{"id":50494011,"url":"https://github.com/asmuelle/diff-risk","last_synced_at":"2026-06-02T05:04:20.190Z","repository":{"id":353073171,"uuid":"1217873756","full_name":"asmuelle/diff-risk","owner":"asmuelle","description":null,"archived":false,"fork":false,"pushed_at":"2026-05-21T21:51:35.000Z","size":121,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-22T06:59:49.717Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/asmuelle.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE-APACHE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-04-22T09:55:43.000Z","updated_at":"2026-05-21T21:51:35.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/asmuelle/diff-risk","commit_stats":null,"previous_names":["asmuelle/diff-risk"],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/asmuelle/diff-risk","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/asmuelle%2Fdiff-risk","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/asmuelle%2Fdiff-risk/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/asmuelle%2Fdiff-risk/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/asmuelle%2Fdiff-risk/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/asmuelle","download_url":"https://codeload.github.com/asmuelle/diff-risk/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/asmuelle%2Fdiff-risk/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33807029,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-02T02:00:07.132Z","response_time":109,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-06-02T05:04:19.225Z","updated_at":"2026-06-02T05:04:20.184Z","avatar_url":"https://github.com/asmuelle.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# 🛠️ Specification: `diff-risk`\n**Subtitle:** *Semantic Risk Scoring \u0026 Vulnerability Detection for AI-Generated Diffs*\n\n## 1. Core Philosophy\n`diff-risk` is based on the premise that **not all lines of code are created equal**. A change to a CSS class is low risk; a change to a `Mutex` lock order is high risk. \n\nInstead of generic linting, `diff-risk` identifies **\"Hot Zones\"**—specific patterns in Rust that are historically prone to failure when modified by LLMs. It assigns a risk score (0–10) to a diff, forcing the developer to slow down and think when the AI touches \"danger zones.\"\n\n---\n\n## 2. The Risk Matrix (Semantic Analysis)\n\n`diff-risk` doesn't just see text; it identifies semantic patterns. It flags the following \"Danger Zones\":\n\n### A. API Contract Violations (Score: 🔴 High)\n*   **Pattern:** Changes to `pub` function signatures, modified return types, or changed visibility modifiers.\n*   **Risk:** Breaking downstream dependencies or public-facing API contracts.\n*   **Detection:** Detects changes in the `pub` keyword or function signature in `lib.rs` or module entry points.\n\n### B. Async Boundaries \u0026 Polling (Score: 🔴 High)\n*   **Pattern:** Introducing `.await` inside a loop, changing `async` to sync (or vice versa), or modifying `Future` implementations.\n*   **Risk:** Deadlocks, \"async-sync\" impedance mismatch, or blocking the executor (e.g., calling `std::thread::sleep` inside a Tokio task).\n*   **Detection:** Scans for changes involving `.await`, `block_on`, `spawn`, and `poll`.\n\n### C. Serde \u0026 Schema Drift (Score: 🟡 Medium/High)\n*   **Pattern:** Renaming fields in a struct that derives `Serialize` or `Deserialize`, or changing a field type (e.g., `u32` $\\rightarrow$ `u64`).\n*   **Risk:** Breaking wire-compatibility with other services or failing to deserialize existing database records.\n*   **Detection:** Cross-references modified structs with `#[derive(Serialize, Deserialize)]` or `#[serde(rename = \"...\")]`.\n\n### D. Auth \u0026 Permission Gates (Score: 🔴 Critical)\n*   **Pattern:** Modifications to functions containing keywords like `authorize`, `authenticate`, `permission`, `role`, or `JWT`.\n*   **Risk:** Accidental privilege escalation or bypassing security middleware.\n*   **Detection:** Keyword-weighted analysis combined with call-graph distance to the request handler.\n\n### E. Concurrency \u0026 Memory Safety (Score: 🔴 High)\n*   **Pattern:** Changing `Mutex` to `RwLock`, modifying `Arc` cloning logic, or adding `unsafe` blocks.\n*   **Risk:** Race conditions, deadlocks, or memory corruption.\n*   **Detection:** Flags any change to `std::sync` or `tokio::sync` primitives.\n\n---\n\n## 3. CLI Interface (UX)\n\n```bash\n# Score the current staged changes\ndiff-risk\n\n# Score a specific commit or PR\ndiff-risk --commit a1b2c3d\n\n# Set a risk threshold: exit with error if risk is \u003e 7 (for CI/CD)\ndiff-risk --threshold 7\n```\n\n### Example Output:\n```text\n🚩 DIFF RISK ASSESSMENT: [SCORE: 8.2/10 - HIGH RISK]\n\n⚠️ HIGH RISK: Async Boundary Change\n- src/worker.rs: Line 42: Added `.await` inside a critical section.\n- Potential: Possible deadlock or executor starvation.\n\n⚠️ HIGH RISK: API Contract Change\n- src/lib.rs: Line 112: Changed `fn get_user(id: u32)` -\u003e `fn get_user(id: uuid::Uuid)`.\n- Potential: Breaking change for all downstream crates.\n\n🟡 MEDIUM RISK: Serde Schema Drift\n- src/models.rs: Line 20: Renamed field `user_name` to `username`.\n- Potential: Incompatibility with stored JSON in MongoDB.\n\n✅ LOW RISK: Logic/Syntax\n- src/utils.rs: Refactored string concatenation.\n```\n\n---\n\n## 4. The Complete \"Vibe Coding\" Stack\n\nWith `diff-risk` added, you now have a professional-grade AI development loop:\n\n| Tool | Role | Logic | Vibe |\n| :--- | :--- | :--- | :--- |\n| **`cargo-context`** | **The Input** | `Diff` $\\rightarrow$ `Context Pack` | *\"Give the AI exactly what it needs to be smart.\"* |\n| **`diff-risk`** | **The Filter** | `Diff` $\\rightarrow$ `Risk Score` | *\"Wait, did the AI just break our auth logic?\"* |\n| **`cargo-impact`** | **The Proof** | `Change` $\\rightarrow$ `Blast Radius` | *\"I'll run exactly these 3 tests to be sure.\"* |\n\n### The Integrated Workflow:\n1.  **Draft:** Use `cargo-context` to feed the AI the state $\\rightarrow$ AI generates a fix.\n2.  **Skepticism:** Run `diff-risk`. \n    *   *If Score \u003c 5:* Move to verification.\n    *   *If Score \u003e 5:* Feed the risk report back to the AI: *\"You changed the Serde schema, which will break our DB. Fix this to be backward compatible.\"*\n3.  **Verification:** Run `cargo-impact --test` to surgically verify the blast radius.\n4.  **Ship:** Commit with confidence.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fasmuelle%2Fdiff-risk","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fasmuelle%2Fdiff-risk","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fasmuelle%2Fdiff-risk/lists"}