test: add Rust Sweettest substrate bridge coverage

.github/workflows/rust-ci.yml

@@ -57,8 +57,10 @@ on:
   merge_group:
     types: [checks_requested]
   schedule:
-    # Once a month at 05:00 UTC on the 1st.
+    # Existing monthly held-job pulse at 05:00 UTC on the 1st.
     - cron: "0 5 1 * *"
+    # Sweettest evidence run: weekly on Monday at 05:00 UTC.
+    - cron: "0 5 * * 1"
   workflow_dispatch:
 
 concurrency:
@@ -168,11 +170,15 @@ jobs:
         with:
           components: rustfmt
 
-      - name: Cargo fmt (check only)
+      - name: Cargo fmt (parent workspace, check only)
         if: needs.changes.outputs.rust == 'true'
         working-directory: ${{ env.CARGO_WORKSPACE }}
         run: cargo fmt --all -- --check
 
+      - name: Cargo fmt (Sweettest child workspace, check only)
+        if: needs.changes.outputs.rust == 'true'
+        run: cargo fmt --manifest-path ARF/tests/sweettest/Cargo.toml --all -- --check
+
       - name: No Rust changes
         if: needs.changes.outputs.rust != 'true'
         run: echo "No Rust files changed; nothing to format-check. Reporting success."
@@ -231,6 +237,59 @@ jobs:
         if: needs.changes.outputs.rust != 'true'
         run: echo "No Rust files changed; nothing to compile-check. Reporting success."
 
+  sweettest:
+    name: Sweettest (weekly/manual, advisory)
+    # Keep it out of required checks and run only on explicit dispatch or the
+    # weekly cron.
+    #
+    # Timeout raised 60 -> 120 on 2026-09-07, and caching added, because the
+    # first dispatch this job ever received (run 34164674347) was killed at
+    # exactly 60 minutes with the suite step still running. The old comment
+    # said "about 30 minutes", which is the two-conductor TEST phase only; the
+    # step ahead of it does a cold `cargo build --workspace --release --target
+    # wasm32-unknown-unknown` over the Holochain crate tree, then `hc dna pack`,
+    # then compiles the sweettest crate against `holochain` as a library. This
+    # job had no cache of any kind while the `clippy` job below it caches
+    # cargo, so every run paid full cold cost and could not finish. That is why
+    # the suite has never produced a result -- the trigger gating was only half
+    # the reason.
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event.schedule == '0 5 * * 1' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    steps:
+      # persist-credentials: false because this job EXECUTES the checked-out
+      # tree -- `nix develop --command ./tests/sweettest/run.sh`. By default
+      # actions/checkout leaves the repository token available to later git
+      # commands in the job, so a manually dispatched run from an untrusted
+      # branch could read it from the code it is running. The job needs no git
+      # authentication after checkout. Raised by CodeRabbit on this PR, CWE-522.
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      # Two target directories, because there are two Cargo workspaces: the ARF
+      # workspace builds the zome WASMs, and ARF/tests/sweettest is a separate
+      # manifest that links the Holochain conductor as a library. Locally that
+      # second target directory measures 21 GB, so omitting it would leave the
+      # dominant cost uncached.
+      - name: Cache cargo registry + both build trees
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            ARF/target
+            ARF/tests/sweettest/target
+          key: ${{ runner.os }}-sweettest-${{ hashFiles('ARF/Cargo.lock', 'ARF/tests/sweettest/Cargo.lock') }}
+          restore-keys: ${{ runner.os }}-sweettest-
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31 tag target, resolved 2026-09-01
+
+      - name: Run freshly built four-zome Sweettest suite
+        working-directory: ARF
+        run: nix develop path:. --command ./tests/sweettest/run.sh
+
   clippy:
     name: Lint (cargo clippy) [HELD -- manual only]
     if: github.event_name == 'workflow_dispatch'
@@ -254,9 +313,28 @@ jobs:
         with:
           components: clippy
 
-      - name: Cargo clippy (deny warnings)
+      # `--force-warn dead_code`, not `-W dead_code`. The latter looks like it
+      # should work and does not: `-D warnings` denies at group level and wins
+      # over a later lint-level `-W`, so the three dead-code findings still
+      # failed the build. Verified both locally — `-W` exited 101 with them as
+      # errors, `--force-warn` exits 0 with them as warnings. `--force-warn` is
+      # the flag documented to override an existing deny.
+      #
+      # Why dead code warns instead of failing: the coordinator zome carries a
+      # `BudgetEngine` struct, its four associated functions, and
+      # `VectorOps::distance`/`normalize`, none of which are constructed or
+      # called. That is scaffolding for a budget path that is specified but not
+      # yet wired, not an accident. Deleting it to satisfy a linter would throw
+      # away intent, and `#[allow(dead_code)]` at each site would hide it
+      # permanently. Warning keeps it visible in every run without blocking, so
+      # the question "wire it or drop it" stays open for whoever owns that path
+      # rather than being answered by CI.
+      #
+      # Revisit when the budget path lands: at that point the lint should go
+      # back to denying, because dead code will then mean something is wrong.
+      - name: Cargo clippy (deny warnings, warn on dead code)
         working-directory: ${{ env.CARGO_WORKSPACE }}
-        run: cargo clippy --all-targets --all-features -- -D warnings
+        run: cargo clippy --all-targets --all-features -- -D warnings --force-warn dead_code
 
   test:
     name: Test (all features) [HELD -- manual only]

