[codex] Prepare ordvec-manifest for publish dry runs

[Fieldnote-Echo]

Summary

• make ordvec-manifest package-publishable metadata-wise with lockstep 0.3.0, docs.rs metadata, and a versioned ordvec dependency
• update docs/comments that still described the manifest verifier as publish=false / checkout-only
• add ordvec-manifest to the CI publish dry-run gate while leaving the real release.yml crates.io OIDC expansion for the next lane

Scout/review loop

• Ran release-flow scout for current release.yml/invariant wiring and manifest package-readiness scout before implementation.
• Chose the narrower Lane 3A split: publishability + dry-run first, release workflow OIDC expansion next.
• Ran adversarial review after implementation; no blockers found.
• Remediated advisory wording in .github/dependabot.yml and adjusted the manifest README CLI examples to distinguish installed use from pre-release workspace use.

Validation

• cargo package -p ordvec-manifest --list
• cargo publish -p ordvec-manifest --dry-run --locked
• cargo publish -p ordvec --dry-run --locked
• cargo test -p ordvec-manifest --no-default-features
• cargo test -p ordvec-manifest --all-features
• cargo clippy -p ordvec-manifest --all-targets --all-features -- -D warnings
• bash tests/release_publish_invariants.sh
• bash tests/release_signed_release_invariants.sh
• /tmp/ordvec-actionlint/actionlint .github/workflows/ci.yml .github/workflows/release.yml
• cargo fmt --all --check
• git diff --check

Follow-up lane

Lane 3B still needs to add the actual release.yml crates.io trusted-publishing path, byte-identity checks, release invariants, and docs for ordvec-manifest. This PR intentionally does not publish the manifest crate in the release workflow.

[gemini-code-assist]

Code Review

This pull request transitions the ordvec-manifest crate from a repo-local, unpublished sidecar to a published crate versioned in lockstep with the core ordvec crate (v0.3.0). This involves updating Cargo.toml configurations, dependency declarations, release documentation, and various READMEs and threat models to reflect its new status. Feedback on the changes points out a broken documentation reference in ordvec-manifest/src/lib.rs pointing to a non-existent function verify_manifest_document.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[qodo-code-review]

Review Summary by Qodo

Make ordvec-manifest publishable and add to CI dry-run validation

✨ Enhancement

Walkthroughs

Description

• Make ordvec-manifest publishable with version 0.3.0 and docs.rs metadata
• Add ordvec-manifest to CI publish dry-run gate for packaging validation
• Update documentation to reflect manifest verifier as lockstep published crate
• Add comprehensive library documentation and clarify CLI usage patterns

Diagram

flowchart LR
  A["ordvec-manifest<br/>v0.0.0 unpublished"] -- "version bump<br/>metadata added" --> B["ordvec-manifest<br/>v0.3.0 publishable"]
  B -- "CI integration" --> C["publish dry-run<br/>validation"]
  D["docs/comments<br/>outdated"] -- "update references" --> E["lockstep crate<br/>terminology"]

Loading

File Changes

1. ordvec-manifest/Cargo.toml ⚙️ Configuration changes +9/-4

Enable publishing with version and metadata

ordvec-manifest/Cargo.toml

---

2. ordvec-manifest/src/lib.rs 📝 Documentation +16/-0

Add comprehensive library documentation

ordvec-manifest/src/lib.rs

---

3. ordvec-manifest/README.md 📝 Documentation +12/-3

Update usage examples and installation guidance

ordvec-manifest/README.md

---

View more (8)

4. .github/workflows/ci.yml ✨ Enhancement +8/-6

Add manifest crate to publish dry-run

.github/workflows/ci.yml

---

5. .github/dependabot.yml 📝 Documentation +2/-2

Clarify manifest verifier as workspace member

.github/dependabot.yml

---

6. Cargo.toml 📝 Documentation +4/-4

Update workspace documentation terminology

Cargo.toml

---

7. README.md 📝 Documentation +10/-11

Reflect manifest as published lockstep crate

README.md

---

8. RELEASING.md 📝 Documentation +4/-3

Include manifest version in release steps

RELEASING.md

---

9. THREAT_MODEL.md 📝 Documentation +3/-3

Remove publish=false references from manifest

THREAT_MODEL.md

---

10. docs/INDEX_PROVENANCE.md 📝 Documentation +1/-1

Update manifest crate terminology

docs/INDEX_PROVENANCE.md

---

11. docs/compatibility-policy.md 📝 Documentation +13/-12

Classify manifest as lockstep published crate

docs/compatibility-policy.md

---

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 🔗 Cross-repo conflicts (0)

1. Changelog publish status wrong ✓ Resolved 🐞 Bug ⚙ Maintainability

Description

CHANGELOG.md still claims ordvec-manifest is "repo-local, publish=false" in the v0.3.0 entry,
but this PR removes publish = false and makes the crate publishable at version 0.3.0. This creates
a direct contradiction in the release notes about how the crate is distributed.

