refactor(generated): adopt style guide rules for pub/module visibility

[chet]

This adopts the new style guide rules around pub and module visibility introduced in #4522, defining the intentional generated and non-Rust boundaries that remain after the crate cleanup passes.

Primary callouts are:

• Keep generated tonic, prost, and Kopium output unchanged, with reasoned unreachable_pub allowances at the source-owned module or include! boundary that owns each output.
• Narrow the SSH mock's generated-module index to its actual callers before allowing each generator-owned child module.
• Keep Askama's 22 generated filter helpers inside the four modules where #[askama::filter_fn] expands them.
• Preserve 55 cbindgen and dynamically loaded Kea symbols at six module-scoped C/C++ ABI boundaries.
• Make the one API Core helper added after its crate cleanup private.
• Leave runtime behavior, wire contracts, templates, and generator-owned source unchanged.

Related issues

This supports #4547.

This supports the updated Rust visibility scoping guidelines in STYLE_GUIDE.md, established in #4522.

Type of Change

• Add - New feature or capability
• Change - Changes in existing functionality
• Fix - Bug fixes
• Remove - Removed features or deprecated functionality
• Internal - Internal changes (refactoring, tests, docs, etc.)

Breaking Changes

• This PR contains breaking changes

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• No testing required (docs, internal refactor, etc.)

The focused test runs covered 949 existing tests across the affected crates. The six packages touched by the final review adjustment were rerun afterward.

cargo test --locked -p carbide-agent -p carbide-dhcp-server -p carbide-dpf -p carbide-health -p carbide-ssh-console-mock-api-server -p carbide-api-web --all-features
cargo test --locked -p carbide-dhcp --lib --all-features
cargo test --locked -p carbide-api-core admission::engine::tests --lib
cargo test --locked -p carbide-machine-controller --lib --all-features
cargo clippy --locked --workspace --all-targets --all-features --message-format short -- --cap-lints warn -W unreachable-pub
cargo clippy --locked --workspace --all-targets --all-features --message-format short -- -D unreachable-pub
cargo make format-nightly
cargo make check-format-nightly
cargo make clippy
cargo make carbide-lints
git diff --check

Additional Notes

The raw forced-lint inventory contains 1,729 intentional declarations: 1,400 in the SSH mock's generated children, 252 in OUT_DIR or Kopium output, 22 emitted by Askama, and 55 at the Kea ABI. The normal workspace lint and the strict -D unreachable-pub run both complete with no diagnostics outside the reviewed boundaries.

make core/tests could not start the 32 Machine Controller SQLx integration cases because the local Docker daemon is unavailable. The Machine Controller library tests and the full all-target/all-feature Clippy build passed locally; CI retains coverage of the Docker-backed path.

The tracked generated outputs and cbindgen header retained their pre-change hashes.

Closes #4547

[chet]

@coderabbitai full_review, thanks!

[coderabbitai]

@chet I will perform a complete review of PR #4682.

✅ Action performed

Full review finished.

[coderabbitai]

Summary by CodeRabbit

• Chores

  • Improved code-quality checks by documenting intentional visibility for generated protocol code, template helpers, and hardware-integration interfaces.
  • Reduced unnecessary visibility warnings while preserving existing interfaces and behavior.
  • Clarified internal annotations to make lint results more accurate and maintainable across generated and integration-related components.

• Bug Fixes

  • No user-facing behavior or functionality changes.

Walkthrough

The PR makes one internal conversion method private and adds documented unreachable_pub allowances for generated code, Askama helpers, CRD exports, protocol modules, RPC code, and Kea ABI symbols. Runtime behavior remains unchanged.

