Files
orca/config/scripts
NeilandOrca 86d4c2b66b refactor(memory-safety): scope bounds to wired ingress and add a ratchet
Audit of the merged OOM foundation found 13 modules with no production
consumer and BoundedMap with none at all: the bounds landed ahead of the
code that uses them.

- Delete the 13 unwired modules; they return with the slice that consumes them.
- Migrate secure-path-hardening-cache, github/conflict-summary-cache and
  runtime/orca-runtime onto BoundedMap, deleting both duplicate
  setBoundedMapEntry helpers so the primitive is net-negative on lines.
- Move the six generic primitives to src/shared/memory-safety/ with a README
  stating the bound-at-ingress doctrine; domain limits stay with their domain.
- Add check:bounded-ingress, a baseline-locked ratchet that fails new
  unbounded readFile/response body/JSON.parse/fan-out unless it uses a
  memory-safety helper or carries a bounded-by: justification.

Co-authored-by: Orca <help@stably.ai>
2026-07-25 23:43:51 -07:00
..
2026-05-15 05:44:25 -04:00