fix(ci): correct the declared MSRV and the licence policy

.github/workflows/ci.yml

@@ -65,7 +65,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@1.85.0
+      - uses: dtolnay/rust-toolchain@1.88.0
       - uses: Swatinem/rust-cache@v2
       - run: cargo build --workspace
 

BACKLOG.md

@@ -95,6 +95,11 @@ Known gaps carried forward, all deliberate and tracked:
   unimplemented in the status bar rather than failing silently
 - `-` (stdin) falls back to `--dump`: the TUI cannot read keys while stdin is a pipe. Proper
   support needs OXD-047
+- **CI is red on `main`.** The MSRV and licence jobs have failed since before the v0.1.0 tag:
+  the declared MSRV of 1.85 is impossible (ratatui 0.30 needs 1.88) and `deny.toml` rejects the
+  project's own GPL crates. `make check` detects neither. Diagnosed in **OXD-005** / issue
+  [#4](https://github.com/AlexanderSlokov/oxidiris/issues/4), scheduled for v0.2.0 because
+  raising the MSRV is a compatibility change
 
 ---
 
@@ -106,6 +111,7 @@ Known gaps carried forward, all deliberate and tracked:
 | OXD-002 | Metadata & MSRV | 0 | S | OXD-001 | ✅ Done |
 | OXD-003 | CI baseline | 0 | M | OXD-001 | ✅ Done |
 | OXD-004 | `testdata/` corpus | 0 | S | OXD-001 | ✅ Done |
+| OXD-005 | Correct MSRV & licence policy ([#4](https://github.com/AlexanderSlokov/oxidiris/issues/4)) | 0 | S | OXD-002, OXD-003 | ⬜ Todo |
 | OXD-010 | Token & Document data types | 1 | M | OXD-001 | ✅ Done |
 | OXD-011 | Unicode Segmenter | 1 | M | OXD-010 | ✅ Done |
 | OXD-012 | ORP Algorithm | 1 | M | OXD-011 | ✅ Done |
@@ -130,7 +136,7 @@ Known gaps carried forward, all deliberate and tracked:
 | OXD-034 | Review Mode | 3 | M | OXD-031 | ⬜ Todo |
 | OXD-035 | Ramp-up on resume | 3 | S | OXD-018 | ⬜ Todo |
 | OXD-036 | TUI Snapshot test | 3 | M | OXD-023 | ⬜ Todo |
-| OXD-037 | Milestone v0.2 | 3 | S | OXD-030…036 | ⬜ Todo |
+| OXD-037 | Milestone v0.2 | 3 | S | OXD-005, OXD-030…036 | ⬜ Todo |
 | OXD-040 | Theme system | 4 | M | OXD-022 | ⬜ Todo |
 | OXD-041 | TOML config file | 4 | M | OXD-020 | ⬜ Todo |
 | OXD-042 | Custom keybindings | 4 | M | OXD-030, OXD-041 | ⬜ Todo |
@@ -194,7 +200,7 @@ Acceptance
 Phase 0 · Depends OXD-001 · Crate repo · Spec §1.2, §9.4 · Size S · Parallel-safe
 
 Scope
-- Add to `[workspace.package]`: `license`, `repository`, `readme`, `keywords`, `categories`, `authors`, `rust-version = "1.85"`.
+- Add to `[workspace.package]`: `license`, `repository`, `readme`, `keywords`, `categories`, `authors`, `rust-version`. Edition 2024 needs 1.85, but ratatui 0.30 pulls the real floor up to `1.88` — the declared value must match what CI's MSRV job builds with.
 - Create `rust-toolchain.toml` to pin the version.
 - Document MSRV in README.
 