Changes

Visibility and lint cleanup

Layer / File(s)	Summary
Internal API visibility crates/api-core/src/admission/engine.rs	ClientKeyRef::to_client_key is now private. Its conversion behavior is unchanged.
Generated code lint allowances crates/agent/src/dhcp_server_grpc_client.rs, crates/dhcp-server/src/grpc_server.rs, crates/api-web/*.rs, crates/dpf/src/crds/mod.rs, crates/health/src/collectors/nvue/gnmi/mod.rs, crates/machine-controller/src/rpc.rs	The modules document and allow unreachable_pub for generated protocol items, Askama helpers, CRD re-exports, health protocol items, and RPC code.
Kea ABI visibility allowances crates/dhcp/src/kea/mod.rs, crates/dhcp/src/lib.rs	The Kea hook modules document public symbols exposed through the Kea C++ ABI and allow unreachable_pub.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	Most issue objectives are addressed, but the SSH generated-module boundary cannot be verified because its source file was excluded by path filters.	Review crates/ssh-console-mock-api-server/src/generated/mod.rs, excluded by the generated-path filter, to verify the SSH module index and scoped allowances.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the visibility refactor and generated-code scope.
Description check	✅ Passed	The description directly explains the visibility changes, boundaries, validation, and linked issue.
Out of Scope Changes check	✅ Passed	The reviewed changes align with the linked issue and do not show unrelated code changes.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[chet]

/ok to test 10d25be

[chet]

/ok to test 10d25be

[chet]

/ok to test 10d25be

[chet]

/ok to test 10d25be

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[chet]

@coderabbitai full_review, thanks!

[coderabbitai]

@chet I will perform a complete review of PR #4682.

🐇✅

✅ Action performed

Full review finished.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pull-request-4682.docs.buildwithfern.com/infra-controller

[coderabbitai]

🧹 Nitpick comments (1)

crates/machine-controller/src/rpc.rs (1)

19-19: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Remove the blanket dead_code allowance.

#![allow(dead_code)] suppresses dead-code diagnostics for every item emitted by scout_firmware_upgrade. Remove it, or gate test- and feature-specific generated items with #[cfg(...)] and fix the generator output for production items. Keep the scoped unreachable_pub allowance for the RPC boundary.

Proposed change

 pub(crate) mod scout_firmware_upgrade {
-    #![allow(dead_code)]
     #![allow(
         unreachable_pub,
         reason = "tonic_prost_build emits public items for this crate-internal protocol module"

As per coding guidelines: avoid #[allow(...)], especially #[allow(dead_code)]; fix the issue or use #[cfg(test)]/feature gating where appropriate. As per path instructions: prefer clippy-clean Rust changes without broad allows.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/machine-controller/src/rpc.rs` at line 19, Remove the module-level
#![allow(dead_code)] from the RPC module. Ensure test- or feature-specific
generated items are gated with the appropriate #[cfg(...)] conditions and
production items are emitted and referenced correctly, while preserving the
scoped unreachable_pub allowance for the RPC boundary.

Sources: Coding guidelines, Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@crates/machine-controller/src/rpc.rs`:
- Line 19: Remove the module-level #![allow(dead_code)] from the RPC module.
Ensure test- or feature-specific generated items are gated with the appropriate
#[cfg(...)] conditions and production items are emitted and referenced
correctly, while preserving the scoped unreachable_pub allowance for the RPC
boundary.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 42fc6ef0-6ed2-413e-b0c3-9a15b943a4f8

📥 Commits

Reviewing files that changed from the base of the PR and between 9d296f6 and 0d826d8.

⛔ Files ignored due to path filters (1)

• crates/ssh-console-mock-api-server/src/generated/mod.rs is excluded by !**/generated/**, !crates/ssh-console-mock-api-server/src/generated/**

📒 Files selected for processing (12)

• crates/agent/src/dhcp_server_grpc_client.rs
• crates/api-core/src/admission/engine.rs
• crates/api-web/src/filters.rs
• crates/api-web/src/ipxe_template.rs
• crates/api-web/src/redfish_actions.rs
• crates/api-web/src/resource_pool.rs
• crates/dhcp-server/src/grpc_server.rs
• crates/dhcp/src/kea/mod.rs
• crates/dhcp/src/lib.rs
• crates/dpf/src/crds/mod.rs
• crates/health/src/collectors/nvue/gnmi/mod.rs
• crates/machine-controller/src/rpc.rs