fix

Author: Haofei

.github/workflows/ci.yml

@@ -12,7 +12,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -24,3 +24,23 @@ jobs:
 
       - name: Check
         run: cargo run --quiet --bin rss -- test --all
+
+  # The `test --all` manifest builds the default feature set; the native
+  # (Cranelift) JIT tier is behind the off-by-default `native-jit` feature, so
+  # run the rsscript suite with it enabled to keep the NativeJit and deopt
+  # backends in the no-gap differential.
+  native-jit:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install nextest
+        uses: taiki-e/install-action@nextest
+
+      - name: Test (native-jit)
+        run: cargo nextest run -p rsscript --features native-jit --no-fail-fast

.github/workflows/release.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable

.github/workflows/rsscript-review-action.yml

@@ -12,7 +12,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable

BUGS.md

@@ -13,10 +13,14 @@ reproduced; the HIGH items were additionally re-verified by hand.
 > - **RSS-5 / RSS-10:** the original single-line struct bodies (`{ first: T  second: T }`)
 >   additionally tripped a field-separator quirk that masked the documented symptom; with
 >   idiomatic newline-separated fields both bugs reproduce exactly as described and are fixed.
-> - Separately discovered (not one of the 11, left open): matching on a borrowed
+> - Separately discovered (not one of the 11): matching on a borrowed
 >   `read Option<T>`/`Result<…>` param and using the bound payload by value
->   (`match o { Some(s) => return s }`) lowers to `&T` and fails rustc E0308. Pre-existing
->   at `f5fab92`; independent of the RSS-4 fix.
+>   (`match o { Some(s) => return s }`) lowered to `&T` and failed rustc E0308.
+>   **FIXED:** the lowerer now rebinds a by-ref match's single payload to an owned
+>   value — `*x` for a `Copy` payload, `x.clone()` for any other cloneable type
+>   (resources, which aren't `Clone`, stay borrowed and are rejected by the resource
+>   move rules). Covers built-in `Option`/`Result` and single-field user variants.
+>   Regression test: `vm_eval_parity::parity_borrowed_match_payload_used_by_value`.
 
 Run recipe used for all repros:
 

crates/reir/src/format.rs

@@ -510,9 +510,13 @@ pub fn format_sarif(reconciliations: &[Reconciliation]) -> String {
             .as_ref()
             .map(|capability| {
                 let mut parts = vec![format!("{:?}", capability.category)];
-                for value in [&capability.provider, &capability.service, &capability.action]
-                    .into_iter()
-                    .flatten()
+                for value in [
+                    &capability.provider,
+                    &capability.service,
+                    &capability.action,
+                ]
+                .into_iter()
+                .flatten()
                 {
                     parts.push(value.clone());
                 }
@@ -1629,7 +1633,9 @@ mod tests {
         let sarif = format_sarif(&[missing_reconciliation()]);
         let value: serde_json::Value = serde_json::from_str(&sarif).expect("valid SARIF JSON");
         assert_eq!(value["version"], "2.1.0");
-        let results = value["runs"][0]["results"].as_array().expect("results array");
+        let results = value["runs"][0]["results"]
+            .as_array()
+            .expect("results array");
         assert_eq!(results.len(), 1);
         assert_eq!(results[0]["ruleId"], "missing_capability");
         assert_eq!(results[0]["level"], "error");

crates/reir/src/main.rs

@@ -269,9 +269,7 @@ fn try_run_collect(args: &[String]) -> Result<ExitCode, CliError> {
         let error_diagnostics = bundle
             .facts
             .iter()
-            .filter(|fact| {
-                fact.kind == reir::FactKind::Diagnostic && fact.unknown_reason.is_some()
-            })
+            .filter(|fact| fact.kind == reir::FactKind::Diagnostic && fact.unknown_reason.is_some())
             .count();
         if error_diagnostics > 0 {
             return Err(CliError::usage(format!(
@@ -321,9 +319,7 @@ fn try_run_report_pr(args: &[String]) -> Result<(ExitCode, String), CliError> {
             "--sarif" => sarif = true,
             "--fail-on-unknown" => cli.fail_on_unknown = Some(true),
             "--fail-on-excess" => cli.fail_on_excess = Some(true),
-            "--require-verified-capabilities" => {
-                cli.require_verified_capabilities = Some(true)
-            }
+            "--require-verified-capabilities" => cli.require_verified_capabilities = Some(true),
             "--allow-missing" => cli.fail_on_missing = Some(false),
             unknown => {
                 return Err(CliError::usage(format!(

