Repository navigation
docs: 2.0 error contract (0250) and untrusted-input mode tasks - #584
Merged
Merged
Conversation
File the tasks from the untrusted-input review with Ruslan's decisions
(S1-S8): Settings::Limits, per-operation size checks, bounded template
cache, hardening by default with throwing invariant checks, a confined
filesystem loader, fuzz targets for untrusted templates, and additive
follow-ups. Link 0097, 0098 and 0224 to them; add a replace('') filter
divergence to 0107.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013xuF18HHo2XvFRnjsqpvFt
Ruslan approved the recommended options (2026-10-18). Write the contract as docs/api-2.0.md section 2.1, keep the plan in docs/design, and file P1 (public types and boundary), P2 (render locations) and P3 (engine runtime error codes). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013xuF18HHo2XvFRnjsqpvFt
rmorozov
changed the title
rmorozov
marked this pull request as ready for review
October 18, 2026 12:27
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013xuF18HHo2XvFRnjsqpvFt
Member
Author
|
@codex review Generated by Claude Code |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f9bd4a7c2b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Rule 2 names the caller-stream exception of rule 3; GetException() is set for exceptions thrown outside the template engine, including the public headers' host-data conversion; 0266 validates what is opened (descriptor or handle walk) instead of a resolved path, closing the check/use race. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013xuF18HHo2XvFRnjsqpvFt
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Ruslan · project thread
Before: the public API had no written error contract, and there was no plan for hosts that render templates written by their users.
After:
Error contract (0250). docs/api-2.0.md §2.1 states the contract Ruslan approved on 2026-10-18:
Result. Only system out-of-memory escapes asbad_alloc, plus a failure of a caller stream whose exception mask the caller enabled.noexceptsibling.jinja2::Exceptionand codes 15-18.ErrorInfobecomes one pointer to a shared payload that keeps the original exception.std::error_codeinterop.The plan is in docs/design/0250-error-contract-plan.md. Phases: 0253 (P1, freeze-critical), 0254 (P2), 0255 (P3).
Untrusted input (Ruslan's decisions S1-S8):
Settings::Limitswith presets (freeze-critical)MemoryFileSystemconst pathConfinedFileSystem, using descriptor/handle-based traversal0097, 0098 and 0224 link to these tasks. 0107 gains a
replace('')filter divergence. 0253 also updates REVIEW.md's error-boundary rule.How: docs only. 0250's own task file is in #573, now merged; P1 (#597) marks it done. The task index is regenerated by the merge steward.
Roles: architect (two reviews: the error contract and untrusted input). No verifier (docs only). Red pushes: none. Codex: 3 findings, 3 fixed, 0 declined (stream exception in rule 2,
GetException()presence rule, symlink check/use race in 0266).🤖 Generated with Claude Code
https://claude.ai/code/session_013xuF18HHo2XvFRnjsqpvFt