src/mimir_lens/room_feed/lenses.rs
//! One function per room-fed lens: gather the lens's typed inputs from the
//! room (and the warehouse tables it still joins), hand them to the fold in
//! the lens's own file, and return the report with the basis it rests on.
use std::collections::{BTreeMap, BTreeSet};
use mimir_room::{MaskSpec, Weights};
use mimir_schema::{EdgeKind, Origin, kind as nk};
use serde_json::{Value, json};
use super::graph::{Graph, internal, room_uncached};
use super::{Basis, CALLS_LOWER_BOUND, Query, Warehouse, heat_scope, sources};
use crate::code_room::{Reach, Refusal};
use crate::mimir_lens as lens;
type Answered = Result<(Basis, Value), Refusal>;
/// Answer a room-fed lens. `None` = `lens` is not one of them.
pub fn answer(lens: &str, reach: &Reach<'_>, wh: &Warehouse<'_>, q: &Query<'_>) -> Option<Answered> {
let f: fn(&Reach<'_>, &Warehouse<'_>, &Query<'_>) -> Answered = match lens {
"villa" => villa,
"zombie_features" => zombie_features,
"change_risk" => change_risk,
"churn" => churn,
"bench_gaps" => bench_gaps,
"undoc_api" => undoc_api,
"weak_tests" => weak_tests,
"reachable_vuln" => reachable_vuln,
// the binary lenses read what Build Thing runs filed (builder 2), never a room
"generic_cost" => super::built::generic_cost,
"binary_drift" => super::built::binary_drift,
"name_collision" => name_collision,
"symbol_identity" => symbol_identity,
"trust" => trust,
"world_impact" => world_impact,
"data_reach" => data_reach,
"system_boundary" => super::boundary::system_boundary,
#[cfg(feature = "vector")]
"similar_code" => super::vectors::similar_code,
// the clone signals (`clone_signals`): clones by what a function does
#[cfg(feature = "vector")]
"semantic_clones" => super::clones::semantic_clones,
#[cfg(feature = "vector")]
"exact_clones" => super::clones::exact_clones,
#[cfg(feature = "vector")]
"near_clones" => super::clones::near_clones,
#[cfg(feature = "vector")]
"structural_clones" => super::clones::structural_clones,
#[cfg(feature = "vector")]
"role_neighbours" => super::clones::role_neighbours,
#[cfg(feature = "vector")]
"same_intent" => super::clones::same_intent,
#[cfg(feature = "vector")]
"semantic_twins" => super::clones::semantic_twins,
// the twins × DEPENDS_ON: a library re-implemented by a crate that imports it
#[cfg(feature = "vector")]
"reimplements_shared" => super::reuse::reimplements_shared,
#[cfg(not(feature = "vector"))]
"similar_code" | "semantic_clones" | "exact_clones" | "near_clones" | "structural_clones" | "role_neighbours" | "same_intent" | "semantic_twins" | "reimplements_shared" => no_vector_store,
_ => return None,
};
Some(f(reach, wh, q))
}
/// The vector lenses in a build without the `vector` feature: there is no
/// vector store in this binary to read.
#[cfg(not(feature = "vector"))]
fn no_vector_store(_: &Reach<'_>, _: &Warehouse<'_>, q: &Query<'_>) -> Answered {
Err(Refusal::new(crate::code_room::State::NotLinked, format!("`{}` reads the function vectors, and this binary was built without the `vector` feature: the server answers it (gRPC `Mimir.*`)", q.lens)))
}
/// `villa` — impure call sites: CALLS edges from the request's repos into the
/// impure std / libc / nix items, one finding per positioned site.
fn villa(reach: &Reach<'_>, _wh: &Warehouse<'_>, q: &Query<'_>) -> Answered {
let mut basis = Basis::default();
let g = Graph::open(reach, q, &mut basis)?;
let room = &g.room;
let impure = g.impure_items()?;
let targets = room.mask_of(&impure.keys().copied().collect::<Vec<_>>());
basis.lower_bound(CALLS_LOWER_BOUND);
let edges = g.edges(&mut basis, &[EdgeKind::Calls], None, Some(&targets))?;
let calls_total = room.stats().edges.get(&EdgeKind::Calls).copied().unwrap_or(0) as usize;
let repos: BTreeSet<&str> = g.repos.iter().map(String::as_str).collect();
let mut sites: Vec<lens::villa::CallSite> = Vec::new();
let mut unpositioned = 0usize;
// the binary a `Command::new` runs is the literal at its site: read from the
// consumed checkout (`mimir_v2/clones/<repo>`), one read per file
let layout = reach.code_room()?.layout().clone();
let mut files: BTreeMap<(String, String), Option<String>> = BTreeMap::new();
let mut binary_of = |repo: &str, file: &str, line: u32| -> Option<String> {
if file.is_empty() {
return None;
}
let text = files.entry((repo.to_string(), file.to_string())).or_insert_with(|| std::fs::read_to_string(layout.clone_of(repo).join(file)).ok());
let lines: Vec<&str> = text.as_deref()?.lines().collect();
lens::villa::binary_at(&lines, line)
};
let mut named = 0usize;
for e in edges {
let from = room.node(e.from);
let Some(repo) = from.repo.filter(|r| repos.contains(r)) else { continue };
if from.origin != Some(Origin::Local) {
continue;
}
let (callee, callee_kind) = impure[&e.to].clone();
let caller = room.display_path(e.from);
let at = room.sites(e.from, e.to, EdgeKind::Calls);
let process = lens::villa::classify(&callee, &callee_kind) == Some(lens::villa::Kind::Process);
let mut site = |file: &str, line: u32| {
let binary = if process { binary_of(repo, file, line) } else { None };
named += binary.is_some() as usize;
lens::villa::CallSite {
repo: repo.to_string(),
caller: caller.clone(),
callee: callee.clone(),
callee_kind: callee_kind.clone(),
file: file.to_string(),
line,
binary,
}
};
for s in &at {
sites.push(site(s.file, s.start_line));
}
// sites the graph counts but cannot position (inside a macro expansion):
// one finding at the caller's own line
if (at.len() as u32) < e.count {
unpositioned += (e.count as usize) - at.len();
let (file, line) = room.span(e.from).map_or(("", 0), |s| (s.file, s.start_line));
sites.push(site(file, line));
}
}
if unpositioned > 0 {
basis.note(format!("{unpositioned} impure call site(s) have no position (macro expansion): each caller is reported once, at its own line"));
}
basis.note(format!("{} impure item(s) are known to the room (std / libc / nix process, exec and exit items)", impure.len()));
basis.note(format!("{named} process site(s) spell their binary as a string literal at the call (read from the consumed checkout): only those name a tool"));
let report = lens::villa::analyze(&sites, calls_total, basis.feeds.clone(), q.repo, q.limit);
Ok((basis, report.state_json()))
}
/// `file:line` of a node, `""` without a span.
fn loc(g: &Graph, o: u64) -> String {
g.room.span(o).map(|s| format!("{}:{}", s.file, s.start_line)).unwrap_or_default()
}
/// `zombie_features` — feature nodes, `ENABLES` from crate nodes (what was
/// built), `GATED_BY` (what each feature gates, own gate vs partial), and the
/// CALLS + USES_TYPE sites arriving at the gated items.
fn zombie_features(reach: &Reach<'_>, wh: &Warehouse<'_>, q: &Query<'_>) -> Answered {
use lens::zombie::{Gate, ManifestFacts};
let mut basis = Basis::default();
let g = Graph::open(reach, q, &mut basis)?;
let room = &g.room;
let label = |o: u64| {
let n = room.node(o);
format!("{}/{}", n.krate.unwrap_or("?"), n.name.unwrap_or("?"))
