sdk%feat!: bump MSRV to 1.89, add portable feature, define system requirements, decouple serde from codec, use thiserror, tune build flags, add mutant config, git merge script

.cargo/config.toml

@@ -1,2 +1,11 @@
 [net]
 git-fetch-with-cli = true
+
+[target.'cfg(target_arch = "aarch64")']
+rustflags = ["-C", "target-feature=+aes"]
+
+[target.'cfg(target_arch = "x86_64")']
+rustflags = ["-C", "target-cpu=x86-64-v3", "-C", "target-feature=+adx,+aes"]
+
+[target.'cfg(target_arch = "wasm32")']
+rustflags = ["-C", "target-feature=+simd128"]

deny.toml → .cargo/deny.toml

@@ -2,6 +2,9 @@
 all-features = true
 
 [advisories]
+db-path = "$CARGO_HOME/advisory-dbs"
+db-urls = ["https://github.com/rustsec/advisory-db"]
+version = 2
 yanked = "deny"
 
 [bans]

.cargo/mutants.toml

@@ -0,0 +1,12 @@
+additional_cargo_test_args = [
+  "--config-file",
+  ".cargo/nextest.toml",
+  "--profile",
+  "fail-fast",
+]
+build_timeout_multiplier = 5.0
+exclude_globs = ["pkgs/dev/**", "pkgs/pow/**"]
+features = ["full"]
+gitignore = true
+profile = "mutants"
+test_tool = "nextest"

.cargo/nextest.toml

@@ -0,0 +1,8 @@
+[profile.default]
+fail-fast = false
+
+[profile.default.junit]
+path = "junit.xml"
+
+[profile.fail-fast]
+fail-fast = true

.github/PULL_REQUEST_TEMPLATE.md

@@ -22,4 +22,13 @@
 - [ ] I have commented my code, particularly in hard-to-understand areas
 - [ ] I have added or updated relevant unit/integration/functional tests
 - [ ] I have made corresponding changes to the documentation
+- [ ] I did not use agentic assistance (i.e. LLMs, AI) except as [disclosed](#agent-disclosure) and can answer questions,
+      comments and concerns without said assistance. I assume authorship of the code submitted.
 - [ ] I have assigned this pull request to a milestone _(for repository code-owners and collaborators only)_
+
+### Agent disclosure
+
+<!--
+  Omit this segment if agentic assistance is not used, otherwise specify model name, version, runner and effort, e.g.
+  "Code generated with Claude Code using Sonnet 4.6, high effort. Reviewed with Codex using GPT-5.6-Sol, medium effort."
+-->

.github/workflows/build_msrv.yml

@@ -1,4 +1,4 @@
-name: MSRV (1.85)
+name: MSRV (1.89)
 
 on:
   push:
@@ -143,11 +143,11 @@ jobs:
           export RUSTC="$TOOLCHAIN_MSRV/bin/rustc"
           export RUSTDOC="$TOOLCHAIN_MSRV/bin/rustdoc"
           "$TOOLCHAIN_MSRV/bin/cargo" build --workspace --exclude dash-pow --features full
-          "$TOOLCHAIN_MSRV/bin/cargo" build -p dash-pow --features std,aes_hw
+          "$TOOLCHAIN_MSRV/bin/cargo" build -p dash-pow --features std
 
       - name: Test workspace
         run: |
           export RUSTC="$TOOLCHAIN_MSRV/bin/rustc"
           export RUSTDOC="$TOOLCHAIN_MSRV/bin/rustdoc"
           "$TOOLCHAIN_MSRV/bin/cargo" test --workspace --exclude dash-pow --features full
-          "$TOOLCHAIN_MSRV/bin/cargo" test -p dash-pow --features std,aes_hw
+          "$TOOLCHAIN_MSRV/bin/cargo" test -p dash-pow --features std

.github/workflows/build_nightly.yml

@@ -25,7 +25,6 @@ jobs:
     name: ubuntu-24.04-arm (nightly, ${{ matrix.config.name }})
     runs-on: ubuntu-24.04-arm
     env:
-      RUSTFLAGS: -D warnings
       HAS_CODECOV: ${{ secrets.CODECOV_TOKEN != '' }}
     strategy:
       fail-fast: false
@@ -34,6 +33,7 @@ jobs:
           - { name: full, args: "--features full" }
           - { name: min, args: "--no-default-features" }
           - { name: std, args: "--features std" }
+          - { name: powerset, args: "" }
 
     defaults:
       run:
@@ -90,15 +90,21 @@ jobs:
             cargo-build-nightly-${{ runner.os }}-${{ runner.arch }}-${{ inputs.package }}-${{ matrix.config.name }}-
 
