Rust Rule Catalogue#
Rust Coding Rules Catalogue
|
status: draft
security: YES
safety: ASIL_B
|
||||
These are draft rules. The proposed levels take effect only after adoption through the Software Development Plan as described in Rust Coding Rules (MISRA-derived draft). Enforcement candidates require validation under Verification and Deviations; a source mapping does not establish compliance.
SCR-RUST-001: Define the supported Rust language and build configuration#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 4.1.1 (safe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: All production crates and their build inputs.
Each component shall record its compiler/toolchain revision, Rust edition, target, dependency resolution, enabled features, panic strategy, and overflow-check settings. Production builds shall use this controlled configuration. Unstable features and compiler-specific assumptions require explicit assessment.
Check: Check manifests, lockfiles and Bazel toolchain/configuration in CI; review language and target assumptions against the chosen compiler documentation.
Coverage limit: A successful build does not establish tool qualification. Reconcile Cargo and Bazel inputs; a host-only build does not cover QNX or a different feature set.
SCR-RUST-002: Enforce selected diagnostics and control suppressions#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 0.0.1 (safe), 0.2.1 (safe), 0.2.2 (safe), 0.2.3 (safe), 0.2.4 (safe), 4.1.2 (safe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: All first-party production crates.
The adopted lint profile shall make selected unused-code, unused-value, unreachable-code and deprecated-API diagnostics blocking. Any suppression shall identify a scoped rationale and rule/deviation. Suppressions inherited from generated or third-party code shall be recorded separately.
Check: Candidate rustc lints: dead_code, unused_variables, unused_assignments, unreachable_code, unused_must_use and deprecated. Verify flags actually reach every Bazel and Cargo analysis action.
Coverage limit: Warnings are not hard language guarantees. These diagnostics are partial, especially for semantic unreachability, public APIs and feature-disabled code. Do not equate a warning-free build with complete coverage of the mapped rules.
SCR-RUST-003: Avoid invariant decisions and ineffective writes#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 0.0.2 (safe), 0.1.1 (safe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Production control flow.
Conditions shall express a meaningful runtime decision unless explicitly designated as a constant configuration choice or intentional loop. A value shall not be written only to be overwritten before any required observation.
Check: rustc unused_assignments; selected Clippy condition/comparison checks; candidate CodeQL control-flow and value-use analysis; review intentional constant branches.
Coverage limit: Local diagnostics do not establish path feasibility or detect every overwritten value across calls. Record intentional loop and configuration exceptions.
SCR-RUST-004: Handle results and preserve error information#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 0.1.2 (safe), 18.5.1 (safe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Production APIs and their callers.
Callers shall use returned values whose contracts require action. Errors shall be propagated, converted with necessary context, or handled according to an explicit recovery policy. Silently discarding a critical Result through let _, drop, .ok(), or a catch-all branch is prohibited. Annotate project APIs with must_use where omission is a defect.
Check: rustc unused_must_use and selectively unused_results; Clippy let_underscore_must_use; candidate CodeQL checks for project error-discard patterns; review recovery paths.
Coverage limit: must_use does not prove meaningful handling. Explicitly discarded or superficially inspected errors require additional checks; broad unused_results can flag intentional side-effect APIs.
SCR-RUST-005: Define floating-point range and precision contracts#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 0.3.1 (safe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Floating-point calculations, conversions and persistence.
Each safety-relevant floating-point use shall specify acceptable range, precision, rounding, comparison tolerance, and handling of NaN, infinity and signed zero. Serialization shall preserve the required information or reject values that cannot meet the declared contract.
Check: Selected Clippy floating-point/cast checks; boundary and round-trip tests; numerical review. Candidate CodeQL checks can locate values reaching sensitive conversion APIs.
Coverage limit: A lint cannot select application tolerances or prove numerical accuracy. Components that store integers as f64 (for example in a JSON backend) need an explicit round-trip contract.
SCR-RUST-006: Validate preconditions at trust boundaries#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 0.3.2 (safe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Public APIs, external data, stored data and unsafe wrappers.
A function shall be called only when its documented preconditions hold. Encode invariants in validated types where possible; otherwise validate untrusted values before use and return a defined error. Stored data shall be treated as potentially malformed.
