Safe Haskell trust revocation lacks runtime mechanism for expired credentials

Direct Answer

As of GHC 9.8, Safe Haskell does not provide a runtime mechanism to revoke or expire Trustworthy status. Trust is decided at compile time when the compiler accepts a module's {-# LANGUAGE Trustworthy #-} pragma and its dependency graph. Once compiled, the module remains trusted for the life of that artifact.

Confirmed Facts vs. Practical Workaround

Confirmed: Safe Haskell's safety model is static. The compiler checks that Safe modules only import other Safe or Trustworthy modules, and that Trustworthy modules do not export unsafe primitives. There is no flag, environment variable, or runtime check in GHC that can later withdraw that trust.

Practical workaround: You can approximate revocable trust by funnelling every unsafe primitive through a single Trustworthy wrapper module that consults a mutable runtime flag. This does not change the compiler's static trust decision, but it lets your program refuse to execute unsafe effects after a policy change.

Implementation Steps

1. Create a dedicated wrapper module, e.g. Guarded.Unsafe, marked Trustworthy.
2. Inside it, hold an IORef Bool (or MVar Bool) representing whether the capability is still active.
3. Export only guarded functions. Each function checks the flag before calling unsafePerformIO or similar primitives.
4. Provide a revoke :: IO () action that flips the flag to False.
5. For time-bounded trust, spawn a thread that sleeps for the desired interval and then calls revoke, or use System.Timeout.timeout around the guarded call.
6. Ensure every other Trustworthy module imports this wrapper and never imports GHC.Exts.unsafePerformIO directly.

module Guarded.Unsafe (guardedIO, revoke, initGuard) where

import Data.IORef
import GHC.Exts (unsafePerformIO)

trustRef :: IORef Bool
trustRef = unsafePerformIO $ newIORef True
{-# NOINLINE trustRef #-}

initGuard :: IO ()
initGuard = writeIORef trustRef True

revoke :: IO ()
revoke = writeIORef trustRef False

guardedIO :: IO a -> a
guardedIO act = unsafePerformIO $ do
  ok <- readIORef trustRef
  if ok then act else error "capability revoked"

Verification

• Compile the wrapper and consumers with -XSafe or -XTrustworthy and confirm no unsafe export leaks.
• At runtime, call guardedIO to produce an effect, call revoke, then call again; the second call must fail.
• Run ghc -ddump-mod-cycles on the Trustworthy consumer to confirm no direct unsafe import remains.

Migration and Deprecation Outlook

Because the wrapper pattern relies only on ordinary Haskell code, it survives the removal of Safe Haskell. If the GHC steering committee's deprecation proposal advances, the same module boundary remains useful; the safety guarantee simply shifts from the compiler to disciplined API design and code review.

Missing Diagnostic

Do any of your current Trustworthy modules import unsafePerformIO or other unsafe primitives directly? If yes, the wrapper alone is insufficient until those imports are refactored; if no, the pattern can be adopted incrementally.