# Rust migration audit evidence — 7 September 2026 Companion to the [Markdown audit](../RUST_MIGRATION_AUDIT_2026-09-07.md). Audited source: `a55b2610459a777d86cc4683acf564e901cece5c`. The application tree was clean at inventory time. Only the audit/report files were added by this task. ## Contents | File | Purpose | | -------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | | [summary.json](summary.json) | Measured language, scope, manifest, dependency and target statistics | | [projects.csv](projects.csv) | All 3,505 explicit Nx project manifests; nearest-project source ownership, language counts and declared target names | | [packages.csv](packages.csv) | All 3,324 package manifests; dependency counts and script names | | [cargo.csv](cargo.csv) | All 953 Cargo manifests; 938 have a package table, 15 are virtual workspace manifests; source ownership and metadata status | | [python-manifests.txt](python-manifests.txt) | All 83 Python project manifests | | [cargo-metadata.json](cargo-metadata.json) | Per-manifest structural check: 944 successful, nine workspace-membership failures; repeated successful warnings summarized by workspace | | [oya-build.log](oya-build.log) | Successful locked build of the selected Oya parity producer | | [oya-parity.log](oya-parity.log) | Existing comparator: 120/120 selected outputs match, maximum relative error `2.88e-15` | | [oya-math-tests.log](oya-math-tests.log) | Targeted Rust library tests: 46 passed; zero doctests discovered | | [inventory.py](inventory.py) | Reproducible full inventory collector; Python 3.11+ standard library only | | [verify.py](verify.py) | Checks catalog counts, cross-file consistency, reported domain coverage, local Markdown links and recorded probe outcomes | | [verification.log](verification.log) | Final document/evidence verification receipt | The original full intermediate inventory is deliberately not committed: it contains repeated package/project configuration already present in source. The compact catalogs retain the complete path/name population. Their rows are projections of the collector's `projects`, `packages`, and `cargo_manifests` arrays. Metadata records add actual Cargo interpretation rather than inferring workspace membership from paths. ## Reproduce the inventory Run against a checkout of the audited revision, using the collector from this evidence bundle: ```sh python3.12 docs/audits/rust-migration-2026-09-07/inventory.py \ /path/to/audited/oshun /tmp/oshun-rust-inventory.json ``` The command reads tracked source/configuration, writes the full JSON intermediate to the requested location, and reports the revision it inspected. The output parent directory must exist. It excludes the audit report and this evidence directory so their addition does not alter the measured source population. It reads working-tree content, so unrelated source edits must not be present when reproducing the baseline. Language totals are physical lines, including comments and blanks. Test/generated exclusions are explicitly heuristic. Rust inline tests remain in ordinary source files. No language count is a productivity estimate, reachability result, or product-readiness claim. Dependency counts are direct declarations; optional groups, requirements files and transitive dependencies need separate review for release planning. ## Cargo probe commands The metadata sweep executed this command serially for every manifest in the catalog: ```sh cargo +stable metadata --offline --locked --no-deps --format-version=1 \ --manifest-path ``` Host: macOS ARM64. Cargo: `1.96.1 (356927216 2026-06-26)`. `+stable` intentionally used the installed compiler rather than downloading the directory-local toolchains. The sweep took approximately 240 seconds. It returned 150 distinct workspace roots across successful invocations, including standalone package roots. That number differs from the 18 explicitly declared workspace tables. Metadata success is not compilation, full dependency resolution, lockfile freshness, or validation against an older MSRV. Nine existing membership defects remain documented in the audit. Successful warnings include ignored profile settings in non-root manifests; warnings repeat when the same workspace is inspected through multiple packages. The selected Oya producer and tests used: ```sh CARGO_BUILD_JOBS=1 cargo +stable run --locked --example parity_dump \ -p oya-math --manifest-path libs/oya/Cargo.toml CARGO_BUILD_JOBS=1 CARGO_NET_OFFLINE=true \ node libs/oya/engine/parity/check.mjs CARGO_BUILD_JOBS=1 cargo +stable test --locked --offline \ --manifest-path libs/oya/Cargo.toml -p oya-math ``` An earlier offline comparator attempt stopped because `criterion` was absent from the local cache. The locked online producer build installed the required dependencies; the final offline comparator and unit tests passed. No tracked Cargo lockfile or application source changed. Absolute checkout paths in retained logs are normalized to ``. The comparator checks a finite fixture output set, uses exact equality for integer outputs and configured absolute/relative tolerances for other values. It is useful parity evidence, not an independent proof that either implementation is mathematically correct, nor complete control-system or hardware qualification. ## Verify the delivered artifact ```sh python3.12 docs/audits/rust-migration-2026-09-07/verify.py pnpm exec prettier --check \ docs/audits/RUST_MIGRATION_AUDIT_2026-09-07.md \ docs/audits/rust-migration-2026-09-07/README.md \ docs/audits/rust-migration-2026-09-07/summary.json \ docs/audits/rust-migration-2026-09-07/cargo-metadata.json ruff check --select E9,F \ docs/audits/rust-migration-2026-09-07/inventory.py \ docs/audits/rust-migration-2026-09-07/verify.py ``` These are documentation/evidence checks. No user-facing behavior changed, so browser, mobile, GPU, provider, and Unreal release suites were not rerun for this artifact. The report identifies where those suites are mandatory for future migrations. Existing audit findings do not become successful product checks merely because the evidence verifier accepts their recorded outcomes.