chore(kiban): reconcile pins to v1.9.0, de-decorate soft gates

.cargo/audit.toml

@@ -0,0 +1,21 @@
+# cargo-audit configuration — Konjo Quality Framework.
+#
+# Created during the kiban v1.9.0 reconciliation (Track A1): `cargo audit`
+# (konjo-gate.yml G1) had no config, so every RUSTSEC advisory against any
+# dependency -- including the two below that need a breaking pyo3 upgrade
+# out of this track's scope -- would fail the (currently soft) step. Kept in
+# sync with `.konjo/deny.toml`'s `[advisories].ignore` list; if you change one,
+# change both.
+[advisories]
+ignore = [
+    # pyo3 0.20.3: both require a major pyo3 upgrade (>=0.24.1 / >=0.29.0),
+    # a breaking API change across vectro_py's whole binding surface --
+    # real Rust implementation work, out of scope for this CI-reconnection
+    # track. See .konjo/deny.toml and NEXT_SESSION_PROMPT.md.
+    "RUSTSEC-2025-0020",
+    "RUSTSEC-2026-0177",
+    # bincode 1.3.3: "unmaintained" (governance/harassment incident, not a
+    # vulnerability). vectro's on-disk format is bincode-encoded; migrating
+    # off it is a real storage-format migration, out of scope here.
+    "RUSTSEC-2025-0141",
+]

