feat(ci): Stage 2 — this repository runs on Rust; the public contract does not

#262 Stage 2 is deliberately thin. Stage 1 proved the Rust core works behind
the launcher; Stage 2 proves only that Own.NET can RUN on it internally, and
that doing so moved nothing a user can see.

What did NOT change, because changing it would be Stage 3 wearing a disguise:
EngineSelection.Default is still Engine.Python, action.yml's engine input still
defaults to python, and a bare `owen` / `own-check.sh` / `own-check.ps1` /
Action invocation still resolves Python. Stage 2 is not implemented by moving a
default — it is implemented by every internal dogfood call site ASKING for
Rust, which is why the ask is written at each call site where a control can
read it back.

The census, because the claim needs a denominator. "Own.NET CI is Rust-default"
is unfalsifiable if it means "we found one job that runs Rust", so
docs/evidence/p022-stage2-census.json names EVERY call site in every workflow
that executes the analysis core or a production launcher surface — twenty of
them across five workflows — and the role each plays: 7 public-contract
verifiers that stay Python-default on purpose, 6 explicit references, 5 compare
gates, 2 operational dogfood. tests/test_stage2_dogfood.py enumerates the
workflows itself and fails in BOTH directions: an unclassified call site, and a
ledger entry for a job that no longer invokes anything. A census that can be
satisfied by editing prose is not a census.

Class D — the Rust-default population — was exactly one job before this change:
own-check-codescan, which calls itself dog-food in its own name. It now builds
the production own-cli, records the candidate's sha256 and byte length, and
passes `engine: rust`. The Action's own public default is untouched and is
still exercised bare by own-check-surface and by the marketplace consumer
simulation, so switching the dogfood deleted no public-contract evidence.

stage2-dogfood is added because codescan is ubuntu-only and uploads a single
code-scanning category, so it cannot carry Windows — and the two launcher
surfaces differ in exactly the mechanics that cost Stage 1 six CI rounds. It
runs this repository's own tree through own-check.sh on both platforms and
through own-check.ps1 on Windows, and then breaks the candidate on purpose to
show the run fails visibly rather than being rescued by Python.

Nine controls, positive and negative: the census; every Class-D site selects
Rust explicitly with a candidate; the public defaults have not moved; a forced
Rust failure is never rescued; the candidate is the production own-cli and the
job says which one; no PATH or target-dir discovery; the reference paths still
exist and `--engine python` still answers; no compare gate was traded for Rust
exposure; the claim covers Linux AND Windows.

The public-default control is a falsifier, not a grep. It runs a BARE
invocation with OWEN_RUST_CORE pointing at something that cannot work: if the
default had moved, the run would die on the locator; because it has not, the
run ignores the candidate entirely and produces a verdict. Written that way
after the first version failed for the wrong reason — it assumed own-check.sh
honours OWEN_PYTHON, and it does not, which is a real asymmetry between the
launcher surfaces and is recorded in the control rather than papered over.

And the relabel escape is closed: every other rule is satisfied by moving a job
OUT of Class D, so a job that calls itself dog-food is Class D by declaration
and the ledger does not get to disagree with the workflow about what the job is
for.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CYLNQy6tLXqsV1CbuNqsSb