@@ -255,6 +261,41 @@ Acceptance
 
 ---
 
+### OXD-005 · Correct the declared MSRV and the licence policy
+
+Phase 0 · Depends OXD-002, OXD-003 · Blocks OXD-037 · Crate repo · Spec §9.3, §9.4 · Size S
+· Issue [#4](https://github.com/AlexanderSlokov/oxidiris/issues/4)
+
+Two CI jobs have failed on `main` since before the v0.1.0 tag. Full diagnosis is in issue #4;
+the summary is that both are defects in project metadata, and `make check` cannot detect either.
+
+The MSRV bump changes the project's compatibility promise, so this ships in **v0.2.0**, not as a
+patch to v0.1.0. v0.1.0 remains tagged as released, with the incorrect claim recorded under its
+known limitations in `CHANGELOG.md`.
+
+Scope
+- `rust-version = "1.88"` in `[workspace.package]`. Edition 2024 only needs 1.85, but `ratatui`
+  0.30 and its tree (`darling`, `instability`, `time`) require 1.88, so the workspace has never
+  built on the declared value.
+- Pin the CI MSRV job to the same version, and state 1.88 in README, CHANGELOG and spec §9.4.
+- `deny.toml`: grant `GPL-3.0-or-later` to `oxidiris` and `oxidiris-core` through `exceptions`.
+  cargo-deny evaluates workspace members, so the permissive-only allow-list currently rejects the
+  project's own crates. The dependency allow-list itself must stay permissive-only.
+- Add a `make msrv` target that builds on the declared MSRV, reading the value out of the manifest
+  so the two cannot drift. Add `msrv` and `audit` to `make ci`.
+- Correct the Makefile header, which claims a green `make check` means a green pipeline. It does
+  not: `make check` runs on whatever toolchain is active and never invokes `cargo deny`.
+
+Acceptance
+- [ ] `cargo +1.88 build --workspace` succeeds
+- [ ] `make msrv` fails with a clear message when the MSRV toolchain is not installed
+- [ ] `cargo deny check` reports `licenses ok`
+- [ ] Adding a GPL dependency still fails the licence check (manually verified)
+- [ ] No file declares or promises 1.85 any more (explaining why it was wrong is fine)
+- [ ] All 6 CI jobs green on `main`
+
+---
+
 # B. Phase 1 — Core Engine (`oxidiris-core`)
 
 > This entire phase contains zero TUI lines. This part is reused for wasm in Phase 8.

CHANGELOG.md

@@ -8,8 +8,27 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). While the
 
 ## [Unreleased]
 
-Nothing yet. Next up is Phase 3 (`OXD-030`…`OXD-037`): modal keymap, full-text panel, outline
-sidebar and Review Mode. See [`BACKLOG.md`](BACKLOG.md).
+Next up is Phase 3 (`OXD-030`…`OXD-037`): modal keymap, full-text panel, outline sidebar and
+Review Mode. See [`BACKLOG.md`](BACKLOG.md).
+
+### Changed
+
+- **Minimum supported Rust version raised from 1.85 to 1.88.** Edition 2024 only needs 1.85, but
+  `ratatui` 0.30 and its dependency tree require 1.88, so the workspace never actually built on
+  the version v0.1.0 declared. Raising it changes the compatibility promise, which is why it
+  lands in a minor release rather than a patch. `OXD-005`, issue
+  [#4](https://github.com/AlexanderSlokov/oxidiris/issues/4).
+
+### Fixed
+
+- `cargo-deny` no longer rejects the project's own crates. The licence allow-list is meant to keep
+  *dependencies* permissive, but cargo-deny evaluates workspace members too, so `oxidiris` and
+  `oxidiris-core` failed their own GPL-3.0-or-later policy. They are now explicit exceptions.
+- `make ci` gained the MSRV build and the licence audit, and a new `make msrv` target builds on
+  the declared minimum, reading the version out of the manifest so the two cannot drift. The
+  Makefile no longer claims that a green `make check` implies a green pipeline: it runs on
+  whatever toolchain is active and never invoked `cargo deny`, which is exactly how both defects
+  above reached a tagged release.
 
 ## [0.1.0] - 2026-09-01
 
@@ -64,11 +83,12 @@ Phases 0-2 of the backlog (`OXD-001`…`OXD-027`).
 
 **Repository**
 
-- Cargo workspace, edition 2024, MSRV 1.85.
+- Cargo workspace, edition 2024, MSRV declared as 1.85.
 - 175 tests: engine unit tests, terminal rendering tests against `TestBackend`, a fixture corpus,
   and property tests asserting the ORP invariants hold for arbitrary Unicode input.
 - CI with six jobs, including a Windows target and a `wasm32-unknown-unknown` build that enforces
   the architectural rule that `oxidiris-core` never depends on a terminal crate.
+- `cargo-deny` policy requiring permissive licences on dependencies.
 - `Makefile` with a self-documenting target list; `make check` is the Definition of Done gate.
 - `BACKLOG.md`: 56 tasks across 9 phases, each with machine-verifiable acceptance criteria.
 - Design spec in `docs/informations/proposals.md` and decision records in `docs/decisions/`.
@@ -82,6 +102,9 @@ Phases 0-2 of the backlog (`OXD-001`…`OXD-027`).
   a pipe. Proper support needs `OXD-047`.
 - RSVP removes the backward eye movements that repair a misparse, which costs comprehension on
   dense material. The tool is built for skim and triage, not for careful reading.
+- **The declared MSRV of 1.85 is wrong.** The dependency tree requires 1.88, so this release does
+  not build on the version it advertises. Use 1.88 or newer. Corrected in the next release; see
+  issue [#4](https://github.com/AlexanderSlokov/oxidiris/issues/4).
 