Code

ordvec-manifest/Cargo.toml[R1-8]

[package]
name = "ordvec-manifest"
-version = "0.0.0"
+version = "0.3.0"
edition = "2021"
rust-version = "1.89"
-publish = false
license = "MIT OR Apache-2.0"
-description = "Repo-local ordvec index manifest verifier"
+description = "Manifest verifier for ordvec index provenance and sidecar artifacts"
+repository = "https://github.com/Fieldnote-Echo/ordvec"

Evidence

The changelog explicitly states ordvec-manifest is publish=false for v0.3.0, while the crate
manifest in this PR makes it publishable (no publish=false and adds crates.io metadata).

CHANGELOG.md[37-46]
ordvec-manifest/Cargo.toml[1-13]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The v0.3.0 changelog entry states `ordvec-manifest` was `publish=false`, but this PR changes `ordvec-manifest` to be publishable (and sets its version to 0.3.0). The changelog must match the actual distribution model.

### Issue Context
Changelog entries are user-facing release notes; incorrect publication status will mislead users about whether `cargo install ordvec-manifest` is expected to work.

### Fix Focus Areas
- CHANGELOG.md[37-53]

### Proposed change
Edit the v0.3.0 bullet to remove/adjust "repo-local, publish=false" for `ordvec-manifest` (e.g., "Added the `ordvec-manifest` crate (published/lockstep) ..."), or explicitly clarify historical vs current state if needed.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Missing docs.rs config ✓ Resolved 🐞 Bug ☼ Reliability

Description

ordvec-manifest is now publishable but lacks a package.metadata.docs.rs section; this can cause
docs.rs to build with all features and pull in the SQLite path, increasing docs build time and
failure risk. The root ordvec crate already pins docs.rs behavior explicitly, so leaving it unset
here is inconsistent and brittle.

Code

ordvec-manifest/Cargo.toml[R1-13]

[package]
name = "ordvec-manifest"
-version = "0.0.0"
+version = "0.3.0"
edition = "2021"
rust-version = "1.89"
-publish = false
license = "MIT OR Apache-2.0"
-description = "Repo-local ordvec index manifest verifier"
+description = "Manifest verifier for ordvec index provenance and sidecar artifacts"
+repository = "https://github.com/Fieldnote-Echo/ordvec"
+homepage = "https://github.com/Fieldnote-Echo/ordvec"
+documentation = "https://docs.rs/ordvec-manifest"
+readme = "README.md"
+keywords = ["vector-search", "manifest", "provenance", "verification", "quantization"]
+categories = ["algorithms", "command-line-utilities", "data-structures"]

Evidence

The repository already treats docs.rs build configuration as important (it explicitly disables
all-features docs for ordvec). ordvec-manifest has feature-gated SQLite support and currently
provides no docs.rs metadata, so docs.rs may build with feature combinations you did not intend.

Cargo.toml[53-58]
ordvec-manifest/Cargo.toml[37-40]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`ordvec-manifest` is now intended to be published and documented on docs.rs, but its `Cargo.toml` does not specify docs.rs build settings. In this repo, `ordvec` explicitly configures docs.rs to avoid building with all features; `ordvec-manifest` should do the same to prevent docs.rs from building SQLite feature paths by default.

### Issue Context
The crate defines optional SQLite features (`sqlite`, `sqlite-bundled`) and depends on `rusqlite` behind those features. Without docs.rs metadata, docs builds can become heavier and more failure-prone.

### Fix Focus Areas
- ordvec-manifest/Cargo.toml[1-40]

### Proposed change
Add a section like:
```toml
[package.metadata.docs.rs]
all-features = false
```
(Alternatively, if you *want* SQLite APIs in docs, set `features = ["sqlite-bundled"]` explicitly to avoid system-SQLite linking.)

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Previous review results

Review updated until commit 68da3ed

Results up to commit c3cae1d

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0)

1. Changelog publish status wrong ✓ Resolved 🐞 Bug ⚙ Maintainability

Description

CHANGELOG.md still claims ordvec-manifest is "repo-local, publish=false" in the v0.3.0 entry,
but this PR removes publish = false and makes the crate publishable at version 0.3.0. This creates
a direct contradiction in the release notes about how the crate is distributed.

