Enforce public Rustdoc before release

.github/workflows/ci.yml

@@ -282,7 +282,13 @@ jobs:
         with:
           toolchain: 1.97.1
           compiler-cache: "false"
-      - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2
+      - name: Install pinned cargo-deny
+        run: |
+          if [[ "$(cargo deny --version 2>/dev/null || true)" != "cargo-deny 0.20.2" ]]; then
+            cargo install cargo-deny --version 0.20.2 --locked
+          fi
+      - name: Enforce dependency policy
+        run: cargo deny check
       - name: Record dependency telemetry
         if: always()
         uses: ./.github/actions/phase-telemetry

.github/workflows/release-builder.yml

@@ -141,7 +141,13 @@ jobs:
           AUTHS_AENEAS_BIN: ${{ github.workspace }}/target/formal-tools/bin/aeneas
           AUTHS_CHARON_BIN: ${{ github.workspace }}/target/formal-tools/bin/charon
         run: cargo xtask formal qualify aeneas
-      - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2
+      - name: Install pinned cargo-deny
+        run: |
+          if [[ "$(cargo deny --version 2>/dev/null || true)" != "cargo-deny 0.20.2" ]]; then
+            cargo install cargo-deny --version 0.20.2 --locked
+          fi
+      - name: Enforce dependency policy
+        run: cargo deny check
       - name: Generate signed SLSA provenance for exact subjects
         id: attest
         uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0

formal/qualification/aeneas/source-closure.json

@@ -1,6 +1,6 @@
 {
   "schema": "auths-proof-translation-source-closure/v2",
-  "digest": "349a21811a328f934693058f1db1c00f7a61ff965d5008d51edc3c18909acd6a",
+  "digest": "b26371ada3c58adb5999f5e15bff34df8f21a8aaf2d4b9bda15cd8d725c49eab",
   "files": [
     {
       "path": "Cargo.lock",
@@ -62,7 +62,7 @@
     },
     {
       "path": "product/policy/auths-bounded-policy/src/lib.rs",
-      "sha256": "7480d654aec562478396bf9b00d52af3e7d6ef956a8fd5d6b13deb66836fe9a3"
+      "sha256": "76a18638b810e62e594d6e951504679305ce21841388e0c282ad51cd7841b91c"
     },
     {
       "path": "product/runtime/auths-lifecycle/Cargo.toml",

product/policy/auths-bounded-policy/src/lib.rs

@@ -21,11 +21,11 @@ pub use arithmetic::{
     ArithmeticError, BasisPoints, RoundingDirection, UnitQuantity, checked_basis_points,
 };
 pub use commitment::{
-    ConfigurationCommitmentV1, ConfigurationMatch, EvaluationCommitmentsV1, PolicyCommitmentV1,
-    configuration_match,
+    CommitmentError, ConfigurationCommitmentV1, ConfigurationMatch, EvaluationCommitmentsV1,
+    PolicyCommitmentV1, configuration_match,
 };
 pub use eligibility::{
-    BoundedOutputs, EligibilityV1, ObligationClass, ObligationCommitmentV1,
+    BoundedOutputs, EligibilityV1, ObligationClass, ObligationCommitmentV1, OutputError,
     ReservationIntentCommitmentV1, ReservationKind, ValidationWork,
 };
 pub use identifier::{

release/semantic-freeze.json

@@ -1,6 +1,6 @@
 {
   "schema": "auths.semantic-freeze/1",
-  "freezeVersion": 8,
+  "freezeVersion": 11,
   "publicSurface": {
     "rustRoots": [
       "auths",
@@ -187,15 +187,15 @@
     },
     {
       "id": "auths.frozen-bytes/formal/qualification/aeneas/source-closure.json",
-      "version": 5,
+      "version": 6,
       "classification": "frozen-bytes",
       "categories": [
         "canonical-generated-evidence"
       ],
       "owners": [
         "formal/qualification/aeneas/source-closure.json"
       ],
-      "sha256": "c43a63873e89bb539affd6b0e24644b61ae9c7d62d1a5f687d4d1a118e100755"
+      "sha256": "0c3f8a472e3dda0be9a39b35b7fd0a297fe537b0bf43f84ca7b927c2101e8392"
     },
     {
       "id": "auths.frozen-bytes/product/fixtures/v1/bounded-policy/manifest.json",
@@ -492,7 +492,7 @@
     },
     {
       "id": "auths.product.bounded-policy",
-      "version": 1,
+      "version": 2,
       "classification": "frozen-meaning",
       "categories": [
         "policy-semantic-ids",
@@ -503,7 +503,7 @@
         "product/fixtures/v1/bounded-policy/registry.toml",
         "product/policy/auths-bounded-policy/src"
       ],
-      "sha256": "3c9c768053d86461db1122a3a048c8e882ecbf95c0fd0e2fa46ac5436a422bc6"
+      "sha256": "016fda0634a31edeed423a1b81220d66fe9034ef76234ef4c71db688bfbdb1d4"
     },
     {
       "id": "auths.product.configuration-commitments",
@@ -592,7 +592,7 @@
     },
     {
       "id": "auths.release.public-surface",
-      "version": 8,
+      "version": 11,
       "classification": "release-metadata",
       "categories": [
         "package-names",
@@ -659,7 +659,7 @@
         "xtask/src/release_control.rs",
         "xtask/src/semantic_freeze.rs"
       ],
-      "sha256": "23af939d2c03e962407ed0049d7ce2aee2b4bfde4fc50c60a7213f68868c5429"
+      "sha256": "6a3fc5e05f10d97a721ad899045234944d78b3647af66d66869d1683fdfe8530"
     }
   ]
 }

