Problem
#![forbid(unsafe_code)] was added to airo_mind in revision 4, on rust-architect's recommendation — correctly, since it converts "pure Rust, no FFI" from a description into a compiler-enforced property on a crate holding key material.
But design §9 also puts the operation log, content store, and replay in that same crate. And forbid — unlike deny — cannot be locally overridden.
memmap2 requires unsafe at the call site. airo_core already does this deliberately and reviewed, at rust/airo_core/src/api/playlist_engine.rs:222 and :924.
Memory-mapped, read-only, sealed log segments are the single most effective tool for "replay one million operations without unbounded memory growth": zero-copy header scanning, and the OS page cache absorbs memory pressure instead of the app heap.
As written, the crate that will own the operation log can never memory-map it.
Required — decide the layering now, not after the log format freezes
Not a request to weaken the lint. chief-security-officer is right to want it.
airo_mind keeps forbid(unsafe_code) and owns crypto, vault, merge, and replay logic. Storage I/O — segment files, mmap, group commit, fsync — lives in a separate small crate (airo_mind_store, or inside airo_core's existing reviewed-unsafe boundary) with an audited unsafe surface of two or three call sites.
Decided now this costs a sentence. Decided in Phase 2 it costs a crate split with the log format already frozen around a heap-resident assumption.
Carry this constraint into the new crate
mmap on Android SIGBUSes if the mapped file is truncated or removed underneath. The discipline that avoids it: sealed segments only — never mmap the active segment.
Reviewers
chief-architect owns the dependency-graph change. rust-architect owns the unsafe surface. chief-security-officer must confirm the split does not move key material into the unaudited crate.
Problem
#![forbid(unsafe_code)]was added toairo_mindin revision 4, on rust-architect's recommendation — correctly, since it converts "pure Rust, no FFI" from a description into a compiler-enforced property on a crate holding key material.But design §9 also puts the operation log, content store, and replay in that same crate. And
forbid— unlikedeny— cannot be locally overridden.memmap2requiresunsafeat the call site.airo_corealready does this deliberately and reviewed, atrust/airo_core/src/api/playlist_engine.rs:222and:924.As written, the crate that will own the operation log can never memory-map it.
Required — decide the layering now, not after the log format freezes
Not a request to weaken the lint. chief-security-officer is right to want it.
Decided now this costs a sentence. Decided in Phase 2 it costs a crate split with the log format already frozen around a heap-resident assumption.
Carry this constraint into the new crate
mmap on Android SIGBUSes if the mapped file is truncated or removed underneath. The discipline that avoids it: sealed segments only — never mmap the active segment.
Reviewers
chief-architect owns the dependency-graph change. rust-architect owns the
unsafesurface. chief-security-officer must confirm the split does not move key material into the unaudited crate.