kobako 0.12.2-x86_64-linux → 0.14.0-x86_64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 425bd29857c91850c1d3920343c44f11dbc425988cd4fb6c400ba638b8b02b1f
-  data.tar.gz: 1472552c0062fa1af7879f5e07a9ae54eaa74419ca7c66c6a253607b95388625
+  metadata.gz: 8fd7f2d9247b940469cb3b45486bec1c9a935e8ded2e84db54ac13604103f1b1
+  data.tar.gz: 29d14df5c7b29841036368eb5f4285b8d4d5e00e3eec7e145752836bae71fe6d
 SHA512:
-  metadata.gz: 7f6faee72e9e29f491d08a8b2d08430127fc1da78aac834a09dccd833ab97f13cb26cd7360e9b6ce9ec323599152a57d8bdb38d744a968e0eadb7a7a3b0296d9
-  data.tar.gz: c425b0a041be572adf2f66faae10a66a38efce1142399d343d9c86e09308537a577a76f3a5399a3282319c3559970e8a9bb9a638c26cc6633a69998b2bf05630
+  metadata.gz: 198273370c7a5824f60acc112db2f1c2c57601ce0dc3b8573f07d7faacda7cf1bb7e017b84252c1fd43a09b726a66e7573e735d3a7e695fe6fa22c718f31cd7e
+  data.tar.gz: 243fc682f59f7852d88fae9d79aee94cf254312666f4bdb8688188ba6de415eac9f5fade45c5009e67aae2e8df186f87cd932edd71478591313170e6d202f785

data/.release-please-manifest.json

@@ -1 +1 @@
-{".":"0.12.2","wasm/kobako-core":"0.6.1","wasm/kobako":"0.6.1","wasm/kobako-io":"0.6.1","wasm/kobako-json":"0.6.1","wasm/kobako-regexp":"0.6.1","wasm/kobako-baker":"0.6.1","crates/kobako-runtime":"0.6.1","crates/kobako-wasmtime":"0.6.1"}
+{".":"0.14.0","wasm/kobako-core":"0.8.0","wasm/kobako-mruby":"0.8.0","wasm/kobako-io":"0.8.0","wasm/kobako-json":"0.8.0","wasm/kobako-regexp":"0.8.0","wasm/kobako-baker":"0.8.0","crates/kobako-codec":"0.8.0","crates/kobako-runtime":"0.8.0","crates/kobako-wasmtime":"0.8.0","crates/kobako":"0.8.0"}