.github/workflows/konjo-gate.yml

@@ -22,33 +22,72 @@ jobs:
       - uses: actions/setup-python@v5
         with: {python-version: "3.11"}
       - run: pip install ruff mypy vulture bandit --quiet
+      # PROMOTED (kiban v1.9.0 reconciliation): 0 standing violations after
+      # `cargo fmt --all` (561 pre-existing diffs, pure formatting, no
+      # behavior change). See LEDGER.md's soft-step triage.
       - name: cargo fmt
-        continue-on-error: true
         run: cargo fmt --all -- --check
-      - name: clippy
-        continue-on-error: true
-        run: cargo clippy --workspace --all-targets --all-features -- -D warnings -D clippy::pedantic -D clippy::unwrap_used -D clippy::expect_used -D clippy::panic -D clippy::todo -D clippy::dbg_macro
+      # PROMOTED, split in two (kiban v1.9.0 reconciliation). The production
+      # -scope check below is the invariant CLAUDE.md actually names
+      # ("No unwrap()/expect() outside tests") -- 0 standing violations after
+      # fixing 15 real production-code unwrap()/expect() sites (see
+      # LEDGER.md). The full pedantic+all-targets sweep is a much bigger,
+      # separate concern (528 standing violations, almost entirely style/
+      # idiom lints, not the unwrap/expect security invariant) -- ratcheted,
+      # not driven to zero, and not left silently soft either: a NEW
+      # violation beyond the recorded ceiling now fails this job for real.
+      - name: clippy (production scope — unwrap/expect/panic/todo/dbg-macro)
+        run: cargo clippy --workspace --lib --bins --examples --all-features -- -D warnings -D clippy::unwrap_used -D clippy::expect_used -D clippy::panic -D clippy::todo -D clippy::dbg_macro
+      - name: clippy (pedantic + all-targets, ratcheted)
+        run: |
+          python3 .konjo/scripts/ceiling_check.py \
+            --ceiling-file .konjo/clippy-pedantic-ceiling.txt \
+            --name clippy-pedantic \
+            --measure-cmd 'cargo clippy --workspace --all-targets --all-features -- -D warnings -D clippy::pedantic -D clippy::unwrap_used -D clippy::expect_used -D clippy::panic -D clippy::todo -D clippy::dbg_macro 2>&1 | grep "^error:" | grep -vc "^error: could not compile"'
+      # PROMOTED (kiban v1.9.0 reconciliation): `.cargo/audit.toml` ignores
+      # the 2 pyo3 advisories that need a breaking major-version upgrade
+      # (tracked in NEXT_SESSION_PROMPT.md) and the bincode "unmaintained"
+      # notice (storage-format migration, same tracking). Real vulnerable
+      # deps (rand, anyhow, rustls-webpki, pyo3's transitive rand) bumped
+      # within semver — 0 standing violations. See LEDGER.md.
       - name: cargo audit
-        continue-on-error: true
         run: cargo install cargo-audit --locked --quiet 2>/dev/null || true && cargo audit
+      # PROMOTED (kiban v1.9.0 reconciliation): this step had never actually
+      # run successfully -- `--config` is a top-level cargo-deny flag, not a
+      # `check` subcommand flag (`cargo deny check --config X` errors
+      # "unexpected argument"), and separately `.konjo/deny.toml` used a
+      # pre-0.14 schema (`copyleft`/`unlicensed`/`vulnerability`/`notice`
+      # keys removed upstream, see EmbarkStudios/cargo-deny#611). Both fixed;
+      # license allowlist gained `Unicode-3.0`; the two workspace path deps'
+      # wildcard version warnings resolved by pinning their version alongside
+      # the path. 0 standing violations. See LEDGER.md.
       - name: cargo deny
-        continue-on-error: true
-        run: cargo install cargo-deny --locked --quiet 2>/dev/null || true && cargo deny check --config .konjo/deny.toml
+        run: cargo install cargo-deny --locked --quiet 2>/dev/null || true && cargo deny --config .konjo/deny.toml check
+      # PROMOTED (kiban v1.9.0 reconciliation): 0 standing violations
+      # (verified clean before this reconciliation touched anything).
       - name: dead code (Rust)
-        continue-on-error: true
         run: |
           COUNT=$(RUSTFLAGS="-W dead_code" cargo check --workspace 2>&1 | grep -c "warning: dead_code" || true)
           echo "Dead code: $COUNT"
           [ "$COUNT" -gt 0 ] && exit 1; echo "✓"
+      # PROMOTED (kiban v1.9.0 reconciliation): 2 real findings (unused
+      # imports), fixed. 0 standing violations.
       - name: ruff lint
-        continue-on-error: true
         run: ruff check .
+      # PROMOTED (kiban v1.9.0 reconciliation): `ruff format .` applied (8
+      # files, pure formatting). 0 standing violations.
       - name: ruff format
-        continue-on-error: true
         run: ruff format --check .
-      - name: vulture
-        continue-on-error: true
-        run: vulture . --min-confidence 80
