feat(rust): add a Rust implementation sharing the Rego rules

[starkross]

A second implementation of the linter in Rust, sharing the Rego rules with the Go one. Nothing in the Go tree changes.

Why

The Go binary embeds the OPA interpreter. As a wasip1 module that is 46,593,356 bytes, and stripping the entire CLI and cobra saves 1.6 MB of it — the interpreter is ~96%. The Go runtime floor alone is 1.6 MB, and TinyGo can't compile OPA (reflection), so there is no route down from inside Go.

Swapping OPA for regorus and trimming unused features gives the same linter in 1,184,533 bytes (330 KB brotli):

build	raw	brotli
Go + OPA (make wasm)	46,593,356	6.04 MB
Rust + regorus (make rust-wasm)	1,184,533	330 KB

39× smaller, and faster: the wasm module compiles in 2 ms and runs a lint in 31 ms, against 45 ms and ~300 ms for the Go module. Verified running under Node WASI — -o json output is byte-identical to the Go native binary on three configs.

Structure

• augur-core — parsing, env substitution, deep merge, evaluation. No I/O; callers pass strings, so it works unchanged in a CLI, a server, or a browser.
• augur-cli — the augur binary. Flags and all three output formats match the Go CLI.

rules/policy/ stays the single source of truth. augur-core/build.rs walks it at compile time, so a new .rego file is picked up by both implementations without touching Rust — the two can't silently drift as rules are added.

Two behaviours reproduced rather than fixed

Both were found by differential testing, and both change lint results:

YAML 1.1 scalars. sigs.k8s.io/yaml wraps go-yaml v2, which resolves yes/no/on/off as booleans. Rust YAML crates follow the YAML 1.2 core schema and leave them strings. Uncoerced, a config with insecure_skip_verify: yes stops matching == true:

GO:    warn|OTEL-032   warn|OTEL-048
RUST:  warn|OTEL-065          ← OTEL-032 silently missing

OTEL-032 is "TLS verification is bypassed" — the worst possible thing for a linter to quietly drop. The coercion applies to mapping keys too, because go-yaml does: a bare y: key becomes true, which sigs.k8s.io/yaml then renders as the string "true". There's a test pinning that, surprising as it looks.

Builtin error handling. OPA leaves an expression undefined when a builtin hits a runtime type error and carries on; regorus aborts by default. An empty config section (grpc: with no body, as in examples/bad.yaml) parses as null, reaches object.get, and under the strict default takes the whole evaluation down — 14 findings become 0. set_strict_builtin_errors(false) restores OPA's behaviour. Confirmed with opa eval --strict-builtin-errors, which reproduces the regorus error exactly.

"findings": null for a clean config is preserved too — Go marshals a nil slice that way, and emitting [] would change the shape consumers parse.

regorus is pinned to a commit

0.11.0 was published 2026-07-21; the fix for function calls through import aliases (microsoft/regorus#747, via #769) merged 2026-07-23. The policies call lib.pipeline_receivers(t) after import data.lib at 48 sites, which the released crate rejects with could not find function. The pinned commit is 19 commits ahead of the fix and 0 behind. Swap it for a version requirement once a release carries the fix.

Testing

rust/difftest.sh runs both binaries over every config in testdata/ and examples/, across all three output formats and the flag combinations, requiring byte-identical stdout and matching exit codes:

pass=28 tolerated=5 fail=0

The 5 tolerated are all testdata/invalid.yaml: both reject it with the same exit code, but the message comes from the underlying YAML library and differs. Plus 13 unit tests in augur-core, and go test ./... still passes its 62.

make rust-build   make rust-test   make rust-wasm   make difftest

What this does not do

This adds an implementation; it does not replace anything. The Go CLI, library API, goreleaser config and Docker image are untouched.

Divergences still unreconciled, each needing a decision before the Rust CLI could stand in for the Go one — documented in rust/README.md:

case	Go	Rust
0644, 010	420, 8	"0644", "010"
duplicate keys	last wins	parse error
<<: merge key	merged	literal << key
ints > 2^53	precision lost via float64	exact

The last is arguably a Go bug worth fixing rather than copying. And the corpus is six configs — this list is what has been looked for, not proof of equivalence. Running a few hundred real collector configs through difftest.sh is the next thing worth doing.