data/CHANGELOG.md

@@ -1,5 +1,46 @@
 # Changelog
 
+## [0.14.0](https://github.com/elct9620/kobako/compare/v0.13.0...v0.14.0) (2026-07-08)
+
+
+### Features
+
+* **codec:** add the Run invocation envelope to the wire tier ([dbdd760](https://github.com/elct9620/kobako/commit/dbdd760ddc258681669f7f620f63b75f36322687))
+* **crates:** add the kobako host SDK skeleton ([8a99d09](https://github.com/elct9620/kobako/commit/8a99d09ef7068a6738d44f1a735d39516b24156b))
+* **crates:** add the parity runner to the kobako SDK ([998f059](https://github.com/elct9620/kobako/commit/998f059abd308ef921c295658aaf8377febb44e2))
+* **crates:** grow the SDK capability-Handle table ([f93fe8f](https://github.com/elct9620/kobako/commit/f93fe8f3dce2509cfa527229f8f593f4d816b940))
+* **crates:** grow the SDK Member block-yield seam ([4404713](https://github.com/elct9620/kobako/commit/44047130f309a2c935198077fb4f7f86839355e7))
+* **crates:** grow the SDK preload and run invocation seams ([d8d5fe2](https://github.com/elct9620/kobako/commit/d8d5fe268a56d45dad4f8b35a25e942a559dcd5f))
+* **crates:** honor the respond_to_guest narrowing on the SDK Member seam ([0f5eff1](https://github.com/elct9620/kobako/commit/0f5eff16a1e9f2229ad9d9c9316bf94e92035301))
+* **crates:** let a resolved Handle recover its concrete member type ([abd5502](https://github.com/elct9620/kobako/commit/abd55029a44a7631d323c3aec3b625d9692f9c5b))
+* **crates:** mark the SDK Error taxonomy non_exhaustive ([001fc69](https://github.com/elct9620/kobako/commit/001fc69e637d2c046f55cb517f9d9cf931793715))
+* **examples:** add the guest→host dispatch half to the Rust host ([5cdde68](https://github.com/elct9620/kobako/commit/5cdde68824352c5685aaa94ae464e909705a4648))
+* **examples:** assemble a minimal Rust host on the published crates ([6b98680](https://github.com/elct9620/kobako/commit/6b98680bcb625f9790f44df839035427a576e266))
+* **tasks:** add a rails-stats-style rake stats size report ([c02d530](https://github.com/elct9620/kobako/commit/c02d530d43a85594323b7801fdbe75aa95ae7f8c))
+* **tasks:** gate parity coverage over the CORE anchor manifest ([d26972c](https://github.com/elct9620/kobako/commit/d26972c1ad51e05df951643e17d66a6c811ba862))
+
+
+### Bug Fixes
+
+* **crates:** give SetupError a Display so Error::Setup reads cleanly ([bc8b128](https://github.com/elct9620/kobako/commit/bc8b128c9e296319c7fef47441b412d2ce345dff))
+* **crates:** keep the no-timeout epoch deadline within range ([a3255df](https://github.com/elct9620/kobako/commit/a3255df98a77825bb39b571a60fe6ff83d269d19))
+* **crates:** reject trailing bytes on Request and Run decode ([8e4929b](https://github.com/elct9620/kobako/commit/8e4929b64f3ea690f38211888070c2511da84754))
+* **lib:** close the Data #with seam on Handle construction ([c0b50ae](https://github.com/elct9620/kobako/commit/c0b50aec659e32a72c905aaf94c939ac009ad621))
+* **release:** resume the gem push loop past already-live versions ([170ee9b](https://github.com/elct9620/kobako/commit/170ee9bae6da3a65b4016040259e31e4721dfcfb))
+* **release:** treat a yanked-only version as unpublished when publishing ([3111cc0](https://github.com/elct9620/kobako/commit/3111cc072a7c9d18b129fd2762f267d855b48d55))
+* **transport:** fold fault messages to UTF-8 before they ride the wire ([0be8d40](https://github.com/elct9620/kobako/commit/0be8d4068dc5647f86746e80b356b0b9d52051f7))
+
+## [0.13.0](https://github.com/elct9620/kobako/compare/v0.12.2...v0.13.0) (2026-07-03)
+
+
+### Features
+
+* **crates:** build the requested isolation profile into the WASI context ([63c25d8](https://github.com/elct9620/kobako/commit/63c25d835d4d03010c1658217cee412318e6b5d8))
+* enforce the isolation-profile floor at Sandbox construction ([73f0dfe](https://github.com/elct9620/kobako/commit/73f0dfe34a144045a559a28caec31468351de64a))
+* forward the Sandbox profile request through the ext to the driver ([f47f906](https://github.com/elct9620/kobako/commit/f47f9063aa56462be023f5c76cbc73db6e4315ad))
+* keep guest output readable after a trap ([464454c](https://github.com/elct9620/kobako/commit/464454cd774db96ad72b3787007f2ce015673587))
+* **runtime:** runtimes declare their isolation profile ([f89717a](https://github.com/elct9620/kobako/commit/f89717a6bc9809f0de0df78f97da33a49a1474ac))
+
 ## [0.12.2](https://github.com/elct9620/kobako/compare/v0.12.1...v0.12.2) (2026-07-02)
 
 

data/README.md

@@ -154,6 +154,8 @@ sandbox = Kobako::Sandbox.new(
 
 `memory_limit` covers the per-invocation `memory.grow` delta from the entry baseline, so a Sandbox reused across invocations does not silently accumulate against a global budget.
 
+A fifth option, `profile:`, requests the Sandbox's isolation posture on the `:permissive` < `:hermetic` ladder (default `:hermetic`). `:hermetic` denies the guest ambient time and entropy; `:permissive` lets the guest's `wasi:clocks` / `wasi:random` read live host sources — an explicit trade of reproducibility, with filesystem, environment, and network still unreachable. The request is also a floor: construction fails with `Kobako::SetupError` on a runtime that declares a weaker posture than requested. See [`docs/security-model.md`](docs/security-model.md) § Isolation profiles.
+
 ### Invocation Lifecycle
 
