nordisk/facett

facett-core/tests/rayon_free_law.rs

//! **ROOT LAW #0 for the whole facett workspace: no rayon.**
//!
//! facett had no gate at all. A `rayon = "1"` added to `facett-map/Cargo.toml`,
//! or a `.par_iter()` dropped into any crate, would have passed every test in
//! this repo — measured 2026-08-03. znippy-zoomies has guarded the same law for
//! the codec tree for months; this is that guard, sharing ONE implementation
//! ([`facett_core::law`]) with korp rather than a second copy of the grep
//! (LAW 5).
//!
//! The three checks below are deliberately three, because "rayon" means three
//! different things here and only two of them are ours:
//!
//! | check | what it fails on |
//! |---|---|
//! | [`our_source_never_calls_rayon`]   | **our code** calling rayon |
//! | [`our_manifests_never_declare_rayon`] | **our manifests** declaring rayon |
//! | [`no_rayon_reaches_a_shipped_binary`] | a **normal** dep edge to rayon |
//!
//! The third one is the subtle one. `Cargo.lock` in this repo *does* contain
//! `rayon 1.12.0` — through `nornir-robotui`'s snapshot harness:
//! `egui_kittest → dify → image → ravif → rav1e → av-scenechange → rayon`, and
//! every one of those edges is a `[dev-dependencies]` edge. Nothing we ship
//! links it. A gate that went red on that would be switched off inside a week;
//! a gate that ignored the axis could not see the day it stopped being
//! test-only. So it fails on the **normal** edge only, and prints the dev chain
//! as context so the reader knows which of the two axes tripped.
//!
//! Run: `cargo test -p facett-core --test rayon_free_law`

use facett_core::law;
use std::path::{Path, PathBuf};

fn root() -> PathBuf {
    law::workspace_root(Path::new(env!("CARGO_MANIFEST_DIR")))
}

#[test]
fn our_source_never_calls_rayon() {
    let root = root();
    let scan = law::scan_source(&root);

    // A scan that found nothing because it read nothing is the hollow green
    // this file exists to prevent.
    assert!(
        scan.scanned > 100,
        "the rayon scan only read {} files under {} — it is not looking at the workspace",
        scan.scanned,
        root.display(),
    );

    assert!(
        scan.hits.is_empty(),
        "LAW 3 violated by OUR OWN SOURCE ({} file(s) scanned): concurrency in this \
         constellation is `gatling`, never rayon. This is not a transitive dependency \
         edge — these are calls written in this repo:\n{}",
        scan.scanned,
        scan.hits.iter().map(|h| format!("  {h}")).collect::<Vec<_>>().join("\n"),
    );
}

#[test]
fn our_manifests_never_declare_rayon() {
    let root = root();
    let scan = law::scan_manifests(&root);

    assert!(
        scan.scanned > 50,
        "the manifest scan only read {} Cargo.toml files under {} — it is not looking \
         at the workspace",
        scan.scanned,
        root.display(),
    );

    assert!(
        scan.hits.is_empty(),
        "LAW 3 violated by OUR OWN MANIFEST ({} manifest(s) scanned): a workspace \
         Cargo.toml declares rayon as a dependency. This is a dependency WE chose, not \
         something a third-party crate dragged in — remove it and route the fan-out \
         through gatling:\n{}",
        scan.scanned,
        scan.hits.iter().map(|h| format!("  {h}")).collect::<Vec<_>>().join("\n"),
    );
}

#[test]
fn no_rayon_reaches_a_shipped_binary() {
    let root = root();

    // LIVENESS FIRST. Same command, same parser, one flag wider: reach rayon
    // over edges of ANY kind. This workspace is known to have such a path — the
    // egui_kittest/dify screenshot harness — so a `None` here means cargo, the
    // command or the parser stopped working, and the clean verdict below would
    // then be worth nothing. `--all-features` is NOT usable as the proof in
    // facett: measured 2026-08-03 it answers "nothing to print" too, because
    // `--all-features` applies to workspace members and no facett member turns
    // `image`'s `avif` on. The proof that the normal axis can report a real
    // violation is `law`'s own unit test over a captured violating tree.
    let live = law::rayon_tree_liveness_chain(&root).expect("cargo tree -e normal,dev,build");
    let live = live.expect(
        "`cargo tree -e normal,dev,build -i rayon --target all` no longer reaches this \
         workspace at all. Either the egui_kittest/dify screenshot harness left the graph or \
         the tree walk stopped reading cargo's output — until that is resolved, the clean \
         answer below is not evidence of anything. Run the command by hand.",
    );
    assert!(
        live.len() >= 3 && live.last().map(|p| p.contains("ray")).unwrap_or(false),
        "the liveness chain is {live:?} — it must be a real path ending at rayon; the parser \
         is reading something other than a dependency chain",
    );

    // THE VERDICT, from the command that resolves features the way a build does.
    // `cargo metadata` is deliberately NOT used here: its resolve unifies
    // dev-dependency features into one graph and reported a phantom
    // `korp -> image -> rayon` on 2026-08-03 (see `overapproximated_normal_chain`).
    let shipped = law::shipped_rayon_tree(&root).expect("cargo tree -e normal");

    if let Some(chain) = &shipped {
        let md = law::cargo_metadata(&root).ok();
        let dev = md.as_ref().and_then(law::unshipped_rayon_chain);
        panic!(
            "LAW 3 violated on a SHIPPED edge: rayon is reachable through NORMAL \
             dependencies, so it links into what we ship.\n  \
             normal chain: {}\n  \
             (for contrast, the known dev-only chain is: {})\n  \
             Reproduce with `cargo tree -e normal -i rayon --target all`, which said \
             \"nothing to print\" when this guard was written on 2026-08-03.",
            chain.join(" -> "),
            dev.map(|c| c.join(" -> ")).unwrap_or_else(|| "none found".into()),
        );
    }
}