Check: Type/API review and negative tests; candidate CodeQL source-to-use checks with explicitly modeled validators and error paths.
Coverage limit: A validation call is not sufficient evidence unless the checked property and success branch match the precondition. Arbitrary application contracts require review.
SCR-RUST-007: Isolate unsafe operations and establish their contracts#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 4.1.3 (safe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Unsafe code, unsafe traits/attributes, safe wrappers and their dependencies.
Undefined behavior is prohibited. Unsafe operations shall be confined to identified modules and justified by operation-specific invariants covering validity, lifetime, aliasing, alignment and concurrency as applicable. Safe APIs shall preserve soundness for all permitted safe callers. Crates designated safe-only shall forbid unsafe_code.
Check: rustc unsafe_op_in_unsafe_fn; Clippy missing_safety_doc and undocumented_unsafe_blocks; independent unsafe review; targeted Miri and applicable verification.
Coverage limit: Documentation checks establish presence, not correctness. Miri covers supported executed paths. A crate with no unsafe blocks may still rely on unsafe dependencies; panic freedom is a separate property.
SCR-RUST-009: Remove disabled code from comments#
Proposed level: Advisory. Source IDs (MISRA C++:2023, SCRC verdict): 5.7.1 (safe), 5.7.2 (safe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Production source comments.
Obsolete implementations should be removed and recovered through version control when needed. Comments should explain intent and constraints. Documentation examples and explanatory pseudocode are permitted.
Check: Code review; a comment-pattern checker may identify candidates for review.
Coverage limit: Text matching cannot reliably distinguish obsolete code from useful documentation.
SCR-RUST-010: Make array and buffer extents explicit at interfaces#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): No direct mapping.
Origin: S-CORE supplement (raw buffer extents at foreign interfaces). Scope: Rust APIs and foreign buffer boundaries.
Use arrays or slices that carry the required extent in native Rust interfaces. Raw buffer interfaces shall document pointer, length, ownership and validity together, with validation before constructing a slice. Exported fixed-size arrays shall declare their size.
Check: Compiler typing for native arrays/slices; API review and boundary tests for raw pointer/length pairs.
Coverage limit: Native array extents are largely compiler-enforced. FFI buffer validity is not, and bounds-checked access can still panic.
SCR-RUST-011: Keep imports and module interfaces explicit#
Proposed level: Advisory. Source IDs (MISRA C++:2023, SCRC verdict): 6.0.3 (unsafe), 19.0.3 (safe), 19.2.1 (safe), 19.2.3 (beyond SCRC).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Crate/module layout and source inclusion.
Imports and re-exports should make dependencies and ownership of names clear. Keep ordinary imports together; document exceptions for narrow local scope. Glob imports should be limited to explicitly designated preludes or tests. Generated/include-based source shall have controlled provenance.
Check: Formatting, compiler name resolution, selected import lints and review of re- export/prelude design.
Coverage limit: Rust permits include! and generated source; the paper’s comparison of use with C++ include is incomplete. Valid syntax alone does not establish clarity or provenance.
SCR-RUST-012: Reserve entry-point naming#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 6.0.4 (safe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: First-party production functions.
Reserve main for actual executable entry points. Other production functions shall use names expressing their role. Generated wrappers and embedded entry-point conventions require an explicit scoped exception.
Check: A syntax/name checker can enforce the declared policy; review generated and platform entry points.
Coverage limit: This is a project naming restriction, not a Rust language requirement.
SCR-RUST-013: Control exported symbols and foreign declarations#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 6.2.1 (unsafe), 6.2.2 (unsafe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Linkage attributes, exported symbols and foreign bindings.
Exported symbols shall have unique definitions and compatible declarations in each delivered binary. Centralize foreign declarations in reviewed binding modules/crates. Use minimal visibility; justify no_mangle, export_name, link_section and equivalent linkage controls.
Check: Compiler/linker checks, binding review and final symbol-table inspection for each delivered target.
Coverage limit: Cross-crate/linker behavior is not fully captured by Rust name resolution. Edition 2021 permits syntax that edition 2024 marks unsafe; do not scope this check by unsafe blocks alone.
