🔧 CodeRabbit CI Fix: Fix failing Rust CI and Dogfood validation checks

.machine_readable/arrival-pack/claude-md.k9.ncl

@@ -1,3 +1,4 @@
+K9!
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #

.machine_readable/coaptation/coapt.k9.ncl

@@ -1,3 +1,4 @@
+K9!
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #

.machine_readable/contractiles/adjust/adjust.k9.ncl

@@ -1,3 +1,4 @@
+K9!
 # SPDX-License-Identifier: MPL-2.0
 # adjust.k9.ncl — K9 trust-tier component of the adjust trident
 # Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>

.machine_readable/contractiles/bust/bust.k9.ncl

@@ -1,3 +1,4 @@
+K9!
 # SPDX-License-Identifier: MPL-2.0
 # bust.k9.ncl — K9 trust-tier component of the bust trident
 # Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
@@ -50,6 +51,7 @@ let base    = import "../_base.ncl" in
       allow_filesystem_write = false,
       allow_subprocess = true,
       probe_scope = 'read_only,
+      signature_required = true,
     },
   },
 

.machine_readable/contractiles/dust/dust.k9.ncl

@@ -1,3 +1,4 @@
+K9!
 # SPDX-License-Identifier: MPL-2.0
 # dust.k9.ncl — K9 trust-tier component of the dust trident
 # Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>

.machine_readable/contractiles/intend/intend.k9.ncl

@@ -1,3 +1,4 @@
+K9!
 # SPDX-License-Identifier: MPL-2.0
 # intend.k9.ncl — K9 trust-tier component of the intend trident
 # Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
@@ -63,6 +64,7 @@ let base    = import "../_base.ncl" in
       allow_network = false,
       allow_filesystem_write = false,   # evidence sinks are indirected
       allow_subprocess = true,
+      signature_required = true,
     },
   },
 

.machine_readable/contractiles/must/must.k9.ncl

@@ -1,3 +1,4 @@
+K9!
 # SPDX-License-Identifier: MPL-2.0
 # must.k9.ncl — K9 trust-tier component of the must trident
 # Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
@@ -72,6 +73,7 @@ let base    = import "../_base.ncl" in
         'external_api,
         'exploit_attempt,          # that's trust's safe_hacking territory
       ],
+      signature_required = true,
     },
   },
 

.machine_readable/contractiles/trust/trust.k9.ncl

@@ -1,3 +1,4 @@
+K9!
 # SPDX-License-Identifier: MPL-2.0
 # trust.k9.ncl — K9 trust-tier component of the trust trident
 # Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
@@ -77,6 +78,7 @@ let base    = import "../_base.ncl" in
       allow_subprocess = true,
       authorised_probes_only = true,    # probe section explicitly lists allowed targets + probe classes
       probe_scope_enforcement = 'this_repo_only,  # probes NEVER hit external systems
+      signature_required = true,
     },
   },
 

.machine_readable/self-validating/methodology-guard.k9.ncl

@@ -1,3 +1,4 @@
+K9!
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}>
 #

container/stapeln/deploy.k9.ncl

@@ -1,3 +1,4 @@
+K9!
 # SPDX-License-Identifier: MPL-2.0
 # deploy.k9.ncl — {{PROJECT_NAME}} deployment component (Hunt level)
 #

crates/squabble-core/src/gate.rs

@@ -26,7 +26,6 @@ pub enum CheckRun {
     Passed,
 }
 
-
 /// Why a required context shows [`CheckRun::Missing`].
 ///
 /// `Missing` is the gate's most common stuck state and its least actionable one:
@@ -234,17 +233,25 @@ mod tests {
     #[test]
     fn missing_cause_is_optional_and_does_not_alter_gate_state() {
         // A diagnosis explains a stuck gate; it must never move it.
-        let undiagnosed = Gate::new(vec![RequiredCheck::new("scan / gitleaks", CheckRun::Missing)]);
-        let diagnosed = Gate::new(vec![RequiredCheck::new("scan / gitleaks", CheckRun::Missing)
-            .with_cause(MissingCause::DeadActionPin)]);
+        let undiagnosed = Gate::new(vec![RequiredCheck::new(
+            "scan / gitleaks",
+            CheckRun::Missing,
+        )]);
+        let diagnosed = Gate::new(vec![RequiredCheck::new(
+            "scan / gitleaks",
+            CheckRun::Missing,
+        )
+        .with_cause(MissingCause::DeadActionPin)]);
         assert_eq!(undiagnosed.evaluate(), GateState::Blocked);
         assert_eq!(diagnosed.evaluate(), GateState::Blocked);
         assert_eq!(diagnosed.evaluate(), undiagnosed.evaluate());
     }
 
     #[test]
     fn remedy_is_offered_only_for_diagnosed_missing_checks() {
-        assert!(RequiredCheck::new("x", CheckRun::Missing).remedy().is_none());
+        assert!(RequiredCheck::new("x", CheckRun::Missing)
+            .remedy()
+            .is_none());
         assert!(RequiredCheck::new("x", CheckRun::Passed)
             .with_cause(MissingCause::NoSuchJob)
             .remedy()
@@ -270,7 +277,11 @@ mod tests {
                 RequiredCheck::new("a", CheckRun::Passed),
                 RequiredCheck::new("b", CheckRun::Missing).with_cause(cause),
             ]);
-            assert_ne!(g.evaluate(), GateState::Green, "{cause:?} must not reach Green");
+            assert_ne!(
+                g.evaluate(),
+                GateState::Green,
+                "{cause:?} must not reach Green"
+            );
         }
     }
 }