Author: claude

.github/workflows/ci.yml

@@ -196,6 +196,19 @@ jobs:
           export OWEN_RUST_CORE="$PWD/rust/target/release/own-cli$ext"
           export OWEN_STAGE1_STUB="$RUNNER_TEMP/stage1-stub$ext"
           python tests/test_stage1_ps1.py
+      # P-022 Stage 2 (#262): the CI/dogfood census and the Rust-default
+      # controls. They live here because this is the job that already has the
+      # candidate, the launcher and both platforms — and REQUIRE=1 because a
+      # census that skips is a census that measured nothing.
+      - name: Stage-2 dogfood controls (census + Rust-default + public contract)
+        env:
+          OWEN_STAGE2_REQUIRE: "1"
+        run: |
+          ext=""
+          if [ "${{ matrix.os }}" = "windows-latest" ]; then ext=".exe"; fi
+          export OWEN_RUST_CORE="$PWD/rust/target/release/own-cli$ext"
+          export OWEN_STAGE1_LAUNCHER_DLL="$PWD/frontend/roslyn/OwnSharp.Cli/bin/Release/net8.0/ownsharp.dll"
+          python tests/test_stage2_dogfood.py
       # The explicit Rust-selected run on this platform, through the shell
       # launcher, recorded as its own step so the evidence names the surface
       # and the platform rather than being inferred from a green job.
@@ -2636,8 +2649,18 @@ jobs:
   # consumer-facing payoff the exporter was built for. The samples are intentional
   # leak fixtures, so the alerts are real-if-intentional; a dedicated
   # `own-net-samples` category keeps them from colliding with anything else.
+  # P-022 step 8 (#262) STAGE 2. This is the repository's dog-food — Own.NET
+  # analysing its own tree and publishing the result to its own code scanning —
+  # so under Stage 2 it runs on the RUST core, selected explicitly.
+  #
+  # Explicitly, and that is the whole design. The product default stays Python
+  # (Stage 3 is a separate authorization), so a job that asks for nothing gets
+  # Python; "the dogfood is Rust-default" therefore has to be written at the
+  # call site, where tests/test_stage2_dogfood.py can read it back. The Action's
+  # own public default is unaffected and is still exercised bare by
+  # own-check-surface and by the marketplace consumer simulation.
   own-check-codescan:
-    name: own-check SARIF -> GitHub code scanning (dog-food)
+    name: own-check SARIF -> GitHub code scanning (Rust dog-food)
     runs-on: ubuntu-latest
     # Skip on fork PRs: GitHub downgrades GITHUB_TOKEN to read-only for a
     # pull_request from a fork, so security-events:write is never granted and the
@@ -2649,14 +2672,36 @@ jobs:
     permissions:
       contents: read
       security-events: write
+    # The candidate reaches the composite action through the environment, and
+    # job level rather than step level because that is the inheritance a
+    # composite action's own steps can be relied on to see.
+    env:
+      OWEN_RUST_CORE: ${{ github.workspace }}/rust/target/release/own-cli
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-      - name: Own.NET leak check (SARIF surface)
+      - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master, 2026-07-10
+        with:
+          toolchain: stable
+      # The PRODUCTION binary, built here, from this commit. Never
+      # own-shadow-engine (the #260 dev adapter) and never the Stage-1 test
+      # stub: a dogfood run through an instrument proves nothing about the
+      # thing being dogfooded.
+      - name: Build the production own-cli candidate
+        working-directory: rust
+        run: cargo build -p own-cli --release
+      - name: Record which candidate ran
+        run: |
+          test -x "$OWEN_RUST_CORE" || { echo "FAIL: no candidate at $OWEN_RUST_CORE"; exit 1; }
+          echo "candidate: $OWEN_RUST_CORE"
+          echo "sha256:    $(sha256sum "$OWEN_RUST_CORE" | cut -d' ' -f1)"
+          echo "bytes:     $(wc -c < "$OWEN_RUST_CORE")"
+      - name: Own.NET leak check (SARIF surface, Rust engine)
         id: own
         uses: ./
         with:
           path: frontend/roslyn/samples
           format: sarif
+          engine: rust               # STAGE 2: the dogfood runs on the Rust core
           severity: warning          # include the injected-source (warning-tier) leaks
           fail-on-finding: "false"   # let code scanning be the gate, not the step
       - name: The action exposes the SARIF path
@@ -2671,6 +2716,105 @@ jobs:
           sarif_file: ${{ steps.own.outputs.sarif-file }}
           category: own-net-samples
 