 One Sandbox serves many invocations. Service bindings and preloaded snippets persist across calls; capability state (Handles, stdout, stderr, memory delta) resets between them.
@@ -300,10 +302,10 @@ sandbox.run(:Greeter, name: "world") # => "hello, world"
 
 | Form     | Signature                            | Snippet name source                   | Validation timing                                                          |
 |----------|--------------------------------------|---------------------------------------|----------------------------------------------------------------------------|
-| Source   | `preload(code: "...", name: :Const)` | The `name:` keyword                   | Trial-compiled at preload; compile errors raise immediately                |
-| Bytecode | `preload(binary: bytes)`             | Read from the bytecode's `debug_info` | Deferred to first invocation; failure raises `Kobako::BytecodeError`       |
+| Source   | `preload(code: "...", name: :Const)` | The `name:` keyword                   | First invocation's replay; compile errors raise `Kobako::SandboxError`     |
+| Bytecode | `preload(binary: bytes)`             | Read from the bytecode's `debug_info` | First invocation's replay; structural failure raises `Kobako::BytecodeError` |
 
-Use the source form for snippets authored in your repo (compile errors fail fast at `#preload`); use the bytecode form when snippets ship as build artifacts from a separate `mrbc` pipeline. Both replay through the same per-invocation path.
+Use the source form for snippets authored in your repo; use the bytecode form when snippets ship as build artifacts from a separate `mrbc` pipeline. Both replay through the same per-invocation path, so no snippet content failure surfaces at `#preload` — force the first replay with a no-op invocation (e.g. `sandbox.eval("nil")`) when you want validation before real traffic.
 
 ## Security
 

data/ROADMAP.md

@@ -0,0 +1,26 @@
+# Roadmap
+
+kobako is a Ruby gem providing an in-process Wasm sandbox for untrusted mruby
+code: a wasmtime host runs a precompiled `kobako.wasm` guest, with host↔guest
+Transport over a MessagePack wire. Features cover one-shot `#eval`, preload +
+`#run` dispatch, Service injection through Namespaces / Members, opaque
+Capability Handles, block yield re-entry, three-class error attribution,
+output capture, and a warm Sandbox pool.
+
+| Feature | Entry Points | Notes |
+|---------|-------------|-------|
+| ✅ [F-01 Sandbox instantiation](docs/behavior/lifecycle.md) | [lib/kobako/sandbox.rb](lib/kobako/sandbox.rb) | B-22 (per-Thread isolation) is exercised only indirectly through the pool contention tests; no test cites it |
+| ✅ [F-02 Namespace declaration](docs/behavior/registration.md) | [lib/kobako/catalog/namespaces.rb](lib/kobako/catalog/namespaces.rb) | — |
+| ✅ [F-03 Member binding](docs/behavior/registration.md) | [lib/kobako/namespace.rb](lib/kobako/namespace.rb) | — |
+| ✅ [F-04 Synchronous mruby source execution (`#eval`)](docs/behavior/lifecycle.md) | [lib/kobako/sandbox.rb](lib/kobako/sandbox.rb) | — |
+| ✅ [F-05 Guest-initiated Transport dispatch](docs/behavior/dispatch.md) | [lib/kobako/transport/dispatcher.rb](lib/kobako/transport/dispatcher.rb) | — |
+| ✅ [F-06 Capability Handle encoding and referencing](docs/behavior/dispatch.md) | [lib/kobako/catalog/handles.rb](lib/kobako/catalog/handles.rb) | — |
+| ✅ [F-07 Three-class error attribution and raising](docs/behavior/errors.md) | [lib/kobako/outcome.rb](lib/kobako/outcome.rb) | E-26 (guest-entry envelope decode failure) has no exercising test — not reachable through the public API |
+| ✅ [F-08 Guest output capture](docs/behavior/lifecycle.md) | [lib/kobako/capture.rb](lib/kobako/capture.rb) | — |
+| ✅ [F-09 Host–guest message codec](docs/wire-codec.md) | [lib/kobako/codec/](lib/kobako/codec/) | — |
+| ✅ [F-10 Reproducible build pipeline](SPEC.md#code-organization) | [tasks/wasm/build.rake](tasks/wasm/build.rake) | Verified by build-time gates (`rake anchors`, double-bake byte-identity, gemspec whitelist), not `test/` |
+| ✅ [F-11 Multi-layer test and benchmark suite](SPEC.md#testing-style) | [test/](test/) | Benchmarks live in [benchmark/](benchmark/) with the gate in `tasks/bench/`; the anchor baseline advances only by deliberate re-bless |
+| ✅ [F-12 Guest block reception and yield re-entry](docs/behavior/yield.md) | [lib/kobako/transport/yielder.rb](lib/kobako/transport/yielder.rb) | — |
+| ✅ [F-13 Snippet preloading (`#preload`)](docs/behavior/invocation.md) | [lib/kobako/catalog/snippets.rb](lib/kobako/catalog/snippets.rb) | — |
+| ✅ [F-14 Synchronous entrypoint dispatch (`#run`)](docs/behavior/invocation.md) | [lib/kobako/sandbox.rb](lib/kobako/sandbox.rb) | — |
+| ✅ [F-15 Warm Sandbox pool checkout (`Kobako::Pool`)](docs/behavior/runtime.md) | [lib/kobako/pool.rb](lib/kobako/pool.rb) | — |

