From d0924726f88a35bbd9ef2e17aef4ca0322834cea Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 26 Aug 2026 17:51:23 +0000
Subject: [PATCH] refactor: replace blanket clippy::restriction with a curated
 workspace lint policy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Phase 1 of issue #1. Nearly every crate opened with
`#![warn(clippy::restriction, clippy::pedantic)]` plus a long, drifted
`#![allow(...)]` list — clippy's own docs say `restriction` isn't meant to
be enabled wholesale, and three of the "commonly allowed" lints turned out
to be default-on via `clippy::all` (match_ref_pats, needless_borrowed_reference,
blanket_clippy_restriction_lints), meaning they were suppressing mainstream
clippy output, not opting out of a restriction-tier lint.

- Centralize the policy in root Cargo.toml's new [workspace.lints.clippy]
  table: pedantic stays fully on, each restriction-tier lint was reviewed
  individually and either enabled (ref_patterns, map_err_ignore,
  allow_attributes_without_reason) or explicitly allowed with a documented
  reason (implicit_return, question_mark_used, shadow_reuse/unrelated/same,
  single_call_fn, absolute_paths, mod_module_files, min_ident_chars,
  separated_literal_suffix, std_instead_of_core/alloc,
  arbitrary_source_item_ordering, doc_paragraphs_missing_punctuation).
  too_many_lines/match_ref_pats/needless_borrowed_reference are explicitly
  re-enabled since they were being suppressed despite not being
  restriction-tier.
- Every hand-written crate (14 that had the old block, plus auth/oauth_flow
  and prototypes/workflow_engine which never opted into any lint policy)
  now just does `[lints] workspace = true`.
- Removed service_loader's three `#[cfg(test)] mod test { #![allow(clippy::restriction,
  clippy::pedantic)] }` blocks, now meaningless since the crate root no
  longer blanket-enables either group.
- Fixed the small, mechanical anti-patterns the old suppressions were
  hiding: `extern crate alloc; use alloc::sync::Arc` (etc.) in 13 ordinary
  std crates (zero crates in this workspace are #![no_std]) replaced with
  plain std paths; 4 `.map_err(|_| ...)` sites that discarded the original
  error now capture it in the resulting message.

The ~86-site ref-pattern/match_ref_pats/needless_borrowed_reference rewrite
this now surfaces as warnings, the too_many_lines fallout, and the
api_caller numeric-safety audit (as_conversions/cast_possible_truncation,
kept allowed here with a documented reason) are tracked as follow-ups in
#85, #86, #87 rather than folded into this policy change.

Fixes #1

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018VzKriyNnMHmqQ6UxPhsv2
---
 Cargo.toml                                    | 39 +++++++++++++++++++
 auth/oauth_flow/Cargo.toml                    |  3 ++
 auth/oauth_flow/src/routes/callback.rs        |  8 ++--
 binary/apicli/Cargo.toml                      |  3 ++
 binary/apicli/src/engine.rs                   | 11 +++---
 binary/apicli/src/main.rs                     | 19 ---------
 binary/apicli/src/stub.rs                     |  2 -
 binary/apicli/src/template.rs                 |  7 ++--
 binary/apid/Cargo.toml                        |  3 ++
 binary/apid/src/main.rs                       | 23 +----------
 binary/apid/src/workers/loader.rs             |  5 +--
 binary/apid/src/workers/mod.rs                |  5 +--
 binary/apid/src/workers/watcher.rs            |  7 +---
 common/data_structures/Cargo.toml             |  3 ++
 common/data_structures/src/lib.rs             | 15 -------
 common/data_structures/src/trie.rs            |  5 ++-
 prototypes/workflow_engine/Cargo.toml         |  3 ++
 runners/api_caller/Cargo.toml                 |  3 ++
 runners/api_caller/src/error.rs               |  2 -
 runners/api_caller/src/lib.rs                 | 37 +++++-------------
 runners/filtered_runner/Cargo.toml            |  3 ++
 runners/filtered_runner/src/error.rs          |  2 -
 runners/filtered_runner/src/lib.rs            | 29 ++------------
 runners/javascript_runner/Cargo.toml          |  3 ++
 runners/javascript_runner/src/error.rs        |  2 -
 runners/javascript_runner/src/lib.rs          | 27 ++-----------
 runners/python_runner/Cargo.toml              |  3 ++
 runners/python_runner/src/bindings.rs         | 15 +++----
 runners/python_runner/src/error.rs            |  2 -
 runners/python_runner/src/lib.rs              | 25 +-----------
 runners/user_input/Cargo.toml                 |  3 ++
 runners/user_input/src/error.rs               |  2 -
 runners/user_input/src/lib.rs                 | 27 +------------
 runners/workflow_runner/Cargo.toml            |  3 ++
 runners/workflow_runner/src/lib.rs            | 17 --------
 storage/in_memory_storage/Cargo.toml          |  3 ++
 storage/in_memory_storage/src/error.rs        |  2 -
 storage/in_memory_storage/src/lib.rs          | 19 ---------
 storage/in_memory_storage/src/repo.rs         | 10 ++---
 storage/local_file_loader/Cargo.toml          |  3 ++
 storage/local_file_loader/src/lib.rs          | 15 -------
 usecases/execution_engine/Cargo.toml          |  3 ++
 usecases/execution_engine/src/error.rs        |  2 -
 usecases/execution_engine/src/lib.rs          | 33 +++++-----------
 usecases/service_loader/Cargo.toml            |  3 ++
 usecases/service_loader/src/error.rs          |  2 -
 usecases/service_loader/src/lib.rs            | 18 ---------
 .../service_loader/src/loaders/openapi/mod.rs |  2 -
 .../src/loaders/openapi/utils.rs              |  1 -
 usecases/service_writer/Cargo.toml            |  3 ++
 usecases/service_writer/src/error.rs          |  2 -
 usecases/service_writer/src/lib.rs            | 21 +---------
 52 files changed, 151 insertions(+), 357 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index 0479472..c1b9bd8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -39,6 +39,45 @@ members = [
 	"prototypes/workflow_engine",
 ]
 