Code

ordvec-manifest/Cargo.toml[R1-8]

[package]
name = "ordvec-manifest"
-version = "0.0.0"
+version = "0.3.0"
edition = "2021"
rust-version = "1.89"
-publish = false
license = "MIT OR Apache-2.0"
-description = "Repo-local ordvec index manifest verifier"
+description = "Manifest verifier for ordvec index provenance and sidecar artifacts"
+repository = "https://github.com/Fieldnote-Echo/ordvec"

Evidence

The changelog explicitly states ordvec-manifest is publish=false for v0.3.0, while the crate
manifest in this PR makes it publishable (no publish=false and adds crates.io metadata).

CHANGELOG.md[37-46]
ordvec-manifest/Cargo.toml[1-13]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The v0.3.0 changelog entry states `ordvec-manifest` was `publish=false`, but this PR changes `ordvec-manifest` to be publishable (and sets its version to 0.3.0). The changelog must match the actual distribution model.

### Issue Context
Changelog entries are user-facing release notes; incorrect publication status will mislead users about whether `cargo install ordvec-manifest` is expected to work.

### Fix Focus Areas
- CHANGELOG.md[37-53]

### Proposed change
Edit the v0.3.0 bullet to remove/adjust "repo-local, publish=false" for `ordvec-manifest` (e.g., "Added the `ordvec-manifest` crate (published/lockstep) ..."), or explicitly clarify historical vs current state if needed.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Missing docs.rs config ✓ Resolved 🐞 Bug ☼ Reliability

Description

ordvec-manifest is now publishable but lacks a package.metadata.docs.rs section; this can cause
docs.rs to build with all features and pull in the SQLite path, increasing docs build time and
failure risk. The root ordvec crate already pins docs.rs behavior explicitly, so leaving it unset
here is inconsistent and brittle.

Code

ordvec-manifest/Cargo.toml[R1-13]

[package]
name = "ordvec-manifest"
-version = "0.0.0"
+version = "0.3.0"
edition = "2021"
rust-version = "1.89"
-publish = false
license = "MIT OR Apache-2.0"
-description = "Repo-local ordvec index manifest verifier"
+description = "Manifest verifier for ordvec index provenance and sidecar artifacts"
+repository = "https://github.com/Fieldnote-Echo/ordvec"
+homepage = "https://github.com/Fieldnote-Echo/ordvec"
+documentation = "https://docs.rs/ordvec-manifest"
+readme = "README.md"
+keywords = ["vector-search", "manifest", "provenance", "verification", "quantization"]
+categories = ["algorithms", "command-line-utilities", "data-structures"]

Evidence

The repository already treats docs.rs build configuration as important (it explicitly disables
all-features docs for ordvec). ordvec-manifest has feature-gated SQLite support and currently
provides no docs.rs metadata, so docs.rs may build with feature combinations you did not intend.

Cargo.toml[53-58]
ordvec-manifest/Cargo.toml[37-40]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`ordvec-manifest` is now intended to be published and documented on docs.rs, but its `Cargo.toml` does not specify docs.rs build settings. In this repo, `ordvec` explicitly configures docs.rs to avoid building with all features; `ordvec-manifest` should do the same to prevent docs.rs from building SQLite feature paths by default.

### Issue Context
The crate defines optional SQLite features (`sqlite`, `sqlite-bundled`) and depends on `rusqlite` behind those features. Without docs.rs metadata, docs builds can become heavier and more failure-prone.

### Fix Focus Areas
- ordvec-manifest/Cargo.toml[1-40]

### Proposed change
Add a section like:
```toml
[package.metadata.docs.rs]
all-features = false
```
(Alternatively, if you *want* SQLite APIs in docs, set `features = ["sqlite-bundled"]` explicitly to avoid system-SQLite linking.)

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[Fieldnote-Echo]

Addressed the remaining docs.rs config finding in 68da3ed.

What changed:

• Added [package.metadata.docs.rs] all-features = false to ordvec-manifest/Cargo.toml, matching the root crate posture and keeping SQLite docs paths opt-in.

Validation:

• cargo check -p ordvec-manifest --no-default-features
• cargo test -p ordvec-manifest --no-default-features
• cargo test -p ordvec-manifest
• cargo package -p ordvec-manifest --locked --no-verify
• cargo package -p ordvec-manifest --locked --list --allow-dirty
• cargo fmt --all --check
• git diff --check
• bash tests/release_publish_invariants.sh

I also rechecked the Gemini note about verify_manifest_document: the inline thread is already resolved/outdated, and current branch content only references verify_document_for_load / verify_for_load.