+  # P-022 step 8 (#262) STAGE 2 — the platform half of the Rust-default claim.
+  #
+  # own-check-codescan is the dogfood of record, but it is ubuntu-only and
+  # uploads a single code-scanning category, so it cannot carry Windows. The
+  # two launcher surfaces differ in exactly the mechanics that cost Stage 1 six
+  # CI rounds — process launch, executable bits, path forms, stream capture —
+  # so a Linux-only "our CI runs on Rust" is a claim about half the product.
+  #
+  # This job is deliberately NOT a contract test. stage1-engine already proves
+  # the engine contract; this one only asks the operational question: does this
+  # repository's own tree analyse correctly, through the shipped launchers,
+  # with the Rust core explicitly selected, on both platforms.
+  stage2-dogfood:
+    name: Rust-default dogfood (Own.NET's own tree, via own-cli)
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
+        with:
+          dotnet-version: "8.0.x"
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.13"
+      - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master, 2026-07-10
+        with:
+          toolchain: stable
+      - name: Build the production own-cli candidate
+        working-directory: rust
+        run: cargo build -p own-cli --release
+      - name: Record which candidate ran
+        run: |
+          ext=""
+          if [ "${{ matrix.os }}" = "windows-latest" ]; then ext=".exe"; fi
+          core="$PWD/rust/target/release/own-cli$ext"
+          test -f "$core" || { echo "FAIL: no candidate at $core"; exit 1; }
+          echo "candidate: $core"
+          echo "sha256:    $(sha256sum "$core" | cut -d' ' -f1)"
+          echo "bytes:     $(wc -c < "$core")"
+      # The operational run. --fail-on-finding is deliberate: the dogfood tree
+      # HAS a leak, so exit 1 is the correct answer and exit 0 would mean the
+      # Rust core analysed nothing and said so quietly.
+      - name: Own.NET's own tree, through own-check.sh on the Rust core
+        run: |
+          ext=""
+          if [ "${{ matrix.os }}" = "windows-latest" ]; then ext=".exe"; fi
+          export OWEN_RUST_CORE="$PWD/rust/target/release/own-cli$ext"
+          set +e
+          out=$(bash scripts/own-check.sh --engine rust --format human --fail-on-finding \
+                  -- frontend/roslyn/samples)
+          rc=$?
+          set -e
+          echo "$out"
+          [ "$rc" -eq 1 ] || { echo "FAIL: expected exit 1 (findings), got $rc"; exit 1; }
+          case "$out" in *OWN001*) ;; *) echo "FAIL: the Rust core found no OWN001"; exit 1 ;; esac
+          echo "OK: Rust-default dogfood on ${{ matrix.os }} (own-check.sh)"
+      # The Windows launcher is a separate implementation, not a wrapper around
+      # the shell one, so the Windows leg has to go through it to mean anything.
+      - name: Own.NET's own tree, through own-check.ps1 on the Rust core
+        if: matrix.os == 'windows-latest'
+        shell: pwsh
+        run: |
+          $env:OWEN_RUST_CORE = "$PWD/rust/target/release/own-cli.exe"
+          $out = & ./scripts/own-check.ps1 -Engine rust -Format human -FailOnFinding `
+                   -Paths frontend/roslyn/samples
+          $rc = $LASTEXITCODE
+          $out | Write-Host
+          if ($rc -ne 1) { throw "expected exit 1 (findings), got $rc" }
+          if ($out -notmatch 'OWN001') { throw "the Rust core found no OWN001" }
+          Write-Host "OK: Rust-default dogfood on windows (own-check.ps1)"
+          exit 0
+      # No fallback, measured rather than asserted: with the candidate broken,
+      # the dogfood must fail visibly. A run that quietly produced a verdict
+      # here would mean Python had answered for Rust, and every green Rust
+      # dogfood above would be worth nothing.
+      - name: A broken candidate fails the dogfood instead of being rescued
+        run: |
+          broken="$RUNNER_TEMP/not-a-core"
+          printf 'this is not an executable image\n' > "$broken"
+          export OWEN_RUST_CORE="$broken"
+          set +e
+          out=$(bash scripts/own-check.sh --engine rust --format human \
+                  -- frontend/roslyn/samples 2>&1)
+          rc=$?
+          set -e
+          case "$out" in
+            *OWN001*)
+              echo "FAIL: a verdict was produced with a broken candidate — Python answered for Rust"
+              exit 1 ;;
+          esac
+          [ "$rc" -ne 0 ] || { echo "FAIL: a broken candidate exited 0"; exit 1; }
+          echo "OK: a broken candidate is a visible failure (exit $rc), never a Python rescue"
+
   # P-014 Tier B: external-reference resolution. The SAME sample, run two ways, must give two
   # verdicts — proving the extractor binds a THIRD-PARTY event only when its DLL is referenced:
   #   A (no refs)        -> ObservableObject is an error type -> OWN050 (honest skip), no leak

