feat!: enforce #[non_exhaustive] policy via clippy lints

Cargo.toml

@@ -26,6 +26,30 @@ authors = ["Amazon Web Services"]
 keywords = ["openjd", "openjobdescription", "render-farm", "job-template", "rendering"]
 categories = ["command-line-utilities", "parser-implementations"]
 
+# Workspace lints. Inherited by each crate via `[lints] workspace = true`.
+#
+# `exhaustive_enums` / `exhaustive_structs` are `restriction`-group lints that
+# fire only on *exported* (publicly reachable) types — private and `pub(crate)`
+# items never trigger them. Enabling them here makes the SemVer growth question
+# an explicit, reviewed decision for every new public type instead of something
+# a contributor has to remember. Every existing site is either marked
+# `#[non_exhaustive]` or carries an `#[expect(..., reason = "...")]` recording
+# why it is intentionally closed.
+#
+# The rule for which way to go is documented in
+# `specs/non-exhaustive-policy.md`. In short: types that mirror a numbered
+# OpenJD spec section grow by extension RFC and are marked `#[non_exhaustive]`;
+# types representing a decidable logical concept, and runtime state machines a
+# consumer must react to, stay closed.
+#
+# Level is `deny`, not `warn`: a new public type that has not made this
+# decision is a hard error at every invocation, not just under CI's
+# `-D warnings`. Local `cargo clippy` / `cargo build` fails too, so the
+# decision surfaces while the type is being written rather than in CI.
+[workspace.lints.clippy]
+exhaustive_enums = "deny"
+exhaustive_structs = "deny"
+
 [workspace.dependencies]
 shlex = "2"
 serde = { version = "1", features = ["derive"] }

crates/openjd-cli/Cargo.toml

@@ -37,3 +37,10 @@ windows = { version = "0.62", features = [
     "Win32_Foundation",
     "Win32_System_Console",
 ] }
+
+# Exempt: a binary crate: its `pub` items are clap argument structs and internal
+# helpers, not a library API any downstream crate can depend on.
+# See specs/non-exhaustive-policy.md.
+[lints.clippy]
+exhaustive_enums = "allow"
+exhaustive_structs = "allow"

crates/openjd-expr/Cargo.toml

@@ -30,3 +30,6 @@ serde_json = { workspace = true }
 ruff_python_parser = { package = "rustpython-ruff_python_parser", version = "0.15.8" }
 ruff_python_ast = { package = "rustpython-ruff_python_ast", version = "0.15.8" }
 ruff_text_size = { package = "rustpython-ruff_text_size", version = "0.15.8" }
+
+[lints]
+workspace = true

crates/openjd-expr/src/eval/evaluator.rs

@@ -47,6 +47,10 @@ pub const DEFAULT_OPERATION_LIMIT: usize = 10_000_000;
 
 /// Result of expression evaluation.
 #[derive(Debug)]
+#[expect(
+    clippy::exhaustive_structs,
+    reason = "fixed tuple of a decidable concept"
+)]
 pub struct EvalResult {
     pub value: ExprValue,
     pub peak_memory: usize,

crates/openjd-expr/src/format_string.rs

@@ -543,6 +543,10 @@ fn parse_segments(input: &str, profile: &ExprProfile) -> Result<Vec<Segment>, Ex
 /// Carries the position of the failing interpolation within the format string
 /// so callers can produce caret-style diagnostics or structured error responses.
 #[derive(Debug, Clone)]
+#[expect(
+    clippy::exhaustive_structs,
+    reason = "fixed tuple of a decidable concept"
+)]
 pub struct FormatStringValidationError {
     /// Description of what went wrong (e.g. "Undefined variable 'Param.X'").
     pub message: String,

crates/openjd-expr/src/function_library.rs

@@ -45,6 +45,10 @@ pub type FunctionImpl = Arc<
 
 /// A registered function overload.
 #[derive(Clone)]
+#[expect(
+    clippy::exhaustive_structs,
+    reason = "fixed tuple of a decidable concept"
+)]
 pub struct FunctionEntry {
     pub signature: ExprType, // TypeCode::Signature
     pub implementation: FunctionImpl,

crates/openjd-expr/src/path_mapping.rs

@@ -11,6 +11,7 @@ use serde::{Deserialize, Serialize};
 /// Path format (POSIX, Windows, or URI).
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
 #[serde(rename_all = "UPPERCASE")]
+#[non_exhaustive]
 pub enum PathFormat {
     #[serde(alias = "posix", alias = "Posix")]
     Posix,
@@ -36,13 +37,40 @@ impl PathFormat {
 /// <https://github.com/OpenJobDescription/openjd-specifications/wiki/How-Jobs-Are-Run#path-mapping>
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
+#[non_exhaustive]
 pub struct PathMappingRule {
     pub source_path_format: PathFormat,
     pub source_path: String,
     pub destination_path: String,
 }
 
 impl PathMappingRule {
+    /// Construct a path mapping rule.
+    ///
+    /// Prefer this over a struct literal: `PathMappingRule` is
+    /// `#[non_exhaustive]`, so literal construction is not available to
+    /// other crates.
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// use openjd_expr::{PathFormat, PathMappingRule};
+    ///
+    /// let rule = PathMappingRule::new(PathFormat::Posix, "/mnt/shared", "Z:\\shared");
+    /// assert_eq!(rule.source_path, "/mnt/shared");
+    /// ```
+    pub fn new(
+        source_path_format: PathFormat,
+        source_path: impl Into<String>,
+        destination_path: impl Into<String>,
+    ) -> Self {
+        Self {
+            source_path_format,
+            source_path: source_path.into(),
+            destination_path: destination_path.into(),
+        }
+    }
+
     /// Apply this rule using host-native output separators.
     /// Equivalent to Python's behavior (uses `os.name` to pick separator).
     pub fn apply(&self, path: &str) -> Option<String> {

