chore: define MSRV and reproducible build policy

.github/workflows/ci.yml

@@ -28,24 +28,42 @@ jobs:
         run: cargo fmt --check
 
       - name: Clippy
-        run: cargo clippy --workspace --all-targets --all-features -- -D warnings
+        run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
 
       - name: Test
-        run: cargo test --workspace --all-features
+        run: cargo test --workspace --all-features --locked
 
       - name: Documentation
         env:
           RUSTDOCFLAGS: -D warnings
-        run: cargo doc -p zstdscope --all-features --no-deps
+        run: cargo doc -p zstdscope --all-features --no-deps --locked
 
       - name: Core default features
-        run: cargo test -p zstdscope --no-default-features
+        run: cargo test -p zstdscope --no-default-features --locked
 
       - name: Package contents
-        run: cargo package -p zstdscope --list
+        run: cargo package -p zstdscope --list --locked
 
       - name: Publish dry run
-        run: cargo publish -p zstdscope --dry-run
+        run: cargo publish -p zstdscope --dry-run --locked
+
+  msrv:
+    name: MSRV (Rust 1.85.0)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Install Rust 1.85.0
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
+        with:
+          toolchain: 1.85.0
+
+      - name: Check workspace
+        run: cargo check --workspace --all-targets --all-features --locked
+
+      - name: Test workspace
+        run: cargo test --workspace --all-features --locked
 
   platform-tests:
     name: Tests (${{ matrix.os }})
@@ -67,4 +85,4 @@ jobs:
           toolchain: stable
 
       - name: Test workspace
-        run: cargo test --workspace --all-features
+        run: cargo test --workspace --all-features --locked

CONTRIBUTING.md

@@ -47,21 +47,29 @@ Keep pull requests focused. A good parser PR should explain:
 
 Avoid mixing large unrelated formatting/refactoring changes with parser semantic changes.
 
+## Rust version and dependency policy
+
+The workspace Minimum Supported Rust Version (MSRV) is **Rust 1.85.0**. This is the compiler floor for Rust 2024 edition and has been verified against the complete workspace with the committed dependency resolution. CI tests both Rust 1.85.0 and the current stable toolchain.
+
+The root `Cargo.lock` is committed intentionally because this repository contains both the reusable library and the `zstdscope` CLI binary. The lockfile makes workspace development, CI, release validation, and future CLI binary builds reproducible. Downstream users of the `zstdscope` library continue to resolve dependencies in their own applications; the repository lockfile is not imposed on library consumers.
+
+Dependency updates should update `Cargo.lock` intentionally and must keep both the MSRV and stable CI jobs green. Raising the MSRV is a compatibility change and should be explicit in the PR and release documentation rather than occurring accidentally through a dependency update.
+
 ## Validation
 
 Pull requests are expected to pass the repository CI. The current quality gates include:
 
 ```bash
 cargo fmt --check
-cargo clippy --workspace --all-targets --all-features -- -D warnings
-cargo test --workspace --all-features
-RUSTDOCFLAGS="-D warnings" cargo doc -p zstdscope --all-features --no-deps
-cargo test -p zstdscope --no-default-features
-cargo package -p zstdscope --list
-cargo publish -p zstdscope --dry-run
+cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
+cargo test --workspace --all-features --locked
+RUSTDOCFLAGS="-D warnings" cargo doc -p zstdscope --all-features --no-deps --locked
+cargo test -p zstdscope --no-default-features --locked
+cargo package -p zstdscope --list --locked
+cargo publish -p zstdscope --dry-run --locked
 ```
 
-Workspace tests also run on Ubuntu, Windows, and macOS.
+The workspace is also checked and tested with Rust 1.85.0, and workspace tests run on current stable Rust across Ubuntu, Windows, and macOS.
 
 Reference-generated fixtures intended to be fully valid should document their official-zstd generation commands and should be checked with `zstd --test` when regenerated. Hand-built fixtures must state whether they prove full validity, only the structural envelope understood by the current parser, or intentional malformed behavior.
 

Cargo.toml

@@ -9,6 +9,7 @@ resolver = "3"
 [workspace.package]
 version = "0.1.0"
 edition = "2024"
+rust-version = "1.85.0"
 license = "MIT OR Apache-2.0"
 repository = "https://github.com/tappe9/zstdscope"
 readme = "README.md"

crates/zstdscope-cli/Cargo.toml

@@ -2,6 +2,7 @@
 name = "zstdscope-cli"
 version.workspace = true
 edition.workspace = true
+rust-version.workspace = true
 license.workspace = true
 repository.workspace = true
 publish = false

crates/zstdscope/Cargo.toml

@@ -2,6 +2,7 @@
 name = "zstdscope"
 version.workspace = true
 edition.workspace = true
+rust-version.workspace = true
 license.workspace = true
 repository.workspace = true
 readme.workspace = true