fix(ci): unblock the red CI gate on main (Clippy arg order + PowerShell lint)

.claude/context/LATEST_CONTEXT.md

@@ -1,21 +1,22 @@
 # LATEST CONTEXT
 
-**Pointer →** [`pcai-context-20260606-gitops-and-system-hardening.md`](pcai-context-20260606-gitops-and-system-hardening.md)
-**ID:** `ctx-pcai-gitops-syshard-20260606` · **Date:** 2026-06-06 · **Branch:** main (PR-only ruleset enforced)
+**Pointer →** [`pcai-context-20260718-ci-restoration.md`](pcai-context-20260718-ci-restoration.md)
+**ID:** `ctx-pcai-ci-restoration-20260718` · **Date:** 2026-07-18 · **Branch:** `fix/ci-gate-pslint-clippy` → PR #58 (`MERGEABLE`, head `15f999a`)
 
 ## One-line state
-Very long session. Shipped: SSH-signing standard + **194-repo branch protection** (PR-only/signed) + non-blocking
-push monitors (`Tools/GitOps/`); GitHub account-picker fix; `.bak` profile-shim fix. Applied input-stack fixes
-**T1/T2/F3** (touchpad device + directed power, MouseKeys). Modernized AI-Media deps (torch≥2.7+cu128, Python≥3.13/uv).
-`vLLM`→Manual. `C:\codedev` confirmed NOT OneDrive-linked. Coordinated with **Codex** via agent-bus throughout.
+Re-enabled GitHub Actions (off ~3 weeks); root-caused and fixed **7 pre-existing CI gate
+failures**. Landed WIP (#57), aligned git/QA config + git-guard gate. PR #58 carries the
+final two fixes: 19 clippy `-D warnings` lints + Pester `Run.Path`. Both clippy gates
+verified exit 0 locally. Ledger: `Reports/ci-restoration-and-techdebt-20260718.md`.
 
-## Resume here
-1. **REBOOT** to activate T2; measure touchpad with `Watch-InputGlitch.ps1`.
-2. **NVIDIA driver** — two-package manual fix (Enterprise 610.47 + Have-Disk GRD 610.47 for 5060 Ti; WU paused).
-   USER-DRIVEN — see `Reports/system-assessment-20260606/nvidia-driver-plan.md`. Clears Code 31 + cursor/DWM risk.
-3. **Lenovo Vantage** updates: touchpad firmware **ds571229**, BIOS/EC, IR camera (GUI).
-4. **Test** AI-Media deps: `cd AI-Media && uv sync`; verify `torch.cuda.get_device_capability()`.
-5. **PC-AI CI is RED** (9 failures) + 3 Dependabot rust-openssl alerts — triage.
-6. Optional optimizations (power plan / pagefile / Dell / BitLocker / ghost HID) — see context file.
+## Resume here (awaiting user go-ahead — nothing auto-merged)
+1. **Merge sequence:** #58 → #57 (rebase) → Dependabot safe batch #56/#50/#49/#52 →
+   #51 tokenizers & #53 windows 0.58→0.62 **gated behind a local `cargo build`**.
+2. **65 pre-existing PS Unit-test failures** — surfaced (not caused) by the Pester fix;
+   attribution proven. Repair as separate `test/repair-unit-contracts` PR, LLM-Logging
+   first (21/21 broken). NOT started; needs scope confirmation (no silenced tests).
+3. **Key fact:** CI is **not** a merge gate (ruleset has no required status checks).
+4. **Latent:** `unused manifest key: package.lints` in 3 Cargo.toml; 126 TODO-ledger
+   items; Gemini/vLLM + google-access integrations remain design-stage backlog.
 
-Full detail: the context file above + `machine-reliability.TODO.md` + `boot.TODO.md`.
+Full detail: the context file above + `Reports/ci-restoration-and-techdebt-20260718.md`.