[Fieldnote-Echo]

/agentic_review

[qodo-code-review]

Code review by qodo was updated up to the latest commit 68da3ed

[qodo-code-review]

CI Feedback 🧐

A test triggered by this PR failed. Here is an AI-generated analysis of the failure:

Action: coverage (cargo-llvm-cov + Intel SDE)

Failed stage: Install Intel SDE [❌]

Failed test name: ""

Failure summary: The action failed during the custom step ./.github/actions/setup-intel-sde while trying to download Intel SDE. - The script runs curl -fsSL "${url_base}/${version}.tar.xz" -o "${archive}" (around lines 450-452). - curl returned HTTP 403 (curl: (22) The requested URL returned error: 403, line 474), which caused the step to exit with code 22 (line 475). - Because the download was forbidden, the Intel SDE archive could not be retrieved/installed, so the workflow stopped before any tests/coverage could run.

Relevant error logs: 1: ##[group]Runner Image Provisioner 2: Hosted Compute Agent ... 227: �[36;1mecho "components=$(for c in ${components//,/ }; do echo -n ' --component' $c; done)" >> $GITHUB_OUTPUT�[0m 228: �[36;1mecho "downgrade=" >> $GITHUB_OUTPUT�[0m 229: shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0} 230: env: 231: targets: 232: components: llvm-tools-preview 233: ##[endgroup] 234: ##[group]Run : set $CARGO_HOME 235: �[36;1m: set $CARGO_HOME�[0m 236: �[36;1mecho CARGO_HOME=${CARGO_HOME:-"$HOME/.cargo"} >> $GITHUB_ENV�[0m 237: shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0} 238: ##[endgroup] 239: ##[group]Run : install rustup if needed 240: �[36;1m: install rustup if needed�[0m 241: �[36;1mif ! command -v rustup &>/dev/null; then�[0m 242: �[36;1m curl --proto '=https' --tlsv1.2 --retry 10 --retry-connrefused --location --silent --show-error --fail https://sh.rustup.rs | sh -s -- --default-toolchain none -y�[0m 243: �[36;1m echo "$CARGO_HOME/bin" >> $GITHUB_PATH�[0m ... 305: �[36;1mif [ -z "${CARGO_REGISTRIES_CRATES_IO_PROTOCOL+set}" -o -f "/home/runner/work/_temp"/.implicit_cargo_registries_crates_io_protocol ]; then�[0m 306: �[36;1m if rustc +stable --version --verbose | grep -q '^release: 1\.6[89]\.'; then�[0m 307: �[36;1m touch "/home/runner/work/_temp"/.implicit_cargo_registries_crates_io_protocol || true�[0m 308: �[36;1m echo CARGO_REGISTRIES_CRATES_IO_PROTOCOL=sparse >> $GITHUB_ENV�[0m 309: �[36;1m elif rustc +stable --version --verbose | grep -q '^release: 1\.6[67]\.'; then�[0m 310: �[36;1m touch "/home/runner/work/_temp"/.implicit_cargo_registries_crates_io_protocol || true�[0m 311: �[36;1m echo CARGO_REGISTRIES_CRATES_IO_PROTOCOL=git >> $GITHUB_ENV�[0m 312: �[36;1m fi�[0m 313: �[36;1mfi�[0m 314: shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0} 315: env: 316: CARGO_HOME: /home/runner/.cargo 317: CARGO_INCREMENTAL: 0 318: CARGO_TERM_COLOR: always 319: ##[endgroup] 320: ##[group]Run : work around spurious network errors in curl 8.0 321: �[36;1m: work around spurious network errors in curl 8.0�[0m 322: �[36;1m# https://rust-lang.zulipchat.com/#narrow/stream/246057-t-cargo/topic/timeout.20investigation�[0m ... 398: ##[endgroup] 399: ... Restoring cache ... 400: Cache hit for restore-key: v0-rust-coverage-Linux-x64-4107bf91-b41724d2 401: Received 61074954 of 61074954 (100.0%), 159.1 MBs/sec 402: Cache Size: ~58 MB (61074954 B) 403: [command]/usr/bin/tar -xf /home/runner/work/_temp/de83aece-c640-43e4-b5bd-5c5b1e356877/cache.tzst -P -C /home/runner/work/ordvec/ordvec --use-compress-program unzstd 404: Cache restored successfully 405: Restored from cache key "v0-rust-coverage-Linux-x64-4107bf91-b41724d2" full match: false. 