xtask/src/checks.rs

@@ -26,12 +26,28 @@ pub(crate) fn ci_authoritative() -> Result<(), String> {
         "-D",
         "warnings",
     ])?;
+    release_documentation()?;
     core_boundary()?;
     workspace_msrv()?;
     platform_artifact(&root().join("target/release-evidence/platform.json"))?;
     fuzz_smoke()
 }
 
+pub(crate) fn release_documentation() -> Result<(), String> {
+    let status = Command::new("cargo")
+        .args(["doc", "--workspace", "--all-features", "--no-deps"])
+        .env("RUSTDOCFLAGS", "-D warnings")
+        .current_dir(root())
+        .status()
+        .map_err(|error| format!("could not build release documentation: {error}"))?;
+    if status.success() {
+        println!("release documentation passed");
+        Ok(())
+    } else {
+        Err(format!("documentation build failed with {status}"))
+    }
+}
+
 pub(crate) fn ci_compliance() -> Result<(), String> {
     let compliance_inventory = compliance_inventory()?;
     abi()?;

xtask/src/release.rs

@@ -144,15 +144,6 @@ pub(crate) fn release_check() -> Result<(), String> {
     ci()?;
     cargo(&["test", "--workspace", "--no-default-features"])?;
     wire(false)?;
-    let status = Command::new("cargo")
-        .args(["doc", "--workspace", "--all-features", "--no-deps"])
-        .env("RUSTDOCFLAGS", "-D warnings")
-        .current_dir(root())
-        .status()
-        .map_err(|error| format!("could not build release documentation: {error}"))?;
-    if !status.success() {
-        return Err(format!("documentation build failed with {status}"));
-    }
     package_check()?;
     release_evidence()?;
     println!("release checks passed");

xtask/src/semantic_freeze.rs

@@ -4,7 +4,7 @@ use crate::*;
 
 const INVENTORY_PATH: &str = "release/semantic-freeze.json";
 const INVENTORY_SCHEMA: &str = "auths.semantic-freeze/1";
-const FREEZE_VERSION: u64 = 8;
+const FREEZE_VERSION: u64 = 11;
 const PUBLIC_RUST_ROOTS: [&str; 2] = ["auths", "auths-sdk"];
 const PUBLIC_RUST_CLOSURE: [&str; 28] = [
     "auths",
@@ -192,7 +192,7 @@ fn generate_inventory() -> Result<SemanticFreezeInventory, String> {
         )?,
         freeze_entry(
             "auths.product.bounded-policy",
-            1,
+            2,
             FreezeClassification::FrozenMeaning,
             &[
                 "policy-semantic-ids",
@@ -279,7 +279,7 @@ fn generate_inventory() -> Result<SemanticFreezeInventory, String> {
     for (id, path) in frozen_byte_inventories()? {
         let version = match path.as_str() {
             "architecture/dependency-graph.json" => 2,
-            "formal/qualification/aeneas/source-closure.json" => 5,
+            "formal/qualification/aeneas/source-closure.json" => 6,
             _ => 1,
         };
         entries.push(freeze_entry(
@@ -321,7 +321,7 @@ fn generate_inventory() -> Result<SemanticFreezeInventory, String> {
     ]);
     entries.push(freeze_entry(
         "auths.release.public-surface",
-        8,
+        11,
         FreezeClassification::ReleaseMetadata,
         &[
             "package-names",