Crate unsafe_review 

Product façade crate for unsafe-review.

unsafe-review finds unsafe Rust changes missing a safety contract, guard, test, or witness. It is advisory static review evidence: it does not prove memory safety, UB-free status, or Miri-clean status, and it does not run witnesses, post comments, edit source, or block by default.

Most users want the command-line interface:

cargo install unsafe-review --locked
unsafe-review pr --base origin/main

Programmatic integrations should depend on unsafe-review-core directly: build an AnalyzeInput, call analyze, and render or consume the returned AnalyzeOutput. Every output surface (CLI, JSON, Markdown PR summary, SARIF, LSP diagnostics, agent packets) projects from the same ReviewCard truth object.

Start with unsafe-review doctor to check a repository is set up for review, then unsafe-review pr or unsafe-review check --base origin/main for the first advisory review.

Modules

api

freshness

Analysis-run identity for freshness-aware consumers.

Structs

AnalysisIdentity

Facts identifying the analysis run that produced an output envelope.

AnalyzeInput

AnalyzeOutput

BaselineHealthCounts

Bucket counts, mirrored 1:1 with HealthBucket.

BaselineHealthEntry

One classified ledger entry or unbaselined card.

BaselineHealthReport

Full baseline-health classification result (baseline status, issue #1893).

BaselineInitResult

Result returned by baseline_init summarizing what was captured.

BaselineRefreshPlan

Deterministic per-entry refresh preview (baseline refresh --dry-run, issue #1893). Writes nothing; a future apply mode is out of scope (see module docs).

CardId

CargoCarefulReceiptInput

ConcurrencyReceiptInput

ContractEvidence

DischargeEvidence

DiscoveryOptions

EditorActionArguments

EditorActionCommand

EditorActionContract

EditorActionDiagnostic

EditorActionPayload

EditorCoverageBlock

EditorDiagnostic

Canonical, card-scoped diagnostic data for editor and agent projections.

EditorEvidenceState

EditorEvidenceSummary

EditorObligationEvidence

EditorPosition

EditorProjection

EditorRange

EditorReachEvidence

EditorSafetyCondition

EditorSimpleEvidence

EditorWitnessRoute

ManualCandidate

ManualCandidateEvidence

ManualCandidateLocation

ManualCandidateOracleMap

ManualCandidateProofMode

ManualCandidateStableByte

MiriReceiptInput

MissingEvidence

NextAction

OutcomeReport

PerFileScanStats

Per-file scan timing entry. Diagnostic only — not a coverage claim, proof, UB-free, Miri-clean, site-execution, or performance guarantee.

PolicyReport

ProofReceiptInput

Provenance

Traceable evidence metadata that the CLI layer assembles from argv, git, and the filesystem before calling the JSON renderer.

ReachEvidence

ReceiptAuditReport

RefreshPlanEntry

RefreshPlanSummary

RelatedTest

RepairCandidate

RepairCandidatePosition

RepairCandidateRange

RepairCandidateTarget

RepairEvidenceMovement

RepoScanEvent

RepoScanStatus

ReviewCard

ReviewCardConfirmationProjection

SafetyObligation

SanitizerReceiptInput

ScanCost

Run cost aperture measured by the CLI emit layer and injected into usefulness-telemetry.json (SPEC-0038 §scan_cost).

SourceLocation

UnsafeOperation

UnsafeSite

WitnessEvidence

WitnessReceipt

WitnessRoute

Enums

AnalysisMode

AnalysisState

Lifecycle state produced by the analysis-identity slice.

Confidence

DiffSource

EditorActionApplicability

EditorActionReadiness

ExecutedReceiptInput

Typed output captured by an explicit unsafe-review witness execution.

HazardKind

HealthBucket

One of the ten SPEC-0030 baseline-health buckets (issue #1893).

PolicyMode

Priority

ProofPath

ReceiptCardIdKind

RefreshAction

Refresh-plan action for one ledger entry (baseline refresh --dry-run, issue #1893).

RepairCandidateApplicability

RepairCandidateKind

RepoScanPhase

RepoStopReason

Why a repo scan stopped short of scanning every discovered file.

ReviewClass

Scope

WitnessKind

Constants

COMMENT_BODY_WORD_LIMIT

Maximum word count for a comment-plan comment body.

FILE_TIMINGS_CAP

Maximum number of files for which per-file timing is collected. Scans touching more files omit file_timings entirely rather than silently emitting a partial list (truncation honesty).