data/crates/kobako-runtime/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## [0.8.0](https://github.com/elct9620/kobako/compare/kobako-runtime-v0.7.0...kobako-runtime-v0.8.0) (2026-07-08)
+
+
+### Bug Fixes
+
+* **crates:** give SetupError a Display so Error::Setup reads cleanly ([bc8b128](https://github.com/elct9620/kobako/commit/bc8b128c9e296319c7fef47441b412d2ce345dff))
+
+## [0.7.0](https://github.com/elct9620/kobako/compare/kobako-runtime-v0.6.1...kobako-runtime-v0.7.0) (2026-07-03)
+
+
+### Features
+
+* **crates:** build the requested isolation profile into the WASI context ([63c25d8](https://github.com/elct9620/kobako/commit/63c25d835d4d03010c1658217cee412318e6b5d8))
+* **runtime:** runtimes declare their isolation profile ([f89717a](https://github.com/elct9620/kobako/commit/f89717a6bc9809f0de0df78f97da33a49a1474ac))
+
 ## [0.6.1](https://github.com/elct9620/kobako/compare/kobako-runtime-v0.6.0...kobako-runtime-v0.6.1) (2026-07-02)
 
 

data/crates/kobako-runtime/README.md

@@ -26,7 +26,7 @@ map the neutral types onto their own language surface.
 
 ```toml
 [dependencies]
-kobako-runtime = "0.6.1" # x-release-please-version
+kobako-runtime = "0.8.0" # x-release-please-version
 ```
 
 ## License

data/crates/kobako-wasmtime/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## [0.8.0](https://github.com/elct9620/kobako/compare/kobako-wasmtime-v0.7.0...kobako-wasmtime-v0.8.0) (2026-07-08)
+
+
+### Bug Fixes
+
+* **crates:** keep the no-timeout epoch deadline within range ([a3255df](https://github.com/elct9620/kobako/commit/a3255df98a77825bb39b571a60fe6ff83d269d19))
+
+## [0.7.0](https://github.com/elct9620/kobako/compare/kobako-wasmtime-v0.6.1...kobako-wasmtime-v0.7.0) (2026-07-03)
+
+
+### Features
+
+* **crates:** build the requested isolation profile into the WASI context ([63c25d8](https://github.com/elct9620/kobako/commit/63c25d835d4d03010c1658217cee412318e6b5d8))
+* **runtime:** runtimes declare their isolation profile ([f89717a](https://github.com/elct9620/kobako/commit/f89717a6bc9809f0de0df78f97da33a49a1474ac))
+
 ## [0.6.1](https://github.com/elct9620/kobako/compare/kobako-wasmtime-v0.6.0...kobako-wasmtime-v0.6.1) (2026-07-02)
 
 

data/crates/kobako-wasmtime/README.md

@@ -24,7 +24,7 @@ SDK consumes the same surface.
 
 ```toml
 [dependencies]
-kobako-wasmtime = "0.6.1" # x-release-please-version
+kobako-wasmtime = "0.8.0" # x-release-please-version
 ```
 
 ## License

data/lib/kobako/catalog/handles.rb

@@ -95,7 +95,7 @@ module Kobako
         end
       end
 
-      # Guard {#alloc} against issuing an ID past the cap. Returns +nil+
+      # Guard #alloc against issuing an ID past the cap. Returns +nil+
       # on success; raises +Kobako::HandleExhaustedError+ at exhaustion.
       def ensure_capacity!
         cap = Kobako::Handle::MAX_ID
@@ -107,7 +107,7 @@ module Kobako
       end
 
       # Single source of truth for the "unknown Handle id" raise used by
-      # {#fetch}. Returns +nil+ on success; raises +Kobako::SandboxError+
+      # #fetch. Returns +nil+ on success; raises +Kobako::SandboxError+
       # when +id+ is not currently bound.
       def require_bound!(id)
         return if @entries.key?(id)

data/lib/kobako/catalog/namespaces.rb

@@ -71,7 +71,7 @@ module Kobako
       end
 
       # Encode the preamble as msgpack bytes for stdin Frame 1 delivery.
-      # Routes through {Kobako::Codec::Encoder} like every other host-side
+      # Routes through Kobako::Codec::Encoder like every other host-side
       # wire encode so there is a single codec path; the preamble carries
       # only Strings and Arrays, so none of the kobako ext types actually
       # fire. Structure: +[["Namespace", ["MemberA", "MemberB"]], ...]+.
@@ -106,7 +106,7 @@ module Kobako
         self
       end
 