+[workspace.lints.clippy]
+# Curated per issue #1, replacing the former per-crate blanket
+# `#![warn(clippy::restriction, clippy::pedantic)]`. `restriction` is not
+# meant to be enabled wholesale (clippy's own docs say so — it contains
+# mutually contradictory lints); each restriction-tier lint below was
+# reviewed individually and either enabled or explicitly rejected with a
+# reason. `pedantic` stays fully enabled.
+pedantic = { level = "warn", priority = -1 }
+
+# Restriction-tier lints deliberately kept on:
+ref_patterns = "warn"
+map_err_ignore = "warn"
+allow_attributes_without_reason = "warn"
+
+# Not restriction-tier, but were being suppressed anyway (default-on via
+# clippy::all / clippy::pedantic) — explicitly un-suppressing:
+too_many_lines = "warn"
+match_ref_pats = "warn"
+needless_borrowed_reference = "warn"
+
+# Restriction-tier lints reviewed and deliberately left off:
+implicit_return = "allow" # bans expression-as-return-value, Rust's core idiom
+question_mark_used = "allow" # fires on every `?`; universally not recommended to enable
+shadow_reuse = "allow" # this codebase's dominant "transform in place" style
+shadow_unrelated = "allow" # same family as shadow_reuse
+shadow_same = "allow" # same family
+single_call_fn = "allow" # named single-call helpers are a deliberate readability tool here
+absolute_paths = "allow" # error.rs files intentionally fully-qualify wrapped error types
+mod_module_files = "allow" # codebase's actual, consistent convention (mod.rs for nested modules)
+self_named_module_files = "allow" # mutually exclusive with the above; moot either way
+min_ident_chars = "allow" # short loop/index identifiers are fine
+separated_literal_suffix = "allow" # pure style preference, no correctness value
+std_instead_of_core = "allow" # no crate in this workspace is #![no_std]; inapplicable
+std_instead_of_alloc = "allow" # same
+arbitrary_source_item_ordering = "allow" # would force alphabetical ordering over the
+# codebase's logical grouping (constructors before accessors, related
+# methods together) for no readability gain — reviewed and rejected
+doc_paragraphs_missing_punctuation = "allow" # low-signal nitpick, not worth the churn
+
 [workspace.dependencies]
 anyhow = "1.0"
 async-trait = "0.1"
diff --git a/auth/oauth_flow/Cargo.toml b/auth/oauth_flow/Cargo.toml
index fecb2a5..0de6e96 100644
--- a/auth/oauth_flow/Cargo.toml
+++ b/auth/oauth_flow/Cargo.toml
@@ -18,3 +18,6 @@ credential_entities = { path = "../../entities/credentials" }
 
 thiserror = { workspace = true }
 
+
+[lints]
+workspace = true
diff --git a/auth/oauth_flow/src/routes/callback.rs b/auth/oauth_flow/src/routes/callback.rs
index f6c0a44..269ae14 100644
--- a/auth/oauth_flow/src/routes/callback.rs
+++ b/auth/oauth_flow/src/routes/callback.rs
@@ -91,12 +91,12 @@ pub async fn route(
         oauth_config.accessTokenPath.clone()
     };
 
-    let expression = jmespath::compile(&access_token_path).map_err(|_| {
-        error::CallbackResponse::InternalError("Invalid access token path".to_string())
+    let expression = jmespath::compile(&access_token_path).map_err(|err| {
+        error::CallbackResponse::InternalError(format!("Invalid access token path: {err}"))
     })?;
 
-    let access_token = expression.search(response_body).map_err(|_| {
-        error::CallbackResponse::InternalError("Unable to find access token".to_string())
+    let access_token = expression.search(response_body).map_err(|err| {
+        error::CallbackResponse::InternalError(format!("Unable to find access token: {err}"))
     })?;
 
     {
diff --git a/binary/apicli/Cargo.toml b/binary/apicli/Cargo.toml
index 89b08cd..4b83e14 100644
--- a/binary/apicli/Cargo.toml
+++ b/binary/apicli/Cargo.toml
@@ -39,3 +39,6 @@ tonic-build = { workspace = true }
 dhat-heap = []
 dhat-ad-hoc = []
 
+
+[lints]
+workspace = true
diff --git a/binary/apicli/src/engine.rs b/binary/apicli/src/engine.rs
index bb84715..25920e3 100644
--- a/binary/apicli/src/engine.rs
+++ b/binary/apicli/src/engine.rs
@@ -1,13 +1,12 @@
-#![allow(clippy::print_stdout)]
-#![allow(clippy::too_many_lines)]
-#![allow(clippy::needless_borrowed_reference)]
+#![allow(
+    clippy::print_stdout,
+    reason = "this CLI's actual output mechanism for command results"
+)]
 
 //! Handlers for every CLI subcommand: the gRPC client calls to `apid`
 //! ([`Cli`]), the local JSON-schema inference/merge helpers, and the
 //! `generate` command's template rendering.
 
-extern crate alloc;
-use alloc::sync::Arc;
 use serde::{Deserialize, Serialize};
 use tera::{Context, Tera};
 
@@ -15,7 +14,7 @@ use std::{
     collections::HashMap,
     env, fs, io,
     path::{Path, PathBuf},
-    sync::Mutex,
+    sync::{Arc, Mutex},
 };
 
 use anyhow::{anyhow, Context as _};
diff --git a/binary/apicli/src/main.rs b/binary/apicli/src/main.rs
index 679d4d3..47b5182 100644
--- a/binary/apicli/src/main.rs
+++ b/binary/apicli/src/main.rs
@@ -1,22 +1,3 @@
-#![warn(clippy::restriction, clippy::pedantic)]
-#![allow(
-    clippy::blanket_clippy_restriction_lints,
-    clippy::mod_module_files,
-    clippy::self_named_module_files,
-    clippy::implicit_return,
-    clippy::shadow_reuse,
-    clippy::match_ref_pats,
-    clippy::shadow_unrelated,
-    clippy::shadow_same,
-    clippy::question_mark_used,
-    // clippy::too_many_lines
-    clippy::absolute_paths,
-    clippy::single_call_fn,
-    clippy::ref_patterns,
-
-    clippy::min_ident_chars,
-)]
-
 //! The CLI binary: a thin gRPC client to `apid`, plus local scaffolding
 //! tools for generating new service definitions and an embedded
 //! interactive-login web server.
diff --git a/binary/apicli/src/stub.rs b/binary/apicli/src/stub.rs
index 07448ac..8573d2b 100644
--- a/binary/apicli/src/stub.rs
+++ b/binary/apicli/src/stub.rs
@@ -1,5 +1,3 @@
-#![allow(clippy::separated_literal_suffix)]
-
 //! Generates a sample JSON input/output payload for an operation, used by
 //! the `InputStub`/`OutputStub` CLI commands.
 