       - name: Lint package
+        if: matrix.config.name == 'full' || matrix.config.name == 'min'
         run: cargo clippy -p ${{ inputs.package }} ${{ matrix.config.args }} --tests --benches -- -D warnings
 
+      - name: Lint every feature combination
+        if: matrix.config.name == 'powerset'
+        run: cargo hack clippy -p ${{ inputs.package }} --feature-powerset --exclude-features default -- -D warnings
+
       - name: Build package
+        if: matrix.config.name == 'full' || matrix.config.name == 'min'
         run: cargo build -p ${{ inputs.package }} ${{ matrix.config.args }}
 
       - name: Test package
-        if: matrix.config.name != 'full'
+        if: matrix.config.name == 'min' || matrix.config.name == 'std'
         run: |
-          cargo nextest run --config-file maint/nextest.toml --profile=ci -p ${{ inputs.package }} ${{ matrix.config.args }}
+          cargo nextest run --config-file .cargo/nextest.toml -p ${{ inputs.package }} ${{ matrix.config.args }}
           cargo test --doc -p ${{ inputs.package }} ${{ matrix.config.args }}
 
       - name: Check formatting
@@ -109,7 +115,7 @@ jobs:
         if: matrix.config.name == 'full'
         run: |
           cargo llvm-cov clean --workspace
-          cargo llvm-cov --no-report nextest --config-file maint/nextest.toml --profile=ci ${{ matrix.config.args }} --package ${{ inputs.package }}
+          cargo llvm-cov --no-report nextest --config-file .cargo/nextest.toml ${{ matrix.config.args }} --package ${{ inputs.package }}
           cargo llvm-cov report --lcov --output-path lcov.info
           cargo test --doc -p ${{ inputs.package }} ${{ matrix.config.args }}
 
@@ -122,13 +128,14 @@ jobs:
           token: ${{ secrets.CODECOV_TOKEN }}
 
       - name: Upload test results to Codecov
-        if: ${{ !cancelled() && matrix.config.name == 'full' && env.HAS_CODECOV == 'true' && hashFiles('target/nextest/ci/junit.xml') != '' }}
+        if: ${{ !cancelled() && matrix.config.name == 'full' && env.HAS_CODECOV == 'true' && hashFiles('target/nextest/default/junit.xml') != '' }}
         uses: codecov/codecov-action@v5
         with:
-          files: target/nextest/ci/junit.xml
+          files: target/nextest/default/junit.xml
           report_type: test_results
           flags: ${{ inputs.package }}
           token: ${{ secrets.CODECOV_TOKEN }}
 
       - name: Sanity check benchmarks
-        run: cargo bench ${{ matrix.config.args }} --package ${{ inputs.package }} --no-run
+        if: matrix.config.name != 'powerset'
+        run: cargo test ${{ matrix.config.args }} --package ${{ inputs.package }} --benches

.vscode/settings.json

@@ -40,6 +40,7 @@
     "**/Cargo.lock": true,
     "**/target": true,
   },
+  "rust-analyzer.cargo.extraArgs": ["--locked"],
   "rust-analyzer.cargo.features": "all",
   "rust-analyzer.check.command": "clippy",
   "rust-analyzer.checkOnSave": true,

AGENTS.md

@@ -37,7 +37,7 @@ The full guide is at [`docs/dev/guide_rust.md`](./docs/dev/guide_rust.md). Key p
 ### Environment
 
 - `no_std` + `alloc` is mandatory for all crates. Every crate uses `#![no_std]` with `extern crate alloc`.
-- `std` is an optional feature that downstream consumers enable when they need stdlib I/O, `Error` impls, etc.
+- `std` is an optional feature that downstream consumers enable when they need standard library I/O, primitives, etc.
 - No networking code in any crate. The SDK provides encoding, decoding, and data types only.
 
 ### Feature flags
@@ -48,13 +48,11 @@ Every crate must follow this feature layout:
 [features]
 default = []
 std = [...]
-full = ["std"]            # add "serde" here only if the crate implements Serialize/Deserialize
+full = ["std"]            # add "serde" here if the crate implements Serialize/Deserialize, do not include "portable"
+portable = [...]          # only if the crate or a dependency defines platform acceleration
 serde = ["dep:serde"]     # only if the crate has serde impls
 ```
 
-No other features should exist unless there is a pressing justification. The `serde` feature is only added to crates
-that actually derive or implement `Serialize`/`Deserialize` on public types.
-
 ### Module conventions
 
 Any shim code that mediates between `alloc` and `std` (e.g. `pub(crate) use alloc::vec::Vec;`) belongs in