-      # Returns +true+ when {#seal!} has been called, +false+ otherwise.
+      # Returns +true+ when #seal! has been called, +false+ otherwise.
       def sealed?
         @sealed
       end

data/lib/kobako/catalog/snippets.rb

@@ -43,7 +43,7 @@ module Kobako
       #
       # The bytes are memoized — the table is replayed verbatim on every
       # invocation after sealing, so Frame 3 never changes between
-      # encodes; {#register} drops the memo while the table is still open.
+      # encodes; #register drops the memo while the table is still open.
       # Unlike +Catalog::Namespaces#encode+, which gates its memo on the
       # seal, this one can fill eagerly and invalidate in +#register+
       # because every mutation funnels through that single method — there is

data/lib/kobako/codec/decoder.rb

@@ -12,23 +12,23 @@ module Kobako
     # ({docs/wire-codec.md}[link:../../../docs/wire-codec.md] § Type Mapping).
     #
     # Translates msgpack gem exceptions into the kobako error taxonomy
-    # ({Truncated}, {InvalidType}, {InvalidEncoding}, {UnsupportedType}) so
+    # (Truncated, InvalidType, InvalidEncoding, UnsupportedType) so
     # callers can pattern-match on the SPEC's wire-violation categories
     # without leaking the gem's internal exception classes.
     #
-    # Public API is a single function — {.decode}. The decoder is
+    # Public API is a single function — +.decode+. The decoder is
     # stateless; the +MessagePack::Unpacker+ instance is built per call
     # because callers always decode exactly one wire value at a time.
     module Decoder
       # Decode +bytes+ into one Ruby value and validate transitively
-      # against the SPEC type mapping. Raises {Truncated}, {InvalidType},
-      # or {InvalidEncoding} on wire violations.
+      # against the SPEC type mapping. Raises Truncated, InvalidType,
+      # or InvalidEncoding on wire violations.
       #
       # When a block is given, the decoded value is yielded and the block's
       # result is returned — wire Value Objects use this to build themselves
       # from the decoded payload. The block runs inside this method's
       # rescue, so a Value Object's +ArgumentError+ invariant failure
-      # surfaces as {InvalidType} without a separate {Utils.with_boundary}
+      # surfaces as InvalidType without a separate Utils.with_boundary
       # wrapper at the call site.
       def self.decode(bytes)
         value = Factory.load(bytes.b)
@@ -37,7 +37,7 @@ module Kobako
       # msgpack gem raises the format/type errors below; +ArgumentError+
       # comes from our ext-type validators (Handle id range, Exception type
       # whitelist) and from a yielded block's Value Object invariants — both
-      # are wire violations, so both map to {InvalidType}.
+      # are wire violations, so both map to InvalidType.
       rescue ::MessagePack::UnknownExtTypeError, ::MessagePack::MalformedFormatError,
              ::MessagePack::StackError, ::ArgumentError => e
         raise InvalidType, e.message
@@ -53,7 +53,7 @@ module Kobako
       # Encoding Rules). The msgpack gem returns UTF-8-tagged Strings for
       # str family but does not validate the bytes; +bin+ family decodes
       # to ASCII-8BIT. Walk the tree once and reject invalid UTF-8 in any
-      # str-typed leaf via {Utils.assert_utf8!}. {Kobako::Fault}
+      # str-typed leaf via Utils.assert_utf8!. Kobako::Fault
       # payloads are validated transitively: +Factory.unpack_fault+
       # feeds the inner ext-0x02 bytes back through this Decoder, so their
       # +str+ fields are already covered by the time control returns here.

data/lib/kobako/codec/encoder.rb

@@ -14,9 +14,9 @@ module Kobako
     # strings, arrays, and maps go through the gem's narrowest-encoding
     # logic; the three kobako-specific ext types (0x00 Symbol, 0x01
     # Capability Handle, 0x02 Exception envelope) are registered on
-    # the cached {Kobako::Codec::Factory} singleton.
+    # the cached Kobako::Codec::Factory singleton.
     #
-    # Public API is a single function — {.encode}. The codec is stateless;
+    # Public API is a single function — +.encode+. The codec is stateless;
     # there is no buffer accumulator and no streaming write API. Callers
     # that need to concatenate multiple encodings build the bytes
     # themselves.

