refactor!: enforce spawn invariants mechanically

.cargo/mutants.toml

@@ -1,14 +1,14 @@
-additional_cargo_args = ["--locked"]
+additional_cargo_args = ["--locked", "--all-features"]
+additional_cargo_test_args = ["--", "--test-threads=1"]
 timeout_multiplier = 5.0
 minimum_test_timeout = 60.0
 gitignore = true
 cap_lints = false
-
-# Each exclusion is an audited equivalent transformation documented in
-# docs/adr/0008-mutation-testing.md. No file or mutation class is excluded.
+test_tool = "cargo"
 exclude_re = [
-  'src/mitigation\.rs:.*replace \| with \^ in replace',
-  'src/sys\.rs:.*replace \| with \^ in <impl Drop for RemoteHandle',
-  'src/sys\.rs:.*replace \| with \^ in open_parent_process',
-  'src/sys\.rs:.*replace \| with \^ in create_process',
+  '^src/core_logic\.rs:[0-9]+:[0-9]+: replace proofs::quoting_length_is_bounded with \(\)$',
+  '^src/core_logic\.rs:[0-9]+:[0-9]+: replace proofs::two_bit_replacement_changes_only_its_field with \(\)$',
+  '^src/core_logic\.rs:[0-9]+:[0-9]+: replace << with >> in proofs::two_bit_replacement_changes_only_its_field$',
+  '^src/core_logic\.rs:[0-9]+:[0-9]+: replace proofs::one_bit_replacement_changes_only_its_field with \(\)$',
+  '^src/core_logic\.rs:[0-9]+:[0-9]+: replace << with >> in proofs::one_bit_replacement_changes_only_its_field$',
 ]

.config/nextest.toml

@@ -0,0 +1,17 @@
+[profile.ci-default]
+fail-fast = false
+slow-timeout = { period = "60s", terminate-after = 2 }
+status-level = "pass"
+final-status-level = "slow"
+
+[profile.ci-default.junit]
+path = "junit.xml"
+
+[profile.ci-all]
+fail-fast = false
+slow-timeout = { period = "60s", terminate-after = 2 }
+status-level = "pass"
+final-status-level = "slow"
+
+[profile.ci-all.junit]
+path = "junit.xml"

.gitattributes

@@ -1 +1,2 @@
+* text=auto eol=lf
 public-api/*.txt text eol=lf

.github/dependabot.yml

@@ -13,11 +13,6 @@ updates:
       - rust
     commit-message:
       prefix: deps
-    # `just msrv` and the Rust 1.75 test legs check the whole workspace, so an
-    # xtask dependency that raises its own MSRV above ours breaks CI even though
-    # it never ships. sha2 0.11 requires Rust 1.85; the checksum code already
-    # handles both generations, so this only needs lifting when the crate MSRV
-    # moves past 1.85.
     ignore:
       - dependency-name: sha2
         update-types:

.github/pull_request_template.md

@@ -1,16 +1,7 @@
 ## Summary
 
-<!-- Explain the problem and the focused change. -->
+Describe the problem and the focused change.
 
 ## Validation
 
-<!-- List the exact commands and relevant Windows versions tested. -->
-
-## Checklist
-
-- [ ] I ran the relevant local tests, including `just ci` and `just coverage` when applicable.
-- [ ] I added or updated deterministic tests for behavior changes.
-- [ ] I documented new or changed ownership, safety, or cleanup contracts.
-- [ ] I reviewed public API compatibility and updated the snapshot if needed.
-- [ ] I did not include secrets or public vulnerability details.
-- [ ] I kept this pull request focused and updated relevant documentation.
+Link the machine-readable `cargo xtask ci` evidence artifact for this revision.

.github/workflows/ci.yml

@@ -18,23 +18,29 @@
     runs-on: windows-latest
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9  # v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
         with:
           toolchain: "1.75"
-      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9  # v1
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
         with:
           toolchain: nightly-2026-07-02
-      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9  # v1
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        with:
+          toolchain: "1.98.0"
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
         with:
           toolchain: stable
           components: rustfmt, clippy
           targets: x86_64-pc-windows-msvc, i686-pc-windows-msvc, aarch64-pc-windows-msvc
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4  # v2.9.1
-      - uses: taiki-e/install-action@6a1bd70eaac3c8bdf093356838d7ee09fda951cf  # v2.85.5
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
+      - uses: taiki-e/install-action@5bf6ce016fd2e72eefc647cbca1e4213f65955b8
         with:
-          tool: just@1.57.0,cargo-public-api@0.52.0,cargo-deny@0.19.4,typos-cli@1.48.0
-      - run: python -m pip install "reuse[charset-normalizer]==6.2.0"
+          tool: just@1.57.0,cargo-public-api@0.52.0,cargo-deny@0.19.4,cargo-vet@0.10.2,typos-cli@1.48.0,uv@0.12.0
+      - run: just ocomment
+      - run: just comment-policy
+      - run: just invariants
+      - run: just source-policy
       - run: just fmt
       - run: just clippy
       - run: just doc
@@ -50,58 +56,164 @@
     strategy:
       fail-fast: false
       matrix:
-        os: [windows-2022, windows-latest]
+        os: [windows-2022, windows-2025]
         rust: [stable, "1.75"]
     runs-on: ${{ matrix.os }}
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9  # v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
         with:
           toolchain: ${{ matrix.rust }}
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4  # v2.9.1
-      - uses: taiki-e/install-action@6a1bd70eaac3c8bdf093356838d7ee09fda951cf  # v2.85.5
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
+      - uses: taiki-e/install-action@5bf6ce016fd2e72eefc647cbca1e4213f65955b8
         with:
-          tool: just@1.57.0
+          tool: just@1.57.0,cargo-nextest@0.9.145
       - run: just test
+      - if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: junit-${{ matrix.os }}-${{ matrix.rust }}
+          path: target/nextest/*/junit.xml
+          if-no-files-found: error
 
   i686-smoke:
     name: Windows i686 execution smoke
     runs-on: windows-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9  # v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
         with:
           toolchain: stable
           targets: i686-pc-windows-msvc
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4  # v2.9.1
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
       - name: Run the ConPTY stdio isolation regression as a 32-bit process
         run: >-
           cargo test --target i686-pc-windows-msvc --test windows_spawn
           pseudoconsole_regular_stdio_stays_off_parent_pipes -- --exact
 
