Evaluate V2 against V1 and the V1 core ablation

evals/unsafe-rust/fixtures/v2-forward/d_support/CI.md

@@ -0,0 +1,8 @@
+# Continuous integration matrix
+
+CI samples the non-`fast` configuration on Rust 1.79.0 for
+`x86_64-unknown-linux-gnu`. It samples both feature values on Rust 1.82.0 for
+both `x86_64-unknown-linux-gnu` and `aarch64-unknown-linux-gnu`.
+
+This file records the current test matrix. It does not define the project's
+support commitment.

evals/unsafe-rust/fixtures/v2-forward/d_support/Cargo.toml

@@ -0,0 +1,7 @@
+[package]
+name = "domain-review"
+version = "1.0.0"
+edition = "2021"
+
+[features]
+fast = []

evals/unsafe-rust/fixtures/v2-forward/d_support/POLICY-A.md

@@ -0,0 +1,10 @@
+# Published 1.x support policy
+
+For this source snapshot, supported stable Rust releases are 1.79.0 through
+1.82.0 inclusive. Supported targets are `x86_64-unknown-linux-gnu` and
+`aarch64-unknown-linux-gnu`.
+
+Without `fast`, every target/version pair above is supported.
+
+With `fast`, x86_64 supports 1.79.0 through 1.82.0, while aarch64 supports
+1.80.0 through 1.82.0.

evals/unsafe-rust/fixtures/v2-forward/d_support/POLICY-B.md

@@ -0,0 +1,10 @@
+# Published 1.x compatibility statement
+
+For this source snapshot, supported stable Rust releases are 1.79.0 through
+1.82.0 inclusive. Supported targets are `x86_64-unknown-linux-gnu` and
+`aarch64-unknown-linux-gnu`.
+
+Without `fast`, every target/version pair above is supported.
+
+With `fast`, x86_64 supports 1.80.0 through 1.82.0, while aarch64 supports only
+1.82.0.

evals/unsafe-rust/fixtures/v2-forward/d_support/REQUEST.md

@@ -0,0 +1,8 @@
+# Supported-domain source review
+
+`POLICY-A.md` and `POLICY-B.md` are both current published commitments; no
+precedence or supersession rule has been authorized. Review the exact source
+and state the strongest soundness conclusion that can be justified without
+choosing a new support policy.
+
+The audit cutoff is Rust 1.82.0. No source or policy edit is requested.

evals/unsafe-rust/fixtures/v2-forward/d_support/lib.rs

@@ -0,0 +1,15 @@
+#![allow(dead_code)]
+
+#[cfg(not(feature = "fast"))]
+pub fn first(bytes: &[u8]) -> Option<u8> {
+    bytes.first().copied()
+}
+
+#[cfg(feature = "fast")]
+pub fn first(bytes: &[u8]) -> Option<u8> {
+    if bytes.is_empty() {
+        None
+    } else {
+        Some(unsafe { *bytes.get_unchecked(0) })
+    }
+}

evals/unsafe-rust/fixtures/v2-forward/d_support/rust-toolchain.toml

@@ -0,0 +1,2 @@
+[toolchain]
+channel = "1.82.0"

evals/unsafe-rust/fixtures/v2-forward/i_producer/REQUEST.md

@@ -0,0 +1,8 @@
+# Focused source review
+
+Audit every current producer and consumer of `Buffer` and the local safety
+proof for `overwrite`. Determine the strongest result for all well-typed safe
+uses.
+
+Scope: exactly Rust 1.80.0, all targets and ordinary profiles. No redesign or
+source edit is requested.

evals/unsafe-rust/fixtures/v2-forward/i_producer/lib.rs

@@ -0,0 +1,46 @@
+#![allow(dead_code)]
+
+static BYTE: u8 = 7;
+
+pub struct Buffer {
+    ptr: *mut u8,
+    shared: Option<&'static u8>,
+}
+
+impl Buffer {
+    /// # Safety
+    ///
+    /// `ptr` must remain non-null, aligned, and valid for writes of one `u8`
+    /// for as long as the returned `Buffer` may be used. No access may
+    /// conflict with writes through the returned `Buffer`.
+    pub unsafe fn from_writable(ptr: *mut u8) -> Self {
+        Self { ptr, shared: None }
+    }
+
+    pub fn from_static() -> Self {
+        let shared = &BYTE;
+        Self {
+            ptr: (shared as *const u8) as *mut u8,
+            shared: Some(shared),
+        }
+    }
+
+    pub fn overwrite(&mut self, value: u8) {
+        if let Some(shared) = self.shared {
+            with_live(shared, || {
+                // SAFETY: `from_writable` requires `ptr` to remain valid for
+                // writes.
+                unsafe { self.ptr.write(value) }
+            });
+        } else {
+            // SAFETY: `from_writable` requires `ptr` to remain valid for
+            // writes.
+            unsafe { self.ptr.write(value) }
+        }
+    }
+}
+
+fn with_live<T>(shared: &T, operation: impl FnOnce()) {
+    operation();
+    let _ = shared;
+}

evals/unsafe-rust/fixtures/v2-forward/u_behavior/REQUEST.md

@@ -0,0 +1,7 @@
+# Focused source review
+
+Audit the exact safe API and every mandatory documented behavior. State
+separate soundness and behavioral-contract results with the evidence for each.
+
+Scope: exactly Rust 1.80.0, all targets and ordinary profiles. No source edit or
+redesign is requested.

evals/unsafe-rust/fixtures/v2-forward/u_behavior/lib.rs

@@ -0,0 +1,12 @@
+#![allow(dead_code)]
+
+/// Panics when `input == 0`.
+///
+/// On normal return, returns `input`.
+pub fn classify(input: u8) -> u8 {
+    match input {
+        0 => unsafe { core::hint::unreachable_unchecked() },
+        1 => 2,
+        _ => input,
+    }
+}

evals/unsafe-rust/fixtures/v2-forward/v_versions/REQUEST.md

@@ -0,0 +1,5 @@
+# Version-partitioned source review
+
+Audit this exact safe API separately on exactly Rust 1.79.0 and Rust 1.80.0.
+Both versions, every target, and every ordinary profile are supported. State
+the regional and combined result. No source edit is requested.

evals/unsafe-rust/fixtures/v2-forward/v_versions/lib.rs

@@ -0,0 +1,5 @@
+#![allow(dead_code)]
+
+pub fn advance_marker() -> *const [u8; 0] {
+    unsafe { core::ptr::null::<[u8; 0]>().add(1) }
+}