S206: root docs + wateringHole handoff — align all hubs to S206/7,841 tests

Made-with: Cursor

Author: westgate

CONTEXT.md

@@ -29,12 +29,14 @@ ToadStool is the **Layer 0** hardware substrate that other primals and springs d
   - Override: `TOADSTOOL_SOCKET` / `TOADSTOOL_TARPC_SOCKET` env vars
   - Family: `compute-{family_id}.sock` / `compute-{family_id}-tarpc.sock`
 - **Peer primals**: Resolved at runtime via capability IDs and Unix-socket discovery (e.g. `capability.discover`, `resolve_capability_socket_fallback`) — not hardcoded URLs or legacy per-primal env manifests.
-- **Tests**: 20,000+ (7,832 lib-only S204, 0 failures, unlimited parallelism)
-- **Unsafe**: 49 blocks (all in hw-safe/GPU/VFIO/display/plugin containment, all SAFETY-documented); workspace `unsafe_code = "deny"`, 41 crates `forbid` + 5 hw crates with narrow `#[allow(unsafe_code, reason)]`
+- **Tests**: 20,000+ (7,841 lib-only S206, 0 failures, unlimited parallelism)
+- **Unsafe**: 49 blocks (all in hw-safe/GPU/VFIO/display/plugin containment, all SAFETY-documented); workspace `unsafe_code = "deny"`, 41 crates `forbid` + 5 hw crates with narrow `#[allow(unsafe_code, reason)]`; all ~40 production `#[allow]` have `reason =` (S206)
 - **async-trait**: DEPRECATED — fully removed and banned in `deny.toml` (S203r); transitive only via axum/config/wiggle
 - **deny.toml**: `ring` + `async-trait` + `zstd-sys` bans active (ecoBin v3 compliant)
 - **Display Phase 2**: `display.present`, `display.subscribe_input`, `display.poll_events` (petalTongue IPC)
+- **Encrypted compute dispatch** (Phase 55): Tower `crypto.encrypt`/`crypto.decrypt` for payloads; `DISCOVERY_SOCKET` highest-precedence capability resolution
 - **BTSP**: 13/13 converged — JSON-line relay + NDJSON post-handshake (primalSpring Phase 45c)
+- **Dep hygiene**: `test-mocks` off by default (S206); all workspace deps unified
 - **Monitoring**: Real host queries via `toadstool_sysmon` + `rustix::fs::statvfs`
 - **Config**: All `TOADSTOOL_*` env vars interned to `socket_env` constants
 

DOCUMENTATION.md

@@ -1,6 +1,6 @@
 # ToadStool Documentation Hub
 
-**Last Updated**: April 2026 — S204
+**Last Updated**: April 2026 — S206
 
 ---
 
@@ -30,11 +30,11 @@ These root documents were **fully resolved** and **fossilized** in wateringHole
 
 ---
 
-## Current State (S204 — April 2026)
+## Current State (S206 — April 2026)
 
 **Post-budding, dependency-sovereign, IPC-first, fully concurrent, capability-based.** barraCuda is a separate primal at `ecoPrimals/barraCuda/`. ToadStool is the hardware infrastructure layer — GPU/NPU/CPU discovery, capability probing, workload orchestration, and shader dispatch.
 
