Library split, README rewrite, BUILD correctness and supply-chain gates

[codeitlikemiley]

Stacked on #3 — base is claude/bazel-single-workspace, so the diff here is only this work. Merge #3 first, then this retargets to main.

Three commits, reviewable one at a time.

commit	what
dad1279	give server a library, so both build systems run the same tests
ad18b6a	rewrite the README so it describes the repo that exists
3ecf5bf	BUILD-file correctness and supply-chain gates

---

dad1279 — the library split

server was binary-only, with two consequences.

tests/ could not test anything. An integration test can only import a library, and there was none — which is why tests/just_test.rs held nothing but assert!(true). Replaced with six tests that drive the real Router through tower::ServiceExt::oneshot: real requests, real status codes, real response bodies. One of them GETs /shared/ada and asserts the serialised corex::User — an end-to-end proof of the workspace collapse.

The repo's best assertions were never run by cargo. Both fibonacci correctness tests lived in the bench file, and harness = false means cargo compiles #[test] functions and then hands main() to criterion — so only bazel test //server:bench_test ever executed them. The algorithms and their tests moved to src/lib.rs; the bench now use server::.... bench_test is deleted, since it existed only to reach those assertions.

	before	after
cargo	3 unit tests	7 unit + 6 integration + 2 doctests
bazel	4 targets, 2 meaningful	4 targets, all meaningful

Also adds a /fib/{n} endpoint that returns 400 above MAX_FIB_INPUT = 93 instead of overflowing, with a test proving the boundary via checked_add.

ad18b6a — the README

701 lines, and a large fraction fiction. Patching individual falsehoods would leave a document still mostly wrong, so it is rewritten against bazel query. What was actually wrong:

• Four BUILD snippets were not parseable Starlark. Commit 2c55b45 — titled "fix: remove invalid square brackets from Bazel list comprehensions" — broke four correct comprehensions and added a note asserting Starlark doesn't use square brackets. It does.
• rust_benchmark does not exist, loaded and called in four places.
• Eleven edition = "2021" in a repo whose every manifest says 2024.
• Six of nine "Quick Commands" named nonexistent targets, and the 138-line cargo-runner section referenced //corex:unit_tests, //corex:example_client, //combos/shared:unit_tests and others — none real, one in a directory that doesn't exist.
• The Axum example used axum::Server::bind and /users/:id (both removed in axum 0.8) and a corex::Calculator that has never existed.
• Line 44's repin command named a repo that didn't exist and a step that isn't needed.

Now 254 lines. Verified: every //label across README, guide and CONTRIBUTING resolves against bazel query //..., and all four Starlark blocks parse.

3ecf5bf — BUILD correctness + supply chain

• Package identity. Every Bazel artifact reported CARGO_PKG_NAME = "server_bin" at version 0.0.0 while cargo said server 0.1.0. Now set explicitly on every source-compiling target.
• Dropped deps from rust_test(crate = …). rules_rust unions them, so those lists were additive — attaching criterion and ~30 crates to targets that never mention it.
• srcs are globs. Not one target used one, so the first mod helpers; would compile under cargo and fail under Bazel with E0583. The likeliest remaining one-line divergence, now closed.
• Deleted build.rs and its orphaned cargo_build_script: the script was one println! that emitted no cargo: directive, had zero reverse deps in Bazel, and re-ran for all five cargo targets on every touch because it declared no rerun-if-changed.
• deny.toml, dependabot, and a cargo-deny CI job.

A nice moment: the --incompatible_disallow_empty_glob guard added in the toolchain PR caught my own bug here — my first proxy srcs glob excluded every file in server/src, and Bazel refused to load the package instead of silently building an empty list.

cargo-deny was run, not assumed. It rejected three things in my first draft: BSD-2-Clause and Zlib are never actually encountered (they appear only inside OR expressions that MIT satisfies), the syn skip was unnecessary (cargo's graph has one version even though Bazel's has two), and wildcards = "deny" flagged corex = { path = "../corex" }, which needs allow-wildcard-paths. Final run: advisories ok, bans ok, licenses ok, sources ok.

Deliberately not included: the hermetic C toolchain

The gold linker is deprecated warning comes from Bazel autodetecting the runner's host cc. The real fix is a pinned toolchain (toolchains_llvm), and I left it out for three reasons worth your call rather than my assumption:

1. I cannot verify it here. The warning does not even reproduce in this sandbox — Bazel's autodetected toolchain picks a different linker — so I would be shipping unverified config into every contributor's build.
2. It costs every CI run. toolchains_llvm downloads a ~1 GB LLVM tarball. That is a real price to pay for a warning.
3. It changes the compiler for everyone, not just CI. That is an architectural decision, not cleanup.

The config is four lines if you want it:

bazel_dep(name = "toolchains_llvm", version = "1.4.0")
llvm = use_extension("@toolchains_llvm//toolchain/extensions:llvm.bzl", "llvm")
llvm.toolchain(llvm_version = "19.1.0")
use_repo(llvm, "llvm_toolchain")
register_toolchains("@llvm_toolchain//:all")

Say the word and I'll open it as its own PR and drive it green.

Verification

cargo fmt --all --check                        ok
cargo clippy --workspace --all-targets -D warnings   ok
cargo test --workspace --all-targets           8 suites ok
cargo deny check                               advisories ok, bans ok, licenses ok, sources ok
bazel test  --config=ci //...                  4/4 pass
bazel build --config=ci --config=lint //...    ok

---

Generated by Claude Code