docs/evidence/p022-stage2-1.json

@@ -0,0 +1,137 @@
+{
+  "schema": 1,
+  "comment": "GENERATED-BY-HAND definition; the RESULT beside it is recorded by scripts/mutate_campaign.py --run and the counts are derived from it, never typed.",
+  "campaign": "p022-stage2-1",
+  "description": "#262 Stage 2 — the CI/dogfood ENGINE-SELECTION seam. Stage 2's deliverable is a configuration, so its mutants are configuration: each one is a plausible way the Rust-default claim could quietly stop being true, or the public contract could quietly start moving, while every job still went green. The catchers are the controls in tests/test_stage2_dogfood.py, which read the workflows rather than being told about them.",
+  "layers_comment": "One layer, on Linux, and that is a claim rather than a convenience. Every mutation here targets DECLARATIVE text — a workflow key, a ledger entry, a C# constant, an action input — and every catcher reads that text, so the verdict is identical on either platform. This is not the Stage-1 situation, where mutants of scripts/own-check.ps1 changed PowerShell SEMANTICS that only a Windows runtime can evaluate; those keep their Windows-native campaign (p022-stage1-windows) and this one does not inherit their requirement. The one Stage-2 mutation with a platform dimension, S03, deletes the windows-latest leg from the matrix — and deleting it is exactly what a Windows runner could not report.",
+  "layers": [
+    {
+      "id": "stage2",
+      "cwd": ".",
+      "parser": "python-fail",
+      "command": [
+        "python",
+        "tests/test_stage2_dogfood.py"
+      ],
+      "env": {
+        "OWEN_STAGE2_REQUIRE": "1"
+      }
+    }
+  ],
+  "control": {
+    "id": "M00",
+    "description": "harness-honesty control: no mutation at all, which must report zero failing layers"
+  },
+  "mutations": [
+    {
+      "id": "S01",
+      "rule": "dogfood-selects-rust-explicitly",
+      "description": "the dog-food job stops asking for an engine — the most likely regression of all, because the job still runs, still analyses, still uploads, and silently goes back to the public Python default",
+      "target": ".github/workflows/ci.yml",
+      "pattern": "          engine: rust               # STAGE 2: the dogfood runs on the Rust core\n",
+      "replacement": "",
+      "expected_catchers": [
+        "stage2::internal-default-not-rust"
+      ]
+    },
+    {
+      "id": "S02",
+      "rule": "dogfood-runs-the-production-core",
+      "description": "the dog-food candidate becomes own-shadow-engine — the #260 dev adapter is a Rust binary that this repository really builds, so the substitution looks right and measures a thing that is not the product",
+      "target": ".github/workflows/ci.yml",
+      "pattern": "      OWEN_RUST_CORE: \\$\\{\\{ github\\.workspace \\}\\}/rust/target/release/own-cli",
+      "replacement": "      OWEN_RUST_CORE: ${{ github.workspace }}/rust/target/release/own-shadow-engine",
+      "expected_catchers": [
+        "stage2::wrong-rust-candidate"
+      ]
+    },
+    {
+      "id": "S03",
+      "rule": "the-claim-covers-both-platforms",
+      "description": "the Rust-default dogfood matrix loses its Windows leg — 'our CI runs on Rust' quietly becomes a statement about Linux, which is the half of the product whose launcher mechanics never broke",
+      "target": ".github/workflows/ci.yml",
+      "pattern": "    name: Rust-default dogfood \\(Own\\.NET's own tree, via own-cli\\)\n    strategy:\n      fail-fast: false\n      matrix:\n        os: \\[ubuntu-latest, windows-latest\\]",
+      "replacement": "    name: Rust-default dogfood (Own.NET's own tree, via own-cli)\n    strategy:\n      fail-fast: false\n      matrix:\n        os: [ubuntu-latest]",
+      "expected_catchers": [
+        "stage2::platform-leg-lost"
+      ]
+    },
+    {
+      "id": "S04",
+      "rule": "the-locator-is-owen-rust-core-alone",
+      "description": "the dogfood finds its candidate on PATH — 'the binary is right there, why spell out an absolute path', which is precisely how a stale binary stands in for the one under test",
