Run a governed coding task on Rust

The governed coding session repairs a Cargo library the same way it repairs a Python package. Only the execution image knows the toolchain; the commit, the allowed paths, and the verified result bind the work as before.

Orchestration stays in Python. This project fixes a small addition bug and applies the patch only in a recipient checkout prepared on its own. It keeps the source isolation, operation recovery, signed transitions, and independent key selection of the governed coding-session guide, which covers the provider, provisioning, and the prepare and run lifecycle in full.

1. Start from a Cargo library whose tests fail

The sample is a Cargo library with no third-party dependencies. Its add function subtracts, so both tests fail until the agent repairs it.

pub fn add(a: i64, b: i64) -> i64 {
    a - b
}

#[cfg(test)]
mod tests {
    use super::add;

    #[test]
    fn adds_positive_numbers() {
        assert_eq!(add(2, 3), 5);
    }

    #[test]
    fn adds_negative_numbers() {
        assert_eq!(add(-2, -3), -5);
    }
}

The session imports the committed package/ subtree; working-tree edits and untracked files stay in your checkout. Cargo runs without network access. For a repository with dependencies, prepare them in the execution image or in a separately approved cache, and treat an offline build failure as a dependency to add there, never as a reason to open the network.

2. Build an immutable Rust execution image

The worker and helper images come from the main operator setup. Build the Rust execution image here, then record all three image identities in one runtime profile.

docker build -f operator/execution.Dockerfile -t chio-coding-rust .
uv run chio-mini-swe runtime-profile \
  --worker-image chio-coding-worker \
  --execution-image chio-coding-rust \
  --helper-image python:3.11-slim --out runtime.json

You should see runtime.json naming three immutable image IDs. The image carries the toolchain before the session starts. The worker image runs the installed coding adapter, and the helper image performs bounded source and result transport.

The execution container runs as UID/GID 65534 and mounts /tmp with noexec. Cargo's writable cache uses a temporary path, while compiler output and test binaries live in the selected workspace. Compiler output is cleaned before each snapshot, and the task runs cargo clean before it submits, so build output stays out of the retained snapshot. Keep the noexec mount; test binaries run from the workspace.

3. Run the coding session

Copy operator/provider.example.json to provider.json and set your endpoint, model, and token prices. The model gateway reads the API key from the named environment variable at run time, so the key stays out of the task and the configuration files. Then commit the sample and initialize the task; the supplied session.json selects the package/ scope and your new runtime profile.

uv sync
git -C sample init
git -C sample add package
git -C sample commit -m "Add Rust calculator exercise"
uv run chio-mini-swe session init --config session.json \
  --task-file issue.md --state .session

The operator reviews .session/provisioning-request.json and returns signed policies in authorization.json, through the same handoff as the Python task. Then prepare, run, and export.

uv run chio-mini-swe session prepare --state .session \
  --authorization authorization.json
uv run chio-mini-swe session run --state .session
uv run chio-mini-swe session result --state .session --out result

You should see result/repository/changes.patch after the agent shows the failing tests, repairs addition, and runs the tests again. The session keeps model decisions and tool-call identities across attempts. A provider request with an unknown outcome is resolved by its original invocation before the agent continues.

4. Verify the patch and run Cargo tests in a recipient checkout

Prepare recipient/ at the full commit you select, set SELECTED_COMMIT to it, and obtain trusted-kernel.pub through the operator's trusted channel before the bundle arrives. Verify the expected package scope, inspect the patch, and test it here.

uv run chio-mini-swe-repository verify-export \
  --bundle result/repository --repository recipient \
  --revision "$SELECTED_COMMIT" --source-path package \
  --chio chio --kernel-key trusted-kernel.pub --server-id sandbox
git -C recipient apply --check ../result/repository/changes.patch
git -C recipient apply ../result/repository/changes.patch
cargo test --offline --manifest-path recipient/package/Cargo.toml

You should see adds_positive_numbers and adds_negative_numbers pass. A patch can apply cleanly and still come from the wrong session, so read each result for the claim it makes:

• Selected commit and source paths. The agent started from the intended committed package.
• Original source hashes. Your dirty and untracked files stayed out of the patch workspace.
• Completed session replay. Rerunning completed work makes no new provider request.
• Recipient Cargo tests. The independently applied patch repairs positive and negative addition.
• Verified transitions and receipts. The retained execution records verify against the authority you selected.

A failed command leaves the retained snapshot in charge

A command timeout can follow a partial file write: keep the retained repository snapshot and recover the original command. Result validation refuses an out-of-scope file change. After a host or worker exit, keep the session state, inspect its original records, and export offline only through the completed-state path; an exit says nothing about whether a patch is safe to apply.

uv run python qualify_session.py --runtime-profile runtime.json \
  --output rust-session-evidence --scoped

The test driver creates a temporary Cargo repository and a local provider with scripted decisions, separate from the session above. It runs Docker commands, native receipts, and recipient verification, including a refusal under the wrong key. The main coding project's failure tests cover command limits, output limits, escaping links, special files, ownership, and selected scope; this fixture adds a toolchain-specific acceptance case. Accepting the patch stays with the repository's reviewers and the resource owner.

Next: give a Rust resource its own ownership check