searchi/docs/RUST-AUDIT.md

Rust audit and completion review — 2026-10-13

Reviewed the shared indexing/media/semantic service boundaries and the desktop, CLI/MCP, setup and optional AI orchestration with two independent Rust reviewers. The review found no reason to add a broad naming or module-splitting project. Existing adapters isolate native processes and desktop concerns from retrieval; long but linear command/setup flows do not need additional indirection merely because of their length. This is a targeted review, not proof of zero defects.

Corrected issue

A valid file modification time before 1970 aborted folder scanning. Other source eligibility and preview checks also assumed nonnegative Unix timestamps. The shared searchi_media::unix_time_ns now performs checked signed conversion, including the minimum signed storage boundary. Indexing, signatures, excerpts, media identity, semantic parent validation and preview identity use that policy. Negative sizes remain invalid. No schema migration or dependency was added.

Regression coverage checks archived documents, unchanged rescans, excerpts, media eligibility and stale-preview revocation followed by successful reindexing. The semantic eligibility fixture uses synthetic geometry to test filtering; it does not claim model-quality validation.

Windows CPU-only results for the final changes:

• Core, media and service: 100 tests passed, six explicit integration tests ignored.
• Desktop: all 47 tests passed, including the new pre-epoch preview regression.
• Strict all-target Clippy passed for the changed crates and desktop.
• Workspace and desktop formatting and Git whitespace checks passed.

The first preview-test assertion expected 404; the protocol correctly returns 410 for an expired capability. The test expectation was corrected; protocol behavior was preserved. Windows filesystem timestamp precision is 100 ns; exact storage boundaries are tested through the conversion helper.

Deferred under YAGNI

Desktop setup could resolve resource_dir() once instead of repeatedly. This does not justify changing working orchestration during this audit. No generic service framework, speculative cache or cosmetic function-renaming sweep was added.

Goal review

The initial usable Windows release is delivered. Windows desktop 0.1.3, Windows CLI/MCP and Ubuntu headless packages are published and byte-verified. An Ubuntu 24.04 desktop Debian preview now also has verified packaged CPU startup. The timestamp correction is in source; those 0.1.3 artifacts precede this fix.

The full cross-platform production goal remains open. Concrete follow-up is:

1. Include this fix in the next packaged update; refresh extraction provenance.
2. Check real Windows interaction, preview playback/seek and installed upgrades.
3. Validate physical GPU use and fallback, and execute a native macOS build.
4. Improve media relevance using independently reviewed real files and queries; the current experimental quality evidence is not sufficient for broad claims.
5. Retain clean-machine, signing and large-library checks as later release gates.

These follow-ups do not justify withholding the already published preview. Gitea Actions remain disabled at Karl's request. See ROADMAP.md for detailed evidence and unchecked gates; this audit does not silently close them.