cargo-vet Methodology
How Thirdpass turns package review coverage into cargo-vet audit evidence.
This page explains how Thirdpass turns file-level review coverage for a crates.io package archive into a cargo-vet audit entry.
Thirdpass publishes those entries in the public audit repo: https://github.com/thirdpass-org/cargo-vet-audits
cargo-vet lets Rust projects track audit evidence for the crate versions they depend on. Projects can import audit repositories and decide in their own policy which evidence is enough for their dependencies.
The Thirdpass audit repo records that, for a given crate version, every file in the crates.io archive was reviewed with the Thirdpass file-focused review procedure.
Criterion
In cargo-vet, a criterion is the named audit result recorded for a crate
version. The Thirdpass audit repo uses the criterion name
thirdpass-full-crate-archive-reviewed/v1.
That criterion means every file in the crate archive manifest has Thirdpass
review coverage under the procedure below. It is not cargo-vet safe-to-run or
safe-to-deploy unless an importing project chooses to map it to one of those
meanings in its own policy.
File-Focused Review
The review procedure reference is file-focused-review/v1.
Thirdpass review evidence is produced file by file. cargo-vet audit entries are crate-level. When accepted file reviews cover every file listed in the crate archive manifest, Thirdpass can export a crate-level cargo-vet audit for that package version.
For the underlying review procedure, see Review Procedure. For the commands that produce shared coverage, see Review Commands.
Inclusion Rules
Thirdpass emits a package-level cargo-vet audit only when accepted review records cover every file in the authoritative crates.io package archive manifest. The manifest lists the regular files in the crate archive.
A crate version is included only when:
- accepted reviews match the crate archive hash
- accepted reviews match the reviewed file hashes
- accepted reviews cover every manifest file
- file count is complete, with line and byte totals matching the manifest coverage calculation
- the export has no pending or unreviewed manifest work for that crate version
Evidence
Each audit note links to a machine-readable evidence file. The evidence exists so readers and AI agents can examine the review judgment, challenge it, and decide how much weight to give it.
The evidence records structured review output, not raw agent transcripts. It includes:
- the crate target and package hash
- the archive manifest inventory
- reviewed file paths and file hashes
- review records and review summaries
- procedure version
- agent name, model, and reasoning effort for each review
- runtime and token metrics when the review records reported them
- a link back to the Thirdpass review page
The audit note summarizes the review procedure, agent runs, metric availability, review counts, package hash, Thirdpass review page, and evidence file path.
Review Provenance
A single crate version may be covered by multiple accepted review records. Those records may have been produced with different agent names, models, or reasoning efforts.
The cargo-vet audit note summarizes those combinations. The evidence file keeps the per-review detail, so readers can see which agent configuration produced which file review.
Using The Criterion
Projects importing the Thirdpass cargo-vet audit repository decide how to treat
thirdpass-full-crate-archive-reviewed/v1 in their own cargo-vet policy.
The criterion is evidence-oriented. It says Thirdpass has reviewed every file in the crate archive manifest under the referenced procedure. It does not by itself claim that the crate is safe to run or safe to deploy.