feat: complete native execution and Steam discovery

scripts/audit_workspace.py

@@ -29,8 +29,18 @@ def main() -> None:
         fail("workspace package license is not AGPL-3.0-or-later")
     if package_defaults.get("publish") is not False:
         fail("private workspace packages must set publish = false")
+    if package_defaults.get("rust-version") != "1.97.1":
+        fail("workspace minimum Rust version must match the reviewed local toolchain")
     if "repository" in package_defaults:
         fail("private scaffold must not advertise a placeholder repository URL")
+    expected_members = {
+        "crates/kiln-core",
+        "crates/kiln-cli",
+        "crates/kiln-adapter-native",
+        "crates/kiln-adapter-steam",
+    }
+    if set(workspace["workspace"].get("members", [])) != expected_members:
+        fail("workspace members do not match the reviewed private components")
 
     cli_manifest = load(ROOT / "crates" / "kiln-cli" / "Cargo.toml")
     core_dependency = cli_manifest.get("dependencies", {}).get("kiln-core", {})
@@ -38,6 +48,37 @@ def main() -> None:
         fail("internal kiln-core dependency must use the exact workspace release version")
     if core_dependency.get("path") != "../kiln-core":
         fail("internal kiln-core dependency must resolve through the reviewed workspace path")
+    if cli_manifest.get("dependencies", {}).get("serde_json") != "=1.0.150":
+        fail("kiln-cli must use the reviewed serde_json contract version")
+    if cli_manifest.get("dependencies", {}).get("kiln-adapter-steam") != {
+        "version": "=0.0.1",
+        "path": "../kiln-adapter-steam",
+    }:
+        fail("kiln-cli Steam adapter dependency must use the reviewed workspace path")
+    native_manifest = load(ROOT / "crates" / "kiln-adapter-native" / "Cargo.toml")
+    native_dependencies = native_manifest.get("dependencies", {})
+    expected_native = {
+        "kiln-core": {"version": "=0.0.1", "path": "../kiln-core"},
+        "serde": {"version": "=1.0.228", "features": ["derive"]},
+        "toml": "=1.1.3",
+    }
+    if native_dependencies != expected_native:
+        fail("native adapter dependencies differ from the reviewed exact set")
+    if native_manifest.get("dev-dependencies", {}) != {
+        "serde_json": "=1.0.150",
+        "uuid": {"version": "=1.24.0", "features": ["v4"]},
+    }:
+        fail("native adapter test dependencies differ from the reviewed exact set")
+    steam_manifest = load(ROOT / "crates" / "kiln-adapter-steam" / "Cargo.toml")
+    if steam_manifest.get("dependencies", {}) != {
+        "kiln-core": {"version": "=0.0.1", "path": "../kiln-core"},
+        "uuid": "=1.24.0",
+    }:
+        fail("Steam adapter dependencies differ from the reviewed exact set")
+    if steam_manifest.get("dev-dependencies", {}) != {
+        "uuid": {"version": "=1.24.0", "features": ["v4"]}
+    }:
+        fail("Steam adapter test dependencies differ from the reviewed exact set")
 
     license_hash = hashlib.sha256((ROOT / "LICENSE").read_bytes()).hexdigest()
     if license_hash != EXPECTED_LICENSE_SHA256:
@@ -55,6 +96,7 @@ def main() -> None:
     expected_dependencies = {
         "serde": "=1.0.228",
         "serde_json": "=1.0.150",
+        "toml": "=1.1.3",
         "uuid": "=1.24.0",
     }
     dependencies = core_manifest.get("dependencies", {})
@@ -63,9 +105,18 @@ def main() -> None:
         configured_version = configured if isinstance(configured, str) else configured.get("version")
         if configured_version != version:
             fail(f"{name} must remain pinned to reviewed version {version}")
-        if components.get(name, {}).get("version") != version.removeprefix("="):
+        inventory_version = (
+            "1.1.3+spec-1.1.0" if name == "toml" else version.removeprefix("=")
+        )
+        if components.get(name, {}).get("version") != inventory_version:
             fail(f"{name} source inventory does not match its manifest version")
 
+    uuid_features = set(dependencies["uuid"].get("features", []))
+    if uuid_features != {"serde", "v4"}:
+        fail("uuid must enable only the reviewed serde and v4 features")
+    if set(components["uuid"].get("features", [])) != uuid_features:
+        fail("uuid source inventory does not match its reviewed features")
+
     lock = load(ROOT / "Cargo.lock")
     external = [package for package in lock["package"] if "source" in package]
     unexpected_sources = [

scripts/verify_repo.py

@@ -43,7 +43,7 @@ def check_spec() -> set[str]:
         if duplicates:
             fail(f"duplicate {label} IDs: {duplicates}")
     versions = re.findall(r"^\| \*\*Version\*\*\s+\| ([0-9.]+)", combined, re.MULTILINE)
-    if versions != ["0.18"]:
+    if versions != ["0.22"]:
         fail(f"active specification version markers are stale or ambiguous: {versions}")
     return set(requirements)
 
@@ -100,6 +100,16 @@ def check_verification_entrypoints() -> None:
     missing = [command for command in required if command not in makefile]
     if missing:
         fail(f"Makefile is missing verification gates: {missing}")
+    if "check: verify audit" not in makefile:
+        fail("Makefile must expose the complete local check entrypoint")
+    hosted = [
+        *ROOT.glob(".github/workflows/*.yml"),
+        *ROOT.glob(".github/workflows/*.yaml"),
+        *ROOT.glob(".gitea/workflows/*.yml"),
+        *ROOT.glob(".gitea/workflows/*.yaml"),
+    ]
+    if hosted:
+        fail(f"hosted workflows conflict with the local-only verification policy: {hosted}")
 
 
 def main() -> None: