补齐 Rust WASM 首次任务的原生确认与修复闭环

Author: loong10k

README.md

@@ -813,4 +813,6 @@ Rust edit feedback now reports safe lines, stable tasks and original Rustfmt rec
 
 Rust edit dialogue now provides an executable post-batch Clippy command and explicitly states that project lint did not run during editing. Original-task repair-ready retains current rule/line feedback and withdraws changed-input guidance; this is not a background queue or authoritative closure. See [project lint follow-up](docs/Rust-Project-Lint-Followup.md).
 
-Native-first Rust syntax tasks now have a scoped protected-host SDK resolution and same-tool recurrence path, binding the original counterexample and Cargo edition provenance. Production host approval integration and WASM-first Rust resolution remain pending; this does not qualify Clippy or project delivery. See [scoped acceptance](tests/acceptance/rust-task-resolution.md).
+Native-first and WASM-first Rust syntax tasks now share a protected-host SDK confirmation, scoped resolution and same-tool recurrence path. Native-first policy1.7/evidence0.8 retain grammar=null; WASM-first policy1.8/evidence0.9 retain the original grammar digest. Both bind the original counterexample and approved Cargo edition provenance; a native counterexample requests investigation, and incomplete or changed inputs cannot resolve. Production host approval integration remains pending; this does not qualify Clippy or project delivery. See [scoped acceptance](tests/acceptance/rust-task-resolution.md).
+
+See [WASM-first acceptance](tests/acceptance/rust-wasm-task-resolution.md) for the actual execution path, protocols and counterexample routing.

README.zh-CN.md

@@ -796,4 +796,6 @@ Rust编辑反馈现保留安全行号、稳定任务与原Rustfmt复检指引，
 
 Rust编辑后现提供可执行的批次后Clippy指令，明确编辑阶段未运行项目lint。原任务repair_ready保留当前规则/行号并撤回输入变化后的指引；这不是后台队列或可信关闭。见[项目lint后续流程](docs/Rust-Project-Lint-Followup.zh_CN.md)。
 
-Rust 原生首次语法任务现有受保护宿主 SDK 关闭与同工具复发重开路径；固定 Cargo edition 来源与原反例，未完成或输入变化不能关闭。生产宿主批准接线和 WASM 首次任务仍待完成，不能替代 Clippy/项目门禁。详见 [限定验收](tests/acceptance/rust-task-resolution.md)。
+Rust 原生首次与 WASM 首次语法任务均可通过同一受保护宿主 SDK 确认、限定关闭和同工具复发重开。原生首次保留 grammar=null（策略1.7/证据0.8）；WASM 首次保留真实 grammar 摘要（策略1.8/证据0.9）。两者绑定 Cargo edition 来源与原反例；原生反证转调查，未完成或输入变化不能关闭。生产宿主批准接线仍待完成，不替代 Clippy/项目门禁。详见 [限定验收](tests/acceptance/rust-task-resolution.md)。
+
+WASM 首次闭环的实际执行路径、协议与误报分流见 [验收记录](tests/acceptance/rust-wasm-task-resolution.md)。