SCR-RUST-014: Avoid misleading name shadowing and method resolution#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 6.4.1 (safe), 6.4.2 (beyond SCRC).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Bindings, inherent methods and trait methods.
Rebinding shall not silently change the logical meaning of a value. A same-name transformation may be allowed when its purpose is immediate and documented by the expression. Where inherent and trait methods share a name but differ semantically, use explicit qualification or change the API.
Check: Selected Clippy shadowing checks plus type-aware custom checks and review of trait/inherent method collisions.
Coverage limit: This intentionally adapts the C++ restriction to Rust idioms. Rust trait composition is not class inheritance; a broad shadowing ban would enforce a different policy.
SCR-RUST-015: Preserve lifetimes across raw interfaces#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 6.8.1 (unsafe), 6.8.2 (unsafe), 6.8.3 (unsafe), 6.8.4 (unsafe), 8.1.2 (unsafe), 28.6.3 (unsafe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: References, raw pointers, callbacks and ownership transfers.
An access shall not outlive its referent. Do not expose a dangling local pointer as a usable API result or store borrowed addresses beyond their valid lifetime. Raw-pointer wrappers shall establish lifetime invariants for returned references and asynchronous/foreign callbacks.
Check: Borrow checking for references; available dangling-pointer diagnostics; unsafe/API review and targeted Miri tests.
Coverage limit: Creating or returning a dangling raw pointer can compile. Compiler-enforced reference lifetimes do not establish equivalent guarantees for raw pointers or foreign callbacks.
SCR-RUST-016: Make numeric, Boolean and character conversions intentional#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 7.0.1 (safe), 7.0.2 (unsafe), 8.2.2 (safe), 10.2.3 (safe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: All conversions, including safe casts and unsafe reinterpretation.
Conversions shall preserve the required value or perform explicit range/validity checks with a defined error. Boolean/character values shall not be used as incidental numbers; documented encoding/decoding boundaries may convert them through valid representations. Lossy floating-point conversion requires a precision contract.
Check: Clippy cast_possible_truncation, cast_possible_wrap, cast_sign_loss, cast_precision_loss and cast_lossless as candidate mappings; custom conversion inventory and boundary tests.
Coverage limit: as is often legal safe Rust. From/TryFrom are preferred where supplied, but not every numeric pair implements them. S-CORE encoding exceptions are adaptations, not verbatim MISRA requirements.
SCR-RUST-017: Represent absent pointers explicitly#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 7.11.1 (beyond SCRC).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Raw-pointer and foreign APIs.
Use typed null constructors when a raw null pointer is required. Use Option or another explicit type for optional references/handles in safe APIs. Check required pointer validity before dereference; a null check alone is insufficient.
Check: Compiler typing, candidate checks for integer-fabricated null pointers, and foreign API review.
Coverage limit: Raw null pointers can be created in safe Rust. Non-nullness alone establishes neither allocation validity nor lifetime/alignment.
SCR-RUST-018: Make mixed-operator intent clear#
Proposed level: Advisory. Source IDs (MISRA C++:2023, SCRC verdict): 8.0.1 (safe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Production expressions.
Expressions mixing arithmetic, bitwise, shift or Boolean operators should use grouping that makes the intended evaluation clear. Split complex expressions when parentheses alone do not make them readable.
Check: Clippy precedence and code review.
Coverage limit: A precedence lint detects only selected patterns; this remains partly a readability judgment.
SCR-RUST-019: Use checked type recovery#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 8.2.1 (unsafe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Type-erased values and trait-object downcasts.
Recover concrete types through checked APIs such as Any downcasts, and handle failure. Unchecked type recovery requires a proven type-identity invariant within an approved unsafe abstraction. Do not invent a ban on ordinary TypeId queries.
Check: API inventory, compiler type checks and review of unchecked downcast/representation operations.
Coverage limit: The paper retains 8.2.9 despite explaining that its specific C++ behavior has no direct counterpart. This is an intent-based policy; ordinary checked native APIs need no custom MISRA-shaped check.
