[LordVoid]

What

On 2026-10-13 Christian set cargo xtask as the one build entrypoint for every estate repo, with nothing behind it but cargo and rustup. This PR adds that entrypoint to kd beside the existing tooling. Nothing is removed or renamed: the Makefile, the Justfile, lefthook, spec-check, toolchain-check, pin-check, fetch-contracts and every existing CI job are unchanged.

• Spec first. Spec 0002 gains the EARS clauses XT-1 to XT-9 for the gates. Spec 0004 records the four gate tools, their versions and their licences.
• xtask/src/gates.rs adds tools, fmt, fmt-check, clippy, test, doc-test, deny, typos, machete, ci and install. toolchain-check is the existing one.
  • ci runs tools, toolchain-check, fmt-check, clippy, test, doc-test, deny, typos and machete, in that order. It stops at the first failure, prints one summary line per step, and exits non-zero when a step fails.
  • install runs ci, then cargo build --release --locked --workspace --exclude xtask --bins.
• tools installs cargo-deny 0.19.9, typos-cli 1.49.0, cargo-machete 0.9.1 and cargo-nextest 0.9.104 from one const table. It uses cargo install --locked --version X --root .tools --force, and only for a tool that is missing or at another version.
• CI: one new job, xtask-ci, runs cargo xtask ci on ubuntu-latest, the runner the existing Rust jobs use. It uses SHA-pinned checkout and rust-cache, with .tools cached.
• Docs: a README "Build" section, and a CHANGELOG line under Unreleased.

Evidence

• Unit tests, red then green. 16 tests carry their clause in their names.

  • Against stub bodies, 12 of 15 failed first. The 16th test, for the environment fix below, was red on its own before its fix.
  • After the code, 16 of 16 pass on rustc 1.94.1.

• cargo xtask ci ran on head d8d89a9 in a Linux rust:1.94.1 container. kd's pidfd and prctl code only compiles on Linux. All 9 steps passed:

  step	result
  tools	ok (built all four from source in 240 s, first run)
  toolchain-check	ok (1.94.1)
  fmt-check	ok
  clippy	ok
  test	ok, nextest 69/69
  doc-test	ok, 2/2
  deny	ok
  typos	ok
  machete	ok

• Other checks:

  • cargo xtask spec-check and cargo xtask pin-check pass.
  • actionlint is clean.
  • All new files are 7-bit ASCII (AGENTS.md rule 10).

• cargo xtask install was not run. Its release-build command line is unit-tested (XT-8), and it starts with the same ci.

Decisions

• Tool builds. The tools build under Rust 1.94.1 (rustup run --install 1.94.1 cargo install ...). That is the pin here, and the ci-rust image's Rust. typos-cli 1.49.0 needs rustc 1.91.
• Where the tools go. They install into .tools/, which is already gitignored, and .tools/bin goes first on PATH for every gate.
  • This means no writes to CARGO_HOME, which is read-only on ci-rust, and no change to a developer's own tools.
  • The probe asks the copy the gate would run. On ci-rust, the baked cargo-deny 0.19.9 and typos 1.49.0 already match, so they are not rebuilt.
• Environment. Gates run without the CARGO_PKG_* and CARGO_MANIFEST_* variables that cargo sets for xtask itself. cargo-machete reads CARGO_PKG_NAME to decide whether cargo started it, and misparses its arguments when it is set (XT-6).
• Jobs and nextest. -j comes from JOBS, default 2 (spec 0002's -j rule). test uses nextest when it is installed, otherwise cargo test. CI sets NEXTEST_PROFILE=ci, as make ci does.
• Tool versions. All four contract versions exist on crates.io and are used as given.
• Ticket. No Linear ticket tracks the cargo-only move.

🤖 Generated with Claude Code

https://claude.ai/code/session_016CEVHJcKc5vyDHPYDF9oVc