Crate unsafe_review 

Product façade crate for unsafe-review.

Programmatic integrations should depend on unsafe-review-core directly.

Modules

api

Structs

AnalyzeInput

AnalyzeOutput

BaselineInitResult

Result returned by baseline_init summarizing what was captured.

CardId

CargoCarefulReceiptInput

ConcurrencyReceiptInput

ContractEvidence

DischargeEvidence

DiscoveryOptions

ManualCandidate

ManualCandidateEvidence

ManualCandidateLocation

ManualCandidateOracleMap

ManualCandidateProofMode

ManualCandidateStableByte

MiriReceiptInput

MissingEvidence

NextAction

OutcomeReport

PerFileScanStats

Per-file scan timing entry. Diagnostic only — not a coverage claim, proof, UB-free, Miri-clean, site-execution, or performance guarantee.

PolicyReport

ProofReceiptInput

Provenance

Traceable evidence metadata that the CLI layer assembles from argv, git, and the filesystem before calling the JSON renderer.

ReachEvidence

ReceiptAuditReport

RelatedTest

RepoScanEvent

RepoScanStatus

ReviewCard

ReviewCardConfirmationProjection

SafetyObligation

SanitizerReceiptInput

ScanCost

Run cost aperture measured by the CLI emit layer and injected into usefulness-telemetry.json (SPEC-0038 §scan_cost).

SourceLocation

UnsafeOperation

UnsafeSite

WitnessEvidence

WitnessReceipt

WitnessRoute

Enums

AnalysisMode

Confidence

DiffSource

HazardKind

PolicyMode

Priority

ProofPath

ReceiptCardIdKind

RepoScanPhase

RepoStopReason

Why a repo scan stopped short of scanning every discovered file.

ReviewClass

Scope

WitnessKind

Constants

COMMENT_BODY_WORD_LIMIT

Maximum word count for a comment-plan comment body.

FILE_TIMINGS_CAP

Maximum number of files for which per-file timing is collected. Scans touching more files omit file_timings entirely rather than silently emitting a partial list (truncation honesty).

MANUAL_CANDIDATE_SCHEMA_VERSION

MANUAL_CANDIDATE_STABLE_BYTE_CLASSES

MANUAL_CANDIDATE_TRUST_BOUNDARY

WITNESS_RECEIPT_SCHEMA_VERSION

Functions

analyze

analyze_with_discovery

analyze_with_discovery_and_progress

analyze_with_discovery_and_repo_events

audit_witness_receipts

baseline_add

baseline add (SPEC-0030): add or update a single baseline entry (plus its snapshot state) by re-analyzing the repo, finding the card matching card_id, and recording its current coverage state.

baseline_init

baseline init (SPEC-0030): scan the repo for open actionable cards, capture each card’s identity and coverage state, and write both the baseline ledger and the coverage snapshot. Idempotent — re-running overwrites with a fresh snapshot of the current state.

bless_fixture_card_goldens

Regenerate expected.cards.json for each named fixture (or all registered fixtures if names is empty), always writing LF line endings.

bless_fixture_card_goldens_from_workspace

Runtime-root-aware variant of bless_fixture_card_goldens.

bless_fixture_surface_goldens

Regenerate surface goldens (expected.lsp.json, expected.repair-queue.json) for a single named fixture, writing LF line endings.

bless_fixture_surface_goldens_from_workspace

Runtime-root-aware variant of bless_fixture_surface_goldens.

collect_context

collect_context_range

Render a file_range_scan envelope for SPEC-0033.

compare_outcome_json

discover_repo_files

evaluate_policy_report

evaluate_policy_report_from_output

explain_card

lint_manual_candidate_text

Lints manual candidate JSON text without importing or writing anything. It reports the first schema or cross-field error from the same validation path candidate import uses, plus every remaining TODO placeholder marker found in string fields. An empty result means the text would import cleanly. Lint is advisory authoring validation only: it is not analyzer discovery, not witness execution, not proof of memory safety, not UB-free status, not Miri-clean status, not a site-execution claim, and not policy gating.

load_manual_candidate

load_manual_candidates

manual_candidate_implementer_handoff

manual_candidate_path

new_manual_candidate_skeleton

Builds a schema-correct manual-candidate/v1 authoring skeleton for one stable-byte class. Free-text fields carry TODO placeholder text for the author to replace, while every cross-field consistency rule the validator enforces (class vocabulary, stable_byte.proof_required == proof_mode.kind, fix_boundary == stable_byte.suggested_fix_boundary, pr_aperture == stable_byte.pr_aperture, trust boundary phrases) is already satisfied. The skeleton is an authoring aid only: it is not analyzer discovery, not witness execution, not proof of memory safety, not UB-free status, not Miri-clean status, not a site-execution claim, and not policy gating.

project_editor

project_review_card_confirmation

read_manual_candidate

render_badge_jsons

render_comment_plan

render_fixture_surface

Render a single surface for a fixture as the bless path would write it (normalised, LF-terminated) without writing a file.

render_fixture_surface_from_workspace

Runtime-root-aware variant of render_fixture_surface.

render_gate_manifest

Render the unsafe-review-gate.json routing manifest (SPEC-0034).

render_gate_manifest_repo

Render unsafe-review-gate.json for a repo run (SPEC-0034 parity).

render_github_summary

render_human

render_json

render_json_with_provenance

Render the JSON analyze artifact with attached traceable evidence metadata.

render_lsp

render_lsp_hover

Render the rich hover markdown for a single ReviewCard as the live LSP server would produce it.

render_manual_candidate_context

render_manual_candidate_explain

render_manual_candidate_witness_plan

render_markdown

render_outcome_json

render_outcome_markdown

render_policy_report_json

render_policy_report_markdown

render_pr_summary

render_receipt_audit_json

render_receipt_audit_markdown

render_repair_queue

render_sarif

render_usefulness_telemetry

Render the usefulness-telemetry.json low-noise usefulness telemetry artifact (SPEC-0038).

render_usefulness_telemetry_with_cost

Render usefulness-telemetry.json with CLI-layer scan cost injected (SPEC-0038 §scan_cost).

render_witness_plan

sha256_hex_of

Compute the SHA-256 hex digest of raw bytes.

validate_witness_receipts