Static read-through audit of plugins/sector-battery (the sector treated as the reference implementation). No production-readiness or security issues (no unsafe/panics reachable, validate_input gates all logic). Two verified findings.
1. Recycled-content Phase-1 scoping is incomplete
Location: src/lib.rs:126
Issue: The only exclusion applied is !batteryType.eq_ignore_ascii_case("portable"). The shared rules crate this plugin depends on (dpp-rules/src/batteries/recycled_content.rs:4-7,94-95) explicitly documents that Annex X Phase-1 (2031 targets) covers only EV/SLI/industrial batteries >2 kWh, and LMT batteries don't join until Phase-2 (2036) — scoping is "the caller's responsibility."
Failure scenario: An LMT battery (e.g. e-bike/e-scooter cell) or a small industrial battery ≤2 kWh incorrectly receives a "below the EU 2023/1542 Annex X Phase-1 minimum (binding from 18 Aug 2031)" advisory — a factually wrong compliance claim surfaced to the manufacturer. No test exercises the LMT case.
2. Chemistry-conflict check exists in the dependency but isn't wired in
Location: src/lib.rs:94-192
Issue: calculate_metrics never calls dpp_rules::batteries::recycled_content::recycled_content_chemistry_conflicts, a function purpose-built to flag chemically-impossible declarations (e.g. positive cobalt content on an LFP cell, which contains no cobalt).
Failure scenario: A contradictory declaration is silently accepted, folded into the mean, and passed through verbatim by generate_passport with no advisory — in what's meant to be the reference implementation for other sector plugins.
Static read-through audit of
plugins/sector-battery(the sector treated as the reference implementation). No production-readiness or security issues (no unsafe/panics reachable, validate_input gates all logic). Two verified findings.1. Recycled-content Phase-1 scoping is incomplete
Location:
src/lib.rs:126Issue: The only exclusion applied is
!batteryType.eq_ignore_ascii_case("portable"). The shared rules crate this plugin depends on (dpp-rules/src/batteries/recycled_content.rs:4-7,94-95) explicitly documents that Annex X Phase-1 (2031 targets) covers only EV/SLI/industrial batteries >2 kWh, and LMT batteries don't join until Phase-2 (2036) — scoping is "the caller's responsibility."Failure scenario: An LMT battery (e.g. e-bike/e-scooter cell) or a small industrial battery ≤2 kWh incorrectly receives a "below the EU 2023/1542 Annex X Phase-1 minimum (binding from 18 Aug 2031)" advisory — a factually wrong compliance claim surfaced to the manufacturer. No test exercises the LMT case.
2. Chemistry-conflict check exists in the dependency but isn't wired in
Location:
src/lib.rs:94-192Issue:
calculate_metricsnever callsdpp_rules::batteries::recycled_content::recycled_content_chemistry_conflicts, a function purpose-built to flag chemically-impossible declarations (e.g. positive cobalt content on an LFP cell, which contains no cobalt).Failure scenario: A contradictory declaration is silently accepted, folded into the mean, and passed through verbatim by
generate_passportwith no advisory — in what's meant to be the reference implementation for other sector plugins.