Add production-ready Rust coordinator migration path

.githooks/pre-commit

@@ -29,6 +29,23 @@ if [ -n "$GO_FILES" ]; then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# Rust — rustfmt if Rust coordinator files are staged
+# ---------------------------------------------------------------------------
+RUST_FILES=$(git diff --cached --name-only --diff-filter=ACM -- 'coordinator-rs/**' 'rust-toolchain.toml')
+
+if [ -n "$RUST_FILES" ]; then
+    echo ">> Checking Rust formatting (cargo fmt)..."
+    if ! (cd coordinator-rs && cargo fmt --all -- --check); then
+        echo ""
+        echo "ERROR: Rust coordinator files need formatting."
+        echo ""
+        echo "Fix with:  cd coordinator-rs && cargo fmt --all"
+        echo ""
+        FAILED=1
+    fi
+fi
+
 # ---------------------------------------------------------------------------
 # TypeScript — next lint in console-ui/ if any .ts/.tsx files are staged
 # ---------------------------------------------------------------------------

.githooks/pre-push

@@ -32,6 +32,7 @@ fi
 CHANGED_FILES=$(git diff --name-only "$RANGE" 2>/dev/null || git diff --name-only HEAD~1)
 
 HAS_GO=$(echo "$CHANGED_FILES" | grep -q '^coordinator/' && echo 1 || echo 0)
+HAS_RUST=$(echo "$CHANGED_FILES" | grep -Eq '^(coordinator-rs/|rust-toolchain.toml$)' && echo 1 || echo 0)
 HAS_TS=$(echo "$CHANGED_FILES" | grep -q '^console-ui/' && echo 1 || echo 0)
 
 # ---------------------------------------------------------------------------
@@ -56,6 +57,29 @@ if [ "$HAS_GO" = "1" ]; then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# Rust — formatting + lint + tests
+# ---------------------------------------------------------------------------
+if [ "$HAS_RUST" = "1" ]; then
+    echo ">> [pre-push] Rust formatting check..."
+    if ! (cd coordinator-rs && cargo fmt --all -- --check); then
+        echo "ERROR: Rust formatting failed. Fix with: cd coordinator-rs && cargo fmt --all"
+        FAILED=1
+    fi
+
+    echo ">> [pre-push] Rust Clippy..."
+    if ! (cd coordinator-rs && cargo clippy --workspace --all-targets --all-features --locked -- -D warnings); then
+        echo "ERROR: Rust Clippy failed."
+        FAILED=1
+    fi
+
+    echo ">> [pre-push] Rust tests..."
+    if ! (cd coordinator-rs && cargo test --workspace --all-features --locked); then
+        echo "ERROR: Rust tests failed."
+        FAILED=1
+    fi
+fi
+
 # ---------------------------------------------------------------------------
 # TypeScript — lint + build
 # ---------------------------------------------------------------------------

.github/dependabot.yml

@@ -1,6 +1,31 @@
 version: 2
 updates:
 
+  - package-ecosystem: "cargo"
+    directory: "/coordinator-rs"
+    schedule:
+      interval: "daily"
+      time: "08:00"
+      timezone: "America/Los_Angeles"
+    target-branch: "master"
+    commit-message:
+      prefix: "[rust-version]"
+      include: "scope"
+    pull-request-branch-name:
+      separator: "-"
+    open-pull-requests-limit: 8
+    labels:
+      - "version"
+      - "rust"
+    groups:
+      rust-version-updates:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
   - package-ecosystem: "gomod"
     directory: "/coordinator"
     schedule:

.github/pull_request_template.md

@@ -30,6 +30,7 @@ For UI changes, include a screenshot or short video.
 <!-- Tick all that apply so reviewers know what to look at. -->
 
 - [ ] coordinator (Go)
+- [ ] coordinator-rs (Rust replacement)
 - [ ] provider (Rust, legacy)
 - [ ] provider-swift (Swift CLI)
 - [ ] console-ui (Next.js)

.github/workflows/ci.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     services:
       postgres:
-        image: postgres:16
+        image: postgres:16@sha256:be01cf82fc7dbba824acf0a82e150b4b360f3ff93c6631d7844af431e841a95c
         env:
           POSTGRES_USER: testbed
           POSTGRES_PASSWORD: testbed
@@ -54,6 +54,142 @@ jobs:
           go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.6
           golangci-lint run
 
