zara-coding: bound persistent task-state cardinality and protocol reads #173

New issue

Closed

opened 2026-09-08 02:03:08 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-08 02:03:08 +00:00

Owner

Problem

The persistent Prolog-owned task-state slice introduced by #238 is intentionally long-lived. Per-command field sizes are bounded, but a service lifetime can still accumulate unbounded task/evidence records, and the Python protocol adapter currently checks response size only after readline() returns.

Slice

Harden the local zara-coding task-state boundary without adding new planning/runtime authority:

cap active task records in the persistent Prolog session;
cap verification evidence records per task and reject overflow deterministically;
bound stdout line reads before allocating an arbitrarily large response;
retain the closed fixed-operation JSON-line protocol;
deterministic RED tests first, including real SWI-Prolog coverage when available;
keep missing Prolog behavior honestly degraded;
registry/plugin/Nix/package gates must remain green.

This remains local #1 work and does not bypass Zara Core #400 cross-plugin composition.

## Problem The persistent Prolog-owned task-state slice introduced by #238 is intentionally long-lived. Per-command field sizes are bounded, but a service lifetime can still accumulate unbounded task/evidence records, and the Python protocol adapter currently checks response size only after `readline()` returns. ## Slice Harden the local `zara-coding` task-state boundary without adding new planning/runtime authority: - cap active task records in the persistent Prolog session; - cap verification evidence records per task and reject overflow deterministically; - bound stdout line reads before allocating an arbitrarily large response; - retain the closed fixed-operation JSON-line protocol; - deterministic RED tests first, including real SWI-Prolog coverage when available; - keep missing Prolog behavior honestly degraded; - registry/plugin/Nix/package gates must remain green. This remains local #1 work and does not bypass Zara Core #400 cross-plugin composition.

nsaspy closed this issue

2026-09-08 02:03:08 +00:00

nsaspy referenced this issue from a pull request that will close it,

2026-09-08 02:19:42 +00:00

registry: validate generated Python dependency metadata #394