refactor: replace blanket clippy::restriction with a curated workspace lint policy

Cargo.toml

@@ -39,6 +39,45 @@ members = [
 	"prototypes/workflow_engine",
 ]
 
+[workspace.lints.clippy]
+# Curated per issue #1, replacing the former per-crate blanket
+# `#![warn(clippy::restriction, clippy::pedantic)]`. `restriction` is not
+# meant to be enabled wholesale (clippy's own docs say so — it contains
+# mutually contradictory lints); each restriction-tier lint below was
+# reviewed individually and either enabled or explicitly rejected with a
+# reason. `pedantic` stays fully enabled.
+pedantic = { level = "warn", priority = -1 }
+
+# Restriction-tier lints deliberately kept on:
+ref_patterns = "warn"
+map_err_ignore = "warn"
+allow_attributes_without_reason = "warn"
+
+# Not restriction-tier, but were being suppressed anyway (default-on via
+# clippy::all / clippy::pedantic) — explicitly un-suppressing:
+too_many_lines = "warn"
+match_ref_pats = "warn"
+needless_borrowed_reference = "warn"
+
+# Restriction-tier lints reviewed and deliberately left off:
+implicit_return = "allow" # bans expression-as-return-value, Rust's core idiom
+question_mark_used = "allow" # fires on every `?`; universally not recommended to enable
+shadow_reuse = "allow" # this codebase's dominant "transform in place" style
+shadow_unrelated = "allow" # same family as shadow_reuse
+shadow_same = "allow" # same family
+single_call_fn = "allow" # named single-call helpers are a deliberate readability tool here
+absolute_paths = "allow" # error.rs files intentionally fully-qualify wrapped error types
+mod_module_files = "allow" # codebase's actual, consistent convention (mod.rs for nested modules)
+self_named_module_files = "allow" # mutually exclusive with the above; moot either way
+min_ident_chars = "allow" # short loop/index identifiers are fine
+separated_literal_suffix = "allow" # pure style preference, no correctness value
+std_instead_of_core = "allow" # no crate in this workspace is #![no_std]; inapplicable
+std_instead_of_alloc = "allow" # same
+arbitrary_source_item_ordering = "allow" # would force alphabetical ordering over the
+# codebase's logical grouping (constructors before accessors, related
+# methods together) for no readability gain — reviewed and rejected
+doc_paragraphs_missing_punctuation = "allow" # low-signal nitpick, not worth the churn
+
 [workspace.dependencies]
 anyhow = "1.0"
 async-trait = "0.1"

auth/oauth_flow/Cargo.toml

@@ -18,3 +18,6 @@ credential_entities = { path = "../../entities/credentials" }
 
 thiserror = { workspace = true }
 
+
+[lints]
+workspace = true

auth/oauth_flow/src/routes/callback.rs

@@ -91,12 +91,12 @@ pub async fn route(
         oauth_config.accessTokenPath.clone()
     };
 
-    let expression = jmespath::compile(&access_token_path).map_err(|_| {
-        error::CallbackResponse::InternalError("Invalid access token path".to_string())
+    let expression = jmespath::compile(&access_token_path).map_err(|err| {
+        error::CallbackResponse::InternalError(format!("Invalid access token path: {err}"))
     })?;
 
-    let access_token = expression.search(response_body).map_err(|_| {
-        error::CallbackResponse::InternalError("Unable to find access token".to_string())
+    let access_token = expression.search(response_body).map_err(|err| {
+        error::CallbackResponse::InternalError(format!("Unable to find access token: {err}"))
     })?;
 
     {

binary/apicli/Cargo.toml

@@ -39,3 +39,6 @@ tonic-build = { workspace = true }
 dhat-heap = []
 dhat-ad-hoc = []
 
+
+[lints]
+workspace = true

binary/apicli/src/engine.rs

@@ -1,21 +1,20 @@
-#![allow(clippy::print_stdout)]
-#![allow(clippy::too_many_lines)]
-#![allow(clippy::needless_borrowed_reference)]
+#![allow(
+    clippy::print_stdout,
+    reason = "this CLI's actual output mechanism for command results"
+)]
 
 //! Handlers for every CLI subcommand: the gRPC client calls to `apid`
 //! ([`Cli`]), the local JSON-schema inference/merge helpers, and the
 //! `generate` command's template rendering.
 
