3b Rust Compiler Analyzer

Perform crate-level compiler analysis for a Rust crate: MIR pattern detection and LLVM IR comparison across optimization levels. A single instance of this agent handles the entire crate (Rust compilation is crate-granular, not per-source-file like C/C++).

Input

You receive these values from the orchestrator:

Process

Output directory: {workdir}/rust-compiler-analysis/

Section C of {baseDir}/references/rust-zeroization-patterns.md documents 12 of the patterns the three scripts below match — C-MIR1–C-MIR3 for Step 2, C-IR1–C-IR5 for Step 4, C-ASM1–C-ASM4 for Step 4b. Every entry explains why source-level analysis is blind to the flaw and carries a Detection line naming the compiler artifact that proves it; most also give a reproducing snippet. When a script reports a pattern that has an entry, that Detection line is the evidence the finding must carry, and checking the artifact against it separates a genuine hit from a match on a coincidental symbol name.

Section C is a subset, not an index. check_mir_patterns.py and check_llvm_patterns.py each emit classes with no entry — secrets passed to FFI calls, secrets live on Err paths, secret return values, and by-value aggregate arguments among them. A pattern absent from Section C is still a valid finding: report it with the evidence the script itself produced. Never drop or downgrade a finding because the reference does not describe it.

Section D lists patterns no current script detects — Arc/Rc deferred drop, repr(C) padding bytes, static/LazyLock secrets, async cancellation, Cow clones, and mem::swap. A clean run does not rule these out, so Step 7 surveys the crate for them and writes coverage-gaps.json. The report assembler reads that file and surfaces it under Analysis Coverage; notes.md is not read by any downstream agent, so a gap recorded only there never reaches the reader.

Step 1 — MIR Emission

Emit MIR (Mid-level Intermediate Representation) for the crate. MIR is lower-level than Rust source but higher-level than LLVM IR, and preserves drop semantics and borrow information.

{baseDir}/tools/emit_rust_mir.sh \
  --manifest <cargo_manifest> \
  --out {workdir}/rust-compiler-analysis/<rust_tu_hash>.mir

If emission fails:

• Write error to notes.md
• Write status-bearing error object to mir-findings.json
• Skip Step 2 and continue with Step 3 (LLVM IR analysis can still run)

Step 2 — MIR Pattern Analysis (produces MISSING_SOURCE_ZEROIZE, SECRET_COPY, NOT_ON_ALL_PATHS)

uv run {baseDir}/tools/scripts/check_mir_patterns.py \
  --mir {workdir}/rust-compiler-analysis/<rust_tu_hash>.mir \
  --secrets {workdir}/source-analysis/sensitive-objects.json \
  --out {workdir}/rust-compiler-analysis/mir-findings.json

This detects:

• drop(_X) without StorageDead(_X) for sensitive locals → MISSING_SOURCE_ZEROIZE (medium)
• resume terminator (unwind path) with live sensitive locals → MISSING_SOURCE_ZEROIZE (medium)
• Secret moved into non-Zeroizing aggregate (e.g. PlainBuffer { data: move _secret }) → SECRET_COPY (medium)
• Drop glue without call zeroize:: → MISSING_SOURCE_ZEROIZE (high)
• Secret passed to FFI call (callee matching ::c_, _ffi_, _sys_, or extern) → SECRET_COPY (high)
• Yield terminator (async/coroutine) with sensitive local live → NOT_ON_ALL_PATHS (high)
• Closure capture of sensitive local by-value (e.g. move |...| { ... sensitive_var ... }) → SECRET_COPY (high)
• Result::Err(...) early-return path with sensitive locals still in scope → NOT_ON_ALL_PATHS (high)

IDs: F-RUST-MIR-NNNN (sequential, zero-padded to 4 digits).

If the script is missing or fails: write a status-bearing error object to mir-findings.json and continue:

{
  "status": "error",
  "error_type": "script_failed",
  "step": "mir_pattern_analysis",
  "message": "<stderr or missing-script reason>",
  "findings": []
}

Step 3 — LLVM IR Emission

Emit LLVM IR at each optimization level in opt_levels. Always include O0 as the unoptimized baseline.