SCR-RUST-020: Restrict pointer casts and representation changes#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 8.2.3 (unsafe), 8.2.5 (unsafe), 8.2.6 (unsafe), 8.2.7 (unsafe), 8.2.8 (safe), 23.11.1 (unsafe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: All raw-pointer transformations, safe and unsafe.
Prefer typed pointer/reference APIs. Pointer-to-integer conversions, reconstruction of pointers, mutability-changing casts and transmute shall be restricted to reviewed low-level interfaces with documented provenance, alignment, validity and aliasing assumptions. Do not truncate addresses or fabricate a mutable reference from shared access outside valid interior-mutability rules.
Check: Candidate Clippy pointer/transmute lints and API restrictions; compiler invalid-reference diagnostics; custom AST inventory, unsafe review and Miri where applicable.
Coverage limit: Many pointer casts are legal outside unsafe. Inventory the entire crate; transmute is not a generally safer replacement for as. Provenance correctness cannot be inferred from equal sizes.
SCR-RUST-021: Preserve function-call ABI and variadic contracts#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 8.2.4 (unsafe), 8.2.11 (unsafe), 21.10.1 (unsafe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Function pointers, callbacks and variadic foreign calls.
Calls shall use a compatible function signature, calling convention and ABI. Function-pointer representation changes require boundary review. Avoid C variadic calls in application code; a necessary adapter shall validate argument types and applicable promotion rules.
Check: Compiler ABI/type diagnostics, binding generation checks, adapter review and cross- language integration tests.
Coverage limit: A successful link does not validate an incorrectly declared foreign signature or variadic argument contract. The paper excludes full FFI analysis.
SCR-RUST-022: Control recursion and stack consumption#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 8.2.10 (safe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Production call paths, including callbacks and recursive destruction.
Direct and indirect recursion shall be prohibited in safety-relevant execution paths unless a scoped deviation establishes a finite depth and stack budget. Assess recursive parsing, traversal and destructor chains as well as explicit self-calls.
Check: Compiler unconditional_recursion provides a narrow check; candidate CodeQL/call-graph analysis and stack/depth testing provide additional evidence.
Coverage limit: Unconditional-recursion diagnostics do not detect all terminating recursion. Dynamic dispatch, callbacks and foreign calls leave call-graph gaps; static analysis is not a general proof of bounded stack use.
SCR-RUST-023: Respect allocation boundaries in pointer operations#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 8.7.1 (unsafe), 8.7.2 (unsafe), 8.9.1 (safe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Raw-pointer arithmetic, differences, comparisons and later use.
Pointer operations shall meet their individual API contracts, including allocation/provenance and bounds requirements. Relational comparisons shall not infer object order across unrelated allocations. Prefer slice indexing/iteration; document any reviewed address-ordering exception separately.
Check: Unsafe review, targeted Miri tests, and candidate checks for pointer operations and their data flow.
Coverage limit: Some construction, wrapping arithmetic and comparisons are safe operations. An out-of-bounds intermediate is not universally forbidden by Rust; the applicable API and eventual access determine validity. The project comparison restriction is stronger than language UB rules.
SCR-RUST-024: Separate persistent effects from short-circuit decisions#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 8.14.1 (safe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Production Boolean expressions.
Required persistent effects shall not depend on accidental short-circuit evaluation. Move state changes and critical I/O out of the right side of && or ||, or document an intentional conditional- effect contract at the call site.
Check: Candidate AST checks for obvious mutations and CodeQL effect/call analysis; code review.
Coverage limit: Identifying arbitrary side effects through calls requires models. A function call in a condition is not automatically a violation.
SCR-RUST-025: Use memory-copy operations with valid overlap and ownership#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 8.18.1 (unsafe), 24.5.2 (unsafe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Raw copies and buffer movement.
Choose copy operations whose overlap contract matches the buffers. copy_nonoverlapping requires disjoint regions; overlapping movement must use an operation permitting overlap. Both cases require valid alignment, size, initialization and ownership handling without double drop.
Check: API review, boundary tests and Miri; candidate checks for raw copy calls and buffer relationships.
Coverage limit: Rust ptr::copy permits overlap. The C++ rule cannot become a blanket ban on overlap without changing its intent. Overlap correctness alone does not establish safe copying of owning values.