};
// the features of the request's own crates (declared, or only mentioned by a cfg)
let features = g.mask(MaskSpec { node_kinds: vec![nk::FEATURE.into()], origins: vec![Origin::Local], ..Default::default() })?;
basis.fact("code_nodes:feature", features.len(), g.root());
// what the build compiled: crate → feature
let mut manifests: BTreeMap<String, ManifestFacts> = BTreeMap::new();
for r in &g.repos {
manifests.insert(r.clone(), ManifestFacts { build_space_known: true, ..Default::default() });
}
let mut undeclared = 0usize;
for &f in features.ordinals() {
let n = room.node(f);
let Some(m) = n.repo.and_then(|r| manifests.get_mut(r)) else { continue };
if n.defined {
m.declared.insert(label(f));
} else {
undeclared += 1;
}
}
let enables = g.edges_if_any(&mut basis, EdgeKind::Enables, None, Some(&features))?;
for e in &enables {
if room.node(e.from).kind != Some(nk::CRATE) {
continue;
}
if let Some(m) = room.node(e.to).repo.and_then(|r| manifests.get_mut(r)) {
m.built.insert(label(e.to));
}
}
// what the repo's own FILES turn on (every manifest's features lists and
// forwarding lines, dev and optional included; the build variants), and
// the opt-in targets (`[[bin]] required-features`) — read from the clone
let mut enablers: BTreeMap<String, lens::zombie::Enablers> = BTreeMap::new();
for r in &g.repos {
let root = g.layout.clone_of(r);
let mut e = lens::zombie::Enablers::default();
for m in manifests_under(&root, 6) {
if let Ok(t) = std::fs::read_to_string(&m) {
e.add_manifest(&t);
}
}
if let Ok(t) = std::fs::read_to_string(root.join(".nornir/build-variants.toml")) {
e.add_build_variants(&t);
}
enablers.insert(r.clone(), e);
}
for (r, m) in manifests.iter_mut() {
if let Some(e) = enablers.get(r) {
let on: Vec<String> = m.declared.iter().filter(|f| e.enables(f)).cloned().collect();
m.built.extend(on);
}
}
// what each feature gates
let gated = g.edges_if_any(&mut basis, EdgeKind::GatedBy, None, Some(&features))?;
let items = room.mask_of(&gated.iter().map(|e| e.from).collect::<Vec<_>>());
let mut inbound: BTreeMap<u64, u32> = BTreeMap::new();
if !items.is_empty() {
basis.lower_bound(CALLS_LOWER_BOUND);
for e in g.edges(&mut basis, &[EdgeKind::Calls, EdgeKind::UsesType], None, Some(&items))? {
*inbound.entry(e.to).or_default() += e.count;
}
}
// the bytes the items take: what Build Thing runs filed (builder 2), never a linked room artifact
let linked = super::built::LinkedBytes::read(reach, wh, &g.repos, &mut basis);
let mut gates: Vec<Gate> = Vec::new();
let mut exempt = 0usize;
for e in &gated {
let item = room.node(e.from);
let Some(repo) = room.node(e.to).repo else { continue };
if enablers.get(repo).is_some_and(|en| en.exempt(&label(e.to))) {
exempt += 1;
continue;
}
gates.push(Gate {
repo: repo.to_string(),
feature: label(e.to),
item: room.display_path(e.from),
site: Some(loc(&g, e.from)).filter(|l| !l.is_empty()).unwrap_or_else(|| room.moniker(e.from).to_string()),
own: !e.partial,
compiled: item.kind != Some(nk::CFG_GATED_OUT),
negated: e.negated,
inbound: inbound.get(&e.from).copied().unwrap_or(0),
bytes: linked.covers(repo).then(|| linked.of(&room.display_path(e.from))),
});
}
// the cross-check `cfg` strings give: a kept item whose own `cfg` names a
// feature the room holds no GATED_BY edge for
let with_cfg = g.mask(MaskSpec { with_cfg: true, origins: vec![Origin::Local], defined_only: true, ..Default::default() })?;
let edge_set: BTreeSet<(u64, String)> = gated.iter().map(|e| (e.from, room.node(e.to).name.unwrap_or("").to_string())).collect();
let unattributed = with_cfg
.ordinals()
.iter()
.filter(|o| room.node(**o).kind != Some(nk::FEATURE))
.flat_map(|o| lens::zombie::features_in_cfg(room.node(*o).cfg.unwrap_or("")).into_iter().map(move |f| (*o, f)))
.filter(|k| !edge_set.contains(k))
.count();
if unattributed > 0 {
basis.gap(format!("{unattributed} item(s) carry a `cfg` naming a feature with no GATED_BY edge to it: those gates are not counted"));
}
if undeclared > 0 {
basis.note(format!("{undeclared} feature name(s) are mentioned by a `cfg` and declared by no manifest of the workspace"));
}
if exempt > 0 {
basis.note(format!("{exempt} gate(s) left out: their feature is an opt-in target's (`[[bin]] required-features`) or offered / excused by the repo's .nornir/build-variants.toml — no zombie"));
}
basis.note("built = ENABLES of the consumed build OR a repo file that turns the feature on (a dependency's features list, dev and optional ones too; a [features] forwarding line; a build variant)");
basis.lower_bound("the predicate of a `cfg_attr` is no GATED_BY edge (it switches an attribute, not code)");
basis.lower_bound("a `cfg` written by a macro with a `$metavariable` feature name is an edge only on the side the build kept");
basis.lower_bound("dependencies carry the own gates of KEPT items only (the token scan for compiled-out items runs on the workspace's own crates): only the request's own crates are judged");
basis.note("never-built = a declared feature no crate node ENABLES (exact, for the configuration the consumer compiled); a compiled-out item is evidence for never-built, never for unreached");
let report = lens::zombie::analyze(&gates, &manifests, basis.feeds.clone(), "code room: rustc-resolved CALLS + USES_TYPE, across every consumed repo", q.limit);
Ok((basis, report.state_json()))
}
/// Every `Cargo.toml` under `root`, at most `depth` directories down (build
/// output, VCS and vendored trees skipped).
fn manifests_under(root: &std::path::Path, depth: usize) -> Vec<std::path::PathBuf> {
let mut out = Vec::new();
let mut stack = vec![(root.to_path_buf(), 0usize)];
while let Some((dir, d)) = stack.pop() {
let Ok(rd) = std::fs::read_dir(&dir) else { continue };
for e in rd.flatten() {
let p = e.path();
let name = e.file_name().to_string_lossy().into_owned();
if p.is_dir() {
if d < depth && !matches!(name.as_str(), "target" | ".git" | "node_modules" | "vendor") {
stack.push((p, d + 1));
}
} else if name == "Cargo.toml" {
out.push(p);
}
}
}
out.sort();
out
}
/// `a, b, c` — or the first eight and how many more.
fn name_list(names: &[&str]) -> String {
const SHOWN: usize = 8;
let mut out = names.iter().take(SHOWN).map(|n| format!("`{n}`")).collect::<Vec<_>>().join(", ");
if names.len() > SHOWN {
out.push_str(&format!(" and {} more", names.len() - SHOWN));
}
out
}
/// What "no test in scope" does to a coverage figure.
fn no_tests_note(basis: &mut Basis, any_test: bool) {
if !any_test {
basis.gap("the scope holds no `#[test]` / bench node: test coverage is 0 everywhere because nothing was measured, not because nothing is tested");
}
}
/// `change_risk` — per file: call sites arriving at its functions (room) ×
/// 90-day churn (`git_heat_facts`) × (1 − the share of its functions a test
/// reaches (room)). A node-level reduce, not a path walk.
fn change_risk(reach: &Reach<'_>, wh: &Warehouse<'_>, q: &Query<'_>) -> Answered {
use lens::risk::FileFacts;
let mut basis = Basis::default();
let g = Graph::open(reach, q, &mut basis)?;
let (callables, any_test) = g.callable_facts(&mut basis)?;
no_tests_note(&mut basis, any_test);
// line coverage: each repo's newest `coverage_fn` run, joined to the room's
// functions by (repo, file, line span)
let cov = wh.table(&mut basis, "coverage_fn");
let cov_rows: Vec<_> = lens::rows::latest_coverage_runs(lens::rows::parse_coverage_fn(&cov)).into_iter().filter(|r| q.wants(&r.repo)).collect();
let spans: Vec<lens::risk::SpanFn> = callables
.iter()
.filter_map(|c| c.file.as_ref().map(|f| lens::risk::SpanFn { ordinal: c.ordinal, repo: c.repo.clone(), file: f.clone(), line: c.line, end_line: c.end_line }))
.collect();
let line = lens::risk::join_line_coverage(&spans, &cov_rows);
// an `only: Affected` run is merged with the run before it: say what it
// carried, and flag what changed and no selected test executed
let carried: std::collections::BTreeSet<&str> = cov_rows.iter().filter(|r| !r.carried_from.is_empty()).map(|r| r.carried_from.as_str()).collect();
if !carried.is_empty() {
basis.note(format!(
"an only: Affected coverage run, merged: {} function(s) keep the counts measured at {} (unchanged since, their tests not run again)",
cov_rows.iter().filter(|r| !r.carried_from.is_empty()).count(),
carried.iter().map(|c| c.chars().take(12).collect::<String>()).collect::<Vec<_>>().join(", ")
));
}
let changed_uncovered: Vec<Value> = cov_rows
.iter()
.filter(|r| r.changed_uncovered())
.map(|r| json!({ "repo": r.repo, "file": r.file, "fn": r.name, "line": r.line, "commit": r.commit }))
.collect();
if !changed_uncovered.is_empty() {
basis.gap(format!(
"{} function(s) changed since the baseline and no selected test executed them (`changed_uncovered`)",
changed_uncovered.len()
));
}
let mut files: BTreeMap<(String, String), FileFacts> = BTreeMap::new();
let mut unplaced = 0usize;
for c in callables.iter().filter(|c| !c.is_test) {
let Some(file) = &c.file else {
unplaced += 1;
continue;
};
let line_measured = line.repos.contains(&c.repo);
let f = files
.entry((c.repo.clone(), file.clone()))
.or_insert_with(|| FileFacts { repo: c.repo.clone(), file: file.clone(), functions: 0, covered: 0, callers: 0, line_measured });
f.functions += 1;
f.covered += if line_measured { line.covered.contains(&c.ordinal) } else { c.covered } as u32;
f.callers += c.call_sites;
}
if unplaced > 0 {
basis.note(format!("{unplaced} function(s) have no span (macro-generated): they belong to no file and are not scored"));
}
let unmeasured: Vec<&str> = g.repos.iter().map(String::as_str).filter(|r| !line.repos.contains(*r)).collect();
if !line.repos.is_empty() {
basis.fact("coverage_fn:joined to room functions", line.measured.len(), g.root());
if line.unjoined > 0 {
basis.note(format!("{} coverage row(s) lie in no function the room knows (another build of the file, or a row without a line): not counted", line.unjoined));
}
}
if !unmeasured.is_empty() {
basis.gap(format!(
"no coverage run filed yet for {}: its coverage is test-REACHABILITY (the room's CALLS walk), which is more generous than line coverage — risk there is UNDER-reported. A Runa `Coverage` step on its checkout files `coverage_fn`",
name_list(&unmeasured)
));
}
let heat = wh.latest(&mut basis, "git_heat_facts");
basis.note("`semver_diffs` has no producer (P5): whether a change breaks a published API is not evaluated");
let files: Vec<FileFacts> = files.into_values().collect();
let cov_any = !cov.is_empty();
let mut report = lens::risk::analyze(&files, &sources(vec![("git_heat_facts", heat), ("coverage_fn", cov)]), basis.feeds.clone(), q.limit);
if line.repos.is_empty() && cov_any {
report.coverage_basis = "test-reachability (the room's CALLS walk) — `coverage_fn` holds no run of the request's repos. \
Reachability is MORE generous than line coverage, so risk is UNDER-reported."
