Omh Rust

---
name: "omh-rust"
description: "[omh] Hermes Rust workflow: prepare Rust changes with ownership, error, and API discipline, and escalate any unsafe, FFI, or lock-free change to the UB checklist. Use when the user says: rust, rust code, rust skill, rustlang, borrow checker, lifetime error, ownership error, trait bound."
metadata:
  hermes:
    tags: [workflow, oh-my-hermes, planning]
    category: planning
    phase: rust-development
    role: planner
    quality_tier: rust-safety-gated
---

# Rust

This is a Hermes-native `rust` workflow skill.

## Why This Exists

`rust` closes OMH's zero-coverage Rust domain and makes the escalation from ordinary Rust work to undefined-behavior discipline a deterministic routing rule rather than something a model is trusted to notice.

## Do Not Use When

- The request is a server, API, or schema design that happens to mention a Rust stack; use `backend` for the contract and name Rust as the stack.
- The request is debugging a stripped or source-less native binary; use `native-debugging`.
- The request is a general code review of finished Rust; use `code-review`.
- The request is a Rust vocabulary or concept question with no change to prepare; answer it directly.

## Examples

Good example:

- Prompt: Rewrite this parser in Rust and fix the borrow checker errors.
- Expected behavior: Prepare rust_change_contract/v1 with the escalation verdict, ownership_shape/v1 for the parser's borrows, error_and_api_contract/v1, and rust_gate_list/v1.
- Why: The request is a Rust change whose difficulty is ownership shape, which is exactly what the contract has to settle before code.

Bad example:

- Prompt: It compiles and the unsafe block looks fine, so call the FFI wrapper safe.
- Expected behavior: Escalate on the `unsafe`/FFI trigger, mark Miri and sanitizer evidence as not_observed, and name them as blocking items.
- Why: Compilation proves nothing about the invariant an `unsafe` block asserts, and the escalation is not optional.

## Completion Checklist

- The escalation verdict is stated with the trigger that decided it.
- The ownership shape names owners, borrows across boundaries, and every deliberate clone.
- The error type, its conversion boundary, and every surviving `unwrap`/`expect`/`panic!` are named.
- The gate list names the exact commands the executor must run and pass.
- An escalated change carries the Miri, sanitizer, and concurrency-testing requirements as blocking items.
- Compiler, clippy, test, Miri, sanitizer, and loom results stay observed-only.

## Recovery Notes

- If the crate cannot be inspected, escalate by default and say the verdict is conservative rather than measured.
- If the toolchain cannot run Miri or a sanitizer for the escalated change, keep the change blocked and name the smallest substitute proof instead of downgrading the verdict.

## Workflow Lane

- Current lane: **Coding handoff** (`idea-to-deploy`, `llm-app-dev`, `cto-loop`, `deploy-and-monitor`, `code-review`, `build-failure-triage`, `verification-gate`, `security-safety-review`, `+13 more`) - coding owners, handoffs, review, CI, and merge evidence.
- If intent belongs to another lane, hand back to `oh-my-hermes` or name the adjacent workflow.
- Shared product, routing, compatibility, and evidence rules: `omh-routing/references/skill-common-rail.md`.

## Use When

Use when Hermes should prepare a Rust change: ownership and lifetime shape, error and API types, cargo/clippy gates, and the mandatory UB escalation when the change touches unsafe, raw pointers, FFI, MaybeUninit, or lock-free primitives.

    Strong routing signals: `rust`, `rust code`, `rust skill`, `rustlang`, `borrow checker`, `lifetime error`, `ownership error`, `trait bound`, `cargo build`, `cargo clippy`, `clippy lint`, `unsafe rust`, `unsafe block`, `raw pointer`, `maybeuninit`, `rust ffi`, `extern c`, `undefined behavior`, `miri`, `loom`, `ボローチェッカー`, `所有権エラー`, `ライフタイムエラー`, `トレイト境界`, `러스트`, `러스트 코드`, `빌림 검사기`, `소유권 에러`, `라이프타임 에러`, `언세이프`, `미정의 동작`, `借用检查器`, `所有权错误`, `生命周期错误`, `特征约束`