SCR-RUST-026: Specify arithmetic overflow and shift behavior#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 7.0.4 (safe), 8.20.1 (safe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Integer arithmetic, shifts and constant calculations.
Arithmetic shall stay within its required range or use explicit checked, saturating, wrapping or overflowing operations with justified semantics. Check division/remainder exceptional inputs and shift counts, including negative counts where applicable. Constants shall not silently wrap contrary to their intended value.
Check: Compiler constant/overflow diagnostics; Clippy arithmetic_side_effects as a candidate restriction; boundary tests under the delivered build settings.
Coverage limit: The paper drops 7.0.4 too broadly: Rust permits different shift-operand types and runtime invalid shift counts. This draft restores a check obligation; panic and release-mode behavior depend on operation and build configuration.
SCR-RUST-027: Make decision fallbacks explicit#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 9.4.1 (safe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Safety-relevant if/else- if decision chains.
Each safety-relevant decision chain shall define behavior when no condition matches. Prefer exhaustive match for finite cases; otherwise provide a final else that performs the defined fallback or documents the intentionally empty action.
Check: Compiler match exhaustiveness; candidate syntax check for missing final else; review of fallback requirements.
Coverage limit: A final else or wildcard arm does not prove that the fallback is correct. This project scope adapts the original rule rather than imposing an else on every independent guard.
SCR-RUST-028: Separate volatile I/O from synchronization#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 10.1.2 (unsafe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Hardware access and volatile operations.
Volatile operations shall be confined to reviewed hardware/platform abstractions with documented address, width, alignment and device-ordering assumptions. Use appropriate synchronization for shared memory; volatile shall not be used as a substitute for atomics or locks.
Check: API restriction/inventory, platform review and hardware integration tests.
Coverage limit: Miri and host tests do not establish real device behavior. Validity requirements differ for the specific I/O operation and memory region.
SCR-RUST-029: Restrict assembly to reviewed platform modules#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 10.4.1 (unsafe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Inline and global assembly.
Assembly is prohibited in ordinary application components. A platform exception shall document the instruction contract, registers/clobbers, stack, memory effects, target assumptions and safe wrapper invariants.
Check: Source/macro inventory, compiler assembly checks and specialist review of each exception.
Coverage limit: Compiler acceptance does not establish correctness of declared assembly effects. Scan generated and macro-expanded code too.
SCR-RUST-030: Limit raw-pointer indirection#
Proposed level: Advisory. Source IDs (MISRA C++:2023, SCRC verdict): 11.3.2 (safe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Raw-pointer APIs and declarations.
Raw-pointer interfaces should use no more than two pointer-indirection levels. Deeper foreign interfaces should be isolated behind a typed adapter with explicit ownership and extent contracts. Native references and smart-pointer composition require separate design assessment.
Check: A type-aware syntax check and interface review.
Coverage limit: Indirection count is a complexity restriction, not proof of memory safety; benign safe abstractions must not be classified solely by textual asterisks.
SCR-RUST-031: Establish initialization and value validity before use#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 11.6.1 (unsafe), 11.6.2 (unsafe), 15.1.4 (unsafe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Native initialization, MaybeUninit, unions and raw storage.
Every observed value shall be initialized and valid for its Rust type. A MaybeUninit/raw-storage abstraction shall prove initialization before assume_init/read/reference creation, track partial initialization and avoid duplicate destruction. Zero-filled storage shall not be treated as a valid arbitrary T.
Check: Compiler definite-initialization checks; unsafe review and Miri tests for low-level storage; candidate inventories for initialization-bypassing APIs.
Coverage limit: Compiler checks for ordinary locals do not establish initialization of raw storage. Some invalid references are already UB when created, before an explicit read.
SCR-RUST-032: Prefer enums over untagged unions#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 12.3.1 (unsafe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Application data models and foreign/low-level representations.
Use enums for application alternatives. A union shall be confined to a justified representation boundary with a documented discriminant/active-field protocol, field validity and destruction policy.
Check: Syntax inventory and review of each union definition/access; targeted tests.
Coverage limit: Rust union reads have validity obligations that a documented active-field name alone cannot satisfy. FFI layout may require a reviewed exception.