 [Unreleased]: https://github.com/AlexanderSlokov/oxidiris/compare/v0.1.0...HEAD
 [0.1.0]: https://github.com/AlexanderSlokov/oxidiris/releases/tag/v0.1.0

Cargo.toml

@@ -5,7 +5,9 @@ resolver = "3"
 [workspace.package]
 version = "0.1.0"
 edition = "2024"
-rust-version = "1.85"
+# Edition 2024 itself only needs 1.85, but ratatui 0.30 and its dependency tree require 1.88.
+# Keep this in sync with the MSRV job in .github/workflows/ci.yml.
+rust-version = "1.88"
 authors = ["Aleksandr Slokov"]
 repository = "https://github.com/AlexanderSlokov/oxidiris"
 readme = "README.md"

Makefile

@@ -1,16 +1,21 @@
 # Oxidiris developer commands.
 #
-# Run `make` with no target for the list. Every target here is also what CI runs, so a green
-# `make check` locally means a green pipeline.
+# Run `make` with no target for the list.
+#
+# `make check` is the Definition of Done gate, but it runs on whatever toolchain you have active.
+# It therefore cannot catch an MSRV or licence regression on its own — `make ci` adds those. See
+# the note on `msrv` below.
 
 FILE ?= BACKLOG.md
 WPM  ?= 300
 CORE := oxidiris-core
 BIN  := oxidiris
+# Read from the manifest so the two can never drift apart.
+MSRV := $(shell grep -m1 '^rust-version' Cargo.toml | cut -d'"' -f2)
 
 .DEFAULT_GOAL := help
 .PHONY: help build release run demo dump frame test test-core test-tui fmt fmt-check lint \
-        check wasm doc doc-open bench audit clean install tree ci
+        check wasm msrv doc doc-open bench audit clean install tree ci
 
 ## help: list the available targets
 help:
@@ -78,12 +83,20 @@ lint:
 wasm:
 	cargo build -p $(CORE) --target wasm32-unknown-unknown
 
+## msrv: build with the declared minimum Rust version, the way CI does
+# v0.1.0 shipped claiming MSRV 1.85 while ratatui 0.30 needed 1.88: the default toolchain hid it
+# and only CI caught it. Run this before touching dependencies.
+msrv:
+	@rustup toolchain list | grep -q '^$(MSRV)' || \
+		{ echo "Rust $(MSRV) not installed. Run: rustup toolchain install $(MSRV)"; exit 1; }
+	cargo +$(MSRV) build --workspace
+
 ## check: the Definition of Done gate — fmt, lint, test, wasm
 check: fmt-check lint test wasm
 	@echo "OK — Definition of Done satisfied"
 
-## ci: everything check does, plus docs
-ci: check doc
+## ci: everything check does, plus docs, MSRV and the licence audit
+ci: check doc msrv audit
 	@echo "OK — full pipeline"
 
 # --- inspection -------------------------------------------------------------

README.md

@@ -41,7 +41,7 @@ paper carefully, and it does not advertise a WPM number as an achievement.
 cargo install --path crates/oxidiris
 ```
 
-Requires Rust 1.85 or newer.
+Requires Rust 1.88 or newer.
 
 ## Use
 

deny.toml

@@ -25,6 +25,13 @@ allow = [
 ]
 confidence-threshold = 0.9
 
+# The allow list above governs *dependencies*, which must stay permissive. Oxidiris' own crates
+# are copyleft and would otherwise be rejected by their own policy.
+exceptions = [
+    { name = "oxidiris", allow = ["GPL-3.0-or-later"] },
+    { name = "oxidiris-core", allow = ["GPL-3.0-or-later"] },
+]
+
 [bans]
 multiple-versions = "warn"
 wildcards = "deny"

docs/informations/proposals.md

@@ -742,6 +742,12 @@ GitHub Actions:
 `edition = "2024"` yêu cầu Rust **≥ 1.85**. Cần khai báo `rust-version` trong `Cargo.toml`, ghi rõ
 trong README, và pin một job CI ở đúng phiên bản MSRV để không vô tình phá vỡ.
 
+> **Đính chính (v0.1.0).** MSRV thực tế là **1.88**, không phải 1.85. Edition 2024 chỉ cần 1.85,
+> nhưng `ratatui` 0.30 cùng cây phụ thuộc của nó (`darling`, `instability`, `time`) yêu cầu 1.88.
+> Con số 1.85 đã được khai báo và lọt qua vì `make check` chạy trên toolchain mặc định của máy
+> dev; chỉ job MSRV trên CI mới phát hiện. Đây chính là lý do job đó tồn tại — giữ nó pin đúng
+> giá trị khai báo trong `[workspace.package]`.
+
 ### 9.5. Đóng gói & Phân phối
 
 crates.io · Homebrew tap · AUR · Nix · `cargo-binstall`.