.claude/context/pcai-context-20260718-ci-restoration.md

@@ -0,0 +1,45 @@
+# PC-AI Context — CI Restoration & Tech-Debt Ledger
+
+**ID:** `ctx-pcai-ci-restoration-20260718` · **Date:** 2026-07-18
+**Branch:** `fix/ci-gate-pslint-clippy` → PR #58 (`MERGEABLE`) · **Head:** `15f999a`
+
+## One-line state
+Re-enabled GitHub Actions (off ~3 weeks), root-caused **7 distinct pre-existing CI gate
+failures** and fixed all. Landed WIP (PR #57), aligned git/QA config, provisioned
+git-guard repo gate. PR #58 carries the final two fixes (19 clippy `-D warnings` lints +
+Pester `Run.Path`). Full ledger: `Reports/ci-restoration-and-techdebt-20260718.md`.
+
+## What shipped (commits on fix/ci-gate-pslint-clippy)
+- `67f6467` build: `--locked/--frozen` before cargo `--` separator
+- `37993d5` build: route `--`-separated cargo cmds past pwsh -File wrapper
+- `7e013fe` lint: PowerShell parse errors (`$var:` interp, malformed foreach)
+- `18b6dd3` lint: 21 PSScriptAnalyzer findings (ShouldProcess/IEX/plaintext-pw)
+- `ed4251d` qa: `.qa-gate.conf` git-guard repo Rust gate
+- `c873fd2` deps: candle-core/transformers/flash-attn 0.9→0.10 (media tree)
+- `7515e03` lint: 19 workspace clippy `-D warnings` (both gates exit 0, re-verified)
+- `15f999a` test: Pester Run.Path → Tests/Unit,Tests/Integration
+
+## Verified green locally (exit 0)
+- `clippy --all-targets --no-default-features --features server,ffi -- -D warnings`
+- `clippy --workspace --all-targets --no-deps -- -D warnings -A clippy::type_complexity`
+
+## Key discoveries
+- **CI is NOT a merge gate.** Ruleset `dtm-default-protection` (id 17356124) = signed
+  commits + PR (0 approvals), **no required_status_checks**. Red CI ≠ blocked.
+- **65 pre-existing PS Unit-test failures** surfaced (not caused) by the Pester fix.
+  Attribution proven: identical counts repo-root vs Tests/ cwd; all use `$PSScriptRoot`.
+  Clusters: LLM-Logging 21/21, WSL vsock bridge 13/20, process-idle ~5. Tracked debt.
+- **Stray corruption caught:** `Config/llm-config.json` was gutted (37 lines) by an
+  unknown prior process — reverted; HEAD intact.
+
+## Resume here (awaiting user go-ahead — nothing auto-merged)
+1. **Merge sequence:** #58 → #57 (rebase) → Dependabot safe batch #56/#50/#49/#52 →
+   #51 tokenizers & #53 windows 0.58→0.62 **gated behind local `cargo build`**.
+2. **65-test repair** as separate `test/repair-unit-contracts` PR — start with
+   LLM-Logging (whole file broken). NOT started; needs scope confirmation (no
+   reward-hacked/silenced tests).
+3. **Latent:** `unused manifest key: package.lints` in 3 Cargo.toml (should be `[lints]`).
+4. **Backlog (not started):** 126 TODO-ledger items; Gemini/vLLM + google-access
+   grand-integration asks remain design-stage.
+
+Full detail: `Reports/ci-restoration-and-techdebt-20260718.md`

.qa-gate.conf

@@ -0,0 +1,29 @@
+# git-guard repo-level QA gate — PC_AI (Rust-heavy Windows workstation agent).
+#
+# Format: flat KEY=VALUE, one per line, '#' comments (see the global default at
+# ~/.git-hooks/common/qa-gate.conf / C:\codedev\git-guard\hooks\common\qa-gate.conf).
+# Per-check values: block (refuse commit) | warn (print, proceed) | off (skip).
+# A repo-root .qa-gate.conf OVERRIDES the global defaults; unset keys inherit them.
+#
+# NOTE: this file is INERT until git-guard is installed for the account
+# (`sh C:\codedev\git-guard\install.sh` sets the global core.hooksPath). It does
+# not change behavior on its own. The authoritative quality gate remains
+# .github/workflows/ci.yml (fmt + clippy -D warnings + PS lint + tests); these
+# keys mirror that Rust bar at commit time for contributors running git-guard,
+# composing with the repo's existing lefthook.yml pre-commit hooks.
+
+qa.enabled=on
+
+# --- Rust (this repo is Rust-heavy: pcai_core 7-crate workspace + FunctionGemma)
+# Enforce formatting and clippy at commit time. clippy is slower than fmt; relax
+# to `warn` if per-commit latency becomes a problem (CI still blocks on it).
+rust.fmt=block
+rust.clippy=block
+
+# --- Structural / security rules (ast-grep). The Rust BLOCK trio
+# (avoid-static-mut / no-glob-reexport / unsafe-with-panic) always blocks; keep
+# the rest advisory to avoid false positives on generated/FFI code.
+astgrep=warn
+
+# --- Filesystem hygiene (NukeNul reserved-name cleanup) stays mandatory.
+nul_cleanup=block

