v0.9.5 - RC (stable)

dev-tools v0.9.5 — The Complete Verification Collection

Suite-complete milestone. The 14-crate dev-* verification collection is fully published, every sub-crate is hardened against the audit pass, and dev-tools is the single one-import entry point with a feature flag per verification dimension. The path-dep ^0.9 SemVer constraint means sub-crate patch fixes flow through automatically — no umbrella republish required for downstream consumers to pick up bug fixes in the sibling crates.

This is the RC-prep release. 0.9.x patches will fix bugs surfaced through community use. 1.0.0 follows once the multi-crate ergonomic story has had time to settle in real projects.

What is dev-tools?

dev-tools is the one-import entry point for the dev-* verification collection. Instead of pulling a dozen separate crates and wiring them together, you add one dependency and turn on the parts you need with feature flags. The collection answers, with machine-readable evidence, the questions a Rust crate maintainer cares about — did tests pass, did performance regress, did async code hang, did failure recovery work, what's the kill-rate of the test suite, are there CVEs or banned licenses in the dep tree, does the CI workflow match the feature set, and so on. Every check flows through dev-report — a stable, versioned JSON schema. No log scraping.

What's new since 0.9.3

Seven new sub-crates landed (0.9.4)

The collection grew from six to thirteen siblings plus the umbrella, all published independently and re-exported through dev-tools as feature flags:

• dev-coverage — wraps cargo-llvm-cov; line / function / region kill rates with a baseline-diff regression gate.
• dev-security — wraps cargo-audit + cargo-deny; CVE scan, license policy, banned-crate detection.
• dev-deps — wraps cargo-udeps + cargo-outdated; unused / outdated / major-lag findings.
• dev-ci — Generator builder for GitHub Actions workflow YAML, plus a dev-ci CLI binary.
• dev-fuzz — wraps cargo-fuzz; budgeted runs, crash / timeout / OOM with deterministic reproducer paths.
• dev-flaky — N-iteration cargo test; stable / flaky / broken classification with reliability scoring.
• dev-mutate — wraps cargo-mutants; kill rate with surviving-mutant evidence and threshold gating.

The full feature now pulls in all twelve sub-crates (was five). The default stays at fixtures + bench + report so the default build footprint stays small.

Reframing for the dev audience (0.9.5)

The subtitle, tagline, "What it is", and "Why a verification suite" sections were rewritten to lead with developer pain — silent regressions, async hangs, fragile code, tests that pass without asserting, vulnerable transitive deps — rather than AI code generation. AI assistance is demoted to one of several consumers; the same JSON output drives CI gates, release pipelines, dashboards, jq one-liners, or an AI assistant validating its own work.

Subtitle changed from VERIFICATION TOOLKIT FOR AI-ASSISTED RUST DEVELOPMENT to RUST VERIFICATION TOOLKIT — TESTS · BENCHES · COVERAGE · FUZZ · AUDIT. Cargo.toml description + keywords were retuned across all 14 crates for crates.io search, dropping verification / ai-tools placeholders in favor of crate-specific terms (sarif, junit, snapshot, golden, fault-injection, llvm-cov, cargo-fuzz, cargo-mutants, udeps, etc.).

CLI cookbook for dev-ci

dev-tools' README now carries an opinionated cookbook for the dev-ci CLI binary — install instructions plus eight named usage patterns (defaults, multi-OS matrix, path-dep wiring, preview-without-write, custom output, workspace, branch filter, no-cache), an exit-code reference, and a review-friendly --print | diff pattern for keeping the generated workflow in version control.

The CLI itself is the only binary in the collection right now. A polished multi-tool entry point is on the roadmap.

Roadmap section

A planned-libraries status table now ships in the README, tracking:

• dev-property — property-based testing wrapper (proptest / quickcheck)
• dev-sanitizer — ASAN / MSAN / TSAN integration
• dev-build — build-time and binary-size regression tracking
• dev-doc — doc-test orchestration and doc-coverage gates
• dev-msrv — MSRV verification across the dep tree

Status legend: ✅ Released · 🧪 Testing · 🚧 In development · 📋 Planned.

