chore: R-16 toolchain pin + reconciliation

[hyperpolymath]

Owner rulings R-16/R-20/R-21/R-24 (2026-08-28): keep the .tool-versions -> .mise.toml pin conversion, revert the rest of the template-sync sweep, reconcile and publish local history. Direct push blocked by ruleset; merged with --admin per standing practice.

🤖 Generated with Claude Code

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar

[github-actions]

🔍 Hypatia Security Scan

Findings: 68 issues detected

Severity	Count
🔴 Critical	6
🟠 High	41
🟡 Medium	21

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "No test directory or test files found",
    "type": "no_tests",
    "file": "/home/runner/work/formatrix-docs/formatrix-docs",
    "action": "flag",
    "rule_module": "honest_completion",
    "severity": "high",
    "deduction": 20
  },
  {
    "reason": "Issue in label-triage.yml",
    "type": "missing_timeout_minutes",
    "file": "label-triage.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in labels.yml",
    "type": "missing_timeout_minutes",
    "file": "labels.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in push-email-notify.yml",
    "type": "missing_timeout_minutes",
    "file": "push-email-notify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "secret_action_without_presence_gate",
    "file": "mirror.yml",
    "action": "webfactory/ssh-agent",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "secret_action_without_presence_gate",
    "file": "mirror.yml",
    "action": "webfactory/ssh-agent",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "secret_action_without_presence_gate",
    "file": "mirror.yml",
    "action": "webfactory/ssh-agent",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "secret_action_without_presence_gate",
    "file": "mirror.yml",
    "action": "webfactory/ssh-agent",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "secret_action_without_presence_gate",
    "file": "mirror.yml",
    "action": "webfactory/ssh-agent",
    "rule_module": "workflow_audit",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b1b91239-c731-4c6a-8661-64a26c30ffa1

📥 Commits

Reviewing files that changed from the base of the PR and between f2c336a and e77bd83.

📒 Files selected for processing (4)

• .mise.toml
• .tool-versions
• CHANGELOG.md
• docs/tech-debt-2026-05-26.md

💤 Files with no reviewable changes (1)

• .tool-versions

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (1)

• GitHub Check: Codacy Static Code Analysis

⚠️ CI failures not shown inline (3)

GitHub Actions: Rust CI / 1_rust-ci _ Cargo check + clippy + fmt.txt: chore: R-16 toolchain pin + reconciliation

Conclusion: failure

View job details

##[group]Run cargo check --locked --all-targets
 �[36;1mcargo check --locked --all-targets�[0m
 shell: /usr/bin/bash -e {0}
 env:
   CARGO_HOME: /home/runner/.cargo
   CARGO_INCREMENTAL: 0
   CARGO_TERM_COLOR: always
   CACHE_ON_FAILURE: false
 ##[endgroup]
 �[1m�[91merror�[0m: failed to load manifest for workspace member `/home/runner/work/formatrix-docs/formatrix-docs/crates/formatrix-gui`
 referenced by workspace at `/home/runner/work/formatrix-docs/formatrix-docs/Cargo.toml`
 Caused by:
   failed to load manifest for dependency `gossamer-rs`
 Caused by:
   failed to read `/home/runner/work/formatrix-docs/gossamer/bindings/rust/Cargo.toml`
 Caused by:
   No such file or directory (os error 2)
 ##[error]Process completed with exit code 101.

---

GitHub Actions: Rust CI / rust-ci _ Cargo check + clippy + fmt: chore: R-16 toolchain pin + reconciliation

Conclusion: failure

View job details

##[group]Run Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
 with:
   workspaces: .
   prefix-key: v0-rust
   add-job-id-key: true
   add-rust-environment-hash-key: true
   cache-targets: true
   cache-all-crates: false
   cache-workspace-crates: false
   save-if: true
   cache-provider: github
   cache-bin: true
   lookup-only: false
   cmd-format: {0}
 env:
   CARGO_HOME: /home/runner/.cargo
   CARGO_INCREMENTAL: 0
   CARGO_TERM_COLOR: always
 ##[endgroup]
 (node:2104) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
 (Use `node --trace-deprecation ...` to show where the warning was created)
 Error: The process '/home/runner/.cargo/bin/cargo' failed with exit code 101
     at ExecState._setResult (/home/runner/work/_actions/Swatinem/rust-cache/c19371144df3bb44fab255c43d04cbc2ab54d1c4/dist/restore/index.js:202817:25)
     at ExecState.CheckComplete (/home/runner/work/_actions/Swatinem/rust-cache/c19371144df3bb44fab255c43d04cbc2ab54d1c4/dist/restore/index.js:202800:18)
     at ChildProcess.<anonymous> (/home/runner/work/_actions/Swatinem/rust-cache/c19371144df3bb44fab255c43d04cbc2ab54d1c4/dist/restore/index.js:202696:27)
     at ChildProcess.emit (node:events:509:28)
     at maybeClose (node:internal/child_process:1124:16)
     at ChildProcess._handle.onexit (node:internal/child_process:306:5) {
   commandFailed: {
     command: 'cargo metadata --all-features --format-version 1 --no-deps',
     stderr: '\x1B[1m\x1B[91merror\x1B[0m: failed to load manifest for workspace member `/home/runner/work/formatrix-docs/formatrix-docs/crates/formatrix-gui`\n' +
       'referenced by workspace at `/home/runner/work/formatrix-docs/formatrix-docs/Cargo.toml`\n' +
       '\n' +
       'Caused by:\n' +
       '  failed to load manifest for dependency `gossamer-rs`\n' +
       '\n' +
       'Caused by:\n' +
       '  failed to read `/home/runner/work/formatrix-docs/gossamer/bindings/rust/Cargo.toml`\n' +
 ...