-extern crate alloc;
-use alloc::sync::Arc;
 use serde::{Deserialize, Serialize};
 use tera::{Context, Tera};
 
 use std::{
     collections::HashMap,
     env, fs, io,
     path::{Path, PathBuf},
-    sync::Mutex,
+    sync::{Arc, Mutex},
 };
 
 use anyhow::{anyhow, Context as _};

binary/apicli/src/main.rs

@@ -1,22 +1,3 @@
-#![warn(clippy::restriction, clippy::pedantic)]
-#![allow(
-    clippy::blanket_clippy_restriction_lints,
-    clippy::mod_module_files,
-    clippy::self_named_module_files,
-    clippy::implicit_return,
-    clippy::shadow_reuse,
-    clippy::match_ref_pats,
-    clippy::shadow_unrelated,
-    clippy::shadow_same,
-    clippy::question_mark_used,
-    // clippy::too_many_lines
-    clippy::absolute_paths,
-    clippy::single_call_fn,
-    clippy::ref_patterns,
-
-    clippy::min_ident_chars,
-)]
-
 //! The CLI binary: a thin gRPC client to `apid`, plus local scaffolding
 //! tools for generating new service definitions and an embedded
 //! interactive-login web server.

binary/apicli/src/stub.rs

@@ -1,5 +1,3 @@
-#![allow(clippy::separated_literal_suffix)]
-
 //! Generates a sample JSON input/output payload for an operation, used by
 //! the `InputStub`/`OutputStub` CLI commands.
 

binary/apicli/src/template.rs

@@ -1,5 +1,3 @@
-#![allow(clippy::needless_borrowed_reference)]
-
 //! A hand-rolled lexer/parser for the `Generate` command's small input/
 //! output-mapping DSL:
 //!
@@ -482,7 +480,10 @@ impl FromStr for InputDescription {
 
 #[cfg(test)]
 mod test {
-    #![allow(clippy::panic_in_result_fn)]
+    #![allow(
+        clippy::panic_in_result_fn,
+        reason = "test code — unwrap/expect panics are expected on failure"
+    )]
 
     use super::*;
 

binary/apid/Cargo.toml

@@ -59,3 +59,6 @@ workflow = []
 input = []
 wrapper = []
 
+
+[lints]
+workspace = true

binary/apid/src/main.rs

@@ -1,22 +1,3 @@
-#![warn(clippy::restriction, clippy::pedantic)]
-#![allow(
-    clippy::blanket_clippy_restriction_lints,
-    clippy::mod_module_files,
-    clippy::self_named_module_files,
-    clippy::implicit_return,
-    clippy::shadow_reuse,
-    clippy::match_ref_pats,
-    clippy::shadow_unrelated,
-    clippy::shadow_same,
-    // clippy::too_many_lines
-    clippy::question_mark_used,
-    clippy::absolute_paths,
-    clippy::single_call_fn,
-    clippy::ref_patterns,
-
-    clippy::min_ident_chars,
-)]
-
 //! The daemon binary: a `tonic` gRPC server that wires concrete adapters
 //! into an [`execution_engine::Engine`] and exposes it as the [`Engine`]
 //! service, the composition root of the whole workspace.
@@ -26,8 +7,6 @@ mod constants;
 mod util;
 mod workers;
 
-extern crate alloc;
-use alloc::sync::Arc;
 use config::Configuration;
 
 use std::{
@@ -36,7 +15,7 @@ use std::{
     fs::{self, File},
     panic,
     path::PathBuf,
-    sync::{mpsc::Sender, Mutex, PoisonError, RwLock},
+    sync::{mpsc::Sender, Arc, Mutex, PoisonError, RwLock},
 };
 
 use anyhow::{anyhow, Context};

binary/apid/src/workers/loader.rs

@@ -1,15 +1,12 @@
 //! The background thread that (re)loads changed services into the shared
 //! repositories, signalled by [`super::watcher`].
 
-extern crate alloc;
-use alloc::sync::Arc;
-
 use std::{
     collections::HashMap,
     path::PathBuf,
     sync::{
         mpsc::{Receiver, Sender},
-        Mutex, PoisonError,
+        Arc, Mutex, PoisonError,
     },
     thread::{self, JoinHandle},
 };

binary/apid/src/workers/mod.rs

@@ -4,13 +4,10 @@
 mod loader;
 mod watcher;
 
-extern crate alloc;
-use alloc::sync::Arc;
-
 use std::{
     collections::HashMap,
     path::PathBuf,
-    sync::{mpsc, Mutex},
+    sync::{mpsc, Arc, Mutex},
     thread::JoinHandle,
 };
 

binary/apid/src/workers/watcher.rs

@@ -1,18 +1,15 @@
 //! The background thread that polls loaded services' directories for
 //! filesystem changes and reports them to [`super::loader`].
 
