zara-shell: stop coercing malformed runtime-bound config #143

New issue

Closed

opened 2026-09-08 02:03:04 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-08 02:03:04 +00:00

Owner

Problem

ZaraShellPlugin.start() coerces runtime bounds with float(...) and int(...) before constructing CommandPolicy. That bypasses the domain's strict type checks: for example max_output_bytes = true becomes integer 1, 1.5 truncates to 1, and boolean runtime values become numeric deadlines.

The plugin therefore accepts malformed operator policy instead of failing closed.

Scope

deterministic RED proving boolean/fractional byte limits are rejected at plugin config load;
reject boolean runtime deadlines and require finite positive numeric values;
require byte limits to already be positive integers, with no string/fractional/bool coercion;
preserve valid integer/float configuration and current defaults;
focused shell config tests plus full compatibility/registry/Nix package gates.

No cancellation implementation; Zara Core #388 remains the cancellation boundary.

## Problem `ZaraShellPlugin.start()` coerces runtime bounds with `float(...)` and `int(...)` before constructing `CommandPolicy`. That bypasses the domain's strict type checks: for example `max_output_bytes = true` becomes integer `1`, `1.5` truncates to `1`, and boolean runtime values become numeric deadlines. The plugin therefore accepts malformed operator policy instead of failing closed. ## Scope - deterministic RED proving boolean/fractional byte limits are rejected at plugin config load; - reject boolean runtime deadlines and require finite positive numeric values; - require byte limits to already be positive integers, with no string/fractional/bool coercion; - preserve valid integer/float configuration and current defaults; - focused shell config tests plus full compatibility/registry/Nix package gates. No cancellation implementation; Zara Core #388 remains the cancellation boundary.

nsaspy

2026-09-08 02:03:04 +00:00