rpi: Rust Coding-Agent Runtime

The security policy states that tools run with the invoking user's privileges, bash/PowerShell can run arbitrary commands, file tools can read and write paths, and plugins are trusted native code without a sandbox. This describes the boundary but does not show general least-privilege isolation, so least_privilege is 1. The policy mentions project trust prompts and gating settings, and installers provide dry-run, but the supplied material does not establish the exact scope or defaults of operation confirmations, so user_confirmation is 1. README and the policy describe remote TCP, tokens, credential files, plugin loading, and tool behavior, giving reasonably useful data-flow visibility without covering every path; data_flow_transparency is 2. Unix auth.json permissions of 0600, advice against shared session directories, and terminal-output sanitization are documented; the full credential lifecycle is not shown, so sensitive_data_handling is 2. Cargo.toml lists dependencies and some pinned versions, but the supplied material shows no vulnerability audit or dependency update policy, so dependency_security is 1. Tools can run arbitrary commands, extensions can execute build scripts, and remote service use has external effects; warnings exist but fine-grained effect controls are not shown, so external_effects is 1. Session crash recovery and installer dry-run are documented, but no general undo mechanism for file edits, commands, or installed extensions is shown, so rollback is 1. README, Cargo.toml author metadata, MIT copyright notices, and security reporting instructions provide attribution and contact clues; publisher registry verification is absent and is not treated as adverse evidence, so source_attribution is 2.

README, Cargo.toml, and CI descriptions of the nine crates, version, MSRV, and test command are broadly consistent. The documentation-index sentence is duplicated and the crate dependency narrative is somewhat elaborate, so self_consistency is 2. CI uses locked workspace tests and dependencies are declared, with some exact pins, but the materials show no offline cache or supply-chain availability plan, so dependency_availability is 1. The policy says provider error bodies and model output are sanitized, and CI scripts include some failure messages; there is no catalog or coverage evidence for CLI/API error messages, so failure_messages is 1.

The project addresses CLI users, embedded SDK developers, and plugin authors with separate starting points, examples, and documentation, so audience_and_scenarios is 3. The policy clearly describes the lack of plugin sandboxing, tool privileges, and remote-mode boundaries; README explains provider features and client/server responsibilities, though the full capability boundary is not enumerated, so capability_boundaries is 2. CLI examples, extension search order, remote mode, and use cases are clear, while guidance on choosing modes and precise triggers is limited, so trigger_precision is 2. README lists Linux/macOS/Windows, binary targets, MSRV, installation paths, and a current Homebrew limitation. CI evidence explicitly covers Linux Rust checks and Windows installer tests, leaving other environment coverage unclear, so environment_fit is 2.

Documentation is grouped by feature, with crate tables and architecture, user, remote, and extension-authoring guides, so information_architecture is 3. Prebuilt, Cargo, package-manager, and source installation instructions include commands and platform notes, checksum verification, and dry-run, so install_notes is 3. Crate names and directories consistently use the rpi- prefix and workspace versions align; some Pi/rpi terminology and dependency-graph phrasing are less consistent, so naming_stability is 2. README provides SDK, tools, plugin, and offline examples and links to guides; the supplied material has no FAQ and does not cover common troubleshooting in depth, so examples_and_faq is 2. The security policy covers threat model and scope, and README notes several platform and benchmark limits; a comprehensive known-issues list is not shown, so known_limitations is 2. LICENSE includes full MIT terms and copyright attribution, consistent with Cargo metadata, so license is 3. Version, release status, roadmap, and changelog entry points are present, but changelog contents and versioning policy details are not supplied, so versioning_changelog is 2. Author metadata, vulnerability reporting, contribution guidance, and support information indicate maintenance and contact paths; curated registry verification is absent, so maintenance_responsibility is 2.

The product offers an interactive terminal, one-shot prompts, JSON event stream, persistent sessions, and SDK events, with clear entry points for machine consumption and embedding, so output_usability is 3. The library-first design, provider-independent tools, plugin ABI, and crash recovery provide concrete value beyond a standalone CLI, supported by architectural descriptions and examples, so marginal_value is 3. A single Rust binary, offline faux provider, and crate-level composition reduce some deployment and test costs; remote, plugin, and multi-platform support add complexity, and performance comparisons are repository claims, so cost_benefit is 2.

README links installation, examples, benchmarks, and architecture claims to scripts, a tape, docs, or CI, but some performance and product-comparison claims remain primarily README assertions, so claim_traceability is 2. README, Cargo.toml, security policy, and CI corroborate some version, feature, and security-boundary claims; independent third-party evidence is not supplied, so cross_source_corroboration is 2. README limits benchmark interpretation and lists unmeasured areas, while the policy distinguishes threat model and scope; evidence status is not equally clear for every performance and comparison statement, so fact_inference_separation is 2.