refactor(cargo): patch crates in place; drop the [patch]-redirect backend + build guard (#107)

* refactor(cargo): patch crates in place; drop the [patch]-redirect backend + build guard

Simplify the cargo apply path to patch crates in place (vendored or
registry cache) like npm/pypi/gem, removing the project-local
`[patch]`-redirect backend and the build-time `socket-patch-guard`
setup wiring. Cargo now rolls back in place from before-blobs rather
than dropping a redirect.

Removed:
- core: `cargo_setup` (discover/update), `patch/cargo_config`,
  `patch/cargo_redirect`, and `go_setup` (the build-time Go guard
  package + templates).
- cli: cargo/go redirect dispatch in `apply`/`rollback`, cargo + Go
  guard wiring in `setup`, and the now-dead setup/redirect tests.

Kept:
- Go `replace`-redirect (`go_redirect`/`go_mod_edit`/`copy_tree`): the
  module cache is checksum-verified, so in-place patching fails
  `go.sum` at build time — Go still needs the project-local copy.
- The `socket-patch-guard` crate and its build-integration test.

`copy_tree` is now gated on `golang` only. Docs (README, CLI_CONTRACT,
module headers) updated to drop the removed backends.

Builds clean across feature combos (default / none / all / cargo-only)
and the full suite passes (--no-fail-fast).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ci: drop removed cargo-coexist suite + go-guard-template lint step

The simplification deleted `tests/e2e_cargo_coexist.rs` and the
`go_setup/templates/*.tmpl` files, but ci.yml still referenced them:
the e2e matrix listed `e2e_cargo_coexist` (no such target → fail) and
the lint-ecosystems job `cp`'d the now-absent Go guard templates for
gofmt/vet (cp → fail). Remove both; keep `guard_build_integration`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor: remove the now-orphaned socket-patch-guard crate + stale references

With cargo patching in place (no `[patch]`-redirect) and `setup` no
longer wiring a build-time guard, the `socket-patch-guard` crate had no
consumer: nothing in cli/core references it, `setup` never writes it,
and its `.socket/cargo-patches/` + `SOCKET_PATCH_ROOT` machinery no
longer exists. Remove it and every dangling reference.

- Delete `crates/socket-patch-guard/` (crate, build.rs, README,
  SAME_TICK_HEAL_RND.md, same_tick_heal_experiment.rs) and drop it from
  the workspace members + Cargo.lock.
- Delete `guard_build_integration.rs`; drop the `guard_build_integration`
  e2e matrix entry and the guard-template gofmt/vet step from ci.yml;
  drop the `cargo publish -p socket-patch-guard` step from release.yml.
- CHANGELOG: rewrite the `[Unreleased]` cargo/guard entries to describe
  what actually ships — cargo in-place patching (default feature) and
  the Go `replace`-redirect backend — and drop the now-false
  "cargo apply now redirects" Changed bullet.
- Drop the dead `SOCKET_PATCH_ROOT`/`SOCKET_PATCH_GUARD` env vars from
  test scrub lists (no longer read in src; `SOCKET_PATCH_BIN` kept — the
  gem Bundler plugin still uses it); repoint stale `setup_matrix_cargo`
  doc-comments to surviving sibling suites; refresh CLI_CONTRACT prose.

Builds clean across feature combos; full suite passes (--no-fail-fast).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mikolalysenko

.github/workflows/ci.yml

@@ -39,9 +39,8 @@ jobs:
 
   # Lint the out-of-workspace packaging artifacts for the ecosystems whose setup
   # / CLI-distribution we added: the RubyGems CLI launcher gem + the Bundler
-  # plugin gem (Ruby), the Composer CLI launcher (PHP), and the generated Go
-  # setup-guard templates. Ruby, PHP, Composer, and Go are all pre-installed on
-  # the ubuntu-latest runner.
+  # plugin gem (Ruby) and the Composer CLI launcher (PHP). Ruby, PHP, and
+  # Composer are all pre-installed on the ubuntu-latest runner.
   lint-ecosystems:
     runs-on: ubuntu-latest
     steps:
@@ -63,19 +62,6 @@ jobs:
           php -l composer/socket-patch/bin/socket-patch
           ( cd composer/socket-patch && composer validate --no-check-publish )
 