.to_string();
} else if !line.repos.is_empty() {
report.coverage_basis = format!(
"coverage_fn (line: a test EXECUTED the function) for {}; {}",
name_list(&line.repos.iter().map(String::as_str).collect::<Vec<_>>()),
if unmeasured.is_empty() { "every repo of the request is measured".to_string() } else { format!("test-reachability for {}", name_list(&unmeasured)) }
);
}
let mut out = report.state_json();
out["changed_uncovered"] = Value::Array(changed_uncovered);
Ok((basis, out))
}
/// `churn` — the frequency filter over the change series (`git_heat_facts`,
/// every generation) with the room's functions-per-file as the complexity.
fn churn(reach: &Reach<'_>, wh: &Warehouse<'_>, q: &Query<'_>) -> Answered {
let mut basis = Basis::default();
let g = Graph::open(reach, q, &mut basis)?;
let callables = g.callables()?;
basis.feed("code_nodes:fn+method", callables.len(), g.root());
let mut complexity: BTreeMap<(String, String), i64> = BTreeMap::new();
for &o in callables.ordinals() {
if let Some(key) = g.file_of(o) {
*complexity.entry(key).or_default() += 1;
}
}
let heat = wh.table(&mut basis, "git_heat_facts");
let mut series = lens::change_series::parse_series(&heat);
heat_scope(&mut basis, &mut series, q);
let unknown = series.iter().filter(|s| !complexity.contains_key(&(s.repo.clone(), s.file.clone()))).count();
if unknown > 0 && !series.is_empty() {
basis.note(format!("{unknown} of {} churned file(s) define no function the room knows (not Rust, or not compiled): complexity 0", series.len()));
}
let band = lens::churn_filter::Band::parse(q.str("band"));
let report = lens::churn_filter::analyze(&series, &complexity, band, q.i64("cutoff_low"), q.i64("cutoff_high"), basis.feeds.clone(), q.limit);
Ok((basis, report.state_json()))
}
/// `bench_gaps` — hot modules without a bench arm: per module the call sites
/// arriving at its functions, its files and its test coverage (room), joined
/// with churn (`git_heat_facts`) and the bench arms (`bench_runs` × `bench_results`).
fn bench_gaps(reach: &Reach<'_>, wh: &Warehouse<'_>, q: &Query<'_>) -> Answered {
use lens::benchcov::ModuleFacts;
use serde_json::json;
let mut basis = Basis::default();
let g = Graph::open(reach, q, &mut basis)?;
let room = &g.room;
let (callables, any_test) = g.callable_facts(&mut basis)?;
no_tests_note(&mut basis, any_test);
let mut modules: BTreeMap<String, BTreeMap<u64, ModuleFacts>> = BTreeMap::new();
for c in callables.iter().filter(|c| !c.is_test) {
let Some(m) = room.module_of(c.ordinal) else { continue };
let f = modules.entry(c.repo.clone()).or_default().entry(m).or_insert_with(|| ModuleFacts { module: room.display_path(m), ..Default::default() });
f.fan_in += c.call_sites;
f.fns_total += 1;
f.fns_covered += c.covered as u32;
if let Some(file) = &c.file {
f.files.insert(file.clone());
}
}
let heat = lens::rows::parse_git_heat(&wh.latest(&mut basis, "git_heat_facts"));
let runs = lens::rows::parse_bench_runs(&wh.table(&mut basis, "bench_runs"));
let results = lens::rows::parse_bench_results(&wh.table(&mut basis, "bench_results"));
let benched: BTreeSet<&str> = runs.iter().map(|r| r.repo.as_str()).collect();
let never: Vec<&str> = g.repos.iter().map(String::as_str).filter(|r| !benched.contains(r)).collect();
if !never.is_empty() {
basis.gap(format!(
"no bench run filed yet for {}: a Runa `Bench` step on its checkout files one (`bench_runs` / `bench_results`, keyed by repo and commit) — until then every hot module there reads unbenched",
name_list(&never)
));
}
let mut per_repo: Vec<Value> = Vec::new();
for repo in &g.repos {
let facts: Vec<ModuleFacts> = modules.remove(repo).map(|m| m.into_values().collect()).unwrap_or_default();
let repo_heat: Vec<_> = heat.iter().filter(|h| &h.repo == repo).cloned().collect();
let cov = lens::benchcov::repo_bench_coverage(repo, &facts, &repo_heat, &runs, &results, &BTreeSet::new(), q.limit);
per_repo.push(json!({
"repo": cov.repo,
"hot_paths": cov.hot_paths,
"benched": cov.benched,
"unbenched": cov.unbenched,
"bench_runs": cov.bench_runs,
"bench_arms": cov.bench_arms,
"never_benched": cov.never_benched(),
"worst": cov.worst.iter().take(q.limit).map(|h| json!({
"module": h.module, "surface_id": h.surface_id,
"fan_in": h.fan_in, "commits_90d": h.commits_90d,
"test_coverage": h.test_coverage, "score": h.score,
"hint": h.hint,
})).collect::<Vec<_>>(),
}));
}
// repos with the most gaps first
per_repo.sort_by(|a, b| b["unbenched"].as_u64().unwrap_or(0).cmp(&a["unbenched"].as_u64().unwrap_or(0)));
let worst: Vec<Value> = per_repo
.iter()
.flat_map(|r| {
let repo = r["repo"].clone();
r["worst"].as_array().cloned().unwrap_or_default().into_iter().map(move |mut h| {
h["repo"] = repo.clone();
h
})
})
.take(q.limit)
.collect();
let report = json!({
"kind": "bench_gaps",
"repos": per_repo.len(),
"per_repo": per_repo,
"worst": worst,
"evidence_note": lens::sources::evidence_note(&basis.feeds, "bench gaps"),
});
Ok((basis, report))
}
/// `undoc_api` — the public callables (rustc's effective visibility `direct`
/// / `reexported`, not `#[doc(hidden)]`) without a doc comment, ranked by
/// their file's churn.
fn undoc_api(reach: &Reach<'_>, wh: &Warehouse<'_>, q: &Query<'_>) -> Answered {
use lens::undoc_api::ApiFn;
let mut basis = Basis::default();
let g = Graph::open(reach, q, &mut basis)?;
let room = &g.room;
for column in ["effective_visibility", "has_doc"] {
if !room.has_attr(column) {
basis.gap(format!("the log's node payload has no `{column}` column (written since mimir-schema 2): nothing can be called public or undocumented"));
}
}
let callables = g.callables()?;
basis.feed("code_nodes:fn+method", callables.len(), g.root());
// an impl block that implements a trait: its items are documented by the trait
let trait_impls: BTreeSet<u64> = g.edges_if_any(&mut basis, EdgeKind::Implements, None, None)?.into_iter().map(|e| e.from).collect();
let (mut api, mut nominal_only, mut unplaced, mut of_traits, mut hidden) = (Vec::new(), 0usize, 0usize, 0usize, 0usize);
for &o in callables.ordinals() {
let n = room.node(o);
if n.is_test || g.in_test_code(o) {
continue;
}
if n.parent.is_some_and(|p| trait_impls.contains(&p)) {
of_traits += 1;
continue;
}
let public = matches!(room.attr(o, "effective_visibility").and_then(|v| v.as_str()), Some("direct" | "reexported"));
if !public {
nominal_only += (room.attr(o, "visibility").and_then(|v| v.as_str()) == Some(mimir_schema::visibility::PUB)) as usize;
continue;
}
// public by the compiler, not part of the DOCUMENTED API by the author
if g.doc_hidden(o) {
hidden += 1;
continue;
}
let Some(file) = n.file else {
unplaced += 1;
continue;
};
api.push(ApiFn {
repo: n.repo.unwrap_or("").to_string(),
func: room.display_path(o),
file: file.to_string(),
line: n.start_line.unwrap_or(0),
documented: room.attr(o, "has_doc").and_then(|v| v.as_bool()).unwrap_or(false),
});
}
basis.fact("code_nodes:public fn+method", api.len(), g.root());
basis.note(format!(
"public = effective visibility `direct` or `reexported` (nameable from another crate); {nominal_only} `pub` function(s) no other crate can name are not counted, \
nor are {of_traits} method(s) of trait impls (derived or written: the trait documents them — rustc's `missing_docs` rule), \
nor {hidden} `#[doc(hidden)]` function(s) (their own attribute, or a hidden module they sit in)"
));
if unplaced > 0 {
basis.note(format!("{unplaced} public function(s) have no span (macro-generated) and are not ranked"));
}
let heat = wh.latest(&mut basis, "git_heat_facts");
let report = lens::undoc_api::analyze(&api, &sources(vec![("git_heat_facts", heat)]), basis.feeds.clone(), q.repo, q.i64("min_commits_90d"), q.limit);
Ok((basis, report.state_json()))
}
/// `weak_tests` — the outcome history (`test_outcomes` × `bench_runs`) folded
/// whole, with the churn behind each test from the room: what the test node
/// reaches along CALLS → the files those items lie in → their 90-day churn.