SCR-RUST-033: Make parameter roles consistent#
Proposed level: Advisory. Source IDs (MISRA C++:2023, SCRC verdict): 13.3.3 (safe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Trait methods, implementations and public API documentation.
Parameter names should consistently describe their semantic roles across trait declarations, implementations and examples. Mark intentionally unused parameters explicitly and explain why an implementation ignores them.
Check: Compiler unused_variables and API review; optional trait/implementation name comparison.
Coverage limit: Rust permits unnamed patterns such as _. This adaptation concerns readable contracts, not C++ overriding syntax.
SCR-RUST-034: Protect type invariants through visibility#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 14.1.1 (safe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Struct fields and constructors.
Fields whose arbitrary mutation can violate an invariant shall be private and changed through validating APIs. Plain data carriers may expose fields when all representable states are valid for their contract. Review mixed visibility explicitly.
Check: API/design review; custom checks may inventory public fields and constructor bypasses.
Coverage limit: Making every field public or private does not itself prove invariant preservation. This replaces the C++ structural recommendation with a Rust invariant-oriented policy.
SCR-RUST-035: Review ownership traits and resource lifecycle#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 15.0.1 (safe), 15.8.1 (unsafe), 21.6.2 (safe), 28.6.1 (safe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Copy/Clone/Drop, pinning, custom owners and raw allocation wrappers.
Copy/Clone/Drop implementations shall preserve ownership and type invariants. Every acquired resource shall have a defined release/transfer policy, including partial failure paths. Unsafe pinning abstractions shall preserve their promised pinning invariants. Do not rely on destructors running to maintain memory safety. Synchronization/resource guards shall remain bound for the intended duration; do not accidentally discard them immediately.
Check: Compiler move/trait checks, review of custom implementations and targeted Miri/resource- failure tests; inventory mem::forget, leaks and manual ownership transfer. Include the rustc let_underscore_lock diagnostic where supported.
Coverage limit: Safe Rust permits leaks and mem::forget, and termination may skip Drop. Pin is a type, not a trait. The paper’s 21.6.5/28.6.1 comments describe largely compiler-handled C++ differences; no artificial direct Rust equivalent is assumed.
SCR-RUST-036: Define panic, termination and cleanup behavior#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 18.1.1 (unsafe), 18.4.1 (safe), 18.5.2 (safe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Production library code, process boundaries and destructors.
Recoverable failures shall use explicit error handling. Application libraries shall not directly terminate the process or panic on expected invalid input. Any intentional fail-stop path requires a documented system response. Account for implicit panics, destructor panics, allocation failure and panic strategy; keep critical fallible cleanup in explicit APIs.
Check: Selected Clippy panic/unwrap_used/expect_used restrictions and disallowed termination APIs; failure-injection tests and call-path review.
Coverage limit: Absence of panic! and unwrap does not prove panic freedom: indexing, arithmetic, dependencies and destructors can fail. Panic is not synonymous with Rust undefined behavior; the system may nevertheless treat it as a safety failure.
SCR-RUST-037: Validate attributes and configuration coverage#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 19.0.1 (beyond SCRC).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: cfg/features, attributes and build-generated configuration.
All cfg names/values and features shall be declared and checked. Invalid or unrecognized attributes/configuration diagnostics shall block analysis. Maintain and analyze the supported configuration matrix, including mutually exclusive features, rather than assuming one all-features build is representative.
Check: rustc unexpected_cfgs and appropriate check-cfg flags, attribute diagnostics, build- matrix checks and configuration review.
Coverage limit: Inactive code is not necessarily type-checked. Correct configuration syntax does not establish that every delivered variant was analyzed.
SCR-RUST-038: Control macro expansion and argument effects#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 19.0.2 (safe), 19.3.4 (safe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Declarative/procedural macros and generated Rust.
Macros shall document whether arguments are evaluated once, more than once or not at all. Use expression fragments where expression semantics are intended. Safety-relevant macro-generated unsafe code and effects shall be included in review and checker coverage.
Check: Macro expansion inspection, tests using arguments with observable effects, and lint coverage checks on generated code.
