Rust native design facts - Phase 6

Status: P6_030 accepted and closed.

This bounded slice switches the selected Windows Cruncher design-review compiled graph and version-E .net artifact to one validated kicad-monkey-native design-facts-a1 result. Python continues to own design JSON, netlist JSON, schematic and PCB presentation, manifests, README content, and command orchestration.

Versioned boundary

The accepted a0 request/result and the a0/a1 handshakes remain unchanged. handshake-a2 advertises the existing operations followed by design-facts-a1. Strict generated A1 request/result contracts add the immutable design-facts-bounded-a1 resource profile, a native source-snapshot digest, and version-E netlist byte-count and SHA-256 integrity fields.

The source digest is domain-separated and covers the manifest root and optional project paths plus every slot's path, kind, length, and exact bytes in slot order. Python computes it from the current in-memory KiCad objects; Rust independently computes it from the capability-contained files it actually opened. A mismatch is terminal before facts can be injected into a design.

Provider and compatibility

NativeDesignFactsProvider is selected once on Windows. Missing, incompatible, timed-out, resource-rejected, malformed, stale, or metadata- mismatched native output is never retried through the Python graph builder or Python version-E writer. Linux and macOS retain their explicit Python route until a later platform promotion.

The provider preserves Cruncher's established absolute schematic source, empty date, and kicad_cruncher tool metadata. The validated graph is injected through Monkey's public current-state fingerprint guard, then reused unchanged by Design JSON, the standalone graph artifact, and schematic SVG enrichment. The native version-E text is published directly. Its ordering is the deterministic native serialization policy; P6_030 does not claim byte equality with the retained Python serializer.

Resources and publication

Both design-facts versions receive an allocation-bounded JSON preflight before generated decoding: at most 65,536 nodes and nesting depth 64. Source, path, output, graph, connectivity, expansion, project, and netlist work stays clamped to the named application's fixed profile and never raises a core default. The A1 profile assigns wildcard matching its own 2,000,000-work-unit aggregate ceiling rather than reusing the 250,000 retained-family item cap; the governed Jumperless project consumes 1,025,852 units. Accepted A0 keeps its original 250,000-unit behavior. Graph and netlist construction, validation, hashing, and bounded serialization complete before stdout publication.

Cruncher invokes the provider once immediately after loading the design and before writing artifacts. The existing sibling-tree transaction publishes only after the graph, netlists, SVGs, manifest, and README all succeed; a later failure preserves the previous destination.

Evidence

Generated contract mutations cover missing, null, literal, tuple-order, UTF-8 length, hash, and empty-netlist failures. Native tests cover exact and one-over request bytes, nodes, and depth; digest slot ordering and byte sensitivity; deterministic repeated output; bounded diagnostics; and no partial stdout. Monkey client tests cover source, metadata, byte, hash, and hostile-process rejection.

Cruncher L3_009 proves one provider call, zero Python graph/netlist-writer retry, graph reuse, deterministic public aliases, provenance, and transactional failure. Root Rack L3_025 composes that real-process provider evidence with the four governed hierarchy projects from L3_020. The required CI and publication chain composes that Rack gate with the preceding installed two-wheel design-review smoke and uses the same Windows-native executable shipped by Monkey; Cruncher retains only its normal public kicad-monkey dependency. The final local Windows Rack run passed its single release-acceptance case in 84.62 seconds, composing 36 focused contract, client, provider, and transport tests; the independent full L3_020 reference-project parity suite passed 5/5 in 52.92 seconds.

The final Windows package gate rebuilt KiCad Monkey 2026.8.18 from its public source distribution, installed that platform wheel with the universal Cruncher wheel in isolation, and passed the real native design-review and PCB workflows. Three independent contract, Python-authority, and Rust reviews approved the completed boundary.

Deferred

The public kicad_monkey.design.a0 and kicad_monkey.netlist.a0 JSON payloads remain Python-owned. The internal Rust netlist model is not promoted as a public JSON contract. Full CLI artifact and exit-code compatibility remains P6_040, and the final platform exit remains P6_050.