kobako 0.29.0 → 0.30.0

data/lib/kobako/codec/decoder.rb

@@ -13,9 +13,9 @@ module Kobako
       # from the decoded payload reports a broken invariant as
       # InvalidTypeError without its own Utils.with_boundary.
       def self.decode(bytes)
-        ValueBudget.assert_within!(bytes, State.current.value_budget)
+        ValueBudget.assert_within(bytes, State.current.value_budget)
         value = FACTORY.load(bytes.b)
-        validate_utf8!(value)
+        validate_utf8(value)
         block_given? ? yield(value) : value
       # msgpack gem raises the format/type errors below; +ArgumentError+
       # covers a yielded block's Value Object invariants — a wire violation
@@ -30,23 +30,23 @@ module Kobako
         raise TruncatedInputError, e.message
       end
 
-      # +str+ family payloads must be UTF-8
-      # (docs/wire/payload-msgpack.md § Text and Bytes). The msgpack gem
+      # +str+ family payloads must be UTF-8, since a sender carries bytes
+      # that are not UTF-8 as +bin+. The msgpack gem
       # returns UTF-8-tagged Strings for
       # str family but does not validate the bytes; +bin+ family decodes
       # to ASCII-8BIT. Walk the tree once and reject invalid UTF-8 in any
-      # str-typed leaf via Utils.assert_utf8!.
+      # str-typed leaf via Utils.assert_utf8.
       class << self
         private
 
-        def validate_utf8!(value)
+        def validate_utf8(value)
           case value
-          when String then Utils.assert_utf8!(value, "str payload") if value.encoding == Encoding::UTF_8
-          when Array  then value.each { |v| validate_utf8!(v) }
+          when String then Utils.assert_utf8(value, "str payload") if value.encoding == Encoding::UTF_8
+          when Array  then value.each { |v| validate_utf8(v) }
           when Hash
             value.each do |key, val|
-              validate_utf8!(key)
-              validate_utf8!(val)
+              validate_utf8(key)
+              validate_utf8(val)
             end
           end
         end

data/lib/kobako/codec/ext_types.rb

@@ -10,13 +10,11 @@ require_relative "../handle"
 module Kobako
   module Codec # :nodoc:
     module ExtTypes # :nodoc:
-      # MessagePack ext type code reserved for Symbol
-      # (docs/wire/payload-msgpack.md § ext 0x00 — Symbol). Module-private —
+      # MessagePack ext type code reserved for Symbol. Module-private —
       # mirrors +codec::EXT_SYMBOL+ on the
       # Rust side.
       EXT_SYMBOL = 0x00
-      # MessagePack ext type code reserved for Capability Handle
-      # (docs/wire/payload-msgpack.md § ext 0x01 — Handle). Module-private —
+      # MessagePack ext type code reserved for Capability Handle. Module-private —
       # mirrors +codec::EXT_HANDLE+ on the
       # Rust side.
       EXT_HANDLE = 0x01
@@ -51,7 +49,7 @@ module Kobako
         # unpacker would otherwise apply to invalid bytes.
         def unpack_symbol(payload)
           name = payload.b.force_encoding(Encoding::UTF_8)
-          Utils.assert_utf8!(name, "Symbol payload")
+          Utils.assert_utf8(name, "Symbol payload")
           name.to_sym
         end
 

data/lib/kobako/codec/handle_walk.rb

@@ -8,8 +8,7 @@ module Kobako
     module HandleWalk # :nodoc:
       # Inclusive Integer range the msgpack gem encodes without raising
       # +RangeError+ at encode time — signed +int 64+ minimum through
-      # unsigned +uint 64+ maximum (docs/wire/payload-msgpack.md § Integer
-      # Range).
+      # unsigned +uint 64+ maximum, the range every wire Integer fits.
       # Anchored as a +Range+ so #primitive_type? stays a single
       # dispatch line. This is the codec's encode domain — not to
       # be confused with the Handle id range, which lives on
@@ -17,8 +16,7 @@ module Kobako
       # represents a different concept entirely.
       MSGPACK_INT_RANGE = (-(2**63)..((2**64) - 1))
 
-      # Whether +value+ falls in the codec's type set
-      # (docs/wire/payload-msgpack.md § Type Mapping). The +depth+ bound
+      # Whether +value+ falls in the codec's closed type set. The +depth+ bound
       # makes a self-referential container —
       # reachable as a cyclic Hash key on the +#run+ argument path — read as
       # non-representable rather than looping.
@@ -32,7 +30,7 @@ module Kobako
       # than crossing as a token the guest→host restore walk could not
       # round-trip.
       def self.deep_wrap(value, handles, depth = 0)
-        guard_nesting!(depth)
+        guard_nesting(depth)
         case value
         when ::Array then value.map { |element| deep_wrap(element, handles, depth + 1) }
         when ::Hash  then deep_wrap_hash(value, handles, depth)
@@ -64,7 +62,7 @@ module Kobako
         # A reference cycle necessarily trips the nesting bound, so a +#run+
         # argument fails as a clean +Kobako::SandboxError+ rather than an
         # unbounded host recursion.
-        def guard_nesting!(depth)
+        def guard_nesting(depth)
           return unless depth > MAX_NESTING_DEPTH
 
