Module check_lints 

cargo dev check-lints — the one crate that cannot inherit the workspace lints still enforces every one of them.

Why this command exists

The workspace forbids unsafe everywhere, and atune_py is the single documented relaxation: its PyO3 bridge needs the hand-written lifetime and pointer operations enumerated in mirror::OPERATIONS, and pyo3’s own proc-macros expand to unsafe that a crate-level forbid rejects. [lints] workspace = true would re-impose forbid and cannot be relaxed afterwards, so atune_py cannot inherit the table at all. It therefore copies it, with the single change unsafe_code = "forbid" → "deny".

A copy holds only until somebody edits the original. Add a lint to [workspace.lints] and nine crates gain it while the tenth silently does not — and the tenth is the one crate in the workspace that writes unsafe. That is exactly the failure this repository gates everywhere else: a generated page that drifts from its source is a red build (generate-all --mode check), and a hand-copied lint table is the same shape of claim with none of the same protection.

What is checked

For each of [lints.rust] and [lints.clippy], the mirror must carry exactly the workspace’s keys, with the same values, except for the keys named in mirror::RELAXATIONS — each of which must be present, must differ, and must differ in the recorded direction. So all four ways the mirror can rot are failures:

• a workspace lint the mirror never gained,
• a mirror lint the workspace does not have (a private tightening is fine to want, but it belongs in the crate’s own #![…] attributes rather than in a table that claims to be a mirror),
• a level or priority that has drifted apart,
• a relaxation that was quietly widened, narrowed, or removed.

Values are compared by their rendered TOML, so "warn" and { level = "warn", priority = -1 } are correctly different: a priority is load-bearing for a lint group and copying one without the other is precisely the drift worth catching.

The second half: what the relaxation actually bought

Mirroring the table correctly still leaves the relaxation itself unbounded, because deny is not forbid. forbid cannot be overridden from inside the crate; deny can, by an #[allow(unsafe_code)] on any item — which is exactly how atune_py’s existing operations are written. So the manifest says “this crate may contain unsafe” and nothing at all says how much. The design’s claim is much narrower than that: a small, enumerated set of operations, each with an argument attached to it.

mirror::OPERATIONS is that enumeration, and the second half of this command holds the tree to it. Every hand-written unsafe in crates/atune_py/src is found by parsing the sources — unsafe blocks, unsafe impls, unsafe fns, unsafe traits and unsafe extern blocks — and its stable AST identity must match the record. The four admitted operations also need their local // SAFETY: rationale; neither check depends on line numbers. A new unsafe block is then a red gate that names the changed operation, not a line in a diff nobody was looking at.

An inner #![allow(unsafe_code)] is rejected outright wherever it appears. Its whole effect is to turn the deny off for a whole module or crate rather than for one reviewed operation, which is the one shape of override that has no legitimate use here.

What it does not check

That the relaxation is sound — that stays a matter for review and for the comments in crates/atune_py/Cargo.toml and ownership/borrowed_ctx.rs (and the layout in ownership/parked.rs). This command checks that each local rationale is the one recorded for its AST identity; it does not attempt to prove the argument. The mirror is likewise the workspace table plus the relaxations written down, so a new relaxation is a deliberate edit to mirror::RELAXATIONS and shows up in a diff as one.

Nor does it see unsafe produced by a macro expansion: the source parse stops at the macro invocation, so pyo3::append_to_inittab!’s own unsafe block is invisible here — correctly, since the point of the inventory is the unsafe this repository writes and has to justify, not the unsafe a dependency’s macro expands to. The consequence is that hiding an operation inside a macro_rules! would evade the count; that is a reviewable edit of a different and more visible kind. The source tree also has a suppression ratchet: the counts of #[expect] attributes, wherever they sit (on items, statements, expressions, fields or parameters), and of #[expect(clippy::too_many_lines)] among them, overall and outside tests, cannot exceed their recorded ceilings. Those ceilings only go down; when a count drops, lower the corresponding constant.

Modules

mirror 🔒

ratchet 🔒

Source suppression ceilings. They only go down as suppressions are removed.

unsafe_inventory 🔒

The unsafe inventory: every hand-written unsafe operation under MIRROR_SRC, found by parsing the sources and held to OPERATIONS.