+      # RATCHETED (kiban v1.9.0 reconciliation): 11 standing findings, mostly
+      # unused-but-required interface parameters in connector/integration
+      # adapters (a real per-site vulture-allowlist-vs-delete call, not a
+      # mechanical fix) — see LEDGER.md. Never allowed to grow silently.
+      - name: vulture (ratcheted)
+        run: |
+          python3 .konjo/scripts/ceiling_check.py \
+            --ceiling-file .konjo/vulture-ceiling.txt \
+            --name vulture \
+            --measure-cmd 'vulture . --min-confidence 80 2>/dev/null | grep -v node_modules | wc -l'
   coverage:
     name: "G2 · Tests + Coverage"
     runs-on: ubuntu-latest
@@ -64,9 +103,33 @@ jobs:
           cargo install cargo-nextest --locked --quiet 2>/dev/null || true
           cargo install cargo-llvm-cov --locked --quiet 2>/dev/null || true
           pip install pytest pytest-cov --quiet && pip install -e . --quiet 2>/dev/null || true
+      # SOFT, owner + target date (kiban v1.9.0 reconciliation triage — not
+      # promoted, not deleted). Could not get a trustworthy measurement this
+      # reconciliation: the sandbox this triage ran in filled its disk
+      # (37GB effective quota) installing cargo-nextest + cargo-llvm-cov
+      # alongside the existing 6-27GB of target/ build artifacts across
+      # concurrently-running repos, and a real instrumented workspace run
+      # needs materially more headroom than a plain build. OWNER: next
+      # session picking up NEXT_SESSION_PROMPT.md's coverage item. TARGET:
+      # before the next Track-A vectro session closes, measure real coverage
+      # on a host with room and seed a `.konjo/coverage-floor.txt` ratchet
+      # (lopi's own `.konjo/coverage-floor.txt` precedent), same shape as
+      # every other ratchet this reconciliation added.
       - name: Rust coverage
         continue-on-error: true
         run: cargo llvm-cov nextest --workspace --all-features --lcov --output-path lcov.info --fail-under-lines 80
+      # SOFT, owner + target date (kiban v1.9.0 reconciliation triage).
+      # `tests/` collection fails on 75 of ~90-odd files without the PyO3
+      # bindings built (`import vectro_py` guards fall through to a hard
+      # collection error, not the intended `pytest.mark.skipif`, on files
+      # that import it unconditionally at module scope rather than behind
+      # the try/except guard convention `test_retriever.py`/
+      # `test_hybrid_search.py` already use) -- confirmed by running
+      # `pytest --cov` directly this reconciliation. OWNER: next session.
+      # TARGET: run `maturin develop` first (or fix the ungated import
+      # sites to use the existing try/except guard convention, whichever a
+      # future session judges cheaper), then measure and seed a coverage
+      # floor.
       - name: Python coverage
         continue-on-error: true
         run: python -m pytest tests/ --cov=. --cov-report=json -x -q 2>/dev/null || true
@@ -84,6 +147,18 @@ jobs:
       - uses: Swatinem/rust-cache@v2
         with: {shared-key: "konjo-${{ github.repository }}"}
       - run: cargo install cargo-mutants --locked --quiet 2>/dev/null || true
+      # SOFT, owner + target date (kiban v1.9.0 reconciliation triage — not
+      # promoted, not deleted). `cargo mutants --in-diff` scopes to the PR
+      # diff so it's cheap per-PR in real CI, but this reconciliation's own
+      # diff touches ~15 Rust files across error-handling fixes plus the
+      # perf-sensitive ivf_pq*.rs hot paths -- a full mutation run against
+      # that diff is a genuinely long, non-deterministic-runtime operation
+      # not practical to verify pass/fail inside this session's time budget.
+      # OWNER: next session. TARGET: run it for real once against a small,
+      # deliberately-mutated diff (this track's own KT-A1.1 kill-test
+      # already proves clippy/cargo-deny/cargo-audit go red on a real
+      # violation; mutation testing needs the equivalent kill-test before
+      # promotion, per this same triage's own standard).
       - name: Run mutation testing
         continue-on-error: true
         run: cargo mutants --in-diff <(git diff origin/${{ github.base_ref }}...HEAD) --timeout 60 --jobs 2 2>&1 | tee mutation_report.txt || true
@@ -98,29 +173,63 @@ jobs:
       - uses: actions/setup-python@v5
         with: {python-version: "3.11"}
       - run: pip install radon --quiet
-      - name: Rust complexity
-        continue-on-error: true
-        run: cargo clippy --workspace --all-targets -- -A clippy::all -W clippy::cognitive_complexity --message-format json 2>/dev/null | python3 -c "import json,sys; count=sum(1 for line in sys.stdin for _ in [json.loads(line)] if _.get('reason')=='compiler-message' and 'cognitive_complexity' in str(_['message'].get('code',{})))" || true
