diff --git a/.cursorrules b/.cursorrules
index 3956545..ad81bd5 100644
--- a/.cursorrules
+++ b/.cursorrules
@@ -19,6 +19,10 @@ Critical Rules:
 6. Use the shared logging library. No raw `echo` for status messages. Use
    `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from
    `lib/log.sh`.
+7. Never suppress failing checks. When a lint, format, security, or test
+   check fails, fix the underlying issue. Never comment out code, add
+   suppression annotations, disable rules, or mark CI jobs as
+   allowed-to-fail to bypass a failing check.
 
 Quick Reference:
 
diff --git a/.devrail.yml b/.devrail.yml
index 5dbbc0a..e351ea0 100644
--- a/.devrail.yml
+++ b/.devrail.yml
@@ -9,6 +9,7 @@ languages:
   # - ruby
   # - go
   # - javascript
+  # - rust
 
 # fail_fast: false          # default: false (run-all-report-all)
 # log_format: json          # default: json | options: json, human
diff --git a/.opencode/agents.yaml b/.opencode/agents.yaml
index 67b0cdc..831e90b 100644
--- a/.opencode/agents.yaml
+++ b/.opencode/agents.yaml
@@ -24,6 +24,10 @@ agents:
       6. Use the shared logging library. No raw `echo` for status messages. Use
          `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from
          `lib/log.sh`.
+      7. Never suppress failing checks. When a lint, format, security, or test
+         check fails, fix the underlying issue. Never comment out code, add
+         suppression annotations, disable rules, or mark CI jobs as
+         allowed-to-fail to bypass a failing check.
 
       Quick Reference:
 
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 510ae8b..3d05ded 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -71,6 +71,16 @@ repos:
   #   hooks:
   #     - id: prettier
 
+  # --- Rust (uncomment if languages includes rust) ---
+  # Formatting and linting with cargo
+  # - repo: https://github.com/AndrejOrsula/pre-commit-cargo
+  #   rev: v0.4.0
+  #   hooks:
+  #     - id: cargo-fmt
+  #       args: ["--all", "--", "--check"]
+  #     - id: cargo-clippy
+  #       args: ["--all-targets", "--all-features", "--workspace", "--", "-D", "warnings"]
+
   # --- Secret Detection ---
   # Detects hardcoded secrets, API keys, and credentials in code
   - repo: https://github.com/gitleaks/gitleaks
diff --git a/AGENTS.md b/AGENTS.md
index 9d29d90..e2eb2d8 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -11,6 +11,7 @@ See DEVELOPMENT.md for the complete reference.
 4. **Respect `.editorconfig`.** Never override formatting rules (indent style, line endings, trailing whitespace) without explicit instruction.
 5. **Write idempotent scripts.** Every script must be safe to re-run. Check before acting: `command -v tool || install_tool`, `mkdir -p`, guard file writes with existence checks.
 6. **Use the shared logging library.** No raw `echo` for status messages. Use `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from `lib/log.sh`.
+7. **Never suppress failing checks.** When a lint, format, security, or test check fails, fix the underlying issue. Never comment out code, add suppression annotations, disable rules, or mark CI jobs as allowed-to-fail to bypass a failing check.
 
 ## Quick Reference
 
diff --git a/CLAUDE.md b/CLAUDE.md
index cf1684f..fe5f560 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -11,6 +11,7 @@ See DEVELOPMENT.md for the complete reference.
 4. **Respect `.editorconfig`.** Never override formatting rules (indent style, line endings, trailing whitespace) without explicit instruction.
 5. **Write idempotent scripts.** Every script must be safe to re-run. Check before acting: `command -v tool || install_tool`, `mkdir -p`, guard file writes with existence checks.
 6. **Use the shared logging library.** No raw `echo` for status messages. Use `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from `lib/log.sh`.
+7. **Never suppress failing checks.** When a lint, format, security, or test check fails, fix the underlying issue. Never comment out code, add suppression annotations, disable rules, or mark CI jobs as allowed-to-fail to bypass a failing check.
 
 ## Quick Reference