crates/codeguard-cli/src/task_lifecycle_store.rs

@@ -88,6 +88,7 @@ pub(crate) fn load(
                             | "0.6.0"
                             | "0.7.0"
                             | "0.8.0"
+                            | "0.9.0"
                     )
                 ) || value["report_type"] != "task_resolution_evidence"
                     || value["identity"] != identity_value
@@ -208,10 +209,16 @@ fn origin_matches_evidence(original: &serde_json::Value, evidence: &serde_json::
             | (Some("swift"), Some("0.3.0"))
             | (Some("kotlin"), Some("0.4.0"))
             | (Some("go"), Some("0.7.0"))
-            | (Some("rust"), Some("0.8.0"))
+            | (Some("rust"), Some("0.8.0" | "0.9.0"))
     ) {
         return false;
     }
+    if evidence["schema_version"] == "0.9.0"
+        && (!matches!(original["schema_version"].as_str(), Some("0.1.0" | "0.7.0"))
+            || !original["native_evidence"].is_null())
+    {
+        return false;
+    }
     if evidence["schema_version"] == "0.8.0"
         && (original["schema_version"] != "0.12.0"
             || evidence["edition_context"]
@@ -400,9 +407,9 @@ pub(crate) fn record_native_recurrence(
                 | (Some("0.3.0"), Some("swift"))
                 | (Some("0.4.0"), Some("kotlin"))
                 | (Some("0.7.0"), Some("go"))
-                | (Some("0.8.0"), Some("rust"))
+                | (Some("0.8.0" | "0.9.0"), Some("rust"))
         )
-        || (evidence["schema_version"] == "0.8.0"
+        || (matches!(evidence["schema_version"].as_str(), Some("0.8.0" | "0.9.0"))
             && scan["native"]["edition_context"] != evidence["edition_context"])
         || (evidence["schema_version"] == "0.7.0"
             && (scan["native"]["gofmt_sha256"] != evidence["gofmt_sha256"]

crates/codeguard-cli/src/task_resolution_checker.rs

@@ -59,7 +59,9 @@ impl TaskResolutionChecker {
     }
     /// 核对入口允许的签名策略版本；Zig 原生首次策略与旧 WASM 来源策略分开。
     pub(crate) fn accepts_policy_version(self, version: &str) -> bool {
-        version == self.policy_version() || (matches!(self, Self::Zig) && version == "1.4.0")
+        version == self.policy_version()
+            || (matches!(self, Self::Zig) && version == "1.4.0")
+            || (matches!(self, Self::Rust) && version == "1.8.0")
     }
     /// 返回该语言专用的脱敏证据版本；参数保留 Zig 原生首次来源与旧来源的区别。
     pub(crate) fn evidence_version(self, policy_version: &str) -> &'static str {
@@ -70,6 +72,7 @@ impl TaskResolutionChecker {
             Self::Swift => "0.3.0",
             Self::Kotlin => "0.4.0",
             Self::Go => "0.7.0",
+            Self::Rust if policy_version == "1.8.0" => "0.9.0",
             Self::Rust => "0.8.0",
         }
     }

crates/codeguard-cli/src/task_resolution_evidence_shape.rs

@@ -19,7 +19,7 @@ pub(crate) fn valid(record: &TaskLifecycleRecord, value: &Value) -> bool {
         "current_native",
         "outcome",
     ];
-    if value["schema_version"] == "0.8.0" {
+    if matches!(value["schema_version"].as_str(), Some("0.8.0" | "0.9.0")) {
         expected.push("edition_context");
         if !valid_rust_binding(value) {
             return false;
@@ -112,13 +112,13 @@ fn native_bound(value: &Value) -> bool {
         Some("0.4.0") => "kotlinc-jvm 2.4.10",
         Some("0.6.0") => "ruff 0.16.8",
         Some("0.7.0") => "go1.23.4",
-        Some("0.8.0") => "rustfmt 1.9.0-stable",
+        Some("0.8.0" | "0.9.0") => "rustfmt 1.9.0-stable",
         _ => return false,
     };
     ["original_native", "current_native"].iter().all(|k| {
         value[*k]["tool_sha256"] == value["tool_sha256"]
             && value[*k]["version"] == version
-            && (value["schema_version"] != "0.8.0"
+            && (!matches!(value["schema_version"].as_str(), Some("0.8.0" | "0.9.0"))
                 || value[*k]["edition_context"] == value["edition_context"])
             && (value["schema_version"] != "0.7.0"
                 || (value[*k]["gofmt_sha256"] == value["gofmt_sha256"]
@@ -128,7 +128,7 @@ fn native_bound(value: &Value) -> bool {
 fn native_for_version(evidence: &Value, key: &str) -> bool {
     match evidence["schema_version"].as_str() {
         Some("0.1.0" | "0.5.0") => native(&evidence[key]),
-        Some("0.8.0") => crate::rust_syntax_evidence::valid(&evidence[key], None),
+        Some("0.8.0" | "0.9.0") => crate::rust_syntax_evidence::valid(&evidence[key], None),
         Some("0.7.0") => crate::go_syntax_probe::valid_observation(&evidence[key], None),
         Some("0.6.0") => crate::python_syntax_probe::valid_native_observation(&evidence[key], None),
         Some("0.2.0") => crate::erlang_syntax_probe::valid_native_observation(&evidence[key], None),
@@ -273,7 +273,9 @@ pub(crate) fn valid_python_binding(value: &Value) -> bool {
 /// 参数为脱敏生命周期证据；结构有效仍须由宿主核验签名和当前字节。
 pub(crate) fn valid_rust_binding(value: &Value) -> bool {
     value["identity"]["checker_id"] == "syntax.native_confirmation"
-        && value["grammar_sha256"].is_null()
+        && ((value["schema_version"] == "0.8.0" && value["grammar_sha256"].is_null())
+            || (value["schema_version"] == "0.9.0"
+                && value["grammar_sha256"].as_str().is_some_and(digest)))
         && value["edition_context"].is_object()
         && ["original_native", "current_native"]
             .iter()