Build.ps1

@@ -801,14 +801,44 @@ function Add-CargoDependencyFlags {
         return $CargoArgs
     }
 
-    if ($script:DependencyStrategy -eq 'locked') {
-        return $CargoArgs + @('--locked')
+    $flag = switch ($script:DependencyStrategy) {
+        'locked' { '--locked' }
+        'frozen' { '--frozen' }
+        default { $null }
     }
-    if ($script:DependencyStrategy -eq 'frozen') {
-        return $CargoArgs + @('--frozen')
+    if (-not $flag) {
+        return $CargoArgs
+    }
+
+    # Cargo-level flags MUST precede the '--' separator. Anything after '--' is
+    # forwarded verbatim to the underlying tool (rustc / clippy-driver), which
+    # rejects '--locked'/'--frozen' and fails the command in <1s. Commands like
+    # `clippy ... -- -D warnings` therefore need the flag inserted before '--',
+    # not appended. (Root cause of the green-CI-blocking Clippy failure.)
+    $sepIndex = [array]::IndexOf($CargoArgs, '--')
+    if ($sepIndex -gt 0) {
+        $before = @($CargoArgs[0..($sepIndex - 1)])
+        $after = @($CargoArgs[$sepIndex..($CargoArgs.Count - 1)])
+        return $before + @($flag) + $after
     }
 
-    return $CargoArgs
+    return $CargoArgs + @($flag)
+}
+
+function Write-RustBuildFailureLog {
+    param([Parameter(Mandatory)][string]$LogFile)
+
+    # cargo output is Tee'd to a log file and suppressed from the console during
+    # the run. On failure, surface the tail so CI consoles (and local runs) show
+    # the real compiler/clippy error instead of only "command N failed".
+    if (Test-Path $LogFile) {
+        $tail = Get-Content -LiteralPath $LogFile -Tail 60 -ErrorAction SilentlyContinue
+        if ($tail) {
+            Write-Host '  ---- cargo output (tail) ----' -ForegroundColor DarkYellow
+            $tail | ForEach-Object { Write-Host "  $_" }
+            Write-Host "  ---- (full log: $LogFile) ----" -ForegroundColor DarkYellow
+        }
+    }
 }
 
 function Invoke-RustBuildCommand {
@@ -827,7 +857,16 @@ function Invoke-RustBuildCommand {
 
     $effectiveCargoArgs = Add-CargoDependencyFlags -CargoArgs $CargoArgs
 
-    if (Test-Path $script:RustBuildWrapper) {
+    # The Invoke-RustBuild.ps1 wrapper is spawned via `pwsh -File`, whose param
+    # binder consumes a bare `--` as the end-of-parameters token and then fails
+    # with "parameter name '' is ambiguous". Any cargo command that forwards
+    # tool args after `--` (e.g. `clippy ... -- -D warnings`) must therefore use
+    # the direct cargo path below, which splats the args as an array with no
+    # command-line reparsing. The wrapper's lld/sccache/preflight machinery is
+    # irrelevant to lint/quality commands anyway.
+    $hasToolSeparator = $effectiveCargoArgs -contains '--'
+
+    if ((Test-Path $script:RustBuildWrapper) -and -not $hasToolSeparator) {
         $shellExe = Resolve-PowerShellExecutable
         $wrapperArgs = @('-NoProfile', '-File', $script:RustBuildWrapper, '-Path', $Path, '-CargoArgs') + $effectiveCargoArgs
 
@@ -842,7 +881,9 @@ function Invoke-RustBuildCommand {
         }
 
         & $shellExe @wrapperArgs 2>&1 | Tee-Object -FilePath $LogFile | Out-Null
-        return ($LASTEXITCODE -eq 0)
+        $succeeded = ($LASTEXITCODE -eq 0)
+        if (-not $succeeded) { Write-RustBuildFailureLog -LogFile $LogFile }
+        return $succeeded
     }
 