fn weak_tests(reach: &Reach<'_>, wh: &Warehouse<'_>, q: &Query<'_>) -> Answered {
use lens::weak::TestChurn;
let mut basis = Basis::default();
let g = Graph::open(reach, q, &mut basis)?;
let room = &g.room;
let outcomes = lens::rows::parse_test_outcomes(&wh.table(&mut basis, "test_outcomes"));
let runs = lens::rows::parse_bench_runs(&wh.table(&mut basis, "bench_runs"));
let heat = lens::rows::parse_git_heat(&wh.latest(&mut basis, "git_heat_facts"));
let churn_of: BTreeMap<(&str, &str), u64> = heat.iter().map(|h| ((h.repo.as_str(), h.file.as_str()), h.commits_90d)).collect();
// the test nodes of the request's repos, by their own name
let tests = g.mask(MaskSpec { is_test: Some(true), ..Default::default() })?;
basis.fact("code_nodes:is_test", tests.len(), g.root());
let mut by_leaf: BTreeMap<(String, String), Vec<(u64, String)>> = BTreeMap::new();
for &o in tests.ordinals() {
let n = room.node(o);
by_leaf.entry((n.repo.unwrap_or("").to_string(), n.name.unwrap_or("").to_string())).or_default().push((o, room.display_path(o)));
}
// the tests the history names, in the request's repos: a bench run's case is
// placed by its `bench_runs` row, a Runa test step's case by its own repo
let repo_of_run: BTreeMap<&str, &str> = runs.iter().map(|r| (r.run_id.as_str(), r.repo.as_str())).collect();
let repo_of = |o: &lens::rows::TestOutcomeFact| -> Option<String> {
repo_of_run.get(o.run_id.as_str()).map(|r| r.to_string()).or_else(|| (!o.repo.is_empty()).then(|| o.repo.clone()))
};
let named_owned: BTreeSet<(String, String)> = outcomes
.iter()
.filter(|o| o.ran())
.filter_map(|o| repo_of(o).map(|repo| (repo, o.test_name.clone())))
.filter(|(repo, _)| g.repos.iter().any(|r| r == repo))
.collect();
let named: BTreeSet<(&str, &str)> = named_owned.iter().map(|(r, t)| (r.as_str(), t.as_str())).collect();
// say plainly which of the request's repos have no test run filed yet
let with_runs: BTreeSet<&str> = named.iter().map(|(r, _)| *r).collect();
let without: Vec<&str> = g.repos.iter().map(String::as_str).filter(|r| !with_runs.contains(r)).collect();
if !without.is_empty() {
basis.gap(format!(
"no test run filed yet for {}: a Runa `Nextest` / `CargoTest` step on its checkout files one (`test_outcomes`, keyed by repo and commit)",
name_list(&without)
));
}
let mut churn: BTreeMap<(String, String), TestChurn> = BTreeMap::new();
let (mut unmatched, mut ambiguous) = (0usize, 0usize);
if !named.is_empty() {
basis.lower_bound(CALLS_LOWER_BOUND);
}
let mut joined: Vec<(&str, &str, u64)> = Vec::new();
for (repo, name) in &named {
let leaf = name.rsplit("::").next().unwrap_or(name);
let tail = format!("::{name}");
let hits: Vec<u64> = by_leaf
.get(&(repo.to_string(), leaf.to_string()))
.map(|v| v.iter().filter(|(_, p)| p == name || p.ends_with(&tail)).map(|(o, _)| *o).collect())
.unwrap_or_default();
let [test] = hits[..] else {
if hits.is_empty() { unmatched += 1 } else { ambiguous += 1 }
continue;
};
joined.push((repo, name, test));
}
// every test's forward CALLS walk at once (one frontier matrix per batch of tests)
let seeds: Vec<u64> = joined.iter().map(|j| j.2).collect();
let walks = room.reach_each(&seeds, &[EdgeKind::Calls], None, None).map_err(internal)?;
for (&(repo, name, _), walk) in joined.iter().zip(walks) {
let walk = walk.value;
let mut files: BTreeSet<(String, String)> = BTreeSet::new();
let mut symbols = 0usize;
for o in &walk.reached {
let n = room.node(*o);
if n.origin != Some(Origin::Local) || !n.defined {
continue;
}
symbols += 1;
if let Some(key) = g.file_of(*o) {
files.insert(key);
}
}
let commits_90d = files.iter().filter_map(|(r, f)| churn_of.get(&(r.as_str(), f.as_str()))).sum();
churn.insert((repo.to_string(), name.to_string()), TestChurn { commits_90d, symbols, files: files.len() });
}
if unmatched + ambiguous > 0 {
basis.gap(format!(
"{} of {} test name(s) in the outcome history could not be joined to ONE `#[test]` node ({unmatched} match none, {ambiguous} match several): \
their verdict rests on run history alone",
unmatched + ambiguous,
named.len()
));
}
let report = lens::weak::weak_tests(&outcomes, &runs, &churn);
let mut v = report.state_json();
if !q.repo.is_empty()
&& let Some(arr) = v.get("worst").and_then(Value::as_array)
{
let kept: Vec<Value> = arr.iter().filter(|t| t.get("repo").and_then(Value::as_str) == Some(q.repo)).cloned().collect();
v["worst"] = Value::Array(kept);
}
if let Some(arr) = v.get_mut("worst").and_then(Value::as_array_mut) {
arr.truncate(q.limit);
}
Ok((basis, v))
}
/// `reachable_vuln` — `vuln_findings` × `sbom_components`, demoted by what
/// the repos' own code uses: CALLS / USES_TYPE sites into each dependency
/// crate at its version.
fn reachable_vuln(reach: &Reach<'_>, wh: &Warehouse<'_>, q: &Query<'_>) -> Answered {
use lens::reachable_vuln::{DepUse, norm_crate};
let mut basis = Basis::default();
let g = Graph::open(reach, q, &mut basis)?;
let room = &g.room;
// what the request's own code calls or names OUTSIDE its repo's crates:
// dependency items (reference stubs — the ring is off) and sibling repos
let own = g.mask(MaskSpec { origins: vec![Origin::Local], ..Default::default() })?;
basis.lower_bound(CALLS_LOWER_BOUND);
let mut uses = DepUse::new();
for e in g.edges(&mut basis, &[EdgeKind::Calls, EdgeKind::UsesType], Some(&own), None)? {
let (from, to) = (room.node(e.from), room.node(e.to));
if to.origin == Some(Origin::Local) && to.repo == from.repo {
continue;
}
let (Some(repo), Some(krate), Some(version)) = (from.repo, to.krate, to.version) else { continue };
*uses.entry((repo.to_string(), norm_crate(krate), version.to_string())).or_default() += e.count as usize;
}
basis.fact("code room: crate@version used by own code", uses.len(), g.root());
basis.lower_bound(
"reachable = the repo's OWN code calls or names an item of the crate (the universe ring is off): \
a vulnerable crate used only through another dependency reads `hold`",
);
let vulns = wh.table(&mut basis, "vuln_findings");
let sbom = wh.latest(&mut basis, "sbom_components");
let report = lens::reachable_vuln::analyze(&sources(vec![("vuln_findings", vulns), ("sbom_components", sbom)]), &uses, basis.feeds.clone(), q.repo, q.limit);
let mut v = report.state_json();
// what the vulnerable code our code calls can reach at the system boundary
if v["worst"].as_array().is_some_and(|w| !w.is_empty()) {
match super::boundary::ring_room(reach, q.repo) {
Ok(ring) => {
let mut with = 0usize;
// the kept walks of the findings (`reach_inc`): a finding whose
// entries and universe half held carries its classes and path
let inc = !lens::reach_inc::reference();
let scope = format!("vuln|{}", lens::reach_inc::scope_key(&ring, &[q.repo.to_string()]));
let mut kept = if inc { Some(super::boundary::KeptFindings::open(&ring, &scope).map_err(internal)?) } else { None };
if let Some(rows) = v["worst"].as_array_mut() {
for row in rows {
let (repo, krate, version) = (row["repo"].as_str().unwrap_or("").to_string(), row["crate"].as_str().unwrap_or("").to_string(), row["version"].as_str().unwrap_or("").to_string());
let b = match kept.as_mut() {
Some(k) => super::boundary::reach_of_crate_kept(&ring, &repo, &krate, &version, k)?,
None => super::boundary::reach_of_crate(&ring, &repo, &krate, &version)?,
};
if let Some(b) = b {
with += usize::from(b["classes"].as_array().is_some_and(|c| !c.is_empty()));
row["boundary"] = b;
}
}
}
if let Some(k) = kept {
k.close(&ring, &scope).map_err(internal)?;
}
basis.note(format!("{with} finding(s) name the system-call classes the vulnerable crate's code our code calls can reach (`boundary`, with one path)"));
}
Err(e) => basis.gap(format!("the system boundary of the findings was not read (the room with the dependencies folded in): {}", e.note)),
}
}
if q.flag("svg") {
let nodes: Vec<lens::verdict_svg::VerdictNode> = report
.worst
.iter()
.map(|f| lens::verdict_svg::VerdictNode {
label: format!("{}: {}@{}", f.repo, f.krate, f.version),
verdict: f.verdict.as_str().to_string(),
weakest_hop: if f.advisory_ids.is_empty() { f.summary.clone() } else { f.advisory_ids.clone() },
})
.collect();
v["svg"] = Value::String(lens::verdict_svg::render_refuse_map("ReachableVuln — refuse/hold set", &nodes, q.limit));
}
Ok((basis, v))
}
/// The positions of a node and the units that describe it.