diff --git a/binary/apicli/src/template.rs b/binary/apicli/src/template.rs
index bcdf823..0102628 100644
--- a/binary/apicli/src/template.rs
+++ b/binary/apicli/src/template.rs
@@ -1,5 +1,3 @@
-#![allow(clippy::needless_borrowed_reference)]
-
 //! A hand-rolled lexer/parser for the `Generate` command's small input/
 //! output-mapping DSL:
 //!
@@ -482,7 +480,10 @@ impl FromStr for InputDescription {
 
 #[cfg(test)]
 mod test {
-    #![allow(clippy::panic_in_result_fn)]
+    #![allow(
+        clippy::panic_in_result_fn,
+        reason = "test code — unwrap/expect panics are expected on failure"
+    )]
 
     use super::*;
 
diff --git a/binary/apid/Cargo.toml b/binary/apid/Cargo.toml
index 82cef20..9e506e6 100644
--- a/binary/apid/Cargo.toml
+++ b/binary/apid/Cargo.toml
@@ -59,3 +59,6 @@ workflow = []
 input = []
 wrapper = []
 
+
+[lints]
+workspace = true
diff --git a/binary/apid/src/main.rs b/binary/apid/src/main.rs
index 2f0ad3d..d31e365 100644
--- a/binary/apid/src/main.rs
+++ b/binary/apid/src/main.rs
@@ -1,22 +1,3 @@
-#![warn(clippy::restriction, clippy::pedantic)]
-#![allow(
-    clippy::blanket_clippy_restriction_lints,
-    clippy::mod_module_files,
-    clippy::self_named_module_files,
-    clippy::implicit_return,
-    clippy::shadow_reuse,
-    clippy::match_ref_pats,
-    clippy::shadow_unrelated,
-    clippy::shadow_same,
-    // clippy::too_many_lines
-    clippy::question_mark_used,
-    clippy::absolute_paths,
-    clippy::single_call_fn,
-    clippy::ref_patterns,
-
-    clippy::min_ident_chars,
-)]
-
 //! The daemon binary: a `tonic` gRPC server that wires concrete adapters
 //! into an [`execution_engine::Engine`] and exposes it as the [`Engine`]
 //! service, the composition root of the whole workspace.
@@ -26,8 +7,6 @@ mod constants;
 mod util;
 mod workers;
 
-extern crate alloc;
-use alloc::sync::Arc;
 use config::Configuration;
 
 use std::{
@@ -36,7 +15,7 @@ use std::{
     fs::{self, File},
     panic,
     path::PathBuf,
-    sync::{mpsc::Sender, Mutex, PoisonError, RwLock},
+    sync::{mpsc::Sender, Arc, Mutex, PoisonError, RwLock},
 };
 
 use anyhow::{anyhow, Context};
diff --git a/binary/apid/src/workers/loader.rs b/binary/apid/src/workers/loader.rs
index 9d7586f..5c276f6 100644
--- a/binary/apid/src/workers/loader.rs
+++ b/binary/apid/src/workers/loader.rs
@@ -1,15 +1,12 @@
 //! The background thread that (re)loads changed services into the shared
 //! repositories, signalled by [`super::watcher`].
 
-extern crate alloc;
-use alloc::sync::Arc;
-
 use std::{
     collections::HashMap,
     path::PathBuf,
     sync::{
         mpsc::{Receiver, Sender},
-        Mutex, PoisonError,
+        Arc, Mutex, PoisonError,
     },
     thread::{self, JoinHandle},
 };
diff --git a/binary/apid/src/workers/mod.rs b/binary/apid/src/workers/mod.rs
index 9cda96a..b0e36ed 100644
--- a/binary/apid/src/workers/mod.rs
+++ b/binary/apid/src/workers/mod.rs
@@ -4,13 +4,10 @@
 mod loader;
 mod watcher;
 
-extern crate alloc;
-use alloc::sync::Arc;
-
 use std::{
     collections::HashMap,
     path::PathBuf,
-    sync::{mpsc, Mutex},
+    sync::{mpsc, Arc, Mutex},
     thread::JoinHandle,
 };
 
diff --git a/binary/apid/src/workers/watcher.rs b/binary/apid/src/workers/watcher.rs
index 0964a35..b3abe7a 100644
--- a/binary/apid/src/workers/watcher.rs
+++ b/binary/apid/src/workers/watcher.rs
@@ -1,18 +1,15 @@
 //! The background thread that polls loaded services' directories for
 //! filesystem changes and reports them to [`super::loader`].
 
-extern crate alloc;
-use alloc::sync::Arc;
-
-use core::time::Duration;
 use std::{
     collections::{HashMap, HashSet},
     path::PathBuf,
     sync::{
         mpsc::{self, Receiver, Sender},
-        Mutex, PoisonError,
+        Arc, Mutex, PoisonError,
     },
     thread::{self, JoinHandle},
+    time::Duration,
 };
 
 use notify::Watcher;
diff --git a/common/data_structures/Cargo.toml b/common/data_structures/Cargo.toml
index 7a1784a..c0202ce 100644
--- a/common/data_structures/Cargo.toml
+++ b/common/data_structures/Cargo.toml
@@ -9,3 +9,6 @@ edition = "2021"
 