---

GitHub Actions: Rust CI / rust-ci _ Cargo check + clippy + fmt: chore: R-16 toolchain pin + reconciliation

Conclusion: failure

View job details

##[group]Run cargo check --locked --all-targets
 �[36;1mcargo check --locked --all-targets�[0m
 shell: /usr/bin/bash -e {0}
 env:
   CARGO_HOME: /home/runner/.cargo
   CARGO_INCREMENTAL: 0
   CARGO_TERM_COLOR: always
   CACHE_ON_FAILURE: false
 ##[endgroup]
 �[1m�[91merror�[0m: failed to load manifest for workspace member `/home/runner/work/formatrix-docs/formatrix-docs/crates/formatrix-gui`
 referenced by workspace at `/home/runner/work/formatrix-docs/formatrix-docs/Cargo.toml`
 Caused by:
   failed to load manifest for dependency `gossamer-rs`
 Caused by:
   failed to read `/home/runner/work/formatrix-docs/gossamer/bindings/rust/Cargo.toml`
 Caused by:
   No such file or directory (os error 2)
 ##[error]Process completed with exit code 101.

🔇 Additional comments (3)

.mise.toml (1)

1-2: LGTM!

CHANGELOG.md (1)

2-2: LGTM!

docs/tech-debt-2026-05-26.md (1)

2-2: LGTM!

---

📝 Walkthrough

Summary by CodeRabbit

• Chores

  • Added configuration for the stable Rust toolchain.
  • Removed the previous Rust toolchain entry to keep development setup definitions consistent.

• Documentation

  • Updated the changelog and technical debt documentation to use the MPL-2.0 licence identifier instead of CC-BY-SA-4.0.

Walkthrough

The project adds a Mise configuration for stable Rust, removes the Rust entry from .tool-versions, and changes two SPDX licence identifiers from CC-BY-SA-4.0 to MPL-2.0.

Changes

Rust toolchain configuration

Layer / File(s)	Summary
Mise Rust toolchain selection .mise.toml, .tool-versions	.mise.toml selects the stable Rust toolchain. .tool-versions no longer declares the Rust toolchain.

SPDX licence metadata

Layer / File(s)	Summary
SPDX licence identifier updates CHANGELOG.md, docs/tech-debt-2026-05-26.md	Both files change their SPDX licence identifier from CC-BY-SA-4.0 to MPL-2.0.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to e77bd

This PR makes a localized toolchain pin conversion and related documentation updates; no actionable merge-blocking risk remains beyond normal checks and review.

Poem

A rabbit checks the Rusty trail

Mise marks stable without fail
Old tool notes hop away
New licence tags now stay
Soft paws approve the tidy day

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description accurately relates to the toolchain pin conversion, reverted template-sync changes, history reconciliation, and merge constraints.
Title check	✅ Passed	The title clearly identifies the main change: pinning and reconciling the Rust toolchain configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codacy-production]

Pull Request Overview

The PR is up to Codacy standards and successfully migrates toolchain management to .mise.toml. However, there is a contradiction between the PR's stated objective to 'pin' the toolchain and the use of the floating 'stable' tag, which fails to guarantee the build reproducibility required for a true pin. Additionally, the repository-wide reconciliation to the MPL-2.0 license is a significant legal change that should be verified for consistency across all codebase files beyond the documentation updated here.

About this PR

• The migration from CC-BY-SA-4.0 to MPL-2.0 represents a significant legal shift. Ensure that this reconciliation (Ruling R-16) is consistently applied repository-wide and has received explicit stakeholder approval.
• The PR specifies a toolchain 'pin', but the implementation uses the floating 'stable' tag. To ensure build reproducibility and meet the requirement for a pin, a concrete version should be used instead of a channel name.

Test suggestions

• Verify .mise.toml correctly defines the rust tool as 'stable'
• Verify license headers in CHANGELOG.md and audit docs are updated to MPL-2.0
• Confirm .tool-versions has been removed to avoid toolchain manager conflict

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}