           raise Kobako::SandboxError,

data/lib/kobako/codec/nesting.rb

@@ -9,12 +9,12 @@ module Kobako
     module Nesting # :nodoc:
       # Raise InvalidTypeError when +value+ nests past MAX_NESTING_DEPTH; a
       # value nested exactly to the bound passes.
-      def self.assert_within_bound!(value, depth = 0)
+      def self.assert_within_bound(value, depth = 0)
         case value
-        when ::Array then assert_members_within_bound!(value, depth)
+        when ::Array then assert_members_within_bound(value, depth)
         when ::Hash
-          assert_members_within_bound!(value.keys, depth)
-          assert_members_within_bound!(value.values, depth)
+          assert_members_within_bound(value.keys, depth)
+          assert_members_within_bound(value.values, depth)
         end
       end
 
@@ -22,7 +22,7 @@ module Kobako
       # level deeper. A member is matched by class rather than asked about
       # itself — it may be a BasicObject — and only one that could be a
       # container is walked into.
-      def self.assert_members_within_bound!(members, depth)
+      def self.assert_members_within_bound(members, depth)
         return if members.empty?
         if depth >= MAX_NESTING_DEPTH
           raise InvalidTypeError,
@@ -30,9 +30,9 @@ module Kobako
         end
         return unless members.any?(::Enumerable)
 
-        members.grep(::Enumerable) { |member| assert_within_bound!(member, depth + 1) }
+        members.grep(::Enumerable) { |member| assert_within_bound(member, depth + 1) }
       end
-      private_class_method :assert_members_within_bound!
+      private_class_method :assert_members_within_bound
     end
   end
 end

data/lib/kobako/codec/utils.rb

@@ -5,7 +5,7 @@ require_relative "error"
 module Kobako
   module Codec
     module Utils # :nodoc:
-      def self.assert_utf8!(string, label)
+      def self.assert_utf8(string, label)
         return if string.valid_encoding?
 
         raise InvalidEncodingError, "#{label} is not valid UTF-8"

data/lib/kobako/codec/value_budget.rb

@@ -5,8 +5,8 @@ require_relative "error"
 module Kobako
   module Codec
     # Counts the values a payload holds before the decoder builds any, so a
-    # guest cannot make the host build more objects than its budget allows
-    # (docs/wire/payload-msgpack.md § Value Budget). Every value takes at
+    # guest cannot make the host build more objects than it could hold in
+    # its own memory. Every value takes at
     # least one byte, so a payload no longer than the budget needs no count.
     #
     # The count stops at the first byte it cannot frame and leaves that
@@ -30,7 +30,7 @@ module Kobako
       UINT = { 1 => "C", 2 => "n", 4 => "N" }.freeze
       private_constant :SCALARS, :COUNTS, :LENGTHS, :UINT
 
-      def self.assert_within!(bytes, budget)
+      def self.assert_within(bytes, budget)
         return if budget.nil? || bytes.bytesize <= budget
 
         remaining = budget

data/lib/kobako/context.rb

@@ -56,7 +56,7 @@ module Kobako
     def mount(at, filesystem, access: :read, &policy)
       raise ArgumentError, "Kobako::Context is spent; ctx.mount is only valid inside the #eval / #run block" if @spent
 
-      Runtime.validate_mount!(at, access, filesystem)
+      Runtime.validate_mount(at, access, filesystem)
       mount = Catalog::Mount.new(at: at, access: access, filesystem: filesystem, policy: policy)
       raise ArgumentError, "cannot override unmounted path #{at.inspect}" unless @grants.include?(mount)
 
@@ -77,13 +77,13 @@ module Kobako
 
     def eval(code, &block) # :nodoc:
       collect_overrides(&block) if block
-      invoke!(:eval) { @runtime.eval(dispatch_handler, setup, code.b) }
+      invoke(:eval) { @runtime.eval(dispatch_handler, setup, code.b) }
     end
 
     def run(request, &block) # :nodoc:
       collect_overrides(&block) if block
-      invoke!(:run, entrypoint: request.entrypoint) do
-        @runtime.run(dispatch_handler, setup, request.entrypoint.to_s, request.payload(@handles))
+      invoke(:run, entrypoint: request.entrypoint) do
+        @runtime.run(dispatch_handler, setup, request.entrypoint.to_s, request.encode_payload(@handles))
       end
     end
 
@@ -157,7 +157,7 @@ module Kobako
     # that raises propagates unwrapped and leaves the guest unrun. A
     # could-not-start fault ran no invocation at all, so it carries no
     # Execution and gains only the verb prefix.
-    def invoke!(verb, entrypoint: nil)
+    def invoke(verb, entrypoint: nil)
       @resolved = @extensions.resolve.transform_values { |object| Transport::Exposure.of(object) }
       begin
         snapshot = yield

data/lib/kobako/filesystem.rb

@@ -5,25 +5,25 @@ module Kobako
   # answered in Rust by the kind of the same name. Hand one to
   # Sandbox#mount:
   #
-  #   sandbox.mount("/data", Kobako::Filesystem::Memory.new("config.yml" => yaml))
+  #   sandbox.mount("/data", Kobako::Filesystem::Tmpfs.new("config.yml" => yