Serde 1.0

Apply the Rust 1.98 baseline first. These rules cover Serde 1.0, its matching core and derive crates, attributes, custom implementations, and integration with separately versioned data formats. They were checked against Serde 1.0.229.

Dependency and format boundaries

• Resolve serde, serde_core, and enabled serde_derive to the same release; the generated code depends on private interfaces tied to that release. Use public serde APIs in application code.
• Check the complete dependency graph against the chosen compiler: serde and serde_core declare Rust 1.56 minima, while serde_derive declares Rust 1.71. Format crates and proc-macro dependencies can impose additional requirements.
• Review the selected format crate's exact version, features, maintenance status, and advisories independently. Serde supplies the data-model interface; it does not supply the format parser or a shared security configuration.

Construction and validation

• Route deserialization of invariant-bearing types through a checked constructor, a wire type plus TryFrom, or #[serde(try_from = "WireType")]. Ordinary derives construct fields directly; private fields, setters, and #[serde(transparent)] do not enforce additional domain invariants.
• Keep server-managed identity, tenant, and permission fields out of input types. If #[serde(skip_deserializing)] is used, account for the default assigned when constructing a new value and populate trusted state explicitly; skip_serializing still accepts input.
• Audit field and container default functions for safe omission semantics.