 [dev-dependencies]
 tempfile = "3"
+
+[lints]
+workspace = true
diff --git a/common/data_structures/src/lib.rs b/common/data_structures/src/lib.rs
index b293349..9dff2bf 100644
--- a/common/data_structures/src/lib.rs
+++ b/common/data_structures/src/lib.rs
@@ -1,18 +1,3 @@
-#![warn(clippy::restriction, clippy::pedantic)]
-#![allow(
-    clippy::blanket_clippy_restriction_lints,
-    clippy::mod_module_files,
-    clippy::self_named_module_files,
-
-    clippy::implicit_return,
-    clippy::shadow_reuse,
-    clippy::shadow_unrelated,
-    clippy::match_ref_pats,
-
-    // Would like to turn on (Configured to 50?)
-    clippy::too_many_lines
-)]
-
 //! Small, dependency-free data structures shared across the workspace.
 //!
 //! A byte-wise, wildcard-aware [`trie`](trie::Trie), and a background-thread
diff --git a/common/data_structures/src/trie.rs b/common/data_structures/src/trie.rs
index a06a8e1..6790181 100644
--- a/common/data_structures/src/trie.rs
+++ b/common/data_structures/src/trie.rs
@@ -1,4 +1,7 @@
-#![allow(clippy::arithmetic_side_effects)]
+#![allow(
+    clippy::arithmetic_side_effects,
+    reason = "byte-index arithmetic for wildcard matching, bounds-checked by the slice ops around it"
+)]
 
 //! A byte-wise trie for wildcard-aware string-key lookups — e.g. matching a
 //! concrete key like `"application/json"` against a registered pattern like
diff --git a/prototypes/workflow_engine/Cargo.toml b/prototypes/workflow_engine/Cargo.toml
index 4dbe1b2..11bc1e0 100644
--- a/prototypes/workflow_engine/Cargo.toml
+++ b/prototypes/workflow_engine/Cargo.toml
@@ -12,3 +12,6 @@ serde_json = { workspace = true }
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["test-util", "macros"] }
+
+[lints]
+workspace = true
diff --git a/runners/api_caller/Cargo.toml b/runners/api_caller/Cargo.toml
index 2a939f2..cc674e9 100644
--- a/runners/api_caller/Cargo.toml
+++ b/runners/api_caller/Cargo.toml
@@ -27,3 +27,6 @@ async-trait = { workspace = true }
 tempfile = "3"
 protobuf = { workspace = true }
 tokio = { workspace = true, features = ["macros", "rt"] }
+
+[lints]
+workspace = true
diff --git a/runners/api_caller/src/error.rs b/runners/api_caller/src/error.rs
index 9c4f9f6..3202b71 100644
--- a/runners/api_caller/src/error.rs
+++ b/runners/api_caller/src/error.rs
@@ -1,5 +1,3 @@
-#![allow(clippy::std_instead_of_core)]
-
 //! Errors produced while making an API call.
 
 use std::{io, num::TryFromIntError};
diff --git a/runners/api_caller/src/lib.rs b/runners/api_caller/src/lib.rs
index ecc62fc..1b0f0e5 100644
--- a/runners/api_caller/src/lib.rs
+++ b/runners/api_caller/src/lib.rs
@@ -1,25 +1,9 @@
-#![warn(clippy::restriction, clippy::pedantic)]
 #![allow(
-    clippy::blanket_clippy_restriction_lints,
-    clippy::mod_module_files,
-    clippy::self_named_module_files,
-
-    clippy::implicit_return,
-    clippy::shadow_reuse,
-    clippy::shadow_unrelated,
-    clippy::match_ref_pats,
-    clippy::separated_literal_suffix,
-
     clippy::as_conversions,
     clippy::cast_possible_truncation,
-
-    // Would like to turn on (Configured to 50?)
-    clippy::too_many_lines,
-    clippy::needless_borrowed_reference,
-    clippy::separated_literal_suffix,
-    clippy::question_mark_used,
-    clippy::absolute_paths,
-    clippy::ref_patterns,
+    reason = "pagination limit/offset casts between i32/usize/u64 are unaudited; \
+              tracked as a dedicated numeric-safety follow-up to issue #1, not \
+              rushed into this lint-hygiene pass"
 )]
 
 //! A [`DataConnectionRunner`] adapter that resolves an operation's request
@@ -29,8 +13,6 @@
 mod constants;
 pub mod error;
 
-extern crate alloc;
-
 use std::collections::HashMap;
 
 use base64::Engine as _;
@@ -492,10 +474,9 @@ impl APICallState {
         creds: Option<&Authentication>,
     ) -> error::Result<()> {
         let defined_auth = &manifest.auth;
-        let auth_type = defined_auth
-            .type_
-            .enum_value()
-            .map_err(|_| error::APICaller::Unimplemented("Unrecognized auth type".into()))?;
+        let auth_type = defined_auth.type_.enum_value().map_err(|raw| {
+            error::APICaller::Unimplemented(format!("Unrecognized auth type: {raw}"))
+        })?;
         match auth_type {
             core_entities::service::swagger_service::service_auth::Type::HEADER => {
                 let key = defined_auth
@@ -1102,11 +1083,13 @@ impl AsyncDataConnectionRunner for AsyncAPICaller {
 
 #[cfg(test)]
 mod tests {
-    use alloc::sync::Arc;
     use std::{
         io::{BufRead, BufReader, Write},
         net::TcpListener,
-        sync::atomic::{AtomicUsize, Ordering},
+        sync::{
+            atomic::{AtomicUsize, Ordering},
+            Arc,
+        },
         thread,
     };
 
diff --git a/runners/filtered_runner/Cargo.toml b/runners/filtered_runner/Cargo.toml
index 167721d..96fc9b4 100644
--- a/runners/filtered_runner/Cargo.toml
+++ b/runners/filtered_runner/Cargo.toml
@@ -18,3 +18,6 @@ core_entities = { path = "../../entities/core" }
 credential_entities = { path = "../../entities/credentials" }
 common_data_structures = { path = "../../common/data_structures" }
 
+
+[lints]
+workspace = true
diff --git a/runners/filtered_runner/src/error.rs b/runners/filtered_runner/src/error.rs
index 7e09ffe..5744a38 100644
--- a/runners/filtered_runner/src/error.rs
+++ b/runners/filtered_runner/src/error.rs
@@ -1,5 +1,3 @@
-#![allow(clippy::std_instead_of_core)]
-
 //! Errors produced while resolving an [`APIWrapper`](crate::APIWrapper)
 //! call.
 
