trust

Trust

A strict Rust dialect for the bugs LLMs actually ship.

Agents write Rust that compiles, type-checks, and reviews clean — then ships a small, predictable set of bugs: positional arguments in the wrong order, .unwrap() in production paths, as casts that silently truncate, glob imports. Add strict = true to Cargo.toml (or #![strict] to a file) and those become compile errors with a fix in the message. In our eval, 60% of agent-authored files shipped one of these bugs in plain Rust; 0% shipped under Trust — across four models from three vendors.

What Trust is

Trust is a strict dialect of Rust — a thin layer that turns the bugs agents ship (wrong argument order, .unwrap(), silent as casts) into compile errors with a fix in the message, caught in one pass before the code ever runs. That dialect is the product, and it's what the eval numbers measure: 60% of agent files shipped a bug in plain Rust, 0% under the dialect.

You can run it two ways — but they are not equals:

1. The dialect — a build gate. Opt in via Cargo.toml, build with cargo trustc, and the full rule set — including named-argument enforcement (R0042), the rule that makes the argument-swap bug unrepresentable — is enforced at compile time. This is Trust.
2. An advisory linter — an on-ramp. Not ready to change how you build? Point the trust CLI at existing plain Rust and it reports the subset of rules that work without the dialect — zero commitment, partial value, a way to see what Trust catches before you switch the build over. It cannot enforce R0042, and it reports rather than blocks.

Install

# The dialect (the build gate) — the CLI, the cargo subcommand, and the two
# lowering shims (cargo doesn't install a dependency's binaries):
cargo install trust-lang cargo-trustc trust-rustc trust-rustdoc

# Or just the advisory linter — only the `trust` CLI (the crate is `trust-lang`):
cargo install trust-lang

All four crates are published on crates.io (latest: 0.2.0); MSRV is Rust 1.85. Building from source also works — see From source below.

The dialect — two steps

# Cargo.toml
[package.metadata.trust]
strict = true

cargo trustc build    # also: run, test, check, clippy, doc, bench

That's the whole setup. cargo trustc wires the lowering shims into cargo itself — no environment variables, no per-file markers, no extra dependencies — and enforces the full rule set at build time: the syntax extensions lower, and every strict lint (.unwrap(), as-casts, positional args, …) is a build error with a fix in the message. Dependencies are never touched. [workspace.metadata.trust] strict = true opts in a whole workspace at once. Because the opt-in lives in Cargo.toml metadata (which stock cargo ignores), every source file stays a valid plain cargo build — nothing in your .rs files changes.

Try it first — the advisory linter

New to Trust, or not ready to change your build? Run the bug-catching rules over your existing plain Rust — no marker, no metadata, no dialect:

trust check --rules bugs  src/     # the runtime-bug rules
trust check --rules safety src/    # every rule that applies to plain Rust

trust check takes a file, a directory, or a Cargo.toml and walks the tree — one command, CI-ready (non-zero exit on findings). Nothing is added to your source, so it can't break a normal cargo build. Tune it in a trust.toml:

# trust.toml — at the project root
rules = "bugs"          # default selection (--rules overrides)
allow = ["R0012"]       # dropped project-wide
warn  = ["R0017"]       # kept, but a non-failing warning

Emit --format json (agent-native) or --format sarif (GitHub code-scanning); trust fix <file> --safety rewrites .unwrap()/.expect(…) → ?. Mind the ceiling, though: advisory mode reports a subset and cannot enforce R0042 (named arguments) — the rule that prevents the argument-swap bug and the strongest result in the eval. For one-pass enforcement rather than after-the-fact reports, you need the dialect above. The advisory linter is the doorway; the dialect is the room.

What it looks like

The bug class Trust catches most reliably is positional argument order. A model that defines make_rect(width, height) will, three files later, call it make_rect(height, width). Nothing downstream notices.

// Plain Rust — compiles, ships the swap.
let area = make_rect(height, width);