Report unsafe native additions in review

Author: olwang

src/diagnostic.rs

@@ -50,6 +50,7 @@ pub mod code {
     pub const REVIEW_TYPE_KIND_CHANGED: &str = "RSR009";
     pub const REVIEW_TYPE_FIELDS_CHANGED: &str = "RSR010";
     pub const REVIEW_BOUNDARY_CHANGED: &str = "RSR011";
+    pub const REVIEW_UNSAFE_NATIVE_ADDED: &str = "RSR012";
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]

src/review.rs

@@ -46,6 +46,7 @@ pub enum ReviewRisk {
     TypeLayout,
     Effect,
     Boundary,
+    Unsafe,
 }
 
 impl ReviewRisk {
@@ -56,6 +57,7 @@ impl ReviewRisk {
             Self::TypeLayout => "type-layout",
             Self::Effect => "effect",
             Self::Boundary => "boundary",
+            Self::Unsafe => "unsafe",
         }
     }
 }
@@ -232,6 +234,10 @@ fn review_fixes(code: &str) -> Vec<ReviewFix> {
             "review_local_manage_boundary",
             "Review the changed local ownership and manage boundary.",
         ),
+        code::REVIEW_UNSAFE_NATIVE_ADDED => (
+            "review_unsafe_native_boundary",
+            "Review the new unsafe or native boundary and require explicit justification.",
+        ),
         _ => ("review_change", "Review this source-level contract change."),
     };
     vec![ReviewFix {
@@ -383,6 +389,31 @@ fn compare_function(old: &FunctionSig, new: &FunctionSig, findings: &mut Vec<Rev
             Some(effects_contract(&new.effects)),
         ));
     }
+    let old_unsafe_native = unsafe_native_effects(&old.effects);
+    let new_unsafe_native = unsafe_native_effects(&new.effects);
+    let added_unsafe_native: BTreeSet<_> = new_unsafe_native
+        .difference(&old_unsafe_native)
+        .cloned()
+        .collect();
+    if !added_unsafe_native.is_empty() {
+        findings.push(review_finding(
+            code::REVIEW_UNSAFE_NATIVE_ADDED,
+            ReviewRisk::Unsafe,
+            format!(
+                "function `{}` added unsafe/native boundary: {}.",
+                old.name,
+                effects_contract(&added_unsafe_native)
+            ),
+            paired_spans(
+                &old.span,
+                &new.span,
+                "old function",
+                "new unsafe/native boundary",
+            ),
+            Some(effects_contract(&old_unsafe_native)),
+            Some(effects_contract(&new_unsafe_native)),
+        ));
+    }
     if old.boundary != new.boundary {
         findings.push(review_finding(
             code::REVIEW_BOUNDARY_CHANGED,
@@ -513,6 +544,14 @@ fn effects_contract(effects: &BTreeSet<String>) -> String {
     effects.iter().cloned().collect::<Vec<_>>().join(", ")
 }
 
+fn unsafe_native_effects(effects: &BTreeSet<String>) -> BTreeSet<String> {
+    effects
+        .iter()
+        .filter(|effect| matches!(effect.as_str(), "unsafe" | "native"))
+        .cloned()
+        .collect()
+}
+
 fn type_contract(ty: &TypeSig) -> String {
     format!(
         "{} {} {{ {} }}",

tests/checker.rs

@@ -228,6 +228,47 @@ fn inspect(image: read Image) -> Unit {
     assert!(format_review_human(&findings).contains("RSR006[effect]:"));
 }
 
+#[test]
+fn review_reports_new_unsafe_native_usage() {
+    let old_source = r#"
+mode: managed
+
+fn checksum(data: read Bytes) -> UInt64
+    effects(no_panic)
+{
+    Bytes.checksum(data: read data)
+}
+"#;
+    let new_source = r#"
+mode: managed
+
+fn checksum(data: read Bytes) -> UInt64
+    effects(no_panic, unsafe, native)
+{
+    Native.checksum(data: read data)
+}
+"#;
+
+    let findings = review_sources("old.rss", old_source, "new.rss", new_source);
+    let unsafe_finding = findings
+        .iter()
+        .find(|finding| finding.code == "RSR012")
+        .expect("expected unsafe/native review finding");
+
+    assert_eq!(unsafe_finding.risk, ReviewRisk::Unsafe);
+    assert_eq!(unsafe_finding.before.as_deref(), Some("<none>"));
+    assert_eq!(unsafe_finding.after.as_deref(), Some("native, unsafe"));
+    assert!(format_review_human(&findings).contains("RSR012[unsafe]: function `checksum` added"));
+
+    let json = format_review_json(&findings);
+    let value: Value = serde_json::from_str(&json).expect("review JSON should parse");
+    assert!(value.as_array().is_some_and(|items| {
+        items
+            .iter()
+            .any(|item| item["code"] == "RSR012" && item["risk"] == "unsafe")
+    }));
+}
+
 #[test]
 fn review_reports_type_layout_changes() {
     let old_source = r#"