-      - name: Python complexity
-        continue-on-error: true
+      # RATCHETED (kiban v1.9.0 reconciliation): 4 standing findings.
+      - name: Rust complexity (ratcheted)
         run: |
-          COUNT=$(radon cc . -n C --json 2>/dev/null | python3 -c "import json,sys; d=json.load(sys.stdin); print(sum(len(v) for v in d.values()))" 2>/dev/null || echo 0)
-          [ "$COUNT" -gt 0 ] && radon cc . -n C -s && exit 1; echo "✓"
-      - name: File size
-        continue-on-error: true
+          python3 .konjo/scripts/ceiling_check.py \
+            --ceiling-file .konjo/rust-complexity-ceiling.txt \
+            --name rust-complexity \
+            --measure-cmd 'cargo clippy --workspace --all-targets --all-features --message-format json -- -A clippy::all -W clippy::cognitive_complexity 2>/dev/null | python3 -c "
+import json,sys
+count=0
+for line in sys.stdin:
+    try:
+        d=json.loads(line)
+    except Exception:
+        continue
+    if d.get(\"reason\")==\"compiler-message\":
+        msg=d.get(\"message\",{})
+        code=msg.get(\"code\") or {}
+        if code.get(\"code\")==\"clippy::cognitive_complexity\":
+            count+=1
+print(count)
+"'
+      # RATCHETED (kiban v1.9.0 reconciliation): 58 standing findings.
+      - name: Python complexity (ratcheted)
         run: |
-          OVERSIZED=""
-          while IFS= read -r -d '' f; do LC=$(wc -l < "$f"); [ "$LC" -gt 500 ] && OVERSIZED="${OVERSIZED}${f}: ${LC}\n"; done < <(find . \( -name "*.rs" -o -name "*.py" \) | grep -v target | grep -v __pycache__ | tr '\n' '\0')
-          [ -n "$OVERSIZED" ] && printf "%b" "$OVERSIZED" && exit 1; echo "✓"
-      - name: DRY
-        continue-on-error: true
+          python3 .konjo/scripts/ceiling_check.py \
+            --ceiling-file .konjo/python-complexity-ceiling.txt \
+            --name python-complexity \
+            --measure-cmd 'radon cc . -n C --exclude "*/node_modules/*" 2>/dev/null | grep -cE "^    [MFC] "'
+      # PROMOTED (kiban v1.9.0 reconciliation), blocking for every file NOT
+      # on the grandfather allowlist (`.konjo/oversized-allowlist.txt`, 33
+      # legacy files — same convention as squish's own
+      # `.konjo/oversized-allowlist.txt`). A brand-new oversized file fails
+      # immediately; the 33 grandfathered files are expected to shrink, not
+      # grow further, but that isn't mechanically re-checked per file yet.
+      - name: File size (blocking, grandfathered)
+        run: python3 .konjo/scripts/file_size_check.py .
+      # RATCHETED (kiban v1.9.0 reconciliation): 271 standing findings,
+      # overwhelmingly duplicate test-setup boilerplate across near-identical
+      # connector/integration test files.
+      - name: DRY (ratcheted)
         run: |
-          python3 .konjo/scripts/dry_check.py --threshold 0.85 --min-lines 20 --report dry_report.json
-          COUNT=$(python3 -c "import json; print(json.load(open('dry_report.json'))['count'])")
-          [ "$COUNT" -gt 0 ] && exit 1; echo "DRY ✓"
-      - name: Rustdoc
-        continue-on-error: true
-        run: RUSTDOCFLAGS="-D missing_docs" cargo doc --workspace --no-deps 2>&1 | grep -q "error" && exit 1 || echo "✓"
+          python3 .konjo/scripts/ceiling_check.py \
+            --ceiling-file .konjo/dry-ceiling.txt \
+            --name dry \
+            --measure-cmd 'python3 .konjo/scripts/dry_check.py --threshold 0.85 --min-lines 20 --report /tmp/dry_report.json >/dev/null 2>&1; python3 -c "import json; print(json.load(open(\"/tmp/dry_report.json\"))[\"count\"])"'
+      # RATCHETED (kiban v1.9.0 reconciliation): 24 standing findings, summed
+      # per-crate (a `--workspace` pass under-counts — cargo stops emitting a
+      # crate's diagnostics after that crate's own doc build fails, so a
+      # workspace-wide run silently drops any crate checked after the first
+      # failure; confirmed by comparing 23 (aggregate) against 24 (summed
+      # per-crate) this reconciliation — see `.konjo/rustdoc-ceiling.txt`).
+      - name: Rustdoc (ratcheted)
+        run: |
+          python3 .konjo/scripts/ceiling_check.py \
+            --ceiling-file .konjo/rustdoc-ceiling.txt \
+            --name rustdoc \
+            --measure-cmd 'for pkg in vectro_lib vectro_cli vectro_py generators; do RUSTDOCFLAGS="-D missing_docs" cargo doc -p $pkg --no-deps 2>&1 | grep -c "^error: missing documentation"; done | awk "{s+=\$1} END {print s}"'
   # G5 disabled — run locally: git diff HEAD~1 | python3 .konjo/scripts/konjo_review.py
   konjo-gate:
     name: "Konjo Gate — All Walls Clear"

