feat: side-repo-ops POC — chore-deadcode-rust source + ADR 0009

[norrietaylor]

Summary

• New workflow source workflows/chore-deadcode-rust.md — Rust port of gh-aw's dead-code-remover, scaffolded as a reusable workflow_call per the existing ch-oracles pattern. Bootstrap-fork header per ADR 0007 cites github/gh-aw/.github/workflows/dead-code-remover.md @ 1924e4f8.
• New ADR decisions/0009-side-repo-ops-distribution.md — codifies the three-role split (ch-oracles = source-of-record, min-aw = operator, consumer = recipient of issues/PRs only) and the App-based cross-repo credential per min-aw ADR 0002.

Why this PR exists

POC for the new distribution model described in 99-ADOPTION-PLAN-ch-oracles.md. The plan moves the 20 catalogued workflow ports off the consumer-install model (wrappers shipped via quick-setup.sh) onto the side-repo-ops pattern from https://github.github.com/gh-aw/patterns/side-repo-ops/ — min-aw runs every chore against external targets via safe-outputs.target-repo.

This is the source half of the pair. The operator-side companion PR is in gominimal/min-aw.

Scope of the chore (Round 1, Rust only)

Detector suite (deterministic precompute):

• cargo machete --with-metadata — unused workspace deps (stable).
• cargo +nightly udeps --workspace --output json — unused deps + unreachable items (optional; skipped if nightly unavailable).
• RUSTFLAGS=\"-W dead_code\" cargo check ... --message-format=json — rustc dead_code lint output for unreachable fns/structs/variants.

Triage gates (LLM-side, per upstream's gatekeeping pattern):

• Test-only callers — flag is still dead, remove.
• #[cfg]-rescued — skip.
• pub use re-export — skip.
• bench / example callers — treat as live.
• #[allow(dead_code)] — skip.

mode: report files one advisory issue per finding-group with the <!-- finding-id: deadcode::rust::<crate>::<identity> --> marker (per shared/safe-output-create-issue.md idempotency contract). mode: autofix opens one PR with at most 5 high-confidence removals + a verification gate (cargo build, cargo test, cargo machete re-run).

Out of scope here

• Polyglot fan-out (-python, -go) — Round 1 of the adoption plan after POC.
• The other 19 catalogued workflows.

Test plan

• Operator companion PR lands and compiles in gominimal/min-aw.
• Operator dispatch against gominimal/minimal lands an advisory issue in the target with the dedup marker.
• Re-dispatch is idempotent (existing issue updated, no duplicate).
• No issue or PR is created in gominimal/min-aw or norrietaylor/ch-oracles itself.

🤖 Generated with Claude Code

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

📝 Walkthrough

Summary by CodeRabbit

Release Notes

• Documentation
  • Added architectural documentation describing workflow distribution and execution patterns
  • Added new Rust dead-code detection workflow specification supporting both detection and automated removal modes

Walkthrough

This PR establishes a new side-repo-ops distribution pattern for GitHub chores by documenting the architectural decision (ADR 0009) and providing a concrete reference implementation via a Rust deadcode detection workflow. Chores shift from wrapper-based distribution to source-of-record authoring with cross-repo outputs, moving scheduling and credential management to a dedicated operator repo.

Changes

New Chore Distribution Model and Implementation

Layer / File(s)	Summary
ADR: Distribution Architecture and Model decisions/0009-side-repo-ops-distribution.md	ADR 0009 describes the architectural shift from wrapper-based chore distribution to side-repo-ops: source-of-record workflows are authored in norrietaylor/ch-oracles with workflow_call interfaces, compiled into the operator repo gominimal/min-aw, and deliver outputs to consumer repos via a gominimal-aw-bot GitHub App. Documents permissions, distribution mechanics, consequences (instant updates, reduced consumer surface, credential blast radius, event isolation), naming conventions for operator wrappers, and agent:* label behavior.
Rust Deadcode Chore Workflow Specification workflows/chore-deadcode-rust.md	Workflow spec implementing the new pattern for Rust deadcode detection: defines workflow_call interface with mode input, required secrets, and permissions; report mode detects dead code via cargo-machete/udeps/check, applies safety triage (test-only, cfg-gated, pub use, benches/examples, #[allow(dead_code)]), groups by confidence, and opens/updates a deduped issue; autofix mode conservatively removes up to 5 items under strict eligibility, enforces a verification gate (build/test/machete), and opens one PR; includes logging formats and prohibitions on risky deletions and gate bypass.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Poem

🐰 A path through the trees, workflows take flight,
From oracle source to operator's might,
Deadcode detected with cautious delight,
Safe outputs glide, permissions kept tight,
Chores distributed, the model's just right! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically identifies the two main additions: a POC for side-repo-ops distribution pattern with a Rust dead-code workflow and its corresponding ADR document.
Description check	✅ Passed	The description comprehensively explains the purpose, scope, and implementation details of both the workflow source and the ADR, with clear context about the broader adoption plan.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/side-repo-ops-poc-deadcode-rust

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[norrietaylor]

Skipping ch-oracles for the side-repo-ops POC. ch-oracles CI (chore-consistency, dogfood-mirror check, label-classes writer glob) enforces the consumer-install distribution model; the new model is fundamentally incompatible and resolving it is out of POC scope. Will revisit ch-oracles' role (source-of-record file location, CI carve-out, or pure policy repo) in a follow-up. ADR 0009 stays as planning; min-aw PR #245 carries the live POC.