data/lib/kobako/codec/error.rb

@@ -7,11 +7,11 @@ module Kobako
     # The wire codec implements the binary contract pinned in
     # {docs/wire-codec.md}[link:../../../docs/wire-codec.md] § Type Mapping.
     # Every wire violation surfaces as a
-    # subclass of {Error} so callers can pattern-match on the specific
+    # subclass of Error so callers can pattern-match on the specific
     # fault while still rescuing all codec faults via this base class.
     #
     # Higher layers (e.g. the Sandbox dispatch loop) translate these into
-    # the public {Kobako::SandboxError} / {Kobako::TrapError} taxonomy.
+    # the public Kobako::SandboxError / Kobako::TrapError taxonomy.
     class Error < StandardError; end
 
     # Input ended before the type prefix or payload was fully consumed.
@@ -21,7 +21,7 @@ module Kobako
     # type mapping (e.g. an unknown ext code, or a reserved msgpack tag).
     class InvalidType < Error; end
 
-    # A msgpack `str` payload was not valid UTF-8, or an ext 0x00 Symbol
+    # A msgpack +str+ payload was not valid UTF-8, or an ext 0x00 Symbol
     # payload was not valid UTF-8 — both are wire violations per SPEC.
     class InvalidEncoding < Error; end
 

data/lib/kobako/codec/factory.rb

@@ -16,7 +16,7 @@ module Kobako
     # § Ext Types).
     #
     # The factory is the single place in the host gem that touches the
-    # msgpack API — both {Encoder} and {Decoder} delegate through it, so
+    # msgpack API — both Encoder and Decoder delegate through it, so
     # the three kobako ext codes (0x00 Symbol, 0x01 Capability Handle,
     # 0x02 Exception envelope) are configured exactly once at first use.
     #
@@ -93,11 +93,11 @@ module Kobako
       end
 
       # Validate the ext-0x00 payload as UTF-8 and intern. Raises
-      # {InvalidEncoding} on invalid bytes — SPEC forbids the
+      # InvalidEncoding on invalid bytes — SPEC forbids the
       # binary-encoding fallback that msgpack-gem's default unpacker
       # would otherwise apply. The re-tag step lives here because the
       # msgpack ext-type unpacker hands us binary bytes; the assertion
-      # itself is shared with {Decoder} via {Utils.assert_utf8!}. The
+      # itself is shared with Decoder via Utils.assert_utf8!. The
       # +"Symbol"+ label keeps the error message in Ruby vocabulary
       # rather than wire-ext-code vocabulary.
       def unpack_symbol(payload)
@@ -125,7 +125,7 @@ module Kobako
       # Peel off the fixext-4 frame, hand the bytes to the
       # Host-Gem-internal +Kobako::Handle.restore+ factory, and
       # translate the +ArgumentError+ raised by Handle's invariants
-      # into a wire-layer +InvalidType+ via {Codec::Utils.with_boundary}.
+      # into a wire-layer +InvalidType+ via Codec::Utils.with_boundary.
       # The Value Object owns the id-range contract; this method only
       # owns the frame shape.
       def unpack_handle(payload)
@@ -136,11 +136,11 @@ module Kobako
         Codec::Utils.with_boundary { Kobako::Handle.restore(id) }
       end
 
-      # Encode the inner ext-0x02 map via {Encoder} (not +factory.dump+) so
+      # Encode the inner ext-0x02 map via Encoder (not +factory.dump+) so
       # the embedded payload flows through the same boundary as a top-level
       # encode — nested kobako values (Handle, nested Fault) reach the
       # registered ext-type packers via the cached singleton. A +details+
-      # chain nested past {MAX_EXT_DEPTH} has no wire representation and
+      # chain nested past MAX_EXT_DEPTH has no wire representation and
       # surfaces as +UnsupportedType+.
       def pack_fault(fault)
         within_ext_frame(UnsupportedType) do
@@ -149,12 +149,12 @@ module Kobako
       end
 
       # Peel the embedded msgpack map and hand it to +Kobako::Fault.new+
-      # inside {Decoder.decode}'s block form, so the value-object's
+      # inside Decoder.decode's block form, so the value-object's
       # +ArgumentError+ invariants surface as +InvalidType+ through the
-      # decoder boundary. Inner decode goes through {Decoder} (not
+      # decoder boundary. Inner decode goes through Decoder (not
       # +factory.load+) so the embedded +str+ payloads flow through the
       # same UTF-8 validation as a top-level decode. A nested ext 0x02 in
-      # +details+ re-enters this method, so {#within_ext_frame} bounds the
+      # +details+ re-enters this method, so #within_ext_frame bounds the
       # chain depth to keep it from exhausting the native stack.
       def unpack_fault(payload)
         within_ext_frame(InvalidType) do
@@ -167,7 +167,7 @@ module Kobako
       end
 