fn key_sites(g: &Graph, node: u64, owners: &[String]) -> (Vec<String>, usize) {
let spans = g.room.spans_of(node);
let files: BTreeSet<&str> = spans.iter().map(|s| s.file).collect();
let mut sites: Vec<String> = spans.iter().map(|s| format!("{}:{}", s.file, s.start_line)).collect();
sites.extend(owners.iter().cloned());
(sites, files.len())
}
/// `name_collision` — how many CALLS edges land on an id that names more than
/// one definition (the room's merged keys), beside the leaf-name baseline.
fn name_collision(reach: &Reach<'_>, _wh: &Warehouse<'_>, q: &Query<'_>) -> Answered {
use lens::name_collision::{Calls, Def, MergedKey};
let mut basis = Basis::default();
let g = Graph::open(reach, q, &mut basis)?;
let room = &g.room;
let callables = g.callables()?;
basis.feed("code_nodes:fn+method", callables.len(), g.root());
let defs: Vec<Def> = callables.ordinals().iter().map(|&o| { let n = room.node(o); Def { repo: n.repo.unwrap_or("").to_string(), name: n.name.unwrap_or("").to_string() } }).collect();
// the CALLS edges out of the request's own code
let own = g.mask(MaskSpec { origins: vec![Origin::Local], ..Default::default() })?;
basis.lower_bound(CALLS_LOWER_BOUND);
let edges = g.edges(&mut basis, &[EdgeKind::Calls], Some(&own), None)?;
let mut calls = Calls { seen: edges.len(), ..Default::default() };
let mut inbound: BTreeMap<u64, usize> = BTreeMap::new();
for e in &edges {
let to = room.node(e.to);
if to.endpoint_only {
calls.unresolved += 1;
}
*calls.by_callee_name.entry(to.name.unwrap_or("").to_string()).or_default() += 1;
*inbound.entry(e.to).or_default() += 1;
}
let dups = room.duplicate_keys(Some(&callables)).map_err(internal)?.value;
basis.fact("code room: merged callable ids", dups.len(), g.root());
let merged: Vec<MergedKey> = dups
.iter()
.map(|d| {
// a definition's rows all come from the repo that defines it
let repos: BTreeSet<String> = room.node(d.node).repo.map(str::to_string).into_iter().collect();
MergedKey {
path: room.display_path(d.node),
definitions: (d.rows as usize).max(2),
repos,
inbound_calls: inbound.get(&d.node).copied().unwrap_or(0),
sites: key_sites(&g, d.node, &d.owners).0,
}
})
.collect();
basis.note("callee ids are rustc's own resolution: same-named functions are different nodes, and are listed only as the leaf baseline");
let report = lens::name_collision::analyze(&defs, &merged, &calls, basis.feeds.clone(), q.repo, q.limit);
Ok((basis, report.state_json()))
}
/// `symbol_identity` — the ids of the request's own definitions that the fold
/// merged, split by cause: a key one unit repeated vs units that disagree.
fn symbol_identity(reach: &Reach<'_>, _wh: &Warehouse<'_>, q: &Query<'_>) -> Answered {
use lens::symbol_identity::KeyFact;
let mut basis = Basis::default();
let g = Graph::open(reach, q, &mut basis)?;
let room = &g.room;
let own = g.local(&[])?;
basis.feed("code_nodes:definitions", own.len(), g.root());
let dups = room.duplicate_keys(None).map_err(internal)?.value;
let repos: BTreeSet<&str> = g.repos.iter().map(String::as_str).collect();
let (mut keys, mut elsewhere) = (Vec::new(), 0usize);
for d in &dups {
let n = room.node(d.node);
let Some(repo) = n.repo.filter(|r| repos.contains(r)) else { continue };
if !own.contains(d.node) {
// a dependency / binary-only id several units describe differently
elsewhere += 1;
continue;
}
let (sites, files) = key_sites(&g, d.node, &d.owners);
keys.push(KeyFact {
repo: repo.to_string(),
symbol: room.moniker(d.node).to_string(),
kind: n.kind.unwrap_or("").to_string(),
rows: d.rows as usize,
distinct_payloads: d.distinct_payloads as usize,
key_dup_rows: d.key_dup_rows as usize,
files,
sites,
});
}
basis.fact("code room: merged ids of own definitions", keys.len(), g.root());
if elsewhere > 0 {
basis.note(format!("{elsewhere} more merged id(s) are not definitions of the request's own crates (dependency stubs, binary-only nodes): not judged here"));
}
let report = lens::symbol_identity::analyze(own.len(), &keys, basis.feeds.clone(), "", q.limit);
Ok((basis, report.state_json()))
}
/// `trust` — local trust per function from its evidence (impure calls, test
/// reach), then the room's bottleneck walk — the (max, min) semiring over node
/// weights — forward from the entry surface, and for each reported verdict the
/// node that caps its best chain.
fn trust(reach: &Reach<'_>, _wh: &Warehouse<'_>, q: &Query<'_>) -> Answered {
use lens::trust::{Bounds, Scored, Trust, TrustNode, Witness};
let mut basis = Basis::default();
let g = Graph::open(reach, q, &mut basis)?;
let room = &g.room;
// the program's own functions: a test is where coverage comes FROM, not a
// link of the provenance chain — a function only tests call is an entry
let all = g.callables()?;
let program: Vec<u64> = all.ordinals().iter().copied().filter(|o| !room.node(*o).is_test && !g.in_test_code(*o)).collect();
let callables = room.mask_of(&program);
basis.feed("code_nodes:fn+method", callables.len(), g.root());
basis.note(format!("{} test function(s) are not nodes of the trust graph (they supply the coverage)", all.len() - callables.len()));
let ords = callables.ordinals();
let at: BTreeMap<u64, usize> = ords.iter().enumerate().map(|(i, o)| (*o, i)).collect();
basis.lower_bound(CALLS_LOWER_BOUND);
// the evidence: impure calls and the test-reachable set
let impure = g.impure_items()?;
let targets = room.mask_of(&impure.keys().copied().collect::<Vec<_>>());
let mut impure_of: BTreeMap<u64, Vec<(lens::villa::Kind, String)>> = BTreeMap::new();
for e in g.edges(&mut basis, &[EdgeKind::Calls], Some(&callables), Some(&targets))? {
let (path, kind) = &impure[&e.to];
if let Some(k) = lens::villa::classify(path, kind) {
impure_of.entry(e.from).or_default().push((k, path.clone()));
}
}
let covered = g.test_reach(&mut basis)?;
let coverage_fed = covered.is_some();
basis.gap("the sensitive-data term of local trust is NOT applied (this lens does not read TOUCHES_TABLE yet; `data_reach` does) — trust is an upper bound on that axis");
let nodes: Vec<TrustNode> = ords
.iter()
.map(|&o| TrustNode {
func: room.display_path(o),
crate_name: room.node(o).krate.unwrap_or("").to_string(),
impure: impure_of.remove(&o).unwrap_or_default(),
access: Vec::new(),
covered: covered.as_ref().is_some_and(|c| c.contains(&o)),
})
.collect();
let locals: Vec<lens::trust::Local> = nodes.iter().map(|n| lens::trust::local_trust(n, coverage_fed)).collect();
// the entry surface: functions no other function of the scope calls
let scope_calls = g.edges(&mut basis, &[EdgeKind::Calls], Some(&callables), Some(&callables))?;
let has_caller: BTreeSet<u64> = scope_calls.iter().filter(|e| e.from != e.to).map(|e| e.to).collect();
let mut entries: Vec<u64> = ords.iter().copied().filter(|o| !has_caller.contains(o)).collect();
if entries.is_empty() {
// a fully cyclic graph has no entry: every node seeds itself
entries = ords.to_vec();
if !entries.is_empty() {
basis.note("no function without a caller: every function was taken as its own entry point");
}
}
// the walk: best over all entry → node paths of the weakest local trust on
// the path. The lens keeps its last walk per scope (by MONIKER key —
// ordinals are per-snapshot) and diffs this room against it: an unchanged
// graph CARRIES the kept vector, a mappable delta ADVANCES it over the
// affected region only, and everything else runs the FULL bottleneck —
// which stays in the code as the fallback and the oracle (ZERO-LOSS: the
// tests hold the incremental answer equal to it on every fixture).