crates/codeguard-cli/src/task_resolution_service.rs

@@ -56,7 +56,7 @@ pub fn verify_go_task_resolution(
     verify_task_resolution(request, TaskResolutionChecker::Go)
 }
 
-/// 验签宿主固定的Rust原生首次任务策略，并在同一Cargo edition下对照原反例与当前源码。
+/// 验签宿主固定的Rust原生首次或WASM首次任务策略，并在同一Cargo edition下对照原反例与当前源码。
 /// 参数来自受保护宿主；返回限定任务收据，不替代Clippy或全项目交付门禁。
 pub fn verify_rust_task_resolution(
     request: &crate::RustTaskResolutionRequest<'_>,
@@ -208,6 +208,14 @@ fn original_binding_matches(
     checker: TaskResolutionChecker,
 ) -> bool {
     if checker.language() == "rust" {
+        if policy.schema_version == "1.8.0" {
+            return matches!(original["schema_version"].as_str(), Some("0.1.0" | "0.7.0"))
+                && original["native_evidence"].is_null()
+                && policy.grammar_sha256.as_ref().is_some_and(|grammar| {
+                    original["observations"][0]["source_sha256"] == policy.original_source_sha256
+                        && original["observations"][0]["grammar_sha256"] == *grammar
+                });
+        }
         return original["schema_version"] == "0.12.0"
             && policy.grammar_sha256.is_none()
             && original["native_evidence"]["target"]["source_sha256"]
@@ -428,7 +436,10 @@ pub(crate) fn commit_resolution(
         "current_native",
         "outcome",
     ];
-    if raw_evidence["schema_version"] == "0.8.0" {
+    if matches!(
+        raw_evidence["schema_version"].as_str(),
+        Some("0.8.0" | "0.9.0")
+    ) {
         keys.push("edition_context");
         if !crate::task_resolution_evidence_shape::valid_rust_binding(&raw_evidence) {
             return Err("task_resolution_evidence_binding_invalid");
@@ -454,7 +465,9 @@ pub(crate) fn commit_resolution(
         object.len() == keys.len() && keys.iter().all(|key| object.contains_key(*key))
     }) || !matches!(
         raw_evidence["schema_version"].as_str(),
-        Some("0.1.0" | "0.2.0" | "0.3.0" | "0.4.0" | "0.5.0" | "0.6.0" | "0.7.0" | "0.8.0")
+        Some(
+            "0.1.0" | "0.2.0" | "0.3.0" | "0.4.0" | "0.5.0" | "0.6.0" | "0.7.0" | "0.8.0" | "0.9.0"
+        )
     ) {
         return Err("task_resolution_evidence_binding_invalid");
     }