Codebase Audit Checklist

Quick health audit before acquisition, on-call rotation, or major refactor.

How to Use This Checklist

• Score unchecked items as debt with severity.
• Run quarterly on production services.
• Pair with cargo audit, clippy, coverage report.

Build and Dependencies

1. Toolchain pinned - rust-toolchain.toml matches CI 1.97.0.
2. Cargo.lock committed for apps.
3. cargo audit clean or documented exceptions.
4. No yanked crates in lockfile.
5. Duplicate dependency majors tracked (cargo tree -d).

Code Quality

6. clippy -D warnings passes on main.
7. fmt --check passes.
8. unwrap count trending down (rg 'unwrap\(' --type rust).
9. unsafe isolated and documented.
10. TODO/FIXME have owners and dates.

Architecture

11. Domain crate free of axum/sqlx imports.
12. Handlers under ~50 lines or extracted services.
13. Errors typed not strings at boundaries.
14. Config validated at startup.
15. Migrations versioned and applied in deploy pipeline.

Operations

16. Health and readiness endpoints exist.
17. Graceful shutdown tested.
18. Structured logs with trace/request ids.
19. Metrics for latency and error rate.
20. Runbooks linked from README.

FAQs

Related

• Architecture Decision Checklist
• Refactoring Decisions
• Dependency Management
• Linting & Formatting Best Practices

External Related Links

• Clippy Book / Lints - Official linter documentation.
• The Cargo Book - Official guide and reference for Cargo.
• docs.rs - Automatic documentation hosting for every crate on crates.io.
• Rust for Rustaceans (Amazon) - Jon Gjengset.
• Rust in Action (Manning) - Tim McNamara.

Stack versions: This page was written for Rust 1.97.0 (edition 2024), Tokio 1.x, Axum 0.8, serde 1.0, sqlx 0.8, clap 4, and Polars 0.46+.