use lens::trust::incremental as inc;
let now = inc::Now::new(
ords.iter().map(|&o| inc::key_of(room.moniker(o))).collect(),
locals.iter().map(|l| l.trust.weight()).collect(),
entries.iter().filter_map(|o| at.get(o).copied()).collect(),
&scope_calls.iter().filter_map(|e| Some((*at.get(&e.from)?, *at.get(&e.to)?))).collect::<Vec<_>>(),
);
let scope_key = format!("{}|{}", g.workspace(), q.repo);
let kept = inc::kept_for(&scope_key);
let plan = match &kept {
_ if now.ambiguous => inc::Plan::Full("two nodes share a moniker key: the remap is ambiguous"),
Some(k) => inc::plan(k.as_ref(), &now),
None => inc::Plan::Full("no kept walk for this scope"),
};
let best: Vec<Option<u64>> = match (plan, &kept) {
(inc::Plan::Carry, Some(k)) => {
inc::count_carried();
inc::carry(k.as_ref(), &now)
}
(inc::Plan::Advance { decreased, raised }, Some(k)) => {
inc::count_advanced();
inc::advance(k.as_ref(), &now, &decreased, &raised)
}
_ => {
inc::count_full();
let weights = Weights { default: Trust::ONE.weight(), set: ords.iter().zip(&locals).map(|(o, l)| (*o, l.trust.weight())).collect() };
let full: BTreeMap<u64, u64> = if entries.is_empty() {
BTreeMap::new()
} else {
room.bottleneck(&entries, &[EdgeKind::Calls], &weights, Some(&callables)).map_err(internal)?.value.into_iter().collect()
};
ords.iter().map(|o| full.get(o).copied()).collect()
}
};
if !now.ambiguous {
inc::keep(scope_key, now.keep(room.state_key().to_string(), &best));
}
let walked: BTreeMap<u64, u64> = ords.iter().zip(&best).filter_map(|(o, b)| b.map(|w| (*o, w))).collect();
let scored: Vec<Scored> = nodes
.into_iter()
.zip(locals)
.zip(ords)
.map(|((node, local), o)| Scored { node, local, inherited: walked.get(o).map(|w| Trust::from_weight(*w)) })
.collect();
let mut bounds = Bounds::default();
if q.f64("act_at") > 0.0 {
bounds.act_at = q.f64("act_at");
}
if q.f64("hold_at") > 0.0 {
bounds.hold_at = q.f64("hold_at");
}
let ranking = lens::trust::rank(&scored, bounds, q.limit);
// the weakest hop of each reported node: a node whose OWN trust equals the
// inherited value and that reaches the node through nodes at least as trusted
let depth: BTreeMap<u64, u64> =
if entries.is_empty() { BTreeMap::new() } else { room.hops_from(&entries, &[EdgeKind::Calls], None, Some(&callables)).map_err(internal)?.value.into_iter().collect() };
let mut by_value: BTreeMap<u64, (mimir_room::Mask, mimir_room::Mask)> = BTreeMap::new();
let mut witness: BTreeMap<usize, Witness> = BTreeMap::new();
for &i in &ranking.worst {
let o = ords[i];
let Some(&v) = walked.get(&o) else { continue };
let (caps, at_least) = by_value.entry(v).or_insert_with(|| {
let caps: Vec<u64> = ords.iter().zip(&scored).filter(|(n, s)| s.local.trust.weight() == v && walked.get(n) == Some(&v)).map(|(n, _)| *n).collect();
let at_least: Vec<u64> = ords.iter().copied().filter(|n| walked.get(n).is_some_and(|w| *w >= v)).collect();
(room.mask_of(&caps), room.mask_of(&at_least))
});
let weakest = if caps.contains(o) {
o
} else {
room.path(&*caps, &[o], &[EdgeKind::Calls], None, Some(at_least)).map_err(internal)?.value.and_then(|p| p.nodes.first().copied()).unwrap_or(o)
};
witness.insert(i, Witness { weakest: at[&weakest], depth: depth.get(&o).copied().unwrap_or(0) as usize });
}
let report = lens::trust::report(&scored, &ranking, &witness, entries.len(), coverage_fed, bounds, basis.feeds.clone());
let mut v = report.state_json();
if q.flag("svg") {
let nodes: Vec<lens::verdict_svg::VerdictNode> = report
.worst
.iter()
.map(|t| lens::verdict_svg::VerdictNode {
label: t.func.clone(),
verdict: t.decision.as_str().to_string(),
weakest_hop: if t.reason.is_empty() { t.weakest_hop.clone() } else { t.reason.clone() },
})
.collect();
let title = if q.repo.is_empty() { "Trust — refuse/hold set".to_string() } else { format!("Trust — {} refuse/hold set", q.repo) };
v["svg"] = Value::String(lens::verdict_svg::render_refuse_map(&title, &nodes, q.limit));
}
Ok((basis, v))
}
/// What the graph cannot see of table access even with every input there.
const TABLES_LOWER_BOUND: &str = "a table reached through a closure parameter or a fn pointer, through a trait none of whose impls the producer saw, \
or named only inside SQL text, is not a TOUCHES_TABLE edge: the tables and reachers are a LOWER bound";
/// Phase wall clock of one lens fold, printed per phase when
/// `NORNIR_LENS_PROFILE=1`. Diagnosis only — the answer is unchanged.
struct Phases(&'static str, Option<std::time::Instant>);
impl Phases {
fn start(lens: &'static str) -> Self {
Self(lens, std::env::var("NORNIR_LENS_PROFILE").is_ok_and(|v| v == "1").then(std::time::Instant::now))
}
fn lap(&mut self, what: &str) {
if let Some(t) = &mut self.1 {
eprintln!("{}: {what} {} ms", self.0, t.elapsed().as_millis());
*t = std::time::Instant::now();
}
}
/// A side note (built only when profiling); the clock is not restarted.
fn note(&self, line: impl FnOnce() -> String) {
if self.1.is_some() {
eprintln!("{}: {}", self.0, line());
}
}
}
/// `data_reach` — which code reaches which warehouse table: the
/// TOUCHES_TABLE edges that leave the request's repos (the direct touch, with
/// `access` and sites), and for each fn that touches a table the backward
/// CALLS walk inside those repos (who can reach it). A site whose table name
/// is not known at compile time is counted and named, not attributed.
fn data_reach(reach: &Reach<'_>, _wh: &Warehouse<'_>, q: &Query<'_>) -> Answered {
use lens::data_reach::Touch;
let mut phases = Phases::start("data_reach");
let mut basis = Basis::default();
let g = Graph::open(reach, q, &mut basis)?;
let room = &g.room;
phases.lap("room open");
phases.note(|| format!("room: {} nodes · {}", room.stats().nodes, room.stats().build.phase_note()));
// the scope: the request's repos' own code — who can touch, and where a walk may go
let code = g.local(&[])?;
// a lake created before mimir-schema 4 holds edges of repos the table
// producer never saw: there the absence of an edge is not yet a fact
let old_lake = room.edge_column_added_in_place("access");
let edges = if old_lake { g.edges(&mut basis, &[EdgeKind::TouchesTable], Some(&code), None)? } else { g.edges_if_any(&mut basis, EdgeKind::TouchesTable, Some(&code), None)? };
if old_lake {
let silent: Vec<&str> = g.repos.iter().map(String::as_str).filter(|r| !edges.iter().any(|e| room.node(e.from).repo == Some(*r))).collect();
if !silent.is_empty() {
basis.gap(format!(
"no TOUCHES_TABLE edge leaves {}: this lake was created before mimir-schema 4, so either that code touches no table or it was last consumed by a producer that did not write the edge — its next consumed commit tells",
silent.join(", ")
));
}
}
basis.lower_bound(CALLS_LOWER_BOUND);
basis.lower_bound(TABLES_LOWER_BOUND);
phases.lap("edges");
// who reaches each fn that touches a table (one backward walk per fn)
let touchers: BTreeSet<u64> = edges.iter().map(|e| e.from).collect();
let mut reachers: BTreeMap<u64, (Vec<String>, bool)> = BTreeMap::new();
let api = |o: u64| room.node(o).effective_visibility.is_some_and(|v| v.is_public_api());
// every toucher's backward CALLS walk at once (one frontier matrix per batch, on the cached Aᵀ)
let seeds: Vec<u64> = touchers.iter().copied().collect();
if lens::reach_inc::reference() {
let walks = room.dependents_by_each(&seeds, &[EdgeKind::Calls], None, Some(&code)).map_err(internal)?;
phases.lap("batched walks");
for (i, (&f, walk)) in seeds.iter().zip(walks).enumerate() {
if i == 0 {
// the CALLS feed and what the room misses for it — not the walk's own notes
let mut ev = walk.evidence.clone();
ev.notes.clear();
basis.evidence(&ev);
}
let public = api(f) || walk.value.reached.iter().any(|o| api(*o));
let mut names: Vec<String> = walk.value.reached.iter().map(|o| room.display_path(*o)).collect();
names.sort();
names.dedup();
reachers.insert(f, (names, public));
}
phases.lap("reacher names");
} else {
// the kept walk of this scope: only the touchers a changed node can
// reach (or could) are walked again, the rest carry their reachers
let scope = format!("tables|{}", lens::reach_inc::scope_key(room, &g.repos));
reachers = lens::reach_inc::table_reachers(room, &scope, &code, &seeds, &api, &mut |ev| basis.evidence(ev)).map_err(internal)?;
phases.lap("kept reacher walks");
}
if !touchers.is_empty() && !room.has_attr("effective_visibility") {
basis.gap("`effective_visibility` is not in this log (written before mimir-schema 2): `public_entry` is false everywhere, not known");
}
let mut no_access = 0usize;
let touches: Vec<Touch> = edges
.iter()
.map(|e| {
let from = room.node(e.from);
let table = mimir_schema::moniker::table_name(room.moniker(e.to)).filter(|t| t != mimir_schema::TABLE_UNRESOLVED);
let sites: Vec<String> = room.sites(e.from, e.to, EdgeKind::TouchesTable).iter().map(|s| format!("{}:{}", s.file, s.start_line)).collect();
let (names, public) = reachers.get(&e.from).cloned().unwrap_or_default();