Audit-pass hardening (cascade)

A multi-agent audit pass scanned every sub-crate for parser fragility, error swallowing, resource leaks, and determinism violations. Five concrete bugs were surfaced and fixed in the sibling crates — those flow through dev-tools 0.9.5 automatically via the ^0.9 path-dep constraint, with no umbrella republish required:

• dev-security 0.9.2 — deny::short_title() no longer panics on UTF-8: a cargo-deny message containing multi-byte characters at the 117-byte truncation boundary used to slice through the middle of a codepoint. Workspace-level policy violations (empty graphs array) now emit <workspace> instead of an empty-string crate name.
• dev-ci 0.9.2 — YAML scalar emission single-quotes values that contain YAML indicators or start with one (workflow_name("Build: CI") no longer corrupts the output). git clone URLs and target paths for --path-dep are POSIX-shell-quoted so a repo URL containing a single quote round-trips correctly.
• dev-report 0.9.5 — Evidence::numeric() coerces NaN / ±Inf to 0.0 at construction. Previously a Report carrying a non-finite measurement compiled cleanly and then panicked at serialization time inside to_json() / to_sarif().
• dev-report 0.9.6 — Diff::to_markdown() backslash-escapes | and replaces newlines with <br> in check-name cells of the Severity changes and Duration regressions tables. A check named a|b|c no longer shifts every column.
• dev-mutate 0.9.2 — Cleaned an unused &[SurvivingMutant] parameter from the internal aggregate_breakdown() helper.

README + branding consistency

Every sub-crate README was standardized against a single template: Rust logo image header, MSRV badge in a consistent position (between the CI badge and the docs.rs badge), a "Part of the dev-* verification collection" content block under the intro paragraph, a full 14-crate sibling map, and a centered copyright block at the bottom. Sub-crate subtitles dropped the AI-ASSISTED framing and gained more specific positioning (DEPENDENCY AUDIT & LICENSE POLICY FOR RUST, MUTATION TESTING WITH KILL-RATE GATES, FAULT INJECTION & RECOVERY TESTING FOR RUST, etc.).

Worktree-noise cleanup

Stopped tracking Cargo.lock on every library crate in the collection (13 of 14). Library crates aren't supposed to ship a lock file — it's a snapshot of one possible dep-tree resolution and downstream consumers ignore it anyway. Only dev-ci (which ships a binary) keeps tracking its lock. This eliminates the spurious dirty-tree churn that sibling-version bumps were causing in every contributor's working copy.

Breaking changes

None. 0.9.5 is purely additive on top of 0.9.4. Existing code that uses dev_tools::report, dev_tools::fixtures, dev_tools::bench, dev_tools::async, dev_tools::stress, or dev_tools::chaos continues to compile unchanged.

Projects opting into the new verification dimensions should set default-features = false if they want a minimal build, then pick exactly the dimensions they need.

Stability promise

0.9.5 is the API freeze for the dev-tools umbrella surface. The 14-feature flag set, the module paths (dev_tools::coverage, dev_tools::security, dev_tools::deps, dev_tools::ci, dev_tools::fuzz, dev_tools::flaky, dev_tools::mutate, etc.), the producers module, the brand color constants, the prelude exports, the full_run! / async_full_run! macros, and the html meta-report module are committed.

Sub-crate path-dep constraints stay pinned at ^0.9 (any 0.9.x) — the umbrella does not require a coordinated patch release of the sibling crates. You can safely use dev-tools 0.9.5 alongside sibling crates at any 0.9.x version.

0.9.x patches will land bug fixes from community use. 1.0.0 follows after the multi-crate ergonomic story has had time to settle in real projects.

Installation

[dependencies]
# Default: report + fixtures + bench
dev-tools = "0.9.5"

# Specific verification dimensions
[dependencies]
dev-tools = { version = "0.9.5", features = ["coverage", "security", "fuzz"] }

# Everything — kitchen-sink verification rigs, AI agents driving the whole suite
[dependencies]
dev-tools = { version = "0.9.5", features = ["full"] }

# Just the report schema (lightest)
[dependencies]
dev-tools = { version = "0.9.5", default-features = false }

What's next

The CLI surface across the collection is the next focus — polishing the existing dev-ci binary, exploring whether dev-tools itself should grow a multi-tool entry point that dispatches to every verification dimension from a single command. That work lands in a subsequent 0.9.x release ahead of 1.0.

---

Full Changelog: v0.9.4...v0.9.5