.github/workflows/konjo-gates.yml

@@ -16,11 +16,11 @@ on:
     branches: [main]
 
 env:
-  # v1.1.4 still let ANSI-colored clippy output (forced by dtolnay/rust-toolchain's
-  # CARGO_TERM_COLOR) and cargo's own build-progress noise ("Checking foo v0.1")
-  # register as false net-new repo:clippy findings (reproduced on PR #104). Fixed in
-  # konjoai/kiban#21, released as v1.1.5.
-  KIBAN_REF: "v1.1.5"   # the pinned kiban ref for this repo; bump deliberately
+  # Matches .konjo/kiban.ref (the session-plane pin) -- bump both together in the
+  # same commit. .konjo/scripts/check_kiban_pin.py fails this job if they diverge;
+  # that check exists because this exact pair drifted silently once already
+  # (kiban.ref read v1.1.0 while this read v1.1.5, both eight minors behind v1.9.0).
+  KIBAN_REF: "v1.9.0"   # the pinned kiban ref for this repo; bump deliberately
 
 jobs:
   gates:
@@ -30,6 +30,9 @@ jobs:
         with:
           fetch-depth: 0   # konjo-gates diffs against the base ref
 
+      - name: Check twin kiban pin
+        run: python3 .konjo/scripts/check_kiban_pin.py
+
       # The repo:* Rust gates (fmt-check, clippy, cargo-deny, cargo-mutants)
       # shell out to `cargo <subcommand>`. kiban v1.1.1 fixed the bug where these
       # gates never actually ran the tool (see kiban#17); they now genuinely need
@@ -47,7 +50,7 @@ jobs:
           shared-key: "konjo-gates-${{ github.repository }}"
 
       - name: Install cargo gate tools
-        run: cargo install cargo-deny cargo-mutants --locked
+        run: cargo install cargo-deny cargo-mutants cargo-audit --locked
 
       - name: Set up Python
         uses: actions/setup-python@v5

.konjo/clippy-pedantic-ceiling.txt

@@ -0,0 +1,32 @@
+# Konjo clippy::pedantic ceiling — Konjo Forward Pillar 2 (main is truth, gates only move up).
+#
+# The value below is `cargo clippy --workspace --all-targets --all-features --
+# -D warnings -D clippy::pedantic -D clippy::unwrap_used -D clippy::expect_used
+# -D clippy::panic -D clippy::todo -D clippy::dbg_macro`'s measured standing
+# error count (unique "error:" diagnostic lines, excluding "could not compile"
+# summary lines). This is the FULL strict set including clippy::pedantic
+# (style/idiom lints) and --all-targets (including test code); it is NOT the
+# same measurement as the separate, already-clean, blocking
+# unwrap/expect/panic/todo/dbg_macro-in-production-scope check (see
+# LEDGER.md's KT-A1.1 finding and soft-step triage) -- that one is a real
+# zero-standing-violation gate today. This ceiling exists because the
+# pedantic+test-code superset is not: 528 real violations measured, almost
+# entirely #[must_use] / doc-formatting / numeric-cast style lints, not the
+# unwrap/expect security invariant. Driving this to zero is real work (a
+# style pass across most of the Rust tree) explicitly out of scope for the
+# CI-reconnection track that seeded this file -- ratcheted instead of left
+# soft forever, matching the instruction that seeded it.
+#
+# NOTE ON MEASUREMENT: cargo aborts a target's own diagnostics on its first
+# hard error but does not necessarily continue past a failed dependency to
+# every downstream target in one aggregate `--workspace --all-targets` pass.
+# 528 is the count from one such aggregate pass; the true figure could be
+# marginally higher. Recorded as a real floor, not a verified exact total --
+# same "state the limit, don't hide it" discipline kiban's own gates use.
+#
+# Ratchet up only when a real net-new violation is deliberately accepted (say
+# why in the commit message and LEDGER.md); ratchet down as the debt is paid
+# off. Never raise it to paper over a regression.
+#
+# verified-against: f9dd8a1 (main), measured this reconciliation (2026-07-29)
+528