       # Track ext-envelope re-entry depth and refuse a chain past
-      # {MAX_EXT_DEPTH}, raising +over_limit+ so the failure lands in the
+      # MAX_EXT_DEPTH, raising +over_limit+ so the failure lands in the
       # caller's existing wire-error class. The counter is thread-scoped and
       # balanced by the +ensure+, so a raise mid-chain still unwinds it to
       # its entry value.

data/lib/kobako/codec/handle_walk.rb

@@ -5,16 +5,16 @@ require_relative "../handle"
 module Kobako
   module Codec
     # Substitutes Capability Handles into and out of a Ruby value tree at
-    # the host↔guest boundary. {deep_wrap} allocates a +Kobako::Handle+ for
+    # the host↔guest boundary. #deep_wrap allocates a +Kobako::Handle+ for
     # each non-wire-representable leaf on the host→guest +#run+ argument
-    # path; {deep_restore} resolves each wire-decoded Handle back to its
-    # host object on every guest→host value path. {representable?} is the
-    # by-value codec-type predicate that decides which leaves {deep_wrap}
+    # path; #deep_restore resolves each wire-decoded Handle back to its
+    # host object on every guest→host value path. #representable? is the
+    # by-value codec-type predicate that decides which leaves #deep_wrap
     # must wrap: the closed 12-entry wire type set
     # ({docs/wire-codec.md}[link:../../../docs/wire-codec.md] § Type
     # Mapping).
     #
-    # All helpers are pure except {deep_wrap}, whose only side effect is
+    # All helpers are pure except #deep_wrap, whose only side effect is
     # allocating new Handle ids into the supplied table.
     module HandleWalk
       module_function
@@ -24,7 +24,7 @@ module Kobako
       # unsigned +uint 64+ maximum
       # ({docs/wire-codec.md}[link:../../../docs/wire-codec.md] § Type
       # Mapping #3, the +fixint+ / +int 8..64+ / +uint 8..64+ union).
-      # Anchored as a +Range+ so {primitive_type?} stays a single
+      # Anchored as a +Range+ so #primitive_type? stays a single
       # dispatch line. This is the codec's encode domain — not to
       # be confused with the Handle id range, which lives on
       # +Kobako::Handle+ as +MIN_ID+ / +MAX_ID+ (1..2^31 − 1) and
@@ -41,13 +41,13 @@ module Kobako
       # representable. Integers outside the codec's signed-64 /
       # unsigned-64 union are rejected so the predicate agrees with the
       # msgpack gem's encode-time +RangeError+ behaviour the codec
-      # already surfaces as {UnsupportedType}.
+      # already surfaces as UnsupportedType.
       def representable?(value)
         primitive_type?(value) || container_representable?(value)
       end
 
       # Deep-walk Array / Hash containers in +value+ and replace every
-      # leaf that fails {representable?} with a +Kobako::Handle+
+      # leaf that fails #representable? with a +Kobako::Handle+
       # allocated from +handler+. The
       # walk only descends through representable container shapes
       # (Array, Hash) one structural level at a time; a non-representable
@@ -61,13 +61,9 @@ module Kobako
       # whose leaves are either representable or +Kobako::Handle+
       # tokens.
       #
-      # The block bodies spell +HandleWalk.deep_wrap+ explicitly rather
-      # than the unqualified +deep_wrap+ because +module_function+ makes
-      # the instance copy of these helpers private; an implicit receiver
-      # inside a block would resolve against the enclosing +self+
-      # (still +HandleWalk+ at definition time, but the qualified form
-      # keeps the dispatch readable when the recursive call sits inside a
-      # Proc captured from elsewhere).
+      # Recursive calls spell the +HandleWalk.+ receiver so the dispatch
+      # stays valid even when a block is captured and run under a
+      # different +self+ (+module_function+ privatizes the instance copies).
       def deep_wrap(value, handler)
         case value
         when ::Array then value.map { |element| HandleWalk.deep_wrap(element, handler) }
@@ -79,7 +75,7 @@ module Kobako
 
       # Deep-walk Array / Hash containers in +value+ and replace every
       # +Kobako::Handle+ leaf with the host-side object +handler+ resolves
-      # it to. The symmetric inverse of {deep_wrap}: that walk allocates objects
+      # it to. The symmetric inverse of #deep_wrap: that walk allocates objects
       # into Handles on the host→guest argument path; this walk resolves
       # Handles back to their objects wherever a guest→host payload carries
       # one — an invocation result, a yield-block result, or a dispatch
@@ -107,9 +103,9 @@ module Kobako
         end
       end
 
