S209: deep debt — lint reason attrs + dep unification + auth capability evolution

Phase 1 — Lint evolution: all remaining crate-level #![allow] attrs given
reason= (7 crates: specialty embedded, akida-models, native, testing).
~30 production #[expect(deprecated)]/#[allow(deprecated)] upgraded with
reason= across config, auth, ecosystem, storage, GPU backends, and CLI.
3 test #[allow(clippy::float_cmp)] in server/mocks converted to reason=.

Phase 2 — Workspace dep unification: sha2 (5 crates), serde_json (4),
tracing-subscriber (4), tokio-test (10), tracing+thiserror (edge) all
converted from pinned versions to { workspace = true } in 23 Cargo.toml.

Phase 3 — Stale feature cleanup: removed unused ai-ml and
squirrel-preparation placeholder features from excluded runtime/python.

Phase 4 — Auth backend capability evolution: hardcoded
well_known::BEARDOG issuer fallback replaced with capabilities::CRYPTO.
Auth backend no longer imports or references any specific primal name.
Unfulfilled #![expect(deprecated)] removed. Test fixtures updated.

7,842 lib-only tests, 0 failures, clippy clean (-D warnings), fmt clean.

Made-with: Cursor

Author: westgate

DEBT.md

@@ -1,13 +1,25 @@
 # Active Technical Debt Register
 
-**Date**: April 2026 — S208
+**Date**: April 2026 — S209
 **Philosophy**: Math is universal, precision is silicon. Workarounds are
 short-term solutions that increase debt. We aim to solve deep debt over
 iterations, evolving toward vendor-agnostic, capability-based solutions—
 with production stubs surfacing typed configuration errors and capability
 guidance, and auth policy driven by explicit environment configuration
 where applicable.
 
+**S209 (Deep Debt — Lint Reason + Dep Unification + Auth Capability)**:
+Completed comprehensive lint evolution: all remaining crate-level `#![allow]`
+attrs evolved to include `reason =` (7 embedded/neuromorphic/native/testing
+crates). ~30 production `#[expect(deprecated)]` / `#[allow(deprecated)]`
+attrs upgraded with `reason =`. Workspace dependency unification: `sha2`,
+`serde_json`, `tracing`, `thiserror`, `tracing-subscriber`, `tokio-test`
+converted to `{ workspace = true }` in 23 Cargo.toml files. Auth backend
+evolved: hardcoded `well_known::BEARDOG` issuer fallback replaced with
+capability-based `capabilities::CRYPTO`. Stale feature flags removed from
+excluded `runtime/python` crate (`ai-ml`, `squirrel-preparation`).
+**7,842 lib-only** tests, 0 failures, clippy clean, fmt clean.
+
 **S208 (Deep Debt — Unsafe Allow + Feature Hygiene + Expect→Result)**:
 Resolved **D-GLOWPLUG-ALLOW** (removed unnecessary `#[allow(unsafe_code)]`
 from `glowplug/mod.rs` — module contains no unsafe code),