406: ##[group]Run cargo install cargo-llvm-cov --version 0.8.7 --locked 407: �[36;1mcargo install cargo-llvm-cov --version 0.8.7 --locked�[0m 408: shell: /usr/bin/bash -e {0} 409: env: 410: CARGO_HOME: /home/runner/.cargo 411: CARGO_INCREMENTAL: 0 412: CARGO_TERM_COLOR: always 413: CACHE_ON_FAILURE: false 414: ##[endgroup] 415: �[1m�[92m Updating�[0m crates.io index 416: �[1m�[92m Downloading�[0m crates ... 417: �[1m�[92m Downloaded�[0m cargo-llvm-cov v0.8.7 418: �[1m�[92m Ignored�[0m package `cargo-llvm-cov v0.8.7` is already installed, use --force to override 419: Prepare all required actions 420: ##[group]Run ./.github/actions/setup-intel-sde 421: with: 422: version: sde-external-10.8.0-2026-03-15-lin 423: url-base: https://downloadmirror.intel.com/915934 424: sha256: 50b320cd226acef7a491f5b321fc1be3c3c7984f9e27a456e64894b5b0979dd3 425: install-dir: intel-sde 426: env: 427: CARGO_HOME: /home/runner/.cargo 428: CARGO_INCREMENTAL: 0 429: CARGO_TERM_COLOR: always 430: CACHE_ON_FAILURE: false 431: ##[endgroup] 432: ##[group]Run set -euo pipefail 433: �[36;1mset -euo pipefail�[0m 434: �[36;1m�[0m 435: �[36;1march="$(uname -m)"�[0m 436: �[36;1mif [ "${arch}" != "x86_64" ]; then�[0m 437: �[36;1m echo "::error::Intel SDE sde64 requires an x86_64 runner; got ${arch}"�[0m 438: �[36;1m exit 1�[0m ... 445: �[36;1mcase "${install_dir}" in�[0m 446: �[36;1m /*) ;;�[0m 447: �[36;1m *) install_dir="${GITHUB_WORKSPACE}/${install_dir}" ;;�[0m 448: �[36;1mesac�[0m 449: �[36;1m�[0m 450: �[36;1marchive="${RUNNER_TEMP}/${version}.tar.xz"�[0m 451: �[36;1mcurl -fsSL "${url_base}/${version}.tar.xz" -o "${archive}"�[0m 452: �[36;1mecho "${sha256} ${archive}" | sha256sum -c -�[0m 453: �[36;1m�[0m 454: �[36;1mmkdir -p "${install_dir}"�[0m 455: �[36;1mtar xf "${archive}" --strip-components=1 -C "${install_dir}"�[0m 456: �[36;1mrm "${archive}"�[0m 457: �[36;1m�[0m 458: �[36;1msde_path="${install_dir}/sde64"�[0m 459: �[36;1mif [ ! -x "${sde_path}" ]; then�[0m 460: �[36;1m echo "::error::Intel SDE install did not produce an executable sde64 at ${sde_path}"�[0m 461: �[36;1m exit 1�[0m 462: �[36;1mfi�[0m 463: �[36;1m"${sde_path}" --version�[0m 464: �[36;1m�[0m 465: �[36;1mecho "install-dir=${install_dir}" >> "${GITHUB_OUTPUT}"�[0m 466: �[36;1mecho "sde-path=${sde_path}" >> "${GITHUB_OUTPUT}"�[0m 467: shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0} 468: env: 469: CARGO_HOME: /home/runner/.cargo 470: CARGO_INCREMENTAL: 0 471: CARGO_TERM_COLOR: always 472: CACHE_ON_FAILURE: false 473: ##[endgroup] 474: curl: (22) The requested URL returned error: 403 475: ##[error]Process completed with exit code 22. 476: Post job cleanup.

[Fieldnote-Echo]

CI follow-up: the remaining red check is coverage (cargo-llvm-cov + Intel SDE) failing during the Intel SDE install step with curl: (22) The requested URL returned error: 403 from downloadmirror.intel.com.

This is not caused by the manifest publishability diff. The same commit has the manifest publish dry-run, release-publish invariants, manifest verifier, and AVX-512 SDE lane green. The release-gate cache hardening for this exact Intel CDN issue is in #165; preferred merge order is #165 first, then rebase/rerun #168 so it inherits the stabilized SDE cache key and timeout/cache behavior.