… run

Every mix-*/cargo-* job has been permanently dormant: mix.exs lives in
opsm_ex/, not the repo root, and the estate's Rust code is nine
independent first-party crates (opsm-ui/tui, two opsm_ex/native NIFs,
six services/* microservices) — there is no root Cargo.toml for
'rules: exists: Cargo.toml' to ever match.

- mix-* jobs (mix-audit, mix-format, credo, mix-test, mix-build):
  rules point at opsm_ex/mix.exs; scripts cd into opsm_ex first.
- cargo-* jobs (cargo-audit, cargo-deny, rustfmt, clippy, cargo-test,
  cargo-build): rules list all nine crates' Cargo.toml paths (rules:
  exists needs literal paths, not variable expansion); scripts loop
  over the new $RUST_CRATE_DIRS variable, running each command
  per-crate. opsm_ex/deps/** (vendored Mix dependency cache) is
  deliberately excluded.
- cache/artifact paths updated for the per-crate target/ layout.

Verified: mix-format's own check (mix format --check-formatted, now
green after the prior commit) and just toolchain-check both pass;
YAML parses clean. The cargo-* loop bodies are not runnable in this
sandbox (no GitLab remote, no network for cargo install) — reviewed
by inspection against the confirmed crate list, same pattern as the
already-working per-crate GitHub Actions job (nif-build.yml).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kq24sZCEohSrNFXSuEuz6C

…1.16.0

Discovered while wiring the live-download CI job (which needed a real
nickel install for the first time): 84 of 95 .ncl files under runtime/
failed to even typecheck against the canonical nickel 1.16.0 pinned in
opsm.toml [runtime]. opsm runtime install has never actually worked
against a real nickel binary — every prior test only reached the
{:error, {:no_plugin, _}} / {:error, {:nickel_not_installed, _}} paths.

Two independent bugs, both traced to a single shared file:

- runtime/contract/runtime-plugin.ncl had three fields with
  '| default = X | doc "..."' annotation ordering. Nickel 1.16's
  grammar requires doc before default in a field's annotation chain;
  the reverse order is a parse error, and every plugin file imports
  this contract, so the failure was transitive to all 84 dependents.
  Fixed by swapping the two annotations (verified minimal repro).

- Every plugin file destructured the import as
  'let { RuntimePlugin, .. } = import "../contract/runtime-plugin.ncl"',
  but the contract file's final expression is the bare contract value
  itself (a  module, not a record wrapping it) —
  so the destructuring pattern could never match. Changed to a plain
  'let RuntimePlugin = import ... in' binding across all 83 affected
  files (one-line mechanical change, same substitution everywhere).

Verified: all 95 .ncl files now nickel typecheck clean; all 94 files
under runtime/core/ (the actual plugin catalog) fully nickel-export to
JSON — the exact call Manager.load_plugin makes. Confirmed end-to-end
via a live zig install (see following commit for the http.ex fix that
was still needed to get a completed install).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kq24sZCEohSrNFXSuEuz6C

… streamed downloads

Two silent option-forwarding bugs in Opsm.Verified.Http, found while
finishing the runtime install path (following the nickel corpus fix):

- do_get/2 and do_post/2 read Keyword.get(opts, :timeout, 30_000), but
  every call site in the codebase (~480 occurrences) passes
  receive_timeout: — Req's actual option name. Every custom timeout
  configured anywhere in OPSM has been silently discarded in favor of
  the 30s default. Now reads :receive_timeout first, falling back to
  the old :timeout key for compatibility, then the same default.

- do_get/2 never forwarded opts[:into] to Req.get/2 at all.
  Runtime.Manager.download_archive/1 calls
  VerifiedHttp.get(url, into: File.stream!(dest)) expecting Req to
  stream the response body straight to disk; because :into was
  dropped, Req buffered the full body in memory, returned {:ok, _},
  and download_archive treated that as success — but dest was never
  written. extract_archive/3 then handed tar a nonexistent file
  ({"", 2} from tar's own "Cannot open" exit). This is why a live zig
  install still failed after the nickel fix.

Verified against a real 47MB zig 0.13.0 download from ziglang.org:
integration_test.exs (--include external_api --include live_download)
now passes 15/15 (0 failures) with a clean cache, including install,
which/1, current_version/1, remove/1, and reinstall idempotency. Full
default suite (807 tests) and mix format --check-formatted unaffected.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kq24sZCEohSrNFXSuEuz6C

The workflow's own header comment has claimed :live_download tests are
"workflow_dispatch only" since it was written, but no job ever ran
them — workflow_dispatch only enabled the manual trigger, it was never
wired to a job scoped to those tests. Adds a live-download job, gated
on `github.event_name == 'workflow_dispatch'`, that:

- Installs a Rust toolchain (pinned to 1.97.0, matching opsm.toml
  [runtime]) and cargo-installs nickel-lang-cli 1.16.0 — confirmed to
  exist at that exact version on crates.io. Manager.install shells out
  to the nickel binary to evaluate runtime/core/*.ncl plugins; without
  it every install fails with {:nickel_not_installed, tool}.
- Runs integration_test.exs with --include external_api --include
  live_download, exercising a real download+extract+install+remove
  cycle (this is what the two prior commits in this branch actually
  fixed and verified locally: 84 broken .ncl files, and a
  VerifiedHttp bug that silently dropped streamed downloads).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kq24sZCEohSrNFXSuEuz6C