crates/reir/src/reconciliation.rs

@@ -380,9 +380,10 @@ mod tests {
             ..required[0].clone()
         }];
         let results = reconcile_capabilities(&required, &granted);
-        assert!(results.iter().any(|r| matches!(
-            r.kind,
-            ReconciliationKind::MissingCapability
-        )));
+        assert!(
+            results
+                .iter()
+                .any(|r| matches!(r.kind, ReconciliationKind::MissingCapability))
+        );
     }
 }

crates/reir/tests/report_pr_cli.rs

@@ -98,8 +98,9 @@ fn report_pr_cli_matches_s3_demo_golden_comment() {
         .output()
         .expect("reir report-pr command should run");
 
-    let expected = fs::read_to_string(workspace.join("examples/demos/s3-iam-reir/expected/pr-comment.md"))
-        .expect("golden PR comment should be readable");
+    let expected =
+        fs::read_to_string(workspace.join("examples/demos/s3-iam-reir/expected/pr-comment.md"))
+            .expect("golden PR comment should be readable");
     let stdout = String::from_utf8(report_pr.stdout).expect("report-pr stdout should be utf-8");
     assert_eq!(stdout, expected);
     assert!(

crates/rsscript/src/analyzer.rs

@@ -4636,7 +4636,6 @@ fn generic_namespace_args(namespace: &str) -> Option<(&str, Vec<&str>)> {
     Some((root, split_top_level_type_args(args)))
 }
 
-
 fn effect_name(effect: &EffectDecl) -> &str {
     match effect {
         EffectDecl::Name(name) | EffectDecl::Retains(name) => name,
@@ -5880,8 +5879,6 @@ fn builtin_value_type_name(name: &str) -> Option<&'static str> {
     }
 }
 
-
-
 fn constructor_pattern_is_irrefutable(pattern: &MatchPattern) -> bool {
     match pattern {
         MatchPattern::Binding { .. } | MatchPattern::Wildcard(_) => true,

crates/rsscript/src/capability.rs

@@ -44,9 +44,21 @@ use CapabilityRisk::{High, Low, Medium};
 pub const CAPABILITY_CATEGORIES: &[CapabilityCategory] = &[
     cat("network.client", High, "Make outbound network connections"),
     cat("network.server", High, "Serve requests on a bound address"),
-    cat("network.public_ingress", High, "Accept traffic from a public ingress"),
-    cat("network.egress", High, "Send traffic to an external destination"),
-    cat("filesystem.read", Medium, "Read files or directory contents"),
+    cat(
+        "network.public_ingress",
+        High,
+        "Accept traffic from a public ingress",
+    ),
+    cat(
+        "network.egress",
+        High,
+        "Send traffic to an external destination",
+    ),
+    cat(
+        "filesystem.read",
+        Medium,
+        "Read files or directory contents",
+    ),
     cat("filesystem.write", High, "Create, modify, or delete files"),
     cat("object_storage.read", Medium, "Read from object storage"),
     cat("object_storage.write", High, "Write to object storage"),
@@ -65,9 +77,21 @@ pub const CAPABILITY_CATEGORIES: &[CapabilityCategory] = &[
     cat("compute.regex", Low, "Evaluate a regular expression"),
     cat("process.args", Low, "Read process arguments"),
     cat("process.spawn", High, "Spawn or exec subprocesses"),
-    cat("identity.assume", High, "Assume an identity / capability role"),
-    cat("identity.grant", High, "Grant an identity / capability role"),
-    cat("runtime.native", High, "Cross an unclassified native boundary"),
+    cat(
+        "identity.assume",
+        High,
+        "Assume an identity / capability role",
+    ),
+    cat(
+        "identity.grant",
+        High,
+        "Grant an identity / capability role",
+    ),
+    cat(
+        "runtime.native",
+        High,
+        "Cross an unclassified native boundary",
+    ),
     cat("runtime.unsafe", High, "Execute unsafe runtime code"),
     cat("build.execute", High, "Execute code at build time"),
     cat("build.network", High, "Access the network at build time"),