fix: security & reliability hardening from the 2026-07-10 review (P2-1, P0-4, P0-3, P1-7)#101

Merged

shoom1 merged 22 commits into

fix/review-hardening-2026-07

Jul 11, 2026

Commits on Jul 10, 2026

Commits on Jul 11, 2026

fix(review2): close residuals from the branch re-review (P0-3, P0-4)
shoom1
committed
fix(document): anchor option-like source filename (P0-3 critical)
shoom1
committed
fix(document): build in a private temp dir, isolate intermediates (P0-3)
shoom1
committed
fix(document): tail-read the compiler .log instead of whole file (P0-3)
shoom1
committed
test(document_compile): add OSError coverage and tighten log-tail bound
shoom1
committed
fix(document): cap captured subprocess output in _run (P0-3)
shoom1
committed
fix(document.compile): assert SIGKILL on timeout, rename capture-limit to bytes, tighten test slack
shoom1
committed
fix(document): exact TEXMF env allowlist instead of prefix (P0-3)
shoom1
committed
fix(tools): pre-limit scan/size ceilings for glob and grep (P0-4)
shoom1
committed
chore: stop tracking AGENTS.md
shoom1
committed
fix(document.compile): absolute TEXINPUTS roots, ignore_cleanup_errors, delivery pdf_path=None
shoom1
committed
test(document): fix gated LaTeX test for the temp-build isolation contract
shoom1
committed
fix(grep): don't let directories consume the file budget; report scan truncation (P0-4)
shoom1
committed
fix(document): cap TeX child file size and CPU (RLIMIT_FSIZE/CPU) (P0-3)
shoom1
committed
fix(grep): bound ripgrep output to a temp file + capped read (P0-4)
shoom1
committed