Report removed guarantees in review

Author: olwang

src/diagnostic.rs

@@ -51,6 +51,7 @@ pub mod code {
     pub const REVIEW_TYPE_FIELDS_CHANGED: &str = "RSR010";
     pub const REVIEW_BOUNDARY_CHANGED: &str = "RSR011";
     pub const REVIEW_UNSAFE_NATIVE_ADDED: &str = "RSR012";
+    pub const REVIEW_GUARANTEE_REMOVED: &str = "RSR013";
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]

src/review.rs

@@ -47,6 +47,7 @@ pub enum ReviewRisk {
     Effect,
     Boundary,
     Unsafe,
+    Guarantee,
 }
 
 impl ReviewRisk {
@@ -58,6 +59,7 @@ impl ReviewRisk {
             Self::Effect => "effect",
             Self::Boundary => "boundary",
             Self::Unsafe => "unsafe",
+            Self::Guarantee => "guarantee",
         }
     }
 }
@@ -238,6 +240,10 @@ fn review_fixes(code: &str) -> Vec<ReviewFix> {
             "review_unsafe_native_boundary",
             "Review the new unsafe or native boundary and require explicit justification.",
         ),
+        code::REVIEW_GUARANTEE_REMOVED => (
+            "review_removed_guarantee",
+            "Review callers that relied on the removed runtime guarantee.",
+        ),
         _ => ("review_change", "Review this source-level contract change."),
     };
     vec![ReviewFix {
@@ -414,6 +420,26 @@ fn compare_function(old: &FunctionSig, new: &FunctionSig, findings: &mut Vec<Rev
             Some(effects_contract(&new_unsafe_native)),
         ));
     }
+    let old_guarantees = guarantee_effects(&old.effects);
+    let new_guarantees = guarantee_effects(&new.effects);
+    let removed_guarantees: BTreeSet<_> = old_guarantees
+        .difference(&new_guarantees)
+        .cloned()
+        .collect();
+    if !removed_guarantees.is_empty() {
+        findings.push(review_finding(
+            code::REVIEW_GUARANTEE_REMOVED,
+            ReviewRisk::Guarantee,
+            format!(
+                "function `{}` removed guarantee(s): {}.",
+                old.name,
+                effects_contract(&removed_guarantees)
+            ),
+            paired_spans(&old.span, &new.span, "old guarantees", "new guarantees"),
+            Some(effects_contract(&old_guarantees)),
+            Some(effects_contract(&new_guarantees)),
+        ));
+    }
     if old.boundary != new.boundary {
         findings.push(review_finding(
             code::REVIEW_BOUNDARY_CHANGED,
@@ -552,6 +578,19 @@ fn unsafe_native_effects(effects: &BTreeSet<String>) -> BTreeSet<String> {
         .collect()
 }
 
+fn guarantee_effects(effects: &BTreeSet<String>) -> BTreeSet<String> {
+    effects
+        .iter()
+        .filter(|effect| {
+            matches!(
+                effect.as_str(),
+                "no_panic" | "noalloc" | "no_block" | "pure"
+            )
+        })
+        .cloned()
+        .collect()
+}
+
 fn type_contract(ty: &TypeSig) -> String {
     format!(
         "{} {} {{ {} }}",

tests/checker.rs

@@ -269,6 +269,52 @@ fn checksum(data: read Bytes) -> UInt64
     }));
 }
 
+#[test]
+fn review_reports_removed_guarantees() {
+    let old_source = r#"
+mode: managed
+
+fn checksum(data: read Bytes) -> UInt64
+    effects(noalloc, no_panic, pure)
+{
+    Bytes.checksum(data: read data)
+}
+"#;
+    let new_source = r#"
+mode: managed
+
+fn checksum(data: read Bytes) -> UInt64
+    effects(no_panic)
+{
+    Bytes.checksum(data: read data)
+}
+"#;
+
+    let findings = review_sources("old.rss", old_source, "new.rss", new_source);
+    let guarantee = findings
+        .iter()
+        .find(|finding| finding.code == "RSR013")
+        .expect("expected removed guarantee finding");
+
+    assert_eq!(guarantee.risk, ReviewRisk::Guarantee);
+    assert_eq!(guarantee.before.as_deref(), Some("no_panic, noalloc, pure"));
+    assert_eq!(guarantee.after.as_deref(), Some("no_panic"));
+    assert!(
+        guarantee
+            .summary
+            .contains("removed guarantee(s): noalloc, pure")
+    );
+    assert!(format_review_human(&findings).contains("RSR013[guarantee]:"));
+
+    let json = format_review_json(&findings);
+    let value: Value = serde_json::from_str(&json).expect("review JSON should parse");
+    assert!(value.as_array().is_some_and(|items| {
+        items
+            .iter()
+            .any(|item| item["code"] == "RSR013" && item["risk"] == "guarantee")
+    }));
+}
+
 #[test]
 fn review_reports_type_layout_changes() {
     let old_source = r#"