-- **20,000+ tests** (7,832 lib-only S204), 0 failures, 0 clippy warnings, 0 fmt diffs. Full workspace concurrent test suite.
+- **20,000+ tests** (7,841 lib-only S206), 0 failures, 0 clippy warnings, 0 fmt diffs. Full workspace concurrent test suite.
 - **65 JSON-RPC methods** (incl. `compute.execute` direct route S203f). Wire Standard L3 (partial): `cost_estimates`, `operation_dependencies`. IPC compliant (`health.liveness` → `{"status":"alive"}`, `health.readiness` → ready+version, `health.check` full envelope, `capabilities.list`, `identity.get`).
 - **Dual-socket IPC** — `compute.sock` (JSON-RPC primary, biomeOS routes here) + `compute-tarpc.sock` (tarpc hot-path). Override: `TOADSTOOL_SOCKET` / `TOADSTOOL_TARPC_SOCKET`. Family: `compute-{fid}.sock` / `compute-{fid}-tarpc.sock`.
 - **Pipeline dispatch** — `compute.dispatch.pipeline.submit` + `.status` for ordered multi-stage workloads (DAG, topological sort, result forwarding). Resolves neuralSpring PG-05.
@@ -44,7 +44,9 @@ These root documents were **fully resolved** and **fossilized** in wateringHole
 - **BTSP Phase 2 + JSON-line relay (S176)** — Handshake enforced on every UDS accept path; auto-detects plain-text clients (primalSpring) and degrades gracefully. JSON-line BTSP auto-detection on `0x7B` path routes `"protocol":"btsp"` to `relay_json_line_handshake()` (4-step BearDog IPC relay). Family seed loading via `load_family_seed_for_btsp()` (env→file cascade).
 - **async-trait DEPRECATED** (S203r) — fully removed and banned in `deny.toml`. All ~91 annotations evolved to manual `Pin<Box<dyn Future>>` (dyn-dispatched) or native AFIT (non-dyn), and subsequently enum dispatch + RPITIT (S203s). Zero runtime behavior change. Transitive only via axum/config/wiggle.
 - **`deny.toml` ring ban active** — ecoBin v3 compliant. `ring` absent from lockfile.
-- **49 unsafe blocks (all in hw-safe/GPU/VFIO/display/plugin containment crates)**; all SAFETY-documented (S204: ffi\_loader.rs gap closed). Workspace `unsafe_code = "deny"`, **41 crates `forbid`** + 5 hw crates with narrow `#[allow]`.
+- **49 unsafe blocks (all in hw-safe/GPU/VFIO/display/plugin containment crates)**; all SAFETY-documented (S204: ffi\_loader.rs gap closed). Workspace `unsafe_code = "deny"`, **41 crates `forbid`** + 5 hw crates with narrow `#[allow(unsafe_code, reason)]`. All ~40 production `#[allow]` have `reason =` (S206).
+- **Encrypted compute dispatch (S205)** — payloads encrypted via Tower `crypto.encrypt` before dispatch, decrypted on result return. `DISCOVERY_SOCKET` wired as highest-precedence capability resolution tier.
+- **Dep hygiene (S206)** — `humantime-serde`, `rand`, `tokio-util`, `temp-env` unified to workspace. GPU `spirv`/`jit`/`testing` stale features removed. `test-mocks` removed from core default features.
 - **Edge discovery evolved (S203m)** — USB via `/sys/bus/usb/devices/`, Bluetooth via sysfs adapter enumeration, IPv6 via `/proc/net/if_inet6`. All gracefully degrade on non-Linux.
 - **Scheduler queuing (S203m)** — `schedule_job` → `UniversalJobQueue::add_job` inserts into per-priority queues (was metadata-only). `schedule_local_job` logs post-enqueue telemetry.
 - **Hardcoding sweep (S203m–p)** — sysfs/procfs paths centralized to `platform_paths`; all `TOADSTOOL_*` env var literals interned to `socket_env` constants (~55 new in S203p). `env_overrides` subsystem fully converted.

docs/README.md

@@ -1,6 +1,6 @@
 # ToadStool Documentation
 
-**Updated**: April 2026 — S204
+**Updated**: April 2026 — S206
 
 Primary documentation lives at the repository root. See [../DOCUMENTATION.md](../DOCUMENTATION.md) for the navigation hub. Session trackers archived to `ecoPrimals/infra/wateringHole/fossilRecord/toadstool/`.
 

docs/guides/TESTING.md

@@ -1,13 +1,14 @@
 # Testing Guide
 
-**Last Updated**: April 12, 2026 — S203c
+**Last Updated**: April 28, 2026 — S206
 
 ## Quick Status
 
 | Metric | Status | Details |
 |--------|--------|---------|
-| **Workspace Tests** | **21,853 (default features, S203c)** | 0 failures, 220 intentional GPU ignores |
-| **Line Coverage** | **~80% (lib-only)** | ~185K production lines. Gap: hardware-dependent code (V4L2/VFIO/neuromorphic) |
+| **Lib-Only Tests** | **7,841 (S206)** | 0 failures, unlimited parallelism |
+| **Workspace Tests** | **20,000+ (default features)** | ~93 intentional GPU/hardware ignores |
+| **Line Coverage** | **~83.6% (lib-only)** | ~185K production lines. Gap: hardware-dependent code (V4L2/VFIO/neuromorphic) |
 | **Clippy Pedantic** | **0 warnings** | Full workspace (`-D warnings`), in CI |
 | **BarraCuda Tests** | Separate primal | Budded to `ecoPrimals/barraCuda/` (S93) |
 

docs/reference/PRODUCTION_DEPLOYMENT_GUIDE.md

@@ -42,5 +42,5 @@ echo '{"jsonrpc":"2.0","method":"health.check","id":1}' | socat - UNIX-CONNECT:$
 ### Quality Gates
 
 - `cargo clippy --workspace --all-features -- -D warnings` (0 warnings)
-- `cargo test --workspace --all-features` (21,853 tests, 0 failures)
+- `cargo test --workspace` (20,000+ workspace / 7,841 lib-only tests, 0 failures)
 - `cargo fmt --check` (clean)

infra/wateringHole/handoffs/TOADSTOOL_S206_LINT_DEP_FEATURE_CLEANUP_HANDOFF_APR28_2026.md