crates/openjd-expr/src/profile.rs

@@ -95,6 +95,7 @@ impl ExprExtension {
 /// the previous split between `FunctionLibrary::with_host_context` and
 /// `FunctionLibrary::with_unresolved_host_context`.
 #[derive(Debug, Clone, Default)]
+#[non_exhaustive]
 pub enum HostContext {
     /// No host-context functions are registered. Default.
     #[default]

crates/openjd-expr/src/range_expr.rs

@@ -33,6 +33,10 @@ pub const MAX_RANGE_EXPR_CHUNKS: usize = 10_000;
 
 /// Error raised when parsing a range expression fails.
 #[derive(Debug, Clone)]
+#[expect(
+    clippy::exhaustive_structs,
+    reason = "fixed tuple of a decidable concept"
+)]
 pub struct RangeExprError {
     pub expr: String,
     pub message: String,

crates/openjd-expr/src/symbol_table.rs

@@ -59,6 +59,10 @@ pub const MAX_SYMBOL_TABLE_ENTRIES: usize = 100_000;
 ///
 /// For example, setting `"A.B.C"` when `"A.B"` is already a scalar value.
 #[derive(Debug, Clone)]
+#[expect(
+    clippy::exhaustive_structs,
+    reason = "fixed tuple of a decidable concept"
+)]
 pub struct SymbolTableError {
     pub key: String,
     pub conflict: String,
@@ -90,6 +94,10 @@ impl From<SymbolTableError> for crate::error::ExpressionError {
 
 /// Entry in a symbol table: either a nested table or a value.
 #[derive(Debug, Clone)]
+#[expect(
+    clippy::exhaustive_enums,
+    reason = "closed dichotomy: matching every arm is the API"
+)]
 pub enum SymbolTableEntry {
     Table(SymbolTable),
     Value(ExprValue),

crates/openjd-expr/src/uri_path.rs

@@ -10,6 +10,10 @@
 
 /// Parsed URI: authority (`scheme://host`) and path segments.
 #[derive(Debug, Clone)]
+#[expect(
+    clippy::exhaustive_structs,
+    reason = "internal mechanics, publicly reachable but not a spec surface"
+)]
 pub struct UriParts {
     pub authority: String,
     pub path_parts: Vec<String>,

crates/openjd-expr/src/value.rs

@@ -1399,6 +1399,10 @@ impl From<crate::types::ExprType> for ExprValue {
 }
 
 /// Zero-allocation iterator over list elements.
+#[expect(
+    clippy::exhaustive_enums,
+    reason = "structural mirror of another type; not independently extensible"
+)]
 pub enum ListIter<'a> {
     Bool(std::slice::Iter<'a, bool>),
     Int(std::slice::Iter<'a, i64>),

crates/openjd-expr/tests/integration/test_function_context.rs

@@ -177,11 +177,7 @@ fn method_syntax_with_host_context() {
 // === Path mapping rules ===
 #[test]
 fn with_path_mapping_rules() {
-    let rule = PathMappingRule {
-        source_path_format: PathFormat::Posix,
-        source_path: "/old".into(),
-        destination_path: "/new".into(),
-    };
+    let rule = PathMappingRule::new(PathFormat::Posix, "/old", "/new");
     let mut st = SymbolTable::new();
     st.set("P", ExprValue::String("/old/file.txt".into()))
         .unwrap();
@@ -199,11 +195,7 @@ fn with_path_mapping_rules() {
 }
 #[test]
 fn unmatched_path_unchanged() {
-    let rule = PathMappingRule {
-        source_path_format: PathFormat::Posix,
-        source_path: "/old".into(),
-        destination_path: "/new".into(),
-    };
+    let rule = PathMappingRule::new(PathFormat::Posix, "/old", "/new");
     let mut st = SymbolTable::new();
     st.set("P", ExprValue::String("/other/file.txt".into()))
         .unwrap();
@@ -334,11 +326,7 @@ fn path_with_suffix_without_host_context() {
 // === Function-syntax apply_path_mapping with rules ===
 #[test]
 fn function_syntax_with_path_mapping_rules() {
-    let rule = PathMappingRule {
-        source_path_format: PathFormat::Posix,
-        source_path: "/old/path".into(),
-        destination_path: "/new/path".into(),
-    };
+    let rule = PathMappingRule::new(PathFormat::Posix, "/old/path", "/new/path");
     let lib = FunctionLibrary::for_profile(
         &ExprProfile::current().with_host_context(HostContext::with_rules(vec![rule])),
     );
@@ -354,11 +342,7 @@ fn function_syntax_with_path_mapping_rules() {
 }
 #[test]
 fn function_syntax_unmatched_path_unchanged() {
-    let rule = PathMappingRule {
-        source_path_format: PathFormat::Posix,
-        source_path: "/specific/path".into(),
-        destination_path: "/mapped/path".into(),
-    };
+    let rule = PathMappingRule::new(PathFormat::Posix, "/specific/path", "/mapped/path");
     let lib = FunctionLibrary::for_profile(
         &ExprProfile::current().with_host_context(HostContext::with_rules(vec![rule])),
     );