hunyi 0.3.0

渾儀 (Hunyi) — Tianheng's semantic (AST/syn) observation dimension, the complement of the static import boundary. Declare in Rust how a module's public surface must behave: what its API must not expose (types — including named public re-exports and, opt-in, a trait impl's impl-site positions — and no dyn / impl Trait or async fn seam), where a trait may be implemented, that it declares no bare pub, and which markers a type must not acquire — observed via syn, reacted in CI. The heavy syn dependency is quarantined here, never in the core.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104

use std::path::PathBuf;

use xuanji::{BoundaryKind, Polarity, RuleKey, Severity, Violation, ViolationId};

use crate::finding::SemanticFact;

pub(crate) struct SingleModuleViolationContext<'a> {
    pub(crate) module: &'a str,
    pub(crate) rule: &'a str,
    pub(crate) rule_key: RuleKey,
    pub(crate) reason: &'a str,
    pub(crate) severity: Severity,
    pub(crate) anchor: Option<&'a str>,
}

/// Add deny-style violations for a boundary whose findings all sit on one governed module seam.
/// Each finding carries the real file its own item's branch was resolved from (see
/// [`crate::module_resolve::resolve_module_items_with_files`]) — never a single, first-branch file
/// for the whole module, which would misattribute a finding produced by a non-first `#[cfg]`-split
/// branch (a real defect found on a round-5 adversarial review; see `PROJECT.md`'s Decisions).
/// Every capability supplies `(target, rule key, structured fact)` identity; presentation, file,
/// anchor, and polarity remain metadata.
pub(crate) fn push_single_module_violations(
    violations: &mut Vec<Violation>,
    context: SingleModuleViolationContext<'_>,
    findings: Vec<(SemanticFact, PathBuf)>,
) {
    let anchor = context.anchor.map(str::to_string);
    for (finding, file) in findings {
        let finding = finding.into_finding();
        let id = ViolationId::new(
            context.module,
            context.rule_key.clone(),
            finding.fact().clone(),
        );
        violations.push(
            Violation::new(
                BoundaryKind::Semantic,
                id,
                context.rule,
                finding.text(),
                context.reason.to_string(),
                context.severity,
            )
            .with_file(Some(file.display().to_string()))
            .with_anchor(anchor.clone())
            .with_polarity(Polarity::DenyBreach),
        );
    }
}

pub(crate) struct MultiModuleViolationContext<'a> {
    /// The violation `target` — the boundary's anchored module, kept stable so identity
    /// `(target, rule key, structured fact)` does not shift as the governed subtree grows.
    pub(crate) target: &'a str,
    pub(crate) rule: &'a str,
    pub(crate) rule_key: RuleKey,
    pub(crate) reason: &'a str,
    pub(crate) severity: Severity,
    pub(crate) anchor: Option<&'a str>,
    /// The finding's polarity metadata (deny-breach vs allowlist-gap). Not part of the violation
    /// identity, so each capability passes its own without shifting structured identity.
    pub(crate) polarity: Polarity,
}

/// Add violations for a boundary whose findings sit across many modules — the shared emitter for
/// every whole-crate-scan capability (forbidden-marker, trait-impl, unsafe-confinement, and the
/// async-exposure subtree branch), of either polarity: each caller supplies its own `polarity` via
/// the context. Each finding carries its enclosing module (metadata, never part of the identity)
/// AND the real file that module's own branch was resolved from, collected directly at the site
/// (`ImplSite`/`TypeDef`/`UnsafeSite`, or the subtree walker's own per-branch file) rather than
/// re-resolved afterward by module string — a re-resolution keyed only by the module string
/// misattributes a finding whenever two `#[cfg]`-split branches share one module path (the same
/// finding as [`push_single_module_violations`]'s doc, found one hop further downstream on a
/// round-5 adversarial review; see `PROJECT.md`'s Decisions). The violation `target` stays the
/// boundary's anchor, so a finding's structured identity is stable.
pub(crate) fn push_multi_module_violations(
    violations: &mut Vec<Violation>,
    context: MultiModuleViolationContext<'_>,
    findings: Vec<(SemanticFact, String, PathBuf)>,
) {
    let anchor = context.anchor.map(str::to_string);
    for (finding, _module, file) in findings {
        let finding = finding.into_finding();
        let id = ViolationId::new(
            context.target,
            context.rule_key.clone(),
            finding.fact().clone(),
        );
        violations.push(
            Violation::new(
                BoundaryKind::Semantic,
                id,
                context.rule,
                finding.text(),
                context.reason.to_string(),
                context.severity,
            )
            .with_file(Some(file.display().to_string()))
            .with_anchor(anchor.clone())
            .with_polarity(context.polarity),
        );
    }
}