diff --git a/runners/filtered_runner/src/lib.rs b/runners/filtered_runner/src/lib.rs
index 84d87cf..9a2c974 100644
--- a/runners/filtered_runner/src/lib.rs
+++ b/runners/filtered_runner/src/lib.rs
@@ -1,37 +1,16 @@
-#![warn(clippy::restriction, clippy::pedantic)]
-#![allow(
-    clippy::blanket_clippy_restriction_lints,
-    clippy::mod_module_files,
-    clippy::self_named_module_files,
-
-    clippy::implicit_return,
-    clippy::shadow_reuse,
-    clippy::shadow_unrelated,
-    clippy::match_ref_pats,
-    clippy::separated_literal_suffix,
-
-    // Would like to turn on (Configured to 50?)
-    clippy::too_many_lines,
-    clippy::question_mark_used,
-    clippy::needless_borrowed_reference,
-
-    clippy::absolute_paths,
-    clippy::single_call_fn,
-    clippy::ref_patterns,
-)]
-
 //! A [`FilteredRunner`] adapter that calls another already-registered
 //! operation through the [`execution_engine`] and narrows its result down to
 //! a specific set of selected output fields.
 
 pub mod error;
 
-extern crate alloc;
-use alloc::{rc::Rc, sync::Arc};
+use std::{
+    rc::Rc,
+    sync::{Arc, RwLock},
+};
 
 use common_data_structures::log_writer::LogWriter;
 use lazy_static::lazy_static;
-use std::sync::RwLock;
 
 use execution_engine::services::FilteredRunner;
 use regex::Regex;
diff --git a/runners/javascript_runner/Cargo.toml b/runners/javascript_runner/Cargo.toml
index 9742bf1..f0303a4 100644
--- a/runners/javascript_runner/Cargo.toml
+++ b/runners/javascript_runner/Cargo.toml
@@ -21,3 +21,6 @@ regex = { workspace = true }
 mini-v8 = "0.4"
 
 
+
+[lints]
+workspace = true
diff --git a/runners/javascript_runner/src/error.rs b/runners/javascript_runner/src/error.rs
index d96132f..50cdba0 100644
--- a/runners/javascript_runner/src/error.rs
+++ b/runners/javascript_runner/src/error.rs
@@ -1,5 +1,3 @@
-#![allow(clippy::std_instead_of_core)]
-
 //! Errors produced while running a [`JsActionRunner`](crate::JsActionRunner)
 //! operation.
 
diff --git a/runners/javascript_runner/src/lib.rs b/runners/javascript_runner/src/lib.rs
index 4e87d94..6ec98d5 100644
--- a/runners/javascript_runner/src/lib.rs
+++ b/runners/javascript_runner/src/lib.rs
@@ -1,23 +1,3 @@
-#![warn(clippy::restriction, clippy::pedantic)]
-#![allow(
-    clippy::blanket_clippy_restriction_lints,
-    clippy::mod_module_files,
-    clippy::self_named_module_files,
-
-    clippy::implicit_return,
-    clippy::shadow_reuse,
-    clippy::shadow_unrelated,
-    clippy::match_ref_pats,
-    clippy::separated_literal_suffix,
-
-    // Would like to turn on (Configured to 50?)
-    clippy::too_many_lines,
-    clippy::question_mark_used,
-    clippy::needless_borrowed_reference,
-    clippy::single_call_fn,
-    clippy::absolute_paths,
-)]
-
 //! A [`CodeRunner`] adapter that executes a JavaScript operation body
 //! inside a [`MiniV8`] interpreter reused per thread.
 
@@ -26,11 +6,12 @@ mod constants;
 mod converters;
 pub mod error;
 
-extern crate alloc;
-use alloc::sync::Arc;
 use mini_v8::MiniV8;
 
-use std::{cell::RefCell, sync::RwLock};
+use std::{
+    cell::RefCell,
+    sync::{Arc, RwLock},
+};
 
 use common_data_structures::log_writer::LogWriter;
 use execution_engine::services::CodeRunner;
diff --git a/runners/python_runner/Cargo.toml b/runners/python_runner/Cargo.toml
index 66d2204..62e89f6 100644
--- a/runners/python_runner/Cargo.toml
+++ b/runners/python_runner/Cargo.toml
@@ -21,3 +21,6 @@ regex = { workspace = true }
 pyo3 = "0.17"
 
 
+
+[lints]
+workspace = true
diff --git a/runners/python_runner/src/bindings.rs b/runners/python_runner/src/bindings.rs
index df85511..84a5384 100644
--- a/runners/python_runner/src/bindings.rs
+++ b/runners/python_runner/src/bindings.rs
@@ -1,16 +1,10 @@
-#![allow(clippy::std_instead_of_core)]
-
 //! `pyo3` classes installed into a running script's module namespace as the
 //! `api`/`workflow`/`action`/`task` bindings, giving the script a way to
 //! call back into the engine and to log activity.
 
-extern crate alloc;
-use alloc::sync::Arc;
-
-use std::sync::RwLock;
+use std::sync::{Arc, RwLock};
 use std::thread;
-
-use core::time::Duration;
+use std::time::Duration;
 
 use common_data_structures::log_writer::LogWriter;
 
@@ -327,7 +321,10 @@ impl WorkflowLogger {
 
     /// Logs `display` at [`constants::LOG_STATUS`], tagged with
     /// `groupId`, without affecting the script's recorded outcome.
-    #[allow(non_snake_case)]
+    #[allow(
+        non_snake_case,
+        reason = "groupId matches the script-facing binding's parameter name"
+    )]
     fn status(&mut self, py: Python<'_>, display: &PyAny, groupId: &str) -> PyResult<Py<PyAny>> {
         self.print_display(display, &format!("{}={groupId}", constants::LOG_STATUS))?;
         Ok(py.None())
diff --git a/runners/python_runner/src/error.rs b/runners/python_runner/src/error.rs
index 551f2eb..818a3a0 100644
--- a/runners/python_runner/src/error.rs
+++ b/runners/python_runner/src/error.rs
@@ -1,5 +1,3 @@
-#![allow(clippy::std_instead_of_core)]
-
 //! Errors produced while running a
 //! [`PyActionRunner`](crate::PyActionRunner) operation.
 