-      # The non-container branch of {representable?}: returns +true+ for
+      # The non-container branch of #representable?: returns +true+ for
       # the scalar leaves and an existing Handle. Not part of the
-      # public surface; reach for {representable?} instead.
+      # public surface; reach for #representable? instead.
       def primitive_type?(value)
         case value
         when ::NilClass, ::TrueClass, ::FalseClass, ::Float, ::String, ::Symbol, Kobako::Handle then true
@@ -118,10 +114,10 @@ module Kobako
         end
       end
 
-      # The container branch of {representable?}: recurses into Array
+      # The container branch of #representable?: recurses into Array
       # elements and Hash key+value pairs through the public
-      # {representable?}. Not part of the public surface; reach for
-      # {representable?} instead.
+      # #representable?. Not part of the public surface; reach for
+      # #representable? instead.
       def container_representable?(value)
         case value
         when ::Array then value.all? { |element| HandleWalk.representable?(element) }

data/lib/kobako/codec/utils.rb

@@ -10,18 +10,18 @@ module Kobako
     #   - UTF-8 assertion at the codec boundary
     #     ({docs/wire-codec.md}[link:../../../docs/wire-codec.md]
     #     § str/bin Encoding Rules and § Ext Types → ext 0x00). Used by
-    #     {Decoder} when walking +str+ family payloads and by {Factory}
+    #     Decoder when walking +str+ family payloads and by Factory
     #     when validating the +ext 0x00+ Symbol payload.
     #   - +ArgumentError+ translation at the codec boundary
-    #     ({with_boundary}) so the public taxonomy stays
-    #     {Kobako::Codec::Error}.
+    #     (#with_boundary) so the public taxonomy stays
+    #     Kobako::Codec::Error.
     #
     # Both helpers are pure — they only inspect inputs, never mutate them.
-    # The host↔guest Handle substitution walk lives in {HandleWalk}.
+    # The host↔guest Handle substitution walk lives in HandleWalk.
     module Utils
       module_function
 
-      # Raise {InvalidEncoding} unless +string+'s bytes are valid under
+      # Raise InvalidEncoding unless +string+'s bytes are valid under
       # its current encoding tag. +label+ is the caller-supplied prefix
       # for the error message (e.g. +"str payload"+, +"Symbol payload"+).
       def assert_utf8!(string, label)
@@ -32,13 +32,13 @@ module Kobako
 
       # Run +block+ at the codec boundary: a value object raises
       # +ArgumentError+ when an invariant is violated at construction, and
-      # this helper surfaces that as {InvalidType} so the public taxonomy
-      # stays {Kobako::Codec::Error} and never leaks +ArgumentError+ from
+      # this helper surfaces that as InvalidType so the public taxonomy
+      # stays Kobako::Codec::Error and never leaks +ArgumentError+ from
       # the Ruby standard library.
       #
       # Reach for this only where a value object is constructed outside a
-      # {Decoder.decode} block, whose rescue already performs the same
-      # mapping (worked example: {Factory#unpack_handle} building
+      # Decoder.decode block, whose rescue already performs the same
+      # mapping (worked example: Factory#unpack_handle building
       # +Handle.restore+ from a raw fixext payload). Do not use it for
       # general-purpose validation outside the codec boundary —
       # host-layer +ArgumentError+ values should propagate unchanged.

data/lib/kobako/codec.rb

@@ -18,12 +18,12 @@ module Kobako
   # the kobako root so the codec can register them without depending
   # upward on Transport.
   #
-  # Backed by the official +msgpack+ gem via {Factory}; {Encoder} and
-  # {Decoder} are thin wrappers that register the three kobako-specific
+  # Backed by the official +msgpack+ gem via Factory; Encoder and
+  # Decoder are thin wrappers that register the three kobako-specific
   # ext types (0x00 Symbol, 0x01 Capability Handle, 0x02 Exception
   # envelope) on a single +MessagePack::Factory+ instance. The Rust side
-  # mirrors this layer as the +codec+ module in the +kobako-core+ crate;
-  # the ext-code constants live as module-private values on {Factory}
+  # mirrors this layer as the +codec+ module in the +kobako-codec+ crate;
+  # the ext-code constants live as module-private values on Factory
   # alongside +codec::EXT_SYMBOL+ / +codec::EXT_HANDLE+ /
   # +codec::EXT_ERRENV+ on that side.
   module Codec