository's declared surfaces.user prefixes, and every runtime it actually ships. The concrete paths moved behind oracle-packs:start product.agentsfleet, the mechanism this file already uses twice:

                     generic Rust repo    agentsfleet
  renders rustd/            no                yes
  renders agentsfleet/      no                yes

Rust is recorded as rustd/crates/*/src/, which is where it is.

Found while fixing that: a live parity bug, left for its own PR

agentsfleet/src/ and agentsfleet/test/ do not exist in that repository. The same stale prefix sits in ufs.sh's cross-runtime parity scan:

  zig_err  src/*.zig                        → 172 codes
  js_err   agentsfleet/src/*.{js,jsx,ts,tsx} →   0 files scanned  ◄──
  ui_err   ui/packages/*/src/*.ts{,x}        → 168 files scanned

So "every JavaScript ERR_* must exist in Zig" has been vacuously green, with ERR_UNAUTHORIZED, ERR_WORKSPACE_NAME_EXISTS and ERR_CLI_CREDENTIAL_EXCHANGE_FAILED in cli/src/ never once compared. That is this branch's own bug class.

Deliberately not folded in: unmuting a check that has been silently passing may surface real ERR_ drift in agentsfleet, and that deserves its own before/after rather than a footnote in a scope-hole PR.

Verification

make audit green (64 PASS, exit 0) · dispatch-evals 17/17 · install-evals 23/23 · bin/orly verify --all green.

Downstream note for agentsfleet

After orly update, rustd reports 3 hits, all fair:

• afd_crypto/src/secret.rs — concat!($label, "(redacted)") in two macro arms. Removable by having Display delegate to Debug.
• two 1_000 numerics in test files — the documented // pin test: literal is the contract annotation applies (numeric-suspect already behaves this way for Zig tests).

🤖 Generated with Claude Code

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!