+      "target": ".github/workflows/ci.yml",
+      "pattern": "          core=\"\\$PWD/rust/target/release/own-cli\\$ext\"",
+      "replacement": "          core=$(which own-cli || echo \"$PWD/rust/target/release/own-cli$ext\")",
+      "expected_catchers": [
+        "stage2::locator-contract-bypassed"
+      ]
+    },
+    {
+      "id": "S05",
+      "rule": "a-rust-failure-is-visible",
+      "description": "the dogfood run swallows its exit code — the classic 'don't let the dogfood job break the build', which turns every Rust-default claim in this PR into decoration",
+      "target": ".github/workflows/ci.yml",
+      "pattern": "          out=\\$\\(bash scripts/own-check\\.sh --engine rust --format human --fail-on-finding \\\\\n                  -- frontend/roslyn/samples\\)",
+      "replacement": "          out=$(bash scripts/own-check.sh --engine rust --format human --fail-on-finding -- frontend/roslyn/samples || true)",
+      "expected_catchers": [
+        "stage2::rust-job-falls-back"
+      ]
+    },
+    {
+      "id": "S06",
+      "rule": "the-public-default-does-not-move",
+      "description": "the PRODUCT default flips to Rust — the covert Stage 3, and the single edit that would make every internal Rust job pass by accident while changing what every user gets",
+      "target": "frontend/roslyn/OwnSharp.Cli/EngineSelection.cs",
+      "pattern": "public const Engine Default = Engine\\.Python;",
+      "replacement": "public const Engine Default = Engine.Rust;",
+      "expected_catchers": [
+        "stage2::public-default-moved"
+      ]
+    },
+    {
+      "id": "S07",
+      "rule": "the-public-default-does-not-move",
+      "description": "the ACTION's public engine input defaults to rust — the same cutover through the other public door, and the one a C#-only control would miss",
+      "target": "action.yml",
+      "pattern": "    required: false\n    default: \"python\"",
+      "replacement": "    required: false\n    default: \"rust\"",
+      "expected_catchers": [
+        "stage2::public-default-moved"
+      ]
+    },
+    {
+      "id": "S08",
+      "rule": "compare-evidence-is-not-traded-away",
+      "description": "a #260 compare gate is disabled — the cheapest way to make a Rust-default dogfood green is to remove the job that would have disagreed with it",
+      "target": ".github/workflows/ci.yml",
+      "pattern": "  shadow-compare:\n    name: shadow compare \\(committed corpus\\)\n",
+      "replacement": "  shadow-compare:\n    name: shadow compare (committed corpus)\n    if: false\n",
+      "expected_catchers": [
+        "stage2::compare-gate-dropped"
+      ]
+    },
+    {
+      "id": "S09",
+      "rule": "no-unclassified-call-site",
+      "description": "a new bare launcher invocation appears in a job nobody classified — the hole the census exists to close, and the one that reopens every time somebody adds a convenient scan step",
+      "target": ".github/workflows/ci.yml",
+      "pattern": "      - name: Check the emitted method is still in sync with the golden host\n",
+      "replacement": "      - name: Check the emitted method is still in sync with the golden host\n        run: scripts/own-check.sh --format human -- frontend/roslyn/samples\n",
+      "expected_catchers": [
+        "stage2::stage2-census"
+      ]
+    },
+    {
+      "id": "S10",
+      "rule": "no-escape-by-relabelling",
+      "description": "the dog-food job is reclassified out of the Rust-default population — every other rule is satisfied by shrinking Class D, so without a rule that reads the job's own name this is a green way to stop dogfooding",
+      "target": "docs/evidence/p022-stage2-census.json",
+      "pattern": "      \"job\": \"own-check-codescan\",\n      \"class\": \"D\",",
+      "replacement": "      \"job\": \"own-check-codescan\",\n      \"class\": \"A\",",
+      "expected_catchers": [
+        "stage2::stage2-census"
+      ]
+    }
+  ]
+}