-      - name: Go — gofmt + vet the setup-guard templates
-        run: |
-          tmp="$(mktemp -d)"
-          cp crates/socket-patch-core/src/go_setup/templates/guard.go.tmpl "$tmp/guard.go"
-          cp crates/socket-patch-core/src/go_setup/templates/guard_test.go.tmpl "$tmp/guard_test.go"
-          unformatted="$(gofmt -l "$tmp")"
-          if [ -n "$unformatted" ]; then
-            echo "::error::Go setup-guard templates are not gofmt-clean:"
-            gofmt -d "$tmp"
-            exit 1
-          fi
-          ( cd "$tmp" && go mod init socketpatchguardlint >/dev/null && go vet ./... )
-
   test:
     strategy:
       fail-fast: false
@@ -456,16 +442,6 @@ jobs:
             suite: e2e_composer
           - os: ubuntu-latest
             suite: e2e_nuget
-          # Cargo project-local [patch]-redirect backend + fail-closed guard.
-          # `guard_build_integration` is hermetic (a shell stub + `cargo build
-          # --offline` against a zero-dep path dep), so it exercises the
-          # build.rs-panic-aborts-a-real-build seam with no network.
-          # `e2e_cargo_coexist`'s real-cargo proofs fetch a crate (cached) and
-          # skip on fetch failure. Both suites are `#[cfg(unix)]`.
-          - os: ubuntu-latest
-            suite: guard_build_integration
-          - os: ubuntu-latest
-            suite: e2e_cargo_coexist
           # The live-API smoke suites (e2e_npm, e2e_pypi, e2e_gem,
           # e2e_scan) are intentionally NOT in the PR matrix — their
           # `#[ignore]`-gated tests hit the real public proxy at

.github/workflows/release.yml

@@ -247,17 +247,6 @@ jobs:
         env:
           CARGO_REGISTRY_TOKEN: ${{ steps.crates-io-auth.outputs.token }}
 
-      # socket-patch-guard is a standalone crate (no dependency on core/cli) that
-      # `socket-patch setup` adds to a user's Cargo.toml as
-      # `socket-patch-guard = "<major.minor>"`. It MUST be published on every
-      # release or cargo setup writes an unresolvable dependency and the user's
-      # `cargo build` fails. Its build.rs is a no-op when SOCKET_PATCH_ROOT is
-      # unset (the case during publish verification), so this builds cleanly.
-      - name: Publish socket-patch-guard
-        run: cargo publish -p socket-patch-guard
-        env:
-          CARGO_REGISTRY_TOKEN: ${{ steps.crates-io-auth.outputs.token }}
-
       - name: Wait for crates.io index update
         run: sleep 30
 

CHANGELOG.md

@@ -16,49 +16,24 @@ in this file — see `.github/workflows/release.yml` (`version` job).
 