if e.access.is_none() {
no_access += 1;
}
Touch {
table,
accessor_fn: room.display_path(e.from),
crate_name: from.krate.unwrap_or("").to_string(),
repo: from.repo.unwrap_or("").to_string(),
access: e.access.map_or("unknown", |a| a.as_str()).to_string(),
sites,
site_count: e.count as usize,
reachers: names,
public_entry: public,
}
})
.collect();
if no_access > 0 {
basis.gap(format!("{no_access} TOUCHES_TABLE edge(s) carry no `access` value: reported as `unknown`"));
}
phases.lap("touch rows");
let report = lens::data_reach::analyze(&touches, basis.feeds.clone(), q.limit);
phases.lap("analyze");
if report.unresolved_sites > 0 {
basis.lower_bound(format!(
"{} site(s) in {} fn(s) touch a table whose name is not known at compile time (a runtime string): they are listed under `unresolved`, not attributed to a table",
report.unresolved_sites, report.unresolved_edges
));
}
let mut v = report.state_json();
phases.lap("state_json");
// the other data the code reaches: the system — which of our fns reach
// which class of system call (`class` = `network` …), each with a path
let classes = super::boundary::classes_asked(q)?;
// a lake the boundary never ran on holds no syscall node: folding the
// dependency universe (8.2 M nodes, 951 s on the lake copy, 2026-10-19)
// only to say so is answered by a targeted scan instead — the same empty
// section, the same note, no ring room
if !super::boundary::boundary_in_lake(reach) {
phases.lap("boundary gate (no syscall node)");
basis.note(format!("syscalls: {}", super::boundary::NO_BOUNDARY));
v["syscalls"] = serde_json::json!([]);
v["syscall_functions_reaching"] = serde_json::json!(0);
v["syscall_functions_seen"] = serde_json::json!(0);
return Ok((basis, v));
}
phases.lap("boundary gate (present)");
match super::boundary::ring_room(reach, q.repo) {
Ok(ring) => {
phases.lap("ring room open");
phases.note(|| format!("ring room: {} nodes · {}", ring.stats().nodes, ring.stats().build.phase_note()));
// the boundary's own basis stays a side note here: data_reach's
// state is about the tables (a lake without the boundary written
// is no gap of THIS lens)
let mut side = Basis::default();
let r = super::boundary::reach_classes(&ring, &g.repos, &classes, q.limit.clamp(1, super::boundary::ROWS_PER_CLASS), &mut side)?;
for s in side.gaps.into_iter().chain(side.notes) {
basis.note(format!("syscalls: {s}"));
}
v["syscalls"] = serde_json::json!(r.classes);
v["syscall_functions_reaching"] = serde_json::json!(r.functions_reaching);
v["syscall_functions_seen"] = serde_json::json!(r.functions_seen);
phases.lap("syscall classes");
}
Err(e) => basis.note(format!("syscalls: the system boundary was not read (the room with the dependencies folded in): {}", e.note)),
}
Ok((basis, v))
}
/// `world_impact` — per repo, what its last consumed commit changed
/// (`Room::diff` between seq N−1 and N, per crate, with the public share),
/// who in the workspace depends on what changed (`Room::dependents`), and the
/// constellation blast radius from `dep_graph_edges`.
fn world_impact(reach: &Reach<'_>, wh: &Warehouse<'_>, q: &Query<'_>) -> Answered {
use lens::world_impact::Change;
use mimir_schema::Level;
let mut basis = Basis::default();
let mut clock = crate::mimir_lens::clone_inc::Clock::new("world_impact");
let g = Graph::open(reach, q, &mut basis)?;
let room = &g.room;
let public = |r: &mimir_room::Room, o: u64| matches!(r.attr(o, "effective_visibility").and_then(|v| v.as_str()), Some("direct" | "reexported"));
let item = |r: &mimir_room::Room, o: u64| r.node(o).level == Some(Level::Item) && r.node(o).origin == Some(Origin::Local) && r.node(o).defined;
let handle = reach.code_room()?;
let mut windows_of: Vec<(&String, std::sync::Arc<lens::world_impact::Window>)> = Vec::new();
let (mut windows, mut kept) = (0usize, 0usize);
for repo in &g.repos {
let seq = room.scope().repos[repo];
if seq < 2 {
basis.note(format!("repo `{repo}` has ONE consumed commit (seq {seq}): there is no earlier state to compare it with"));
continue;
}
windows += 1;
// the window (seq-1 → seq) never changes once folded: kept per (repo, seq)
// (the guard goes before a fold: `put` takes the lock again)
let kept_window = handle.windows().get(repo, seq);
let w = match kept_window {
Some(w) => {
kept += 1;
w
}
None => {
let w = std::sync::Arc::new(match window_from_zone(reach, repo, seq)? {
Some(w) => w,
None => fold_window(reach, repo, seq, &public, &item)?,
});
handle.windows().put(repo, seq, w.clone());
w
}
};
if w.per_crate.is_empty() {
basis.note(format!("repo `{repo}`: seq {seq} added, removed or changed no item (the commit touched no compiled code)"));
}
windows_of.push((repo, w));
clock.lap("window");
}
// who depends on what changed or went away, in the whole workspace (the
// current room: read on every ask) — every crate's walk at once
let asks: Vec<(usize, &String, Vec<&str>)> =
windows_of.iter().enumerate().flat_map(|(i, (_, w))| w.touched.iter().map(move |(krate, seeds)| (i, krate, seeds.iter().map(String::as_str).collect()))).collect();
if !asks.is_empty() {
basis.lower_bound(CALLS_LOWER_BOUND);
}
let seeds: Vec<mimir_room::Seeds<'_>> = asks.iter().map(|(_, _, s)| mimir_room::Seeds::Monikers(s)).collect();
let walks = room.dependents_each(&seeds, None).map_err(internal)?;
clock.lap("dependents walk");
let mut per_window: Vec<BTreeMap<String, Change>> = windows_of.iter().map(|(_, w)| w.per_crate.iter().map(|c| (c.crate_name.clone(), c.clone())).collect()).collect();
for ((i, krate, _), walk) in asks.iter().zip(walks) {
let repo = windows_of[*i].0;
let callers: BTreeSet<String> = walk.value.reached.iter().filter_map(|o| room.node(*o).repo).filter(|r| r != repo && !r.starts_with('@')).map(str::to_string).collect();
if let Some(c) = per_window[*i].get_mut(*krate) {
c.callers = callers;
}
}
let changes: Vec<Change> = per_window.into_iter().flat_map(BTreeMap::into_values).collect();
if kept > 0 {
basis.note(format!("{kept} of {windows} commit window(s) were folded on an earlier ask and are kept per (repo, seq): no as-of room was built for them"));
}
basis.fact("code room: repos with a commit window", windows, g.root());
if windows == 0 {
basis.gap("no repo of the request has two consumed commits: there is no change to rank yet");
}
basis.gap("callers outside the workspace (the crates.io ring) and published semver diffs have no producer (P5): `world_callers` are the workspace's own repos only");
basis.note("breaking = a removed item another crate could name (effective visibility `direct` / `reexported`); an item's doc is part of its payload, so `changed_items` includes doc-only edits");
let deps = wh.table(&mut basis, "dep_graph_edges");
let report = lens::world_impact::analyze(&changes, &sources(vec![("dep_graph_edges", deps)]), basis.feeds.clone(), "", q.limit);
Ok((basis, report.state_json()))
}
/// One repo's commit window straight from the READ-FAST zone
/// ([`mimir_room::Room::commit_window`]): the item versions that start or
/// end at the commit, each with its node on the side the diff reads it —
/// the same window [`fold_window`] folds two as-of rooms for. `None` = the
/// zone cannot answer it (no anchor at the commit, a binary stream): fold.
pub(super) fn window_from_zone(reach: &Reach<'_>, repo: &str, seq: i64) -> Result<Option<lens::world_impact::Window>, crate::code_room::Refusal> {
use lens::world_impact::Change;
use mimir_schema::Level;
let log = reach.code_room()?.log()?;
let Some(cw) = mimir_room::Room::commit_window_blocking(&log, repo, seq).map_err(internal)? else { return Ok(None) };
// the lens's own `item` / `public` rules, on the node the diff reads
let item = |n: &mimir_room::WindowNode| n.level == Some(Level::Item) && n.origin == Some(Origin::Local) && n.defined;
let public = |n: &mimir_room::WindowNode| matches!(n.effective_visibility.as_deref(), Some("direct" | "reexported"));
let window = format!("{repo}@{}→{seq}", seq - 1);
let mut per_crate: BTreeMap<String, Change> = BTreeMap::new();
let mut touched: BTreeMap<String, Vec<String>> = BTreeMap::new();
for (list, kind) in [(&cw.added, 0u8), (&cw.removed, 1), (&cw.changed, 2)] {
for (m, n) in list {
if !item(n) {
continue;
}
let krate = n.krate.clone().unwrap_or_else(|| "?".to_string());
let is_public = public(n) as i64;
let c = per_crate.entry(krate.clone()).or_insert_with(|| Change { repo: repo.to_string(), window: window.clone(), crate_name: krate.clone(), ..Default::default() });
match kind {
0 => {
c.added_items += 1;
c.added_public += is_public;
}
1 => {
c.removed_items += 1;
c.removed_public += is_public;
}
_ => c.changed_items += 1,
}
if kind != 0 {
touched.entry(krate).or_default().push(m.clone());
}
}
}
Ok(Some(lens::world_impact::Window { per_crate: per_crate.into_values().collect(), touched }))
}
/// Fold one repo's commit window: the as-of rooms at seq − 1 and seq, their
/// diff per crate, and the ids each crate changed or removed.