Coverage limit: Rust macros avoid some C++ textual-substitution hazards but can still duplicate evaluation, introduce panics or unsafe code. Compiler type checking is not a substitute for semantic review.
SCR-RUST-039: Bound allocation and isolate manual allocators#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 21.6.1 (safe), 21.6.3 (unsafe), 21.6.4 (beyond SCRC).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Heap allocation, container growth and custom allocation.
Each component shall declare where allocation is permitted and justify peak memory, growth limits and failure behavior. Unbounded input-driven growth is prohibited. Manual allocators and raw allocation APIs shall be restricted to reviewed modules with allocator/layout/ownership contracts.
Check: Allocation API inventory, workload/boundary/failure tests and memory-budget review; candidate CodeQL flow checks for untrusted size inputs.
Coverage limit: A blanket no-allocation profile is an optional stricter component policy, not silently imposed here. try_reserve covers only particular failures; RAII does not bound memory, prevent leaks or guarantee recovery from OOM.
SCR-RUST-040: Separate compile-time and runtime assertions#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 22.3.1 (safe).
Origin: S-CORE interpretation of MISRA C++:2023 guidelines. Scope: Assertions and invariant checks.
An invariant intended for compile-time checking shall use a const-evaluated construct supported by the pinned compiler. Required runtime validation shall remain active in production and return the specified error or enter the approved failure path. Do not put required side effects inside debug_assert!.
Check: Compiler const evaluation; Clippy assertions_on_constants as a candidate; release- configuration tests and assertion review.
Coverage limit: A constant argument to an ordinary assert! does not by itself request const evaluation. debug_assert! can be disabled and must not carry a required safety check.
SCR-RUST-041: Account for dependency and generated-code soundness#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): No direct mapping.
Origin: S-CORE supplement (dependency and generated-code soundness). Scope: Transitive crates, standard library assumptions, macros and generators.
Maintain the dependency/generator inventory and record the evidence relied on for unsafe implementations, feature selection and foreign code. Component safe-only status shall describe first-party source scope separately from the full linked dependency graph.
Check: Dependency lock/configuration review, unsafe/binding inventories, change-impact review and relevant integration tests.
Coverage limit: No-unsafe in first-party source is not a soundness proof for dependencies. The paper analyzes language constructs, not the delivered dependency graph.
SCR-RUST-042: Assess foreign-language boundaries explicitly#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): 21.10.2 (unsafe), 21.10.3 (unsafe), 22.4.1 (unsafe), 25.5.1 (unsafe), 25.5.2 (unsafe), 25.5.3 (unsafe).
Origin: S-CORE supplement informed by MISRA C:2025 Addendum 6. Scope: Every Rust/C/C++ boundary.
Foreign bindings shall match the actual ABI, layout, types and exported definitions. Document ownership, pointer/length contracts, threading and callback lifetime, error conventions and unwinding behavior in both directions. Prohibit unwinding across a boundary that does not support it. Assess C/C++ implementations under their own applicable policy.
Check: MISRA C:2025 Addendum 6 cross-check, binding/layout/symbol review and tests on delivered targets. Its explicit comments on R.8.3, R.8.5, R.8.6 and R.8.15 provide boundary cross-references.
Coverage limit: The addendum is an applicability assessment, and the full MISRA C:2025 rule text was not part of the analysis. A complete C-to-Rust rule mapping is pending; this supplement does not claim one.
SCR-RUST-043: Record coverage, deviations and residual obligations#
Proposed level: Required. Source IDs (MISRA C++:2023, SCRC verdict): No direct mapping.
Origin: S-CORE governance supplement. Scope: Every adopted guideline and delivered configuration.
Each required adopted rule shall have evidence of conformance or an approved scoped deviation. Record rule version, configuration, checker version, known blind spots and review/test evidence. Advisory nonconformances shall be considered and dispositioned. Safety-relevant liveness, timing and persistence guarantees need separate requirements and verification.
Check: Rule-to-checker coverage register, deviation validation and release evidence review. Separate test/tooling profiles shall not suppress production library obligations.
Coverage limit: A clean lint/SARIF report proves neither full rule coverage nor functional safety. This draft defines obligations; it installs no checker and grants no approval.