 ### Added
 
-- **Project-local cargo `[patch]`-redirect backend (local mode).** Patching a
-  Rust dependency from the registry cache no longer mutates the shared
-  `$CARGO_HOME` registry in place. Instead `apply` writes a project-local
-  patched **copy** under `.socket/cargo-patches/<name>-<version>/` and a managed
-  `[patch.crates-io]` entry (+ `[env] SOCKET_PATCH_ROOT`) into
-  `.cargo/config.toml`, so patches are project-scoped and the registry stays
-  pristine for sibling projects. `rollback` cleanly drops the entry + copy
-  (leaving `setup` state — the guard dependency + `[env]` — intact).
-  `apply --check` is a new read-only, lock-free, offline auditor that verifies
-  the committed copies/config match the manifest **and** cross-checks
-  `Cargo.lock` (flagging a patched dependency that silently resolved to an
-  unpatched version); it exits non-zero on drift (for CI / GitHub-App use).
-  Vendored crates (`vendor/`) and `--global` cargo keep the existing in-place
-  `.cargo-checksum.json` rewrite path unchanged. **`cargo` is now a default
-  feature** (alongside the always-on npm + PyPI support), so released binaries and
-  a plain `cargo install socket-patch-cli` patch Rust dependencies and run the
-  guard out of the box; `golang`/`maven`/`composer`/`nuget`/`deno` remain opt-in.
-  A binary built `--no-default-features` (no cargo) now fails `apply --check`
-  closed rather than reporting "in sync", so it can never make the guard pass
-  vacuously.
-- **`socket-patch-guard` crate + `setup` cargo support.** `socket-patch setup`
-  now also configures Rust projects: it adds a tiny `socket-patch-guard`
-  dependency (a normal `[dependencies]` entry, not a `[build-dependencies]` one,
-  so cargo always compiles it and runs its build script) to every workspace
-  member and writes `[env] SOCKET_PATCH_ROOT`. The guard's build script runs `socket-patch apply --check`
-  on every relevant `cargo build` and is **fail-closed**: if the committed
-  patched copies are out of sync with `.socket/manifest.json` (a stale copy, or
-  a patched dependency that resolved to an unpatched version), the build
-  **fails** rather than silently compiling stale/unpatched sources — closing the
-  CI footgun where a one-shot build could ship an unpatched binary. The fix is
-  run-order-independent (it checks the static committed state, not when the
-  build script happens to run). It is a single fail-closed mode with no
-  `warn`/`off` escape: on drift it regenerates the copies then fails the build
-  with a "re-run" message (the retry is clean), and an unrecoverable state or a
-  missing `socket-patch` CLI also fails the build. In normal use the guard never
-  fires, since changing a patch goes through `get`/`apply` (which regenerate the
-  copies). The user's own `build.rs` is never touched. For CI, run
-  `socket-patch apply --check --ecosystems cargo` as an explicit pipeline gate.
-  `setup --check` / `setup --remove` cover the
-  round-trip. *(A guarded repo requires `socket-patch` on the build machine —
-  wire it into apps/workspaces you control, not a published library. Pre-GA:
-  `socket-patch-guard` will be published to crates.io; airgapped users vendor
-  it.)*
+- **Cargo support (`cargo` is now a default feature).** `apply` patches a Rust
+  dependency **in place** wherever the crawler finds it — the project `vendor/`
+  directory or the shared `$CARGO_HOME` registry cache — rewriting the crate's
+  `.cargo-checksum.json` sidecar so `cargo build` accepts the modified files.
+  `rollback` restores the original bytes from the `beforeHash` blobs, like
+  npm/PyPI/gem. `cargo` ships on by default (alongside the always-on npm + PyPI
+  + Ruby gems support), so released binaries and a plain `cargo install
+  socket-patch-cli` patch Rust dependencies out of the box;
+  `maven`/`composer`/`nuget`/`deno` remain opt-in.
+- **Project-local Go `replace`-redirect backend (`golang`, default feature).**
+  The Go module cache is shared, read-only and checksum-verified, so in-place
+  patching would fail `go.sum` at build time. Instead `apply` writes a
+  project-local patched **copy** under `.socket/go-patches/<module>@<version>/`
+  and a managed `replace` directive in the project `go.mod`, so the patch is
+  project-scoped and the cache stays pristine for sibling projects. `rollback`
+  cleanly drops the `replace` directive + copy. `apply --check` is a read-only,
+  lock-free, offline auditor that verifies the committed redirects match the
+  manifest, exiting non-zero on drift (for CI / GitHub-App use).
 - **Inline OpenVEX generation on `apply` and `scan` via `--vex <path>`.** A
   single successful `apply`/`scan` can now both patch and emit the OpenVEX
   0.2.0 attestation, instead of requiring a separate `socket-patch vex` step.
@@ -71,16 +46,6 @@ in this file — see `.github/workflows/release.yml` (`version` job).
   command exit non-zero even when the apply/scan itself succeeded, surfacing a
   stable error code in the envelope.
 
