Abstract:Rust crates encode rich structural information about software quality—including APIboundaries, error-handling patterns, concurrency constructs, unsafe usage (or absence thereof),test coverage signals, and architectural motifs—that are typically evaluated through ad hoccode review, linting, or static analysis tools focused on localized rule violations. In cur-rent practice, these signals are rarely aggregated into a coherent, deterministic structuralinterpretation of overall code quality and review readiness. As a result, a crate may ap-pear “clean” under conventional linting while still exhibiting latent structural weaknesses,fragmented design patterns, or certification-relevant gaps.This paper introduces the DSFB (Drift–Slew Fusion Bootstrap) Structural SemioticsEngine as a deterministic, non-intrusive auditing layer for Rust crate quality analysis. Inthis context, DSFB operates as a read-only observer over source code and derived structuralsignals, transforming heterogeneous code features into typed structural objects governed byadmissibility envelopes, grammar states, and semantic interpretation layers. Rather thantreating individual findings as isolated rule violations, the system aggregates them intoa structured audit that classifies the crate into interpretable states reflecting coherence,boundary pressure, and structural deviation.The DSFB framework is instantiated in the dsfb-gray crate, which performs a singlecanonical broad audit over a Rust codebase. The system emits a locked assurance score(dsfb-assurance-score-v1) with visible subscores, structured findings, and multiple ex-port formats including SARIF, in-toto, and DSSE. These outputs are designed to supporthuman review, supply-chain attestation workflows, and standards- or certification-orientedinterpretation, without claiming compliance with any specific standard.Empirical results presented in this paper should be interpreted as constructibility evi-dence rather than comprehensive validation. The crate demonstrates deterministic execu-tion, reproducible artifact generation, and stable audit outputs across repeated runs. Theevaluation emphasizes transparency of scoring, traceability of findings, and consistency ofstructural interpretation rather than claims of optimal detection or superiority over existingstatic analysis tools.DSFB does not replace existing linting, static analysis, or formal verification methods,and makes no claim of completeness or certification. Its role is to augment them by providinga deterministic structural interpretation layer that organizes dispersed code-quality signalsinto a coherent, human-readable audit. The architecture preserves strict non-interferenceby operating purely in a read-only mode and enforcing #!forbid(unsafe code) withinthe crate implementation.This work should be understood as a prior-art and constructibility disclosure demon-strating that deterministic structural semiotic auditing of Rust codebases is feasible andimplementable. A fully validated, domain-general, and production-grade system would re-quire further research, expanded datasets, and dedicated funding. The contribution hereis to establish the method, its implementation viability, and its applicability across realcodebases, rather than to claim a completed solution.
Riaan De Beer (Thu,) studied this question.