@@ -0,0 +1,74 @@
+# ToadStool S206 — Lint Evolution + Dep Hygiene + Feature Cleanup
+
+**Date**: April 28, 2026
+**Session**: S206
+**Scope**: Codebase-wide lint evolution, dependency unification, stale feature removal, mock default policy
+
+---
+
+## Changes
+
+### 1. Lint Evolution — All `#[allow]` with `reason =`
+
+All ~40 production bare `#[allow(...)]` evolved to `#[allow(..., reason = "...")]`:
+
+- **17 `unsafe_code` modules**: hw-safe (10: device_mmap, volatile_mmio, locked_memory, huge_page, vfio_dma, safe_mmap, vfio_setup, exclusive_ptr, aligned_alloc, contiguous), GPU (4: backend, glowplug, buffer/mod, buffer/threading), display (v4l2/ioctl), hw-learn (nouveau_drm), plugin (ffi_loader)
+- **~23 clippy/deprecated/async-fn-in-trait**: auto_config, cli (lib + lifecycle_ops + 3 template modules), client, distributed (lib + discovery/client), integration (primals, protocols, security), management (analytics, monitoring, performance), neuromorphic (akida-driver, reservoir-research lib + readout, cross-substrate-validation lib + main), runtime (adaptive, secure_enclave, wasm), security/policies
+
+### 2. Dependency Unification
+
+Added to `[workspace.dependencies]` and unified across 20+ crate Cargo.toml files:
+
+| Dep | Crates Unified |
+|-----|---------------|
+| `humantime-serde` | common, toadstool, distributed (3) |
+| `rand` | distributed, reservoir-research, testing (3) |
+| `tokio-util` | distributed, client, server (3) |
+| `temp-env` | 13 crates (all dev-deps) |
+
+### 3. Stale Feature Removal
+
+**GPU crate** (`toadstool-runtime-gpu`):
+- Removed features: `spirv`, `jit`, `testing` (none referenced in `cfg` source)
+- Removed optional deps: `spirv`, `cranelift-jit`, `wasmtime`
+
+**Testing crate** (`toadstool-testing`):
+- Removed features: `integration-tests`, `benchmarks` (none referenced in source)
+- Removed optional dep: `wiremock`
+
+### 4. Mock Default Policy
+
+- `test-mocks` removed from `toadstool` core `default` features
+- Production builds no longer compile `InMemoryAuthBackend` / `InMemoryAgentBackend`
+- `toadstool-testing` explicitly enables via `features = ["test-mocks"]`
+
+---
+
+## Files Changed (60)
+
+- `Cargo.toml` (root): added `humantime-serde`, `temp-env` to workspace deps
+- 20+ `crates/*/Cargo.toml`: unified dep versions
+- 17 `unsafe_code` module files: `reason =` added
+- ~23 clippy/deprecated allow files: `reason =` added
+- `DEBT.md`, `NEXT_STEPS.md`, `README.md`: S206 documentation
+
+## Tests
+
+- **7,841 lib-only**, 0 failures, clippy clean (`-D warnings`), fmt clean
+- No test count change — all existing tests pass unchanged
+
+## For primalSpring / guideStone
+
+- No wire protocol changes
+- No IPC surface changes
+- `test-mocks` feature must be explicitly requested if needed (no longer default)
+- Workspace dep versions unchanged (only source of version truth moved to root)
+
+---
+
+## Next Evolution
+
+- Coverage push 83.6% → 90% (hardware mocks for V4L2/VFIO)
+- `crypto_integration` migration (replace deprecated `SecurityClient` direct calls)
+- Primal self-registration with Songbird (`ipc.register`)
+- Pipeline encryption (extend dispatch encryption to pipeline submit)

specs/README.md

@@ -115,9 +115,9 @@ toadStool picks the row. coralReef compiles for it. Springs never see the table.
 | Test coverage | Target 90%, current ~83.6% (llvm-cov) | D-COV |
 | Mocks in production | 0 (all `#[cfg(test)]` gated) | ✅ |
 
-### Key Numbers (S203i)
+### Key Numbers (S206)
 
-- **21,600+ tests** (0 failures), **~69 JSON-RPC methods**
+- **20,000+ workspace / 7,841 lib-only** tests (0 failures), **~65 JSON-RPC methods**
 - **3 hardware transports** — Display (DRM), Capture (V4L2), Serial
 - **VFIO interface** — BAR0, DMA, power management (nvpmu)
 - **NPU dispatch** — Akida AKD1000/1500 (kernel, VFIO, userspace)