From 549e8d532f67ecdc362aa491504b0f680988ae5e Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 27 Jul 2026 19:14:46 +0100 Subject: [PATCH] fix(hypatia): scoped exemption for the unsatisfiable unsafe_block rule MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The rule is a bare `unsafe\s*\{` regex — it flags every unsafe block unconditionally; the 'requires SAFETY comment' in its description is not checked. my-llvm's single unsafe block is mandated by inkwell's unsafe build_gep and carries a full SAFETY invariant argument. Same mechanism as the existing coq_axiom / transmute keyword-match exemptions. Co-Authored-By: Claude Fable 5 --- .hypatia-ignore | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.hypatia-ignore b/.hypatia-ignore index 71ed12c..c896db9 100644 --- a/.hypatia-ignore +++ b/.hypatia-ignore @@ -99,3 +99,13 @@ security_errors/secret_detected:docs/wiki/guides/getting-started.md # GetElementPtr pointer invariant. `grep -nE 'transmute\s*(::<|\()'` over the file # returns nothing. No unchecked bit-reinterpretation exists here. code_safety/transmute:crates/my-llvm/src/lib.rs + +# --- Rule cannot be satisfied: `unsafe_block` is a bare `unsafe\s*\{` regex +# (hypatia lib/rules/code_safety.ex) — it flags EVERY unsafe block regardless +# of documentation; the "requires SAFETY comment" in its description is not +# actually checked. The single unsafe block here is mandatory (inkwell declares +# `build_gep` unsafe) and carries a 17-line SAFETY invariant argument plus an +# adjacent `// SAFETY:` marker. Until the rule checks for SAFETY comments +# (upstream fix candidate), a scoped exemption is the only correct mechanism — +# a baseline entry would just regenerate as expiring debt for a permanent fact. +code_safety/unsafe_block:crates/my-llvm/src/lib.rs