pub(super) fn fold_window(
reach: &Reach<'_>,
repo: &str,
seq: i64,
public: &dyn Fn(&mimir_room::Room, u64) -> bool,
item: &dyn Fn(&mimir_room::Room, u64) -> bool,
) -> Result<lens::world_impact::Window, crate::code_room::Refusal> {
use lens::world_impact::Change;
use mimir_room::Scope;
let older = room_uncached(reach, &Scope::repo(repo, Some(seq - 1)))?;
let newer = room_uncached(reach, &Scope::repo(repo, Some(seq)))?;
let diff = older.diff(&newer).map_err(internal)?.value;
let window = format!("{repo}@{}→{seq}", seq - 1);
let mut per_crate: BTreeMap<String, Change> = BTreeMap::new();
let mut touched: BTreeMap<String, Vec<String>> = BTreeMap::new();
{
for (monikers, side, kind) in [(&diff.added_nodes, &newer, 0u8), (&diff.removed_nodes, &older, 1), (&diff.changed, &newer, 2)] {
for m in monikers {
let Some(o) = side.ordinal(m) else { continue };
if !item(side, o) {
continue;
}
let krate = side.node(o).krate.unwrap_or("?").to_string();
let is_public = public(side, o) as i64;
let c = per_crate.entry(krate.clone()).or_insert_with(|| Change { repo: repo.to_string(), window: window.clone(), crate_name: krate.clone(), ..Default::default() });
match kind {
0 => {
c.added_items += 1;
c.added_public += is_public;
}
1 => {
c.removed_items += 1;
c.removed_public += is_public;
}
_ => c.changed_items += 1,
}
if kind != 0 {
touched.entry(krate).or_default().push(m.to_string());
}
}
}
}
Ok(lens::world_impact::Window { per_crate: per_crate.into_values().collect(), touched })
}
/// The item kinds a span is reported for, in the vocabulary the clone
/// detector reads (`fn` and `method` are the callable bodies).
#[cfg(feature = "vector")]
fn span_kind(kind: Option<&str>) -> Option<&'static str> {
Some(match kind? {
nk::FN => "fn",
nk::METHOD => "method",
nk::STRUCT => "struct",
nk::ENUM => "enum",
nk::UNION => "union",
nk::TRAIT => "trait",
nk::IMPL => "impl",
nk::MOD => "mod",
nk::CONST => "const",
nk::STATIC => "static",
nk::TYPE => "type",
nk::MACRO => "macro",
_ => return None,
})
}
/// The item spans of one file, from the room's node spans: every item whose
/// span lies in it, outer before inner, with its container path inside the file.
#[cfg(feature = "vector")]
fn item_spans(room: &mimir_room::Room, repo: &str, file: &str) -> Option<Vec<crate::vector::spans::ItemSpan>> {
let nodes = room.nodes_in_file(Some(repo), file);
if nodes.is_empty() {
return None;
}
let here: BTreeSet<u64> = nodes.iter().copied().collect();
let segment = |o: u64| room.display_path(o).rsplit("::").next().unwrap_or("").to_string();
let mut out = Vec::new();
for &o in &nodes {
let n = room.node(o);
let (Some(kind), Some(start), Some(end)) = (span_kind(n.kind), n.start_line, n.end_line) else { continue };
// the containers of the item that lie in this file, innermost first
let mut chain: Vec<u64> = Vec::new();
let mut cur = n.parent;
while let Some(p) = cur.filter(|p| here.contains(p)) {
chain.push(p);
cur = room.node(p).parent;
}
// the outermost one is the file itself (its module, or the crate root)
let file_root = chain.last().is_some_and(|p| matches!(room.node(*p).kind, Some(nk::MOD | nk::CRATE)));
if file_root {
chain.pop();
} else if chain.is_empty() && kind == "mod" {
// the module this file IS: not an item inside it
continue;
}
out.push(crate::vector::spans::ItemSpan {
kind,
name: segment(o),
path: chain.iter().rev().map(|p| segment(*p)).collect::<Vec<_>>().join("::"),
start_line: start as usize,
end_line: end as usize,
depth: chain.len(),
is_leaf: !matches!(kind, "impl" | "mod" | "trait"),
});
}
Some(out)
}
/// `subclone` — the source-text fold with the room's item spans. A repo the
/// room cannot give spans for is still scanned, span-less, and says why.
#[cfg(feature = "vector")]
pub fn subclone(reach: &Reach<'_>, q: &Query<'_>, warehouse_root: &std::path::Path) -> Value {
use lens::subclone::Spans;
let mut basis = Basis::default();
let v = match Graph::open(reach, q, &mut basis) {
Ok(g) if !q.repo.is_empty() => {
let of = |file: &str| item_spans(&g.room, q.repo, file);
let spans = Spans { of: &of, source: format!("the code room holds no span in them — not compiled by the consumed configuration; room {}", g.root()) };
lens::subclone::analyze(warehouse_root, q.repo, q.limit, &spans)
}
Ok(_) => lens::subclone::analyze(warehouse_root, q.repo, q.limit, &Spans::none("no repo named")),
Err(r) => lens::subclone::analyze(warehouse_root, q.repo, q.limit, &Spans::none(format!("no item spans: {} [{}]", r.note, r.state))),
};
super::stamp_source_lens(q, v)
}
/// The repo's MIR block payloads at the room's seq, read from the lake
/// beside the room (the room keeps the bodies only), at most
/// `MIMIR_MIR_SIDE_CAP_MB` (default 2048) MiB of payload.
#[cfg(feature = "vector")]
fn mir_side(reach: &Reach<'_>, room: &mimir_room::Room, repo: &str) -> anyhow::Result<mimir_room::MirSide> {
let cap_mb: usize = std::env::var("MIMIR_MIR_SIDE_CAP_MB").ok().and_then(|v| v.parse().ok()).unwrap_or(2048);
let upto = room.scope().repos.get(repo).copied();
let log = reach.code_room().map_err(|r| anyhow::anyhow!("{}", r.note))?.log().map_err(|r| anyhow::anyhow!("{}", r.note))?;
let t0 = std::time::Instant::now();
let side = std::thread::scope(|s| s.spawn(|| log.block_on(mimir_room::MirSide::load(&log, repo, upto, cap_mb << 20))).join().unwrap_or_else(|p| std::panic::resume_unwind(p)))?;
eprintln!("mimir-lens: group_twins {repo}: {} MIR block(s), {} MB beside the room in {} ms{}", side.len(), side.bytes >> 20, t0.elapsed().as_millis(), if side.capped { " (CAPPED)" } else { "" });
Ok(side)
}
/// `group_twins` — the compiled graph first (the room's per-line facts of
/// the repo's functions, rarity over the room's), the optional embedding
/// index beside it (the checkout cut by the room's item spans, the group
/// vectors when `embeddings_groups` holds any). A door without a room still
/// runs the index, and says the graph is missing.
#[cfg(feature = "vector")]
pub fn group_twins(reach: &Reach<'_>, wh: &Warehouse<'_>, q: &Query<'_>, warehouse_root: &std::path::Path) -> Value {
use lens::group_twins::Compiled;
use lens::subclone::Spans;
let mut basis = Basis::default();
let profile = q.str("model_profile");
match Graph::open(reach, q, &mut basis) {
Ok(g) if !q.repo.is_empty() => {
let of = |file: &str| item_spans(&g.room, q.repo, file);
let spans = Spans { of: &of, source: format!("the code room holds no span in them — not compiled by the consumed configuration; room {}", g.root()) };
let mut clock = crate::mimir_lens::clone_inc::Clock::new("group_twins");
let compiled = match mir_side(reach, &g.room, q.repo).and_then(|side| {
clock.lap("mir side");
crate::mimir_groupclone_graph::gather(&g.room, q.repo, &side)
}) {
Ok(c) => Compiled::Read(c),
Err(e) => Compiled::Unread(format!("reading the room's facts failed: {e:#}")),
};
clock.lap("gather");
let v = lens::group_twins::analyze(wh.handle(), warehouse_root, q.repo, q.limit, profile, &spans, &compiled);
clock.lap("pair + index + render");
v
}
Ok(_) => lens::group_twins::analyze(wh.handle(), warehouse_root, q.repo, q.limit, profile, &Spans::none("no repo named"), &Compiled::Unread("no repo named".into())),
Err(r) => {
let why = format!("{} [{}]", r.note, r.state);
lens::group_twins::analyze(wh.handle(), warehouse_root, q.repo, q.limit, profile, &Spans::none(format!("no item spans: {why}")), &Compiled::Unread(why))
}
}
}