From 688b5dc51959f145dd43ca34d75947066ec1fe61 Mon Sep 17 00:00:00 2001 From: karl Date: Tue, 13 Oct 2026 14:54:02 +0200 Subject: [PATCH] Specify coordinated worker resource and parent lifetime contract --- docs/EXTRACTION-ISOLATION.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/docs/EXTRACTION-ISOLATION.md b/docs/EXTRACTION-ISOLATION.md index 664a76c..8a40355 100644 --- a/docs/EXTRACTION-ISOLATION.md +++ b/docs/EXTRACTION-ISOLATION.md @@ -77,3 +77,26 @@ preservation, version/hash/location/size failures and truncated frames. Strict all-target Clippy, Rust formatting and diff checks passed. Product extraction defaults and code/text parsing are unchanged. No separate worker was launched; process isolation and resource ceilings remain open. + +## Worker and parent implementation contract + +The next slice adds a separate `searchi-extract-worker` binary and a shared-core +parent adapter. Neither changes indexing defaults until integration and packaging +are complete. The adapter owns the child and three bounded I/O tasks; its total +deadline covers input writes, response/diagnostic reads and process exit. Cancel, +timeout, resource failure and malformed protocol remain distinct failures. + +Windows uses a parent-owned Job Object with a 512-MiB process commitment limit +and kill-on-close. The parent assigns the job before writing input. The worker +reads only the four-byte frame prefix before checking current job membership and +limits, then admits the header/payload. Prefix arrival synchronizes job setup +without allowing document parsing first. It fails closed when protection is +missing. Unix applies address-space and CPU limits before input; actual macOS +semantics still require evidence. The proposed wall deadline is at most 30 s. + +The worker handles one request and no path arguments. Extra arguments/input, +wrong framing or an unprotected Windows launch fail explicitly. Successful +parsing or structured parser rejection must produce one bounded, flushed frame; +the parent independently checks EOF and exit status. None of these limits is a +filesystem/network sandbox or proof that every malicious parser input is safe. +The helper does not add arbitrary file reads or writes to its application API.