MANUAL_CANDIDATE_SCHEMA_VERSION

MANUAL_CANDIDATE_STABLE_BYTE_CLASSES

MANUAL_CANDIDATE_TRUST_BOUNDARY

WITNESS_RECEIPT_SCHEMA_VERSION

Functions

actions_for_card

analyze

analyze_with_discovery

analyze_with_discovery_and_progress

analyze_with_discovery_and_repo_events

audit_witness_receipts

baseline_add

baseline add (SPEC-0030): add or update a single baseline entry (plus its snapshot state) by re-analyzing the repo, finding the card matching card_id, and recording its current coverage state.

baseline_init

baseline init (SPEC-0030): scan the repo for open actionable cards, capture each card’s identity and coverage state, and write both the baseline ledger and the coverage snapshot. Idempotent — re-running overwrites with a fresh snapshot of the current state.

baseline_init_preview

Preview the baseline entries that baseline init would author without writing files. The returned result is the same plan used by the applying command, preserving one source of truth for card selection and output paths.

baseline_ledger_path

Canonical location of the baseline debt ledger for a scan root.

baseline_refresh_preview

baseline refresh --dry-run (issue #1893): build the deterministic per-entry action plan from the same classification as baseline_status. Writes nothing; there is no apply mode (SPEC-0030 non-goal — a future apply command would be separately approved, explicit, idempotent, and refuse to overwrite a changed ledger).

baseline_status

baseline status (issue #1893): classify every baseline ledger entry, plus every currently open actionable card the ledger does not represent, into the ten SPEC-0030 baseline-health buckets. Read-only — runs a full repo scan and reads policy files; writes nothing.

bless_fixture_card_goldens

Regenerate expected.cards.json for each named fixture (or all registered fixtures if names is empty), always writing LF line endings.

bless_fixture_card_goldens_from_workspace

Runtime-root-aware variant of bless_fixture_card_goldens.

bless_fixture_surface_goldens

Regenerate surface goldens (expected.lsp.json, expected.repair-queue.json) for a single named fixture, writing LF line endings.

bless_fixture_surface_goldens_from_workspace

Runtime-root-aware variant of bless_fixture_surface_goldens.

collect_context

collect_context_range

Render a file_range_scan envelope for SPEC-0033.

compare_outcome_json

discover_repo_files

evaluate_policy_report

evaluate_policy_report_from_output

explain_card

lint_manual_candidate_text

Lints manual candidate JSON text without importing or writing anything. It reports the first schema or cross-field error from the same validation path candidate import uses, plus every remaining TODO placeholder marker found in string fields. An empty result means the text would import cleanly. Lint is advisory authoring validation only: it is not analyzer discovery, not witness execution, not proof of memory safety, not UB-free status, not Miri-clean status, not a site-execution claim, and not policy gating.

load_manual_candidate

Look up one manual advisory candidate by id.

load_manual_candidates

manual_candidate_implementer_handoff

manual_candidate_path

new_manual_candidate_skeleton

Builds a schema-correct manual-candidate/v1 authoring skeleton for one stable-byte class. Free-text fields carry TODO placeholder text for the author to replace, while every cross-field consistency rule the validator enforces (class vocabulary, stable_byte.proof_required == proof_mode.kind, fix_boundary == stable_byte.suggested_fix_boundary, pr_aperture == stable_byte.pr_aperture, trust boundary phrases) is already satisfied. The skeleton is an authoring aid only: it is not analyzer discovery, not witness execution, not proof of memory safety, not UB-free status, not Miri-clean status, not a site-execution claim, and not policy gating.

project_actionable_editor_diagnostics

Project only actionable canonical editor diagnostics for live transport.

project_editor

project_editor_diagnostics

Project only the canonical editor diagnostics without constructing hovers or code actions that a caller does not need.

project_review_card_confirmation

read_manual_candidate

render_badge_jsons

render_baseline_refresh_human

render_baseline_refresh_json

render_baseline_status_human

render_baseline_status_json

render_comment_plan

render_fixture_surface

Render a single surface for a fixture as the bless path would write it (normalised, LF-terminated) without writing a file.

render_fixture_surface_from_workspace

Runtime-root-aware variant of render_fixture_surface.

render_gate_manifest

Render the unsafe-review-gate.json routing manifest (SPEC-0034).

render_gate_manifest_repo

Render unsafe-review-gate.json for a repo run (SPEC-0034 parity).

render_github_summary

render_human

render_human_short

render_json

render_json_with_provenance

Render the JSON analyze artifact with attached traceable evidence metadata.

render_lsp

render_lsp_hover

Render the rich hover markdown for a single ReviewCard as the live LSP server would produce it.

render_manual_candidate_context

render_manual_candidate_explain

render_manual_candidate_witness_plan

render_markdown

render_outcome_json

render_outcome_markdown

render_policy_report_json

render_policy_report_markdown

render_pr_summary

render_receipt_audit_json

render_receipt_audit_markdown

render_repair_queue

render_sarif

render_usefulness_telemetry

Render the usefulness-telemetry.json low-noise usefulness telemetry artifact (SPEC-0038).

render_usefulness_telemetry_with_cost

Render usefulness-telemetry.json with CLI-layer scan cost injected (SPEC-0038 §scan_cost).

render_witness_plan

sha256_hex_of

Compute the SHA-256 hex digest of raw bytes.

validate_witness_receipts