Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

ENCRUST: Encapsulated Substitution and Agentic Refinement on a Live Scaffold for Safe C-to-Rust Translation

Hohyun Sim, Hyeonjoong Cho, Ali Shokri, Zhoulai Fu, Binoy Ravindran

Abstract

We present Encapsulated Substitution and Agentic Refinement on a Live Scaffold for Safe C-to-Rust Translation, a two-phase pipeline for translating real-world C projects to safe Rust. Existing approaches either produce unsafe output without memory-safety guarantees or translate functions in isolation, failing to detect cross-unit type mismatches or handle unsafe constructs requiring whole-program reasoning. Furthermore, function-level LLM pipelines require coordinated caller updates when type signatures change, while project-scale systems often fail to produce compilable output under real-world dependency complexity. Encrust addresses these limitations by decoupling boundary adaptation from function logic via an Application Binary Interface (ABI)-preserving wrapper pattern and validating each intermediate state against the integrated codebase. Phase 1 (Encapsulated Substitution) translates each function using an ABI-preserving wrapper that splits it into two components: a caller-transparent shim retaining the original raw-pointer signature, and a safe inner function targeted by the LLM with a clean, scope-limited prompt. This enables independent per-function type changes with automatic rollback on failure, without coordinated caller updates. A deterministic, type-directed wrapper elimination pass then removes wrappers after successful translation. Phase 2 (Agentic Refinement) resolves unsafe constructs beyond per-function scope, including static mut globals, skipped wrapper pairs, and failed translations, using an LLM agent operating on the whole codebase under a baseline-aware verification gate. We evaluate Encrust on 7 GNU Coreutils programs and 8 libraries from the Laertes benchmark, showing substantial unsafe-construct reduction across all 15 programs while maintaining full test-vector correctness.

ENCRUST: Encapsulated Substitution and Agentic Refinement on a Live Scaffold for Safe C-to-Rust Translation

Abstract

We present Encapsulated Substitution and Agentic Refinement on a Live Scaffold for Safe C-to-Rust Translation, a two-phase pipeline for translating real-world C projects to safe Rust. Existing approaches either produce unsafe output without memory-safety guarantees or translate functions in isolation, failing to detect cross-unit type mismatches or handle unsafe constructs requiring whole-program reasoning. Furthermore, function-level LLM pipelines require coordinated caller updates when type signatures change, while project-scale systems often fail to produce compilable output under real-world dependency complexity. Encrust addresses these limitations by decoupling boundary adaptation from function logic via an Application Binary Interface (ABI)-preserving wrapper pattern and validating each intermediate state against the integrated codebase. Phase 1 (Encapsulated Substitution) translates each function using an ABI-preserving wrapper that splits it into two components: a caller-transparent shim retaining the original raw-pointer signature, and a safe inner function targeted by the LLM with a clean, scope-limited prompt. This enables independent per-function type changes with automatic rollback on failure, without coordinated caller updates. A deterministic, type-directed wrapper elimination pass then removes wrappers after successful translation. Phase 2 (Agentic Refinement) resolves unsafe constructs beyond per-function scope, including static mut globals, skipped wrapper pairs, and failed translations, using an LLM agent operating on the whole codebase under a baseline-aware verification gate. We evaluate Encrust on 7 GNU Coreutils programs and 8 libraries from the Laertes benchmark, showing substantial unsafe-construct reduction across all 15 programs while maintaining full test-vector correctness.

Paper Structure

This paper contains 65 sections, 2 equations, 1 figure, 7 tables.

Table of Contents

  1. Introduction
  2. Verification scope.
  3. Transformation scope.
  4. Encrust.
  5. Related Work
  6. Rule-Based C-to-Rust Transpilation
  7. LLM-Based C-to-Rust Translation
  8. Function-Level Translation
  9. Project-Scale Translation
  10. ENCRUST
  11. Phase 1: Encapsulated Substitution
  12. Preprocessing
  13. Decomposition.
  14. Translation ordering.
  15. C-to-Rust source mapping.
  16. ...and 50 more sections

Figures (1)

  • Figure 1: Encrust two-phase translation pipeline. Phase 1 (left): for each function, the LLM generates a wrapper/safe-function pair verified through a compile-and-test loop; successfully translated pairs are collected into rust_safe/. After all functions are translated, type-directed wrapper elimination rewrites call sites to invoke safe functions directly, yielding a wrapper-free crate rust_safe_remap/. Phase 2 (right): an LLM agent equipped with 17 tools resolves the unsafe patterns deferred from Phase 1---static mut globals, unsafe-cast wrapper pairs, failed struct translations, and functions that exhausted the per-function retry budget---through an iterative loop governed by a compile-and-test verification gate.

Theorems & Definitions (3)

  • Definition 1: Safe Struct Abstraction
  • Definition 2: Wrapper Pattern
  • Claim 1: Verification Gate Soundness