diff --git a/runners/python_runner/src/lib.rs b/runners/python_runner/src/lib.rs
index 9296761..2c68bf5 100644
--- a/runners/python_runner/src/lib.rs
+++ b/runners/python_runner/src/lib.rs
@@ -1,23 +1,3 @@
-#![warn(clippy::restriction, clippy::pedantic)]
-#![allow(
-    clippy::blanket_clippy_restriction_lints,
-    clippy::mod_module_files,
-    clippy::self_named_module_files,
-
-    clippy::implicit_return,
-    clippy::shadow_reuse,
-    clippy::shadow_unrelated,
-    clippy::match_ref_pats,
-    clippy::separated_literal_suffix,
-
-    // Would like to turn on (Configured to 50?)
-    clippy::too_many_lines,
-    clippy::question_mark_used,
-    clippy::single_call_fn,
-    clippy::absolute_paths,
-    clippy::min_ident_chars
-)]
-
 //! A [`CodeRunner`] adapter that executes a Python operation body in an
 //! embedded `CPython` interpreter, exposing `api`/`workflow`/`action`/`task`
 //! bindings the script can use to interact with the engine.
@@ -27,10 +7,7 @@ mod constants;
 mod converters;
 pub mod error;
 
-extern crate alloc;
-use alloc::sync::Arc;
-
-use std::sync::RwLock;
+use std::sync::{Arc, RwLock};
 
 use common_data_structures::log_writer::LogWriter;
 use execution_engine::services::CodeRunner;
diff --git a/runners/user_input/Cargo.toml b/runners/user_input/Cargo.toml
index f89eca7..2490abc 100644
--- a/runners/user_input/Cargo.toml
+++ b/runners/user_input/Cargo.toml
@@ -11,3 +11,6 @@ serde_json = { workspace = true }
 execution_engine = { path = "../../usecases/execution_engine" }
 
 thiserror = { workspace = true }
+
+[lints]
+workspace = true
diff --git a/runners/user_input/src/error.rs b/runners/user_input/src/error.rs
index cafc993..90bcc8f 100644
--- a/runners/user_input/src/error.rs
+++ b/runners/user_input/src/error.rs
@@ -1,5 +1,3 @@
-#![allow(clippy::std_instead_of_core)]
-
 //! Errors produced while waiting on a [`UserInput`](crate::UserInput)
 //! prompt.
 
diff --git a/runners/user_input/src/lib.rs b/runners/user_input/src/lib.rs
index 81ce5f1..a69c8ba 100644
--- a/runners/user_input/src/lib.rs
+++ b/runners/user_input/src/lib.rs
@@ -1,38 +1,15 @@
-#![warn(clippy::restriction, clippy::pedantic)]
-#![allow(
-    clippy::blanket_clippy_restriction_lints,
-    clippy::mod_module_files,
-    clippy::self_named_module_files,
-
-    clippy::implicit_return,
-    clippy::shadow_reuse,
-    clippy::match_ref_pats,
-
-    // Would like to turn on (Configured to 50?)
-    clippy::too_many_lines,
-    clippy::question_mark_used,
-    clippy::needless_borrowed_reference,
-    clippy::absolute_paths,
-    clippy::ref_patterns,
-    clippy::single_call_fn,
-    clippy::min_ident_chars,
-)]
-
 //! An [`InputPrompter`] adapter that pauses a running workflow and waits for
 //! an external caller to supply the answer.
 
 pub mod error;
 
-extern crate alloc;
-use alloc::sync::Arc;
-use core::time::Duration;
-
 use std::{
     collections::HashMap,
     sync::{
         mpsc::{self, Sender},
-        Mutex,
+        Arc, Mutex,
     },
+    time::Duration,
 };
 
 use execution_engine::services::InputPrompter;
diff --git a/runners/workflow_runner/Cargo.toml b/runners/workflow_runner/Cargo.toml
index 24484c7..13052e2 100644
--- a/runners/workflow_runner/Cargo.toml
+++ b/runners/workflow_runner/Cargo.toml
@@ -22,3 +22,6 @@ common_data_structures = { path = "../../common/data_structures" }
 tempfile = "3"
 credential_entities = { path = "../../entities/credentials" }
 protobuf = { workspace = true }
+
+[lints]
+workspace = true
diff --git a/runners/workflow_runner/src/lib.rs b/runners/workflow_runner/src/lib.rs
index 08e02a9..a6b9635 100644
--- a/runners/workflow_runner/src/lib.rs
+++ b/runners/workflow_runner/src/lib.rs
@@ -1,20 +1,3 @@
-#![warn(clippy::restriction, clippy::pedantic)]
-#![allow(
-    clippy::blanket_clippy_restriction_lints,
-    clippy::mod_module_files,
-    clippy::self_named_module_files,
-    clippy::implicit_return,
-    clippy::shadow_reuse,
-    clippy::shadow_unrelated,
-    clippy::match_ref_pats,
-    clippy::separated_literal_suffix,
-    clippy::question_mark_used,
-    clippy::single_call_fn,
-    clippy::absolute_paths,
-    clippy::ref_patterns,
-    clippy::min_ident_chars
-)]
-
 //! Adapts `prototypes/workflow_engine::WorkflowEngine` to
 //! `execution_engine`'s async `WorkflowRunner` output port - the concrete
 //! wiring that connects the standalone prototype crate to the daemon's
diff --git a/storage/in_memory_storage/Cargo.toml b/storage/in_memory_storage/Cargo.toml
index 29beb2c..1ce3c9c 100644
--- a/storage/in_memory_storage/Cargo.toml
+++ b/storage/in_memory_storage/Cargo.toml
@@ -19,3 +19,6 @@ credential_entities = { path = "../../entities/credentials" }
 
 regex = { workspace = true }
 thiserror = { workspace = true }
+
+[lints]
+workspace = true
diff --git a/storage/in_memory_storage/src/error.rs b/storage/in_memory_storage/src/error.rs
index 296374f..c9dae05 100644
--- a/storage/in_memory_storage/src/error.rs
+++ b/storage/in_memory_storage/src/error.rs
@@ -1,5 +1,3 @@
-#![allow(clippy::std_instead_of_core)]
-
 //! Errors produced by an [`OperationRepos`](crate::OperationRepos)
 //! repository.
 