NEXT_STEPS.md

@@ -1,8 +1,8 @@
 # ToadStool -- Next Steps
 
-**Updated**: April 2026 — S208 (Deep Debt — Unsafe Allow + Feature Hygiene + Expect→Result)
-**Status**: Production-grade | Rust edition **2024** (MSRV 1.85) | **AGPL-3.0-or-later** | **All quality gates green** | **7,842 lib-only** tests verified (20,000+ workspace, 0 failures) | **~65 JSON-RPC methods** | Wire Standard L3 (partial) | Zero C FFI deps (ecoBin v3.0) | **Zero production panics/expects** | IPC-first | workspace `unsafe_code = "deny"`, **41 crates `forbid`** | **49 unsafe blocks** (all in hw containment, all SAFETY-documented) | **0 production TODOs** | **rustix 1.x workspace-wide** | **capability-based primal references (no hardcoded names)** | **`async-trait` DEPRECATED** (banned in `deny.toml`) | **`deny.toml` ring + async-trait + zstd-sys bans active** | **env centralized via config structs** | **real Linux sandbox (rustix)** | **real resource metrics (cgroup v2/proc)** | **plugin loading (libloading)** | **binary tarpc framing (MessagePack)** | **BTSP JSON-line relay (Phase 45c)** | **Display Phase 2 (petalTongue IPC)** | **Encrypted compute dispatch (Phase 55)** | **All lint attrs with reason (S206)** | **test-mocks off by default (S206)** | **Self-registration with Songbird (S207)**
-**Latest**: S208 — Deep Debt — Unsafe Allow + Feature Hygiene + Expect→Result: Removed unnecessary `#[allow(unsafe_code)]` from `glowplug/mod.rs`. 4 empty no-op CLI features (`ecosystem`/`universal`/`monitoring`/`templates`) removed; test modules ungated; `gpu-ai` comment corrected. `InputManager::subscribe_events` evolved from panic to `Result`. `ProtocolEngine::build_*` evolved from `expect()` to `Option::insert`. Transport handshake `expect` replaced with array indexing. Edge discovery ports 22/80/8080 extracted to `well_known_ports` constants. **7,842 lib-only** tests, 0 failures, clippy clean, fmt clean.
+**Updated**: April 2026 — S209 (Deep Debt — Lint Reason + Dep Unification + Auth Capability)
+**Status**: Production-grade | Rust edition **2024** (MSRV 1.85) | **AGPL-3.0-or-later** | **All quality gates green** | **7,842 lib-only** tests verified (20,000+ workspace, 0 failures) | **~65 JSON-RPC methods** | Wire Standard L3 (partial) | Zero C FFI deps (ecoBin v3.0) | **Zero production panics/expects** | IPC-first | workspace `unsafe_code = "deny"`, **41 crates `forbid`** | **49 unsafe blocks** (all in hw containment, all SAFETY-documented) | **0 production TODOs** | **rustix 1.x workspace-wide** | **capability-based primal references (no hardcoded names)** | **`async-trait` DEPRECATED** (banned in `deny.toml`) | **`deny.toml` ring + async-trait + zstd-sys bans active** | **env centralized via config structs** | **real Linux sandbox (rustix)** | **real resource metrics (cgroup v2/proc)** | **plugin loading (libloading)** | **binary tarpc framing (MessagePack)** | **BTSP JSON-line relay (Phase 45c)** | **Display Phase 2 (petalTongue IPC)** | **Encrypted compute dispatch (Phase 55)** | **All lint attrs with reason (S209)** | **test-mocks off by default (S206)** | **Self-registration with Songbird (S207)** | **Auth issuer capability-based (S209)**
+**Latest**: S209 — Deep Debt — Lint Reason + Dep Unification + Auth Capability: All remaining crate-level `#![allow]` attrs given `reason =` (7 crates). ~30 production `#[expect(deprecated)]`/`#[allow(deprecated)]` upgraded with `reason =`. 23 Cargo.toml files unified to workspace deps (`sha2`, `serde_json`, `tracing`, `thiserror`, `tracing-subscriber`, `tokio-test`). Auth backend: hardcoded `well_known::BEARDOG` issuer fallback → `capabilities::CRYPTO`. Stale python feature flags removed. **7,842 lib-only** tests, 0 failures, clippy clean, fmt clean.
 