     Push-Location $Path
@@ -865,13 +906,16 @@ function Invoke-RustBuildCommand {
                 $effectivePreflightArgs = Add-CargoDependencyFlags -CargoArgs $preflightArgs
                 & cargo @effectivePreflightArgs 2>&1 | Tee-Object -FilePath $LogFile | Out-Null
                 if ($LASTEXITCODE -ne 0) {
+                    Write-RustBuildFailureLog -LogFile $LogFile
                     return $false
                 }
             }
         }
 
         & cargo @effectiveCargoArgs 2>&1 | Tee-Object -FilePath $LogFile | Out-Null
-        return ($LASTEXITCODE -eq 0)
+        $succeeded = ($LASTEXITCODE -eq 0)
+        if (-not $succeeded) { Write-RustBuildFailureLog -LogFile $LogFile }
+        return $succeeded
     } finally {
         Pop-Location
     }

Native/pcai_core/pcai_core_lib/src/hash.rs

@@ -126,7 +126,7 @@ pub fn find_duplicates(
     }
 
     // Sort by wasted bytes descending
-    results.sort_by(|a, b| b.wasted_bytes.cmp(&a.wasted_bytes));
+    results.sort_by_key(|r| std::cmp::Reverse(r.wasted_bytes));
 
     Ok(DuplicateResult {
         status: "Success".to_string(),

Native/pcai_core/pcai_core_lib/src/performance/disk.rs

@@ -275,7 +275,7 @@ pub fn get_disk_usage(root_path: &str, top_n: usize) -> io::Result<(DiskUsageSta
         })
         .collect();
 
-    entries.sort_by(|a, b| b.size_bytes.cmp(&a.size_bytes));
+    entries.sort_by_key(|e| std::cmp::Reverse(e.size_bytes));
     entries.truncate(top_n);
 
     Ok((stats, entries))

Native/pcai_core/pcai_core_lib/src/performance/optimizer.rs

@@ -737,8 +737,10 @@ mod tests {
 
     #[test]
     fn test_memory_pressure_to_json_label() {
-        let mut report = MemoryPressureReport::default();
-        report.status = PcaiStatus::Success;
+        let mut report = MemoryPressureReport {
+            status: PcaiStatus::Success,
+            ..Default::default()
+        };
 
         report.pressure_level = 0;
         assert_eq!(memory_pressure_to_json(&report).pressure_label, "low");

Native/pcai_core/pcai_core_lib/src/performance/process.rs

@@ -263,7 +263,7 @@ pub fn get_top_processes(top_n: usize, sort_by: &str) -> (ProcessStats, Vec<Proc
                 .partial_cmp(&a.cpu_usage)
                 .unwrap_or(std::cmp::Ordering::Equal)
         }),
-        _ => processes.sort_by(|a, b| b.memory_bytes.cmp(&a.memory_bytes)),
+        _ => processes.sort_by_key(|p| std::cmp::Reverse(p.memory_bytes)),
     }
 
     processes.truncate(top_n);

Native/pcai_core/pcai_core_lib/src/preflight/vram_audit.rs

@@ -140,7 +140,7 @@ pub fn vram_snapshot_all() -> Result<Vec<GpuVramSnapshot>> {
             .collect();
 
         // Sort by VRAM usage descending so top consumers appear first.
-        processes.sort_by(|a, b| b.used_mb.cmp(&a.used_mb));
+        processes.sort_by_key(|p| std::cmp::Reverse(p.used_mb));
 
         snapshots.push(GpuVramSnapshot {
             index: idx,

Native/pcai_core/pcai_inference/src/backends/mod.rs

@@ -207,10 +207,7 @@ mod tests {
     fn test_backend_type_no_features() {
         // With no backend features enabled, BackendType has no variants,
         // so we can't construct one. The enum is effectively empty.
-        // This test verifies the module compiles correctly without backends.
-        assert!(
-            true,
-            "BackendType correctly has no constructible variants without features"
-        );
+        // This test verifies the module compiles correctly without backends —
+        // reaching this point at runtime is the assertion.
     }
 }