[New1Direction]

What this adds

Two new Rust binaries that do the same jobs as the Python tools, faster and with the same answers, plus a way to install them without a Rust toolchain.

Binary	Replaces	Measured (4-core container, release build)
ontologyex-feeds	feeds.py	OTLP receiver: 1.74M spans/s vs 98k (17.8×), 8.3 MiB vs 41.5 MiB resident. Probes and Prometheus polled in parallel.
ontologyex-discover	discover_repo.py	5,900-file repo, 125 manifests: 0.088 s vs 1.30 s (14.8×). Byte-identical JSON.

Python stays the default and the reference. control_room.py --view-engine rust now also uses Rust discovery. Benchmark: tests/bench_rust_engines.py.

How we know they give the same answers

• Discovery parity (tests/rust_discover_parity.py): 49 edge-case repos plus seeded mutations of compose files, workflows, package.json, Cargo.toml and pyproject.toml. Locally, 0 mismatches over 24,000+ mutated manifests. The YAML loader is a port of PyYAML's reader, scanner and parser. A YAML 1.2 crate first disagreed on tabs, U+0085 line breaks and indentation, which is why the port exists.
• Feeds parity (tests/rust_feeds_parity.py): config validation (60 URL shapes plus seeded mutations), OTLP protobuf/JSON/gzip decoding with byte-flipped bodies, Prometheus responses, span-window replays, byte-for-byte store merges, once end to end, and the live receiver's status codes and rows. 2,223 cases, 0 mismatches. A planted bug is caught.
• Kernels (tests/feeds_conformance.py): classification (31,250 cases), retention (4,095) and the p95 rank for every count up to 100,000. Compared across Python, Rust and Lean.
• Lean (OntologyEX.Feeds): down_is_error, threshold_inclusive, classify_monotone, keep_at_most, keep_from_input, dropped_are_older, p95_index_in_range.

CI runs all of this in rust-proof-foundation.yml, with cargo --locked. Cargo.lock is now committed.

Python changes (needed for exact parity)

Each change refuses input that was malformed anyway, rather than copying a quirk into Rust:

• Feeds:
  • URLs must be printable RFC 3986 text with a plain host and port.
  • OTLP/JSON and Prometheus bodies must be strict UTF-8 JSON with typed fields.
  • Truncated gzip bodies are refused.
  • The bearer token is compared as bytes; a non-ASCII header used to raise.
  • A non-object Prometheus response no longer crashes the runner.
• Discovery:
  • Explicit YAML tags are refused.
  • Nesting is bounded explicitly: YAML 64 levels, JSON 512.
  • A TOML float overflow is an error instead of infinity.
  • Gap error_type is now a stable parse category.

Releases

• release-engine.yml builds Linux (static musl, x86_64 and arm64) and macOS (arm64, plus x86_64 cross-built), and runs the parity suites on each native build. On an engine-v* tag it publishes the archives, SHA256SUMS, and a build provenance attestation. This PR only builds.
• fetch_engine.py downloads from github.com only, verifies the checksum, and installs just the four binaries into the skill's bin/. It never runs them and prints the gh attestation verify command.

Docs: docs/rust-engine.md, which includes the known differences (IPv6 bind, timestamp forms, Windows via WSL).

Verification run locally

• 560 Python tests OK.
• cargo test --all-targets with -D warnings: 39 tests.
• Existing Rust parity scripts pass (view, incident, HTTP, business 1,111/64/259 rows).
• Static musl build: parity re-run, 549 and 556 cases, 0 mismatches. A self-signed certificate is refused by both implementations.
• Lean is not built locally; CI checks it.

---

Generated by Claude Code