 ---
 

crates/auto_config/src/hardware/gpu.rs

@@ -203,7 +203,10 @@ pub fn calculate_gpu_score(gpu_info: &[GpuInfo]) -> f64 {
 }
 
 #[cfg(test)]
-#[allow(deprecated)]
+#[allow(
+    deprecated,
+    reason = "tests exercise legacy GPU config APIs pending migration"
+)]
 mod tests {
     use super::*;
 

crates/cli/Cargo.toml

@@ -95,7 +95,7 @@ colored = "2.0"
 
 # Encoding
 base64 = { workspace = true }
-sha2 = "0.10"
+sha2 = { workspace = true }
 
 # barracuda removed S94b: nautilus methods are now proxied to barraCuda via
 # capability-based IPC (JSON-RPC over Unix socket). Zero library coupling.

crates/cli/src/commands/doctor/checks.rs

@@ -90,7 +90,10 @@ async fn check_gpu_available() -> bool {
     }
 }
 
-#[expect(deprecated)]
+#[expect(
+    deprecated,
+    reason = "health check uses legacy EcosystemService enum for status display"
+)]
 pub(crate) async fn check_ecosystem_health() -> EcosystemReport {
     let mut issues = vec![];
 

crates/cli/src/ecosystem/adapters/universal.rs

@@ -134,7 +134,10 @@ impl UniversalServiceAdapter {
 
         match protocol.as_str() {
             "jsonrpc" | "unix" => self.invoke_jsonrpc(provider, request).await,
-            #[expect(deprecated)]
+            #[expect(
+                deprecated,
+                reason = "HTTP invoke kept for legacy providers; prefer unix/jsonrpc"
+            )]
             "http" | "https" => self.invoke_http(provider, request).await,
             "grpc" => {
                 tracing::error!(

crates/cli/src/ecosystem/discovery.rs

@@ -133,7 +133,10 @@ pub fn discover_from_config(capability_category: &str) -> Option<String> {
 ///
 /// **Status**: Currently unused but part of capability-based architecture.
 /// Will be used when full capability routing is implemented.
-#[expect(deprecated)]
+#[expect(
+    deprecated,
+    reason = "bridges capability categories to legacy ServiceEndpoint types"
+)]
 pub async fn discover_service_by_capability(
     capability_category: &str,
 ) -> Result<Vec<ServiceEndpoint>> {
@@ -226,7 +229,10 @@ fn parse_service_url(url: &str) -> Result<SocketAddr> {
 ///
 /// Delegates to the production mDNS implementation in toadstool-core (uses mdns-sd).
 /// Discovery runs for 2 seconds, matching Bonjour browse behavior.
-#[expect(deprecated)]
+#[expect(
+    deprecated,
+    reason = "mDNS discovery returns legacy ServiceEndpoint types"
+)]
 async fn discover_via_mdns(capability_category: &str) -> Result<Vec<ServiceEndpoint>> {
     let mdns = match toadstool::discovery::MdnsDiscoveryService::new() {
         Ok(m) => m,

crates/cli/src/ecosystem/integrator_impl.rs

@@ -26,7 +26,7 @@ use tokio::time::timeout;
 use tracing::{info, warn};
 
 // Legacy integration layer; uses deprecated EcosystemService for ServiceConnection migration
-#[expect(deprecated)]
+#[expect(deprecated, reason = "entire impl block wraps legacy EcosystemService; callers migrating to capability-based discovery")]
 impl EcosystemIntegrator {
     /// Create a new ecosystem integrator (legacy discovery layer)
     #[must_use]

crates/client/Cargo.toml

@@ -51,7 +51,7 @@ default = []
 tarpc = ["dep:tarpc", "dep:tokio-util", "dep:bytes", "dep:toadstool-integration-protocols"]
 
 [dev-dependencies]
-tokio-test = "0.4"
+tokio-test = { workspace = true }
 temp-env = { workspace = true }
 
 [lints]

crates/core/common/src/infant_discovery/sources/service_mesh.rs

@@ -78,7 +78,10 @@ impl Default for ServiceMeshSource {
 }
 
 impl EndpointSource for ServiceMeshSource {
-    #[expect(deprecated)]
+    #[expect(
+        deprecated,
+        reason = "resolve() matches on deprecated vendor-specific mesh variants"
+    )]
     fn resolve(
         &self,
         service: &str,