## Catalog Metadata

Category: `planning`
Phase: `rust-development`
Hermes role: `planner`
Quality tier: `rust-safety-gated`
Reasoning demand: `standard`

Quality bar:

- Run the escalation check before anything else and state the verdict; a change whose `unsafe`/FFI status is unknown is escalated by default.
- Load `references/rust-discipline.md` for the ownership, error, and API rules, and name the gate commands from it rather than assuming `cargo build` is the whole bar.
- When the escalation triggers, load `references/ub-escalation.md` and carry its Miri, sanitizer, and loom-style concurrency requirements into the handoff as blocking items.
- Name the ownership decision behind every clone, `Arc`, interior-mutability wrapper, and lifetime annotation the change introduces.
- Name the error type and its conversion boundary; a surviving `unwrap` needs a written reason, not silence.
- Keep compilation, clippy, tests, Miri, sanitizers, and loom as observed-only evidence.

Handoff policy:

Keep the ownership shape, error-type choice, API surface, gate list, and the UB escalation verdict in Hermes. Record compilation, clippy output, test results, Miri runs, sanitizer runs, and loom runs only from executor or wrapper observed evidence.

Required inputs:

- the crate, module, or function being changed
- whether the change touches `unsafe`, raw pointers, FFI, `MaybeUninit`, or a lock-free primitive
- the crate's edition, MSRV, and async runtime when relevant
- existing error type and public API stability constraints
- the gate commands the repository already runs
- observed compiler, clippy, test, and Miri/sanitizer evidence for completion claims

Expected outputs:

- rust_change_contract/v1
- ownership_shape/v1
- error_and_api_contract/v1
- rust_gate_list/v1
- ub_escalation_verdict/v1
- ub_discipline_checklist/v1 when the escalation triggers
- observed_rust_gate_evidence/v1 when observed

Artifact expectations:

- rust_change_contract/v1 names the crate, the change, and the escalation verdict on its first line
- ownership_shape/v1 states who owns each value, which borrows cross a function or await boundary, and where a clone is deliberate rather than a borrow-checker surrender
- error_and_api_contract/v1 names the error type, its conversion boundary, and every `unwrap`, `expect`, or `panic!` that survives with its justification
- rust_gate_list/v1 lists the exact commands the executor must run and pass
- ub_escalation_verdict/v1 is `escalated` or `not_escalated` with the trigger that decided it
- ub_discipline_checklist/v1 adds the Miri, sanitizer, and loom-style concurrency requirements when escalated
- compiler, clippy, test, Miri, sanitizer, and loom results only when observed

Safety rules:

- Do not claim compilation, clippy cleanliness, passing tests, a Miri run, a sanitizer run, or a loom run from a prepared Rust contract.
- The UB escalation is deterministic, not a judgment call: if the change touches `unsafe`, `*mut`/`*const`, FFI or `extern`, `MaybeUninit`, `unsafe impl Send`/`Sync`, `transmute`, or a hand-written lock-free primitive, escalate.
- When escalated, a change is not ready for handoff until the UB checklist names the Miri, sanitizer, and concurrency-testing requirement for it.
- Never present `unsafe` as safe because it compiles: the compiler does not check the invariant an `unsafe` block asserts.
- Do not silence a borrow-checker error with a clone, `Rc<RefCell<_>>`, or `unsafe` without naming the ownership decision that made it necessary.
- Do not run cargo, Miri, sanitizers, or any toolchain from OMH core.

## Runtime Evidence

Preferred harness for this skill: `coding-handling`.

```sh
omh runtime record --skill rust --harness coding-handling --status started
```

Record observed delegation results; otherwise return `not_available` or `not_observed`.
Prepared OMH routing is not execution, review, CI, merge-readiness, or merge evidence.
- Treat wrapper memory/context summaries as advisory local context, not proof of opaque Hermes memory reads or changes.
Preserve workflow intent and stop conditions; verify before claiming completion.

Use Hermes-native subagent/delegation features when available: native subagents -> Hermes delegation when available, otherwise sequential lanes.

Shared product, compatibility, topology, memory, harness, and execution rules: `omh-routing/references/skill-common-rail.md`. Load it when applicable; otherwise name an unavailable capability.