Implement the 2026-10 audit and usability OpenSpec proposals

.git-blame-ignore-revs

@@ -0,0 +1,7 @@
+# Commits that only reformat code; `git blame` skips them when configured
+# with `git config blame.ignoreRevsFile .git-blame-ignore-revs` (GitHub's
+# blame view reads this file automatically).
+
+# ci-and-build-tooling: one-time `cargo fmt --all` with the committed
+# rustfmt.toml (max_width = 150, use_small_heuristics = "Max").
+58a7792b2404d3ca04d6e66478fe25183ee8d2e1

.github/workflows/ci.yml

@@ -0,0 +1,95 @@
+# Continuous integration for FileCommand (build-tooling capability; design D1).
+#
+# `windows` and `msrv` are the required checks (branch protection on `main`
+# lists them). `linux` is best-effort and never blocks a merge: non-Windows
+# builds are best-effort per the project charter.
+#
+# The stable toolchain is pinned to one version so a Rust release cannot turn
+# `-D warnings` red on an unchanged branch. Bump RUST_TOOLCHAIN deliberately,
+# in a PR that also fixes whatever new lints the release brings.
+
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+env:
+  RUST_TOOLCHAIN: "1.98.1"
+  CARGO_TERM_COLOR: always
+
+jobs:
+  windows:
+    name: windows
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install pinned stable toolchain
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
+          components: rustfmt, clippy
+
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Format check
+        run: cargo fmt --all -- --check
+
+      - name: Clippy
+        run: cargo clippy --workspace --all-targets --locked -- -D warnings
+
+      - name: Test
+        run: cargo test --workspace --locked
+
+      - name: Doc
+        run: cargo doc --workspace --no-deps --locked
+        env:
+          RUSTDOCFLAGS: -D warnings
+
+  msrv:
+    name: msrv
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # The floor is whatever `[workspace.package] rust-version` says, so the
+      # manifest and this job cannot drift apart.
+      - name: Read rust-version from Cargo.toml
+        id: msrv
+        shell: bash
+        run: |
+          version=$(sed -n 's/^rust-version = "\([^"]*\)"/\1/p' Cargo.toml)
+          test -n "$version"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Install rust-version toolchain
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ steps.msrv.outputs.version }}
+
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Check on the declared minimum toolchain
+        run: cargo check --workspace --all-targets --locked
+
+  linux:
+    name: linux (best-effort)
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install pinned stable toolchain
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
+
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Build
+        run: cargo build --workspace --locked
+
+      - name: Test
+        run: cargo test --workspace --locked

Cargo.toml

@@ -5,6 +5,11 @@ members = ["crates/filecommand-core", "crates/filecommand-tui"]
 [workspace.package]
 version = "0.1.4"
 edition = "2021"
+# Minimum supported Rust version. Verified empirically: the lowest toolchain
+# on which `cargo check --workspace --all-targets --locked` passes, and
+# re-checked by the `msrv` CI job on every pull request (ci-and-build-tooling
+# design D3).
+rust-version = "1.88"
 license = "MIT OR Apache-2.0"
 authors = ["The FileCommand Authors"]
 repository = "https://github.com/kkaminsk/FileCommand"
@@ -15,5 +20,60 @@ ratatui = "0.29"
 crossterm = "0.28"
 insta = "1"
 proptest = "1"
-memmap2 = "0.9"
-git2 = "0.19"
+# Local repository state only (`discover`, `head`, `statuses`): no SSH or
+# HTTPS transport, so libssh2 and, on Unix, OpenSSL drop out of the build
+# (ci-and-build-tooling design D5).
+git2 = { version = "0.19", default-features = false }
+# Windows-only binding crate shared by both crates. The feature list is the
+# union of what the workspace calls (ci-and-build-tooling design D6):
+# - Win32_Foundation: HANDLE, BOOL, SYSTEMTIME, CloseHandle, GetLastError,
+#   INVALID_HANDLE_VALUE and the ERROR_* codes
+# - Win32_Storage_FileSystem: CreateFileW, GetFileInformationByHandle,
+#   FindFirstStreamW/FindNextStreamW/FindClose, GetLogicalDrives,
+#   GetVolumeInformationW, GetDiskFreeSpaceExW, CopyFileExW, ReplaceFileW
+#   and their constants
+# - Win32_Security: required by `windows-sys` to compile CreateFileW
+#   (its SECURITY_ATTRIBUTES parameter)
+# - Win32_System_Diagnostics_Debug: SetThreadErrorMode, SEM_FAILCRITICALERRORS
+# - Win32_System_SystemInformation: GlobalMemoryStatusEx, MEMORYSTATUSEX,
+#   GetLocalTime
+# - Win32_System_SystemServices: FILE_NAMED_STREAMS
+# - Win32_System_WindowsProgramming: COPY_FILE_* and PROGRESS_* for
+#   CopyFileExW
+# - Win32_System_Console: the console control handler
+#   (process-lifecycle-hardening)
+# - Win32_System_Com: CoInitializeEx/CoUninitialize around ShellExecuteW
+#   (offload-blocking-io)
+# - Win32_UI_Shell, Win32_UI_WindowsAndMessaging: ShellExecuteW
+#   (open-with-associated-app)
+windows-sys = { version = "0.59", features = [
+    "Win32_Foundation",
+    "Win32_Storage_FileSystem",
+    "Win32_Security",
+    "Win32_System_Diagnostics_Debug",
+    "Win32_System_SystemInformation",
+    "Win32_System_SystemServices",
+    "Win32_System_WindowsProgramming",
+    "Win32_System_Console",
+    "Win32_System_Com",
+    "Win32_UI_Shell",
+    "Win32_UI_WindowsAndMessaging",
+] }
+
+[workspace.lints.clippy]
+# Every `unsafe` block carries a `// SAFETY:` comment stating the invariant
+# that makes it sound; with `-D warnings` in CI an undocumented one fails the
+# pull request (ci-and-build-tooling design D6).
+undocumented_unsafe_blocks = "warn"
+
+[profile.release]
+lto = "thin"
+codegen-units = 1
+strip = "symbols"
+# `panic` deliberately stays at its default, "unwind" (ci-and-build-tooling
+# design D4). Three things depend on unwinding: the terminal-restoring RAII
+# guard and chained panic hook in `filecommand-tui::terminal` must run on a
+# main-thread panic; worker threads isolate their panics with `catch_unwind`
+# so one bad listing or job ends that thread, not the process; and the
+# `panic_restoration` integration test checks that order. `panic = "abort"`
+# would kill the process with the terminal left in raw mode.