ARF/.cargo/config.toml

@@ -1,16 +1,21 @@
 # Cargo configuration for the FLOSSI0ULLK Rose Forest workspace.
 #
 # Added 2026-05-19 alongside the holochain-0.4 -> holochain-0.6 migration.
-# HDI 0.7.1 / HDK 0.6.1 brings in getrandom 0.3.x, which requires explicit
-# opt-in for the wasm32-unknown-unknown target via a config flag (see the
-# getrandom 0.3 release notes and the Holochain HDK 0.6 docs). Without
-# this, building wasm artifacts fails with:
+# HDI 0.7.1 / HDK 0.6.1 brings in getrandom 0.3.x, which requires an explicit
+# wasm32-unknown-unknown backend. Holochain 0.6.1's test-utils guest build
+# contract uses its HDK-provided custom backend, not the browser wasm_js
+# backend. The size optimization matches that upstream guest-build contract.
+# Without an explicit backend, building WASM artifacts fails with:
 #
 #     error[E0425]: cannot find function `fill_inner` in module `backends`
 #
 # Cross-reference:
 # - FLOSS/docs/agent-memory/project/holochain-version-line-skew.md
 # - FLOSS/docs/specs/consent-payload.spec.md (validation-status table)
+# - Upstream contract: holochain crates/test_utils/wasm/build.rs:86 sets
+#   `-C opt-level=z --cfg getrandom_backend="custom"` for ALL wasm guest
+#   builds; the HDK defines __getrandom_v03_custom. This config mirrors
+#   that exact guest-build contract so release WASMs are reproducible.
 
 [target.wasm32-unknown-unknown]
-rustflags = ['--cfg', 'getrandom_backend="wasm_js"']
+rustflags = ['-C', 'opt-level=z', '--cfg', 'getrandom_backend="custom"']

ARF/dnas/rose_forest/zomes/coordinator/src/lib.rs

@@ -5,7 +5,7 @@ mod budget;
 mod ontology;
 mod vector_ops;
 
-use budget::{consume_budget, get_budget_state, BudgetEngine, BudgetState};
+use budget::{consume_budget, get_budget_state, BudgetState};
 use budget::{
     COST_ADD_KNOWLEDGE, COST_CREATE_THOUGHT_CREDENTIAL, COST_LINK_EDGE, COST_VALIDATE_TRIPLE,
 };
@@ -198,6 +198,11 @@ pub fn assert_triple(input: AssertTripleInput) -> ExternResult<ActionHash> {
 }
 
 #[hdk_extern]
+/// Query triples by subject or predicate.
+///
+/// When both fields are supplied, subject wins and predicate is intentionally
+/// ignored. This is the current public contract; callers that need an
+/// intersection must filter the subject results themselves.
 pub fn query_triples(input: QueryTriplesInput) -> ExternResult<Vec<TripleResult>> {
     let results = match (&input.subject, &input.predicate) {
         (Some(subject), _) => ontology::query_by_subject(subject)?,

ARF/dnas/rose_forest/zomes/coordinator/src/vector_ops.rs

@@ -1,8 +1,8 @@
-/// Pure-Rust vector operations for Rose Forest semantic search.
-///
-/// Extracted from `archive/old_project/src/core/vector.rs` with Holochain
-/// dependencies removed.  This module provides only the math needed by the
-/// coordinator zome's `vector_search` function.
+//! Pure-Rust vector operations for Rose Forest semantic search.
+//!
+//! Extracted from `archive/old_project/src/core/vector.rs` with Holochain
+//! dependencies removed.  This module provides only the math needed by the
+//! coordinator zome's `vector_search` function.
 
 /// A thin wrapper around `Vec<f32>` that provides distance and similarity
 /// operations used by the Rose Forest knowledge graph.

ARF/dnas/rose_forest/zomes/integrity/src/lib.rs

@@ -149,7 +149,7 @@ fn validate_thought_credential(
         ));
     }
     let dim = credential.content.len();
-    if dim < 32 || dim > 4096 {
+    if !(32..=4096).contains(&dim) {
         return Ok(ValidateCallbackResult::Invalid(format!(
             "E_THOUGHT_CONTENT_DIM: {} out of [32,4096]",
             dim
@@ -182,7 +182,7 @@ fn validate_rose_node(node: &RoseNode) -> ExternResult<ValidateCallbackResult> {
         )));
     }
     let dim = node.embedding.len();
-    if dim < 32 || dim > 4096 {
+    if !(32..=4096).contains(&dim) {
         return Ok(ValidateCallbackResult::Invalid(format!(
             "E_EMBED_DIM: {} out of [32,4096]",
             dim