-extern crate alloc;
-use alloc::sync::Arc;
-
-use core::time::Duration;
 use std::{
     collections::{HashMap, HashSet},
     path::PathBuf,
     sync::{
         mpsc::{self, Receiver, Sender},
-        Mutex, PoisonError,
+        Arc, Mutex, PoisonError,
     },
     thread::{self, JoinHandle},
+    time::Duration,
 };
 
 use notify::Watcher;

common/data_structures/Cargo.toml

@@ -9,3 +9,6 @@ edition = "2021"
 
 [dev-dependencies]
 tempfile = "3"
+
+[lints]
+workspace = true

common/data_structures/src/lib.rs

@@ -1,18 +1,3 @@
-#![warn(clippy::restriction, clippy::pedantic)]
-#![allow(
-    clippy::blanket_clippy_restriction_lints,
-    clippy::mod_module_files,
-    clippy::self_named_module_files,
-
-    clippy::implicit_return,
-    clippy::shadow_reuse,
-    clippy::shadow_unrelated,
-    clippy::match_ref_pats,
-
-    // Would like to turn on (Configured to 50?)
-    clippy::too_many_lines
-)]
-
 //! Small, dependency-free data structures shared across the workspace.
 //!
 //! A byte-wise, wildcard-aware [`trie`](trie::Trie), and a background-thread

common/data_structures/src/trie.rs

@@ -1,4 +1,7 @@
-#![allow(clippy::arithmetic_side_effects)]
+#![allow(
+    clippy::arithmetic_side_effects,
+    reason = "byte-index arithmetic for wildcard matching, bounds-checked by the slice ops around it"
+)]
 
 //! A byte-wise trie for wildcard-aware string-key lookups — e.g. matching a
 //! concrete key like `"application/json"` against a registered pattern like

prototypes/workflow_engine/Cargo.toml

@@ -12,3 +12,6 @@ serde_json = { workspace = true }
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["test-util", "macros"] }
+
+[lints]
+workspace = true

runners/api_caller/Cargo.toml

@@ -27,3 +27,6 @@ async-trait = { workspace = true }
 tempfile = "3"
 protobuf = { workspace = true }
 tokio = { workspace = true, features = ["macros", "rt"] }
+
+[lints]
+workspace = true

runners/api_caller/src/error.rs

@@ -1,5 +1,3 @@
-#![allow(clippy::std_instead_of_core)]
-
 //! Errors produced while making an API call.
 
 use std::{io, num::TryFromIntError};

runners/api_caller/src/lib.rs

@@ -1,25 +1,9 @@
-#![warn(clippy::restriction, clippy::pedantic)]
 #![allow(
-    clippy::blanket_clippy_restriction_lints,
-    clippy::mod_module_files,
-    clippy::self_named_module_files,
-
-    clippy::implicit_return,
-    clippy::shadow_reuse,
-    clippy::shadow_unrelated,
-    clippy::match_ref_pats,
-    clippy::separated_literal_suffix,
-
     clippy::as_conversions,
     clippy::cast_possible_truncation,
-
-    // Would like to turn on (Configured to 50?)
-    clippy::too_many_lines,
-    clippy::needless_borrowed_reference,
-    clippy::separated_literal_suffix,
-    clippy::question_mark_used,
-    clippy::absolute_paths,
-    clippy::ref_patterns,
+    reason = "pagination limit/offset casts between i32/usize/u64 are unaudited; \
+              tracked as a dedicated numeric-safety follow-up to issue #1, not \
+              rushed into this lint-hygiene pass"
 )]
 
 //! A [`DataConnectionRunner`] adapter that resolves an operation's request
@@ -29,8 +13,6 @@
 mod constants;
 pub mod error;
 
-extern crate alloc;
-
 use std::collections::HashMap;
 
 use base64::Engine as _;
@@ -492,10 +474,9 @@ impl APICallState {
         creds: Option<&Authentication>,
     ) -> error::Result<()> {
         let defined_auth = &manifest.auth;
-        let auth_type = defined_auth
-            .type_
-            .enum_value()
-            .map_err(|_| error::APICaller::Unimplemented("Unrecognized auth type".into()))?;
+        let auth_type = defined_auth.type_.enum_value().map_err(|raw| {
+            error::APICaller::Unimplemented(format!("Unrecognized auth type: {raw}"))
+        })?;
         match auth_type {
             core_entities::service::swagger_service::service_auth::Type::HEADER => {
                 let key = defined_auth
@@ -1102,11 +1083,13 @@ impl AsyncDataConnectionRunner for AsyncAPICaller {
 
 #[cfg(test)]
 mod tests {
-    use alloc::sync::Arc;
     use std::{
         io::{BufRead, BufReader, Write},
         net::TcpListener,
-        sync::atomic::{AtomicUsize, Ordering},
+        sync::{
+            atomic::{AtomicUsize, Ordering},
+            Arc,
+        },
         thread,
     };
 

runners/filtered_runner/Cargo.toml

@@ -18,3 +18,6 @@ core_entities = { path = "../../entities/core" }
 credential_entities = { path = "../../entities/credentials" }
 common_data_structures = { path = "../../common/data_structures" }
 
+
+[lints]
+workspace = true

runners/filtered_runner/src/error.rs

@@ -1,5 +1,3 @@
-#![allow(clippy::std_instead_of_core)]
-
 //! Errors produced while resolving an [`APIWrapper`](crate::APIWrapper)
 //! call.