diff --git a/storage/in_memory_storage/src/lib.rs b/storage/in_memory_storage/src/lib.rs
index 9696c5d..537cbfe 100644
--- a/storage/in_memory_storage/src/lib.rs
+++ b/storage/in_memory_storage/src/lib.rs
@@ -1,22 +1,3 @@
-#![warn(clippy::restriction, clippy::pedantic)]
-#![allow(
-    clippy::blanket_clippy_restriction_lints,
-    clippy::mod_module_files,
-    clippy::self_named_module_files,
-
-    clippy::implicit_return,
-    clippy::shadow_reuse,
-    clippy::match_ref_pats,
-
-    // Would like to turn on (Configured to 50?)
-    clippy::too_many_lines,
-    clippy::question_mark_used,
-    clippy::needless_borrowed_reference,
-    clippy::absolute_paths,
-    clippy::ref_patterns,
-    clippy::single_call_fn
-)]
-
 //! An in-memory storage adapter that backs both [`service_loader`]'s
 //! [`LoaderOutput`] (persisting loaded services/credentials) and
 //! [`execution_engine`]'s [`EngineLookup`] (resolving them again at
diff --git a/storage/in_memory_storage/src/repo.rs b/storage/in_memory_storage/src/repo.rs
index 9256eb1..9b1c2a4 100644
--- a/storage/in_memory_storage/src/repo.rs
+++ b/storage/in_memory_storage/src/repo.rs
@@ -1,9 +1,8 @@
 //! The [`Repository`] storage port and its in-memory implementation.
 
-use super::error;
+use std::collections::BTreeMap;
 
-extern crate alloc;
-use alloc::collections::BTreeMap;
+use super::error;
 
 /// A keyed store of values of type `V`.
 pub trait Repository<V> {
@@ -52,10 +51,7 @@ impl<V> Default for InMemoryRepository<V> {
 impl<V: Clone> Repository<V> for InMemoryRepository<V> {
     #[inline]
     fn list(&self) -> Vec<String> {
-        self.storage
-            .keys()
-            .map(alloc::borrow::ToOwned::to_owned)
-            .collect()
+        self.storage.keys().cloned().collect()
     }
 
     #[inline]
diff --git a/storage/local_file_loader/Cargo.toml b/storage/local_file_loader/Cargo.toml
index f02ae82..11b57d6 100644
--- a/storage/local_file_loader/Cargo.toml
+++ b/storage/local_file_loader/Cargo.toml
@@ -10,3 +10,6 @@ service_loader = { path = "../../usecases/service_loader" }
 service_writer = { path = "../../usecases/service_writer" }
 
 thiserror = { workspace = true }
+
+[lints]
+workspace = true
diff --git a/storage/local_file_loader/src/lib.rs b/storage/local_file_loader/src/lib.rs
index 2e0ee1f..b165cdd 100644
--- a/storage/local_file_loader/src/lib.rs
+++ b/storage/local_file_loader/src/lib.rs
@@ -1,18 +1,3 @@
-#![warn(clippy::restriction, clippy::pedantic)]
-#![allow(
-    clippy::blanket_clippy_restriction_lints,
-    clippy::mod_module_files,
-    clippy::self_named_module_files,
-
-    clippy::implicit_return,
-    clippy::shadow_reuse,
-    clippy::match_ref_pats,
-
-    // Would like to turn on (Configured to 50?)
-    clippy::too_many_lines,
-    clippy::absolute_paths
-)]
-
 //! A local-filesystem adapter implementing [`service_loader`]'s [`Fetcher`]
 //! and [`service_writer`]'s [`Storage`] output ports.
 
diff --git a/usecases/execution_engine/Cargo.toml b/usecases/execution_engine/Cargo.toml
index 4f92947..cf94387 100644
--- a/usecases/execution_engine/Cargo.toml
+++ b/usecases/execution_engine/Cargo.toml
@@ -22,3 +22,6 @@ anyhow = { workspace = true }
 tempfile = "3"
 tokio = { workspace = true, features = ["macros", "rt"] }
 
+
+[lints]
+workspace = true
diff --git a/usecases/execution_engine/src/error.rs b/usecases/execution_engine/src/error.rs
index 9f2221d..a40b906 100644
--- a/usecases/execution_engine/src/error.rs
+++ b/usecases/execution_engine/src/error.rs
@@ -1,5 +1,3 @@
-#![allow(clippy::std_instead_of_core, clippy::absolute_paths)]
-
 //! Errors produced while resolving and running an operation identifier.
 
 use std::io;
diff --git a/usecases/execution_engine/src/lib.rs b/usecases/execution_engine/src/lib.rs
index 3203d2d..965850f 100644
--- a/usecases/execution_engine/src/lib.rs
+++ b/usecases/execution_engine/src/lib.rs
@@ -1,20 +1,3 @@
-#![warn(clippy::restriction, clippy::pedantic)]
-#![allow(
-    clippy::blanket_clippy_restriction_lints,
-    clippy::mod_module_files,
-    clippy::self_named_module_files,
-
-    clippy::implicit_return,
-    clippy::shadow_reuse,
-    clippy::match_ref_pats,
-
-    // Would like to turn on (Configured to 50?)
-    clippy::too_many_lines,
-    clippy::needless_borrowed_reference,
-    clippy::question_mark_used,
-    clippy::ref_patterns
-)]
-
 //! The core orchestrator: [`Engine`] resolves a `service.operation`
 //! identifier against a loaded manifest and dispatches it to the
 //! registered [`services`] output port for that manifest's type.
@@ -25,16 +8,13 @@ pub mod services;
 /// Shared constants for the engine.
 mod constants;
 
-extern crate alloc;
-use alloc::sync::Arc;
-
 use common_data_structures::log_writer::LogWriter;
 use serde_json::Value;
 use services::{
     AsyncDataConnectionRunner, CodeRunner, DataConnectionRunner, DataConnectorBundle,
     EngineInputContext, EngineLookup, FilteredRunner, InputPrompter, ScriptRunner, WorkflowRunner,
 };
-use std::collections::HashMap;
+use std::{collections::HashMap, sync::Arc};
 
 use chrono::offset::Local;
 use core_entities::service::{code_resource::Language, service_manifest_latest};
@@ -489,7 +469,10 @@ impl Engine {
     /// Returns an error if the identifier can't be parsed, the service
     /// isn't found, the manifest isn't a `Swagger` manifest, or no
     /// [`AsyncDataConnectionRunner`] is registered.
-    #[allow(clippy::type_complexity)]
+    #[allow(
+        clippy::type_complexity,
+        reason = "return type mirrors the resolved connector's own nested Result/Option shape"
+    )]
     pub fn resolve_data_connector(
         &self,
         identifier: &str,
@@ -544,7 +527,11 @@ impl Engine {
     /// # Errors
     /// Returns an error if no `CodeRunner` is registered for `lang_key`, or
     /// if the registered runner's own call fails.
-    #[allow(clippy::too_many_arguments)]
+    #[allow(
+        clippy::too_many_arguments,
+        reason = "each argument is a distinct dispatch input; see the doc comment above for why \
+                  this isn't yet unified with the sibling dispatch fn (#16)"
+    )]
     fn dispatch_code_runner(
         &self,
         identifier: &str,
diff --git a/usecases/service_loader/Cargo.toml b/usecases/service_loader/Cargo.toml
index d009783..827f078 100644
--- a/usecases/service_loader/Cargo.toml
+++ b/usecases/service_loader/Cargo.toml
@@ -21,3 +21,6 @@ core_entities = { path = "../../entities/core" }
 thiserror = { workspace = true }
 anyhow = { workspace = true }
 