-### Changed
-
-- **Local cargo `apply` now redirects instead of patching in place.** Registry
-  crates patched by a previous (in-place) version leave a mutated shared
-  registry + rewritten `.cargo-checksum.json` behind; the new local backend
-  never touches the registry, so those stay dirty until cargo re-fetches.
-  `apply` now prints a one-line **warning** when it detects such a crate
-  (suppressed under `--offline`, so the build-time guard stays quiet) and points
-  at restoring the pristine copy. No automatic registry cleanup is performed.
-
 ## [3.2.0] — 2026-05-29
 
 A repo-wide correctness, security, and filesystem-safety hardening pass: every

Cargo.lock

@@ -2,7 +2,6 @@
 members = [
     "crates/socket-patch-core",
     "crates/socket-patch-cli",
-    "crates/socket-patch-guard",
 ]
 resolver = "2"
 

Cargo.toml

@@ -408,10 +408,9 @@ Configure your project so patches are **re-applied automatically after install**
 
 - **npm / yarn / pnpm / bun** — writes a `postinstall` script into `package.json` so any install re-applies patches (pnpm: root package only).
 - **Python (pip / uv / poetry / pdm / hatch)** — Python has no universal post-install hook, so `setup` instead commits a **`socket-patch[hook]`** dependency (for classic Poetry, the equivalent `socket-patch = { extras = ["hook"] }`). Installing it lays down a startup `.pth` (shipped by the small `socket-patch-hook` wheel) that re-applies your committed `.socket/` patches the next time the interpreter runs. It is package-manager-agnostic (it rides the interpreter, not any one installer) and **fail-open** — a hook error can never break interpreter startup.
-- **Cargo** — adds a `socket-patch-guard` build dependency to each workspace member's `Cargo.toml` plus an `[env] SOCKET_PATCH_ROOT` in `.cargo/config.toml`. The guard's build script re-applies patches on every `cargo build` and is **fail-closed** — a build using stale/unpatched sources fails loudly. (Requires the `socket-patch` CLI on `PATH` at build time.)
-- **Go** — generates a committed `internal/socketpatchguard/` guard package plus a blank import in each `main` package. The guard re-applies patches and gates both `go test ./...` (CI) and every `go run` / binary launch via `init()` — **fail-closed**. Fully self-contained committed source. (Requires the `socket-patch` CLI on `PATH`.)
 - **Ruby gems (Bundler)** — adds a managed `plugin "socket-patch"` block to the `Gemfile` and commits an in-tree Bundler plugin under `.socket/bundler-plugin/`. It re-applies patches on every `bundle install` (cached *and* fresh). (Requires the `socket-patch` CLI on `PATH`.)
 - **Composer (PHP)** *(opt-in `composer` feature)* — appends `socket-patch apply` to `composer.json`'s `post-install-cmd` / `post-update-cmd` script events, so patches re-apply on every `composer install` / `composer update`. Only available in a build compiled with `--features composer`. (Requires the `socket-patch` CLI on `PATH`.)
+- **Cargo & Go** — *apply-only, no `setup` hook.* A one-click auto-repatch-on-build isn't possible for these, so `setup` skips them. Patch with `socket-patch apply` directly: **cargo** patches the crate in place (in `vendor/` or the registry cache, rewriting `.cargo-checksum.json` so `cargo build` accepts it); **go** writes a project-local patched copy under `.socket/go-patches/` plus a `go.mod` `replace` directive (the module cache is `go.sum`-verified, so in-place patching can't build). Commit `go.mod` + `.socket/go-patches/` so a clone builds the patched bytes. Declare them in `setup.manual` for VEX attestation.
 - **Apply-only ecosystems** (nuget · maven · deno) — no native install hook to wire, so `setup` reports `no_files`; patch them on demand with `socket-patch apply`.
 
 **Usage:**
@@ -425,7 +424,7 @@ socket-patch setup --remove   # revert what setup added
 | Flag | Description |
 |------|-------------|
 | `--check` | Read-only verification that every manifest is configured; exits non-zero if any still needs setup. Never writes (safe in CI). Conflicts with `--remove`. |
-| `--remove` | Revert the install hooks `setup` added (npm `package.json` scripts, the Python `socket-patch[hook]` dependency, the cargo `socket-patch-guard` dependency + `[env]`, the Go guard package + imports, and the gem Bundler plugin wiring). |
+| `--remove` | Revert the install hooks `setup` added (npm `package.json` scripts, the Python `socket-patch[hook]` dependency, and the gem Bundler plugin wiring). |
 
 #### Disabling / opting out (Python hook)