+  test-coordinator-rust:
+    name: Rust Coordinator Tests
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    services:
+      postgres:
+        image: postgres:16@sha256:be01cf82fc7dbba824acf0a82e150b4b360f3ff93c6631d7844af431e841a95c
+        env:
+          POSTGRES_USER: rust_coord
+          POSTGRES_PASSWORD: rust_coord
+          POSTGRES_DB: rust_coord
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U rust_coord -d rust_coord"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    env:
+      DATABASE_URL: postgres://rust_coord:rust_coord@127.0.0.1:5432/rust_coord?sslmode=disable
+      DARKBLOOM_TEST_DATABASE_URL: postgres://rust_coord:rust_coord@127.0.0.1:5432/rust_coord?sslmode=disable
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+        with:
+          go-version-file: go.mod
+      - name: Install pinned Rust toolchain
+        run: rustup toolchain install 1.97.0 --profile minimal --component rustfmt,clippy
+      - name: Fetch locked dependencies
+        working-directory: coordinator-rs
+        run: cargo fetch --locked
+      - name: Prepare PostgreSQL schema for SQLx
+        run: go run ./coordinator/cmd/migrate -database-url "$DATABASE_URL"
+      - name: Check SQLx offline metadata
+        working-directory: coordinator-rs
+        run: |
+          cargo install sqlx-cli --version 0.9.0 --no-default-features --features rustls,postgres --locked
+          cargo sqlx prepare --workspace --check -- --all-targets --all-features
+      - name: Check formatting
+        working-directory: coordinator-rs
+        run: cargo fmt --all -- --check
+      - name: Run Clippy
+        working-directory: coordinator-rs
+        run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
+      - name: Run tests
+        working-directory: coordinator-rs
+        run: cargo test --workspace --all-features --locked
+      - name: Build all targets
+        working-directory: coordinator-rs
+        run: cargo build --workspace --all-targets --all-features --locked
+      - name: Check dependency policy
+        working-directory: coordinator-rs
+        run: |
+          cargo install cargo-deny --version 0.20.2 --locked
+          cargo deny check advisories bans licenses sources
+      - name: Verify Go-to-Rust NaCl compatibility
+        run: go test ./coordinator/internal/e2e -run '^TestCrossLanguageEncryption$' -count=1
+
+  test-coordinator-rust-faults:
+    name: Rust Coordinator Fault Recovery
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    services:
+      postgres:
+        image: postgres:16@sha256:be01cf82fc7dbba824acf0a82e150b4b360f3ff93c6631d7844af431e841a95c
+        env:
+          POSTGRES_USER: rust_coord
+          POSTGRES_PASSWORD: rust_coord
+          POSTGRES_DB: rust_coord
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U rust_coord -d rust_coord"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    env:
+      DATABASE_URL: postgres://rust_coord:rust_coord@127.0.0.1:5432/rust_coord?sslmode=disable
+      DARKBLOOM_TEST_DATABASE_URL: postgres://rust_coord:rust_coord@127.0.0.1:5432/rust_coord?sslmode=disable
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+        with:
+          go-version-file: go.mod
+      - name: Install pinned Rust toolchain
+        run: rustup toolchain install 1.97.0 --profile minimal
+      - name: Prepare PostgreSQL schema
+        run: go run ./coordinator/cmd/migrate -database-url "$DATABASE_URL"
+      - name: Verify fault workflow command parity
+        run: python3 -m unittest scripts.tests.test_fault_workflow_parity
+      - name: Validate deterministic fault matrix and recovery
+        run: |
+          umask 077
+          openssl genpkey -algorithm EC \
+            -pkeyopt ec_paramgen_curve:P-256 \
+            -out /tmp/fault-matrix-test.pem
+          openssl pkey -in /tmp/fault-matrix-test.pem -pubout \
+            -out /tmp/fault-matrix-test.pub.pem
+          scripts/run-fault-matrix.sh \
+            --output artifacts/fault-matrix.json \
+            --signing-key /tmp/fault-matrix-test.pem \
+            --trusted-key /tmp/fault-matrix-test.pub.pem
+
+  test-deployment-image:
+    name: Deployment Image & Shell Tests
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Validate shell syntax and behavior
+        run: |
+          git ls-files 'coordinator/deploy/*.sh' 'deploy/gcp/*.sh' 'deploy/gcp/tests/*.sh' |
+            xargs -r -n1 bash -n
+          deploy/gcp/tests/run.sh
+      - name: Run ShellCheck
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y shellcheck
+          git ls-files 'coordinator/deploy/*.sh' 'deploy/gcp/*.sh' 'deploy/gcp/tests/*.sh' |
+            xargs -r shellcheck -e SC1090,SC1091,SC2317
+      - name: Parse deployment and workflow YAML
+        run: |
+          ruby -e 'require "yaml"; ARGV.each { |path| YAML.parse_file(path) }' \
+            deploy/gcp/cloudbuild.yaml deploy/gcp/cloudbuild-prod.yaml \
+            .github/workflows/*.yml
+      - name: Build reproducible dual coordinator image
+        run: |
+          docker build \
+            --file coordinator/Dockerfile \
+            --build-arg BUILD_VERSION="${GITHUB_SHA::12}" \
+            --build-arg BUILD_COMMIT="$GITHUB_SHA" \
+            --tag darkbloom/coordinator:ci \
+            .
+      - name: Validate image layout and versions
+        run: |
+          docker run --rm \
+            --entrypoint /usr/local/bin/coordinator-image-check \
+            darkbloom/coordinator:ci smoke
+
   test-provider:
     name: Provider Tests
     runs-on: blacksmith-12vcpu-macos-latest