1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
[]
= "ffai-core"
= "FFai shared types, engine traits, and the engine registry"
# Decoupled from the workspace version. `DetectEngine`, `DetectOptions`,
# `Detection`, `DetectOutput` and `Letterbox` all landed AFTER 0.6.1 was
# published, so the crates.io copy of 0.6.1 cannot build ffai-diana — a gap
# invisible locally, where path dependencies mask it, and caught only by
# `cargo publish --dry-run`.
= "0.7.1"
= true
= true
= true
= true
= true
= "README.md"
= ["ai", "inference", "candle", "machine-learning", "toolkit"]
= ["multimedia", "science", "api-bindings"]
[]
= { = true }
# The tensor activations in `fastops` fan out across cores; candle's own
# elementwise kernels are single-threaded (its CPU backend uses rayon for
# conv2d and nothing else).
= { = true }
= { = true }
[]
# GPU backends forward straight to candle. Note: today these pull C/CUDA/Metal
# tooling — the pure-Rust replacement path (cool-japan/oxicuda) is tracked in
# ROADMAP.md § Watchlist.
= ["candle-core/cuda"]
= ["candle-core/metal"]
[]
# Mirrors [workspace.lints.rust]; restated because this crate needs its own
# [lints.clippy] table, and `[lints] workspace = true` is all-or-nothing.
= "warn"
# Gate H-15: ffai-core is the first crate under pedantic + nursery.
#
# 94 findings became 0. Most were mechanical (`cargo clippy --fix` cleared 63:
# use_self, doc_markdown, must_use_candidate). The SAFETY-relevant ones - eight
# numeric casts and one suspicious_operation_groupings - were reviewed
# individually and allowed AT THE SITE with the reasoning written down, so the
# lints stay live for future code. That matters here: unchecked arithmetic on
# outside values is the bug class this audit found five of.
#
# The allows below are the residue: documentation and style, nothing that can
# change behaviour.
[]
= { = "warn", = -1 }
= { = "warn", = -1 }
# 14 sites. Real documentation debt rather than a bad lint - worth doing, not
# worth blocking on today. Revisit 2026-11-15.
= "allow"
# --- the numeric-kernel set, added when fastmath grew its SIMD twins.
# Each is a deliberate decision, not a blanket. The CAST lints stay split by
# trust boundary exactly as the note above describes: only cast_precision_loss
# is crate-wide, and truncation / sign_loss / wrap remain DENIED so they keep
# firing on new code, allowed individually at their four sites with the
# reasoning written there. ---
#
# `exp`, `ln`, `tanh`, `sigmoid`, `silu` and `round_ties_even_fast` are single
# expressions on the hottest path in the workspace, and they exist to REPLACE a
# libm call. Leaving the inlining to chance is the one thing that would undo
# them.
= "allow"
# clippy wants `mul_add`. Taking that suggestion would be a BUG here: `mul_add`
# is a fused multiply-add, it rounds once instead of twice, and this module's
# whole contract is tracking libm within a stated tolerance -- `exp_tracks_libm`
# and its siblings pin exactly that. The polynomials are also transcribed from a
# derivation where the operation order is the approximation.
= "allow"
# The polynomial coefficients are `const` items declared next to the expression
# that uses them, which reads better than hoisting them away from their maths.
= "allow"
# Trimming a digit to satisfy this lint silently selects a DIFFERENT f32 and
# breaks the oracle -- the module says so at the `exp2_unchecked` coefficients,
# and the same applies to `SQRT_2_OVER_PI`, which the SIMD twins must match
# bit-for-bit.
= "allow"
# Rounding, never aliasing: every instance is a small count or index widened for
# float maths. It cannot map two distinct values onto one, which is the property
# the other three cast lints exist to protect and which is why they stay denied.
= "allow"
# `out.push_str(&format!(..))` in the caption writers. `write!` avoids the
# intermediate String; the difference is unmeasurable while building a subtitle
# file, and the push_str form reads better.
= "allow"
# nursery. `map_or_else` is not clearer than the `if let` it replaces here.
= "allow"
# A config struct with four independent switches. Bundling them into an enum
# would invent states that do not exist.
= "allow"
# Style preference about the first doc line's length.
= "allow"