crates.io: trusted publishing first, token secret as fallback

[konard]

Organization policy: every pipeline publishes through trusted publishing (OIDC) first and falls back to a token only when OIDC is unavailable.

Changes

• rust-lang/crates-io-auth-action step: continue-on-error: true. A missing or mismatched trusted publisher, or an OIDC outage, no longer stops the release.
• Steps that use the crates.io token (preflight and publish): ${{ steps.<auth>.outputs.token || secrets.CARGO_REGISTRY_TOKEN || secrets.CARGO_TOKEN }}.
• rust.yml declares CARGO_REGISTRY_TOKEN / CARGO_TOKEN as optional workflow_call secrets. js.yml already passes them through secrets: inherit.
• Changelog fragments.
• CI flake fix (experiments/issue-209-docker.mjs): the Reproduce stale-sample OOM attribution (Linux) step failed on this PR (run 38429115626) and on main (run 38277995076), each time with Unexpected attribution for main-oom and 0 test failures. In both failing runs, Docker's oom events list only the child's kill. Every passing run lists two events: the child, then the main process about 30 s later. Without that final event the probe has no evidence from exit time (its cgroup sample is 30 s old), so attribution can't succeed. The probe now retries main-oom up to 3 times only when no recent Docker oom event exists. If the event is present but attribution is still wrong, it fails on the first attempt. Each attempt is recorded in the evidence artifact (attempt field).

The trusted publisher on crates.io stays configured, so normal releases keep using OIDC.

Checks

• actionlint: no new findings.
• start's workflow tests (39/39) and check-javascript-first pass.
• bun run check (eslint, prettier, file size), regression-209, javascript-first-ci and ci-workflow-invariants tests pass locally. The retry condition was checked against the evidence artifacts: it returns "retry" for both failing runs and "no retry" for the passing ones. The Docker probe can't run end to end in the local sandbox (nested cgroup v2 rejects memory limits), so CI run 38462028057 is the end-to-end check, and it passes.

🤖 Generated with Claude Code

[konard]

🤖 AI Work Session Started

Started at 2026-10-13T20:14:58.888Z. Please wait for it to finish before giving feedback.

Runtime: solve v2.35.8 · tool claude · model opus · task image konard/hive-mind-dind:2.35.8@sha256:9706ce436565c715d6c2b95f615b51fa8c8ee96ddbbf56d98201e6861fdc60e9

[konard]

Working session summary

PR #217 is now all green and marked ready for review. Merge status is CLEAN: #217

What was failing: Both failing checks came from one CI step, Reproduce stale-sample OOM attribution (Linux). The test suite itself passed: 1250 tests, 0 failures. That step runs a Docker test script, experiments/issue-209-docker.mjs, which failed with Unexpected attribution for main-oom. This had nothing to do with the PR's Rust release changes; the same failure hit main on 2026-10-12 (run 38277995076).

Root cause: The script kills a container's main process by running it out of memory, and expects Docker to report an oom event for that kill.

• In every passing run I checked, Docker reports two events: one for an earlier child process, then one for the main process about 30 s later.
• In both failing runs, only the child's event appears.

Without that second event there is nothing recent to attribute the kill to, because the script's other evidence is 30 s old. So the script can't succeed in that case. Docker sometimes just doesn't deliver the event; it isn't a logic bug in the attribution code.

Fix (commit ec8b47c): The script now retries the main-process case up to 3 times, but only when Docker reported no recent oom event. If the event is there and the attribution is still wrong, it fails on the first try. Each attempt is recorded in the uploaded evidence.

Verification:

• The retry condition gives "retry" on the evidence from both failing runs and "no retry" on the passing ones.
• Lint, formatting, the file-size check and the related tests pass locally.
• I couldn't run the Docker script end to end here, because this sandbox's nested Docker rejects memory limits. The new CI run (38462028057) is the end-to-end check: it passed on the first attempt, so the retry path itself hasn't actually run in CI yet.

I updated the PR description with this evidence. There were no new review comments.

---

This summary was automatically extracted from the AI working session output.

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost: $1.043287

📊 Context and tokens usage:

• 66.4K / 1M (7%) input tokens, 15.1K / 128K (12%) output tokens

Total: (60 new + 57.8K cache writes + 1.4M cache reads) input tokens, 15.1K output tokens, $1.043287 cost

🤖 Models used:

• Tool: Anthropic Claude Code
• Requested: opus (claude-opus-5-5)
• Thinking level: high (~23999 tokens)
• Model: Claude Opus 5.5 (claude-opus-5-5)

📎 Log file uploaded as Gist (963KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

🎉 Auto-merged

This pull request has been automatically merged by hive-mind.

• All CI checks have passed