Nested Rust surfaces are invisible to the Rust rule packages (AP-001 under-coverage)

[leynos]

Problem

Rust applicability is inferred from a root Cargo.toml only. Repositories
whose Rust lives in a subdirectory — PyO3 extensions, rust/ workspaces —
receive an AP-001 indeterminate finding from every Rust rule package,
so exactly the mixed-language repositories are under-covered.

Evidence from the 2026-08-13 Rust-ecosystem sweep (54 repositories, 7 rule
packages): cuprum, femtologging, msgspec-crockford, and prosidy-darn
each record AP-001 across all five Rust packages (24 of the sweep's
AP-001 findings), while their nested crates go unaudited. The phase 1
baseline flagged the same repositories plus shared-actions and
agent-template-rust.

Designed remediation (not yet shipped)

docs/concordat-design.md §2.2.1 specifies the fix as
rust-makefile-baseline v0.3.0:

• an optional language.rust.surfaces list in the .concordat manifest
  (each entry a Cargo.toml path with an optional workspace/crate
  role), authoritative when present — including the empty list ("no
  governed Rust");
• absent block: a root Cargo.toml implies a single root surface (today's
  behaviour), and its absence stays an AP-001 onboarding prompt;
• the envelope carries the resolved list additively as
  cargo.surfaces[] = {path, parsed} (stays schema_version: 1);
• QG-001 gate reachability widens to a full static closure, with
  surface-qualified gate invocations (cd <dir> && or --manifest-path).

Phase 2 packages (rust-rustfmt-baseline, rust-lints-baseline,
rust-clippy-config-baseline, rust-toolchain-baseline,
rust-dev-fast-baseline) share the same root-sniffing applicability guard,
so the surfaces resolution should feed all of them, not only the Makefile
package.

Acceptance sketch

• A repository declaring rust/Cargo.toml as a surface is audited against
  that surface by every Rust package; AP-001 no longer fires.
• A declared empty surfaces list yields no Rust findings at all.
• The Parabellum sweep re-run shows cuprum, femtologging,
  msgspec-crockford, and prosidy-darn with real verdicts instead of
  indeterminate.

[coderabbitai]

🔗 Related PRs

leynos/theoremc#38 - Add core+macros crates; implement theorem_file proc-macro (3.2.1) [closed]
leynos/rust-skill#4 - Extend the Rust skill catalogue with verification and supply-chain skills [closed]
#62 - Roll out a Rust Makefile audit vertical slice across the estate (1.2) [merged]
leynos/netsuke#448 - Remove ambient fs [merged]
leynos/netsuke#478 - Narrow no_std_fs_operations exemptions with Whitaker module-path suppressions (#462) [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!