+
+[lints]
+workspace = true
diff --git a/usecases/service_loader/src/error.rs b/usecases/service_loader/src/error.rs
index 5291943..5c3281d 100644
--- a/usecases/service_loader/src/error.rs
+++ b/usecases/service_loader/src/error.rs
@@ -1,5 +1,3 @@
-#![allow(clippy::std_instead_of_core)]
-
 //! Errors produced while loading a service, its credentials, or its
 //! override configuration.
 
diff --git a/usecases/service_loader/src/lib.rs b/usecases/service_loader/src/lib.rs
index 30e129a..30320ac 100644
--- a/usecases/service_loader/src/lib.rs
+++ b/usecases/service_loader/src/lib.rs
@@ -1,19 +1,3 @@
-#![warn(clippy::restriction, clippy::pedantic)]
-#![allow(
-    clippy::blanket_clippy_restriction_lints,
-    clippy::mod_module_files,
-    clippy::self_named_module_files,
-    clippy::implicit_return,
-    clippy::shadow_reuse,
-    clippy::shadow_unrelated,
-    clippy::too_many_lines,
-    clippy::question_mark_used,
-    clippy::needless_borrowed_reference,
-    clippy::absolute_paths,
-    clippy::ref_patterns,
-    clippy::single_call_fn
-)]
-
 //! Loads a service manifest (currently OpenAPI-based), its credentials, and
 //! its override configuration from a [`Fetcher`] source into a
 //! [`LoaderOutput`] sink.
@@ -213,8 +197,6 @@ impl Default for ServiceLoader {
 
 #[cfg(test)]
 mod test {
-    #![allow(clippy::restriction, clippy::pedantic)]
-
     use std::cell::RefCell;
     use std::collections::HashMap;
 
diff --git a/usecases/service_loader/src/loaders/openapi/mod.rs b/usecases/service_loader/src/loaders/openapi/mod.rs
index 9c6a165..3d30de9 100644
--- a/usecases/service_loader/src/loaders/openapi/mod.rs
+++ b/usecases/service_loader/src/loaders/openapi/mod.rs
@@ -538,8 +538,6 @@ fn handle_schema<R: io::Read>(
 
 #[cfg(test)]
 mod test {
-    #![allow(clippy::restriction, clippy::pedantic)]
-
     use core::cell::RefCell;
 
     use super::*;
diff --git a/usecases/service_loader/src/loaders/openapi/utils.rs b/usecases/service_loader/src/loaders/openapi/utils.rs
index 1cdf481..462503e 100644
--- a/usecases/service_loader/src/loaders/openapi/utils.rs
+++ b/usecases/service_loader/src/loaders/openapi/utils.rs
@@ -170,7 +170,6 @@ impl FromStr for Reference {
 
 #[cfg(test)]
 mod test {
-    #![allow(clippy::restriction, clippy::pedantic)]
     use super::*;
 
     #[test]
diff --git a/usecases/service_writer/Cargo.toml b/usecases/service_writer/Cargo.toml
index 78afd28..729173a 100644
--- a/usecases/service_writer/Cargo.toml
+++ b/usecases/service_writer/Cargo.toml
@@ -19,3 +19,6 @@ core_entities = { path = "../../entities/core" }
 thiserror = { workspace = true }
 anyhow = { workspace = true }
 
+
+[lints]
+workspace = true
diff --git a/usecases/service_writer/src/error.rs b/usecases/service_writer/src/error.rs
index 19af49f..584d5af 100644
--- a/usecases/service_writer/src/error.rs
+++ b/usecases/service_writer/src/error.rs
@@ -1,5 +1,3 @@
-#![allow(clippy::std_instead_of_core)]
-
 //! Errors produced while writing a service manifest or its credentials.
 
 use std::io;
diff --git a/usecases/service_writer/src/lib.rs b/usecases/service_writer/src/lib.rs
index 8295472..ddf49ee 100644
--- a/usecases/service_writer/src/lib.rs
+++ b/usecases/service_writer/src/lib.rs
@@ -1,20 +1,3 @@
-#![warn(clippy::restriction, clippy::pedantic)]
-#![allow(
-    clippy::blanket_clippy_restriction_lints,
-    clippy::mod_module_files,
-    clippy::self_named_module_files,
-    clippy::implicit_return,
-    clippy::shadow_reuse,
-    clippy::match_ref_pats,
-    // clippy::shadow_unrelated,
-    // clippy::too_many_lines
-    clippy::question_mark_used,
-    clippy::needless_borrowed_reference,
-    clippy::absolute_paths,
-    clippy::ref_patterns,
-    clippy::single_call_fn
-)]
-
 //! Serializes an internal [`VersionedServiceTree`]/[`Authentication`] pair
 //! back out to OpenAPI-shaped JSON/YAML and credential JSON, the inverse of
 //! `service_loader`'s `OpenAPI` loader.
@@ -330,8 +313,8 @@ fn handle_parameter(
 ) -> error::Result<()> {
     // TODO: extract into a referece based on a flag
 
-    let in_type = source.in_.enum_value().map_err(|_| {
-        error::ServiceWriter::Unimplemented("Unrecognized parameter location".into())
+    let in_type = source.in_.enum_value().map_err(|raw| {
+        error::ServiceWriter::Unimplemented(format!("Unrecognized parameter location: {raw}"))
     })?;
     sink.insert(
         "in".into(),