+  stress-x64:
+    name: Windows x64 spawn cleanup stress
+    runs-on: windows-latest
+    timeout-minutes: 120
+    env:
+      WINDOWS_SPAWN_STRESS_CASES: "10000"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
+      - run: cargo test --test windows_spawn spawn_cleanup_stress -- --ignored --exact --test-threads=1
+
+  stress-i686:
+    name: Windows i686 spawn cleanup stress
+    runs-on: windows-latest
+    timeout-minutes: 90
+    env:
+      WINDOWS_SPAWN_STRESS_CASES: "2000"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        with:
+          toolchain: stable
+          targets: i686-pc-windows-msvc
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
+      - run: cargo test --target i686-pc-windows-msvc --test windows_spawn spawn_cleanup_stress -- --ignored --exact --test-threads=1
+
   linux:
     name: Linux empty API
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9  # v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
         with:
           toolchain: stable
       - run: cargo xtask linux-empty
 
+  kani:
+    name: Kani proofs
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
+      - run: cargo install --locked kani-verifier --version 0.68.0
+      - run: cargo kani setup
+      - run: cargo xtask kani
+
+  miri:
+    name: Miri platform-neutral core
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        with:
+          toolchain: nightly-2026-07-02
+          components: miri
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
+      - run: cargo miri setup
+      - run: 'cargo miri test --package windows-spawn --lib core_logic::tests::'
+
+  sanitizer:
+    name: Address sanitizer pure logic
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      RUSTFLAGS: -Zsanitizer=address
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        with:
+          toolchain: nightly-2026-07-02
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
+      - run: 'cargo test --package windows-spawn --target x86_64-unknown-linux-gnu --lib core_logic::tests::'
+
+  careful:
+    name: Windows cargo-careful
+    runs-on: windows-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        with:
+          toolchain: nightly-2026-07-02
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
+      - uses: taiki-e/install-action@5bf6ce016fd2e72eefc647cbca1e4213f65955b8
+        with:
+          tool: cargo-careful@0.4.10
+      - run: cargo careful test --workspace --all-targets --all-features --locked -- --test-threads=1
+
+  arm64-smoke:
+    name: Windows 11 ARM64 smoke
+    runs-on: windows-11-arm
+    timeout-minutes: 30
+    env:
+      RUST_TEST_THREADS: "1"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
+      - run: cargo test --package windows-spawn --lib --locked
+
   coverage:
     name: Coverage
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9  # v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
         with:
-          toolchain: stable
+          toolchain: nightly-2026-07-02
           components: llvm-tools-preview
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4  # v2.9.1
-      - uses: taiki-e/install-action@6a1bd70eaac3c8bdf093356838d7ee09fda951cf  # v2.85.5
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
+      - uses: taiki-e/install-action@5bf6ce016fd2e72eefc647cbca1e4213f65955b8
         with:
           tool: just@1.57.0,cargo-llvm-cov@0.8.7
       - run: just coverage
@@ -110,20 +222,42 @@
     name: Reproducible release candidate
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9  # v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
         with:
           toolchain: stable
-      - uses: taiki-e/install-action@6a1bd70eaac3c8bdf093356838d7ee09fda951cf  # v2.85.5
+      - uses: taiki-e/install-action@5bf6ce016fd2e72eefc647cbca1e4213f65955b8
         with:
-          tool: just@1.57.0,cargo-cyclonedx@0.5.9
-      - run: python -m pip install "reuse[charset-normalizer]==6.2.0"
+          tool: just@1.57.0,cargo-cyclonedx@0.5.9,uv@0.12.0
       - run: just release-candidate
 
+  release-dry-run:
+    name: Release dry run
+    runs-on: windows-2022
+    timeout-minutes: 45
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: ${{ github.head_ref || github.ref_name }}
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        with:
+          toolchain: stable
+      - uses: release-plz/action@2eb1d8bcb770b4c48ccfaad919734b38b51958c9
+        with:
+          command: release
+          version: 0.3.160
+          dry_run: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
   ci-required:
     name: CI required
     if: always()
-    needs: [hygiene, test, i686-smoke, linux, coverage, package]
+    needs: [hygiene, test, i686-smoke, stress-x64, stress-i686, linux, kani, miri, sanitizer, careful, arm64-smoke, coverage, package, release-dry-run]
     runs-on: ubuntu-latest
     steps:
       - if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped')

.github/workflows/codeql.yml

@@ -33,18 +33,18 @@ jobs:
           - language: actions
             os: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
       - if: matrix.language == 'rust'
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9  # v1
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
         with:
           toolchain: stable
-      - uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38  # v4.37.4
+      - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938
         with:
           languages: ${{ matrix.language }}
           build-mode: none
           queries: security-extended
-      - uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38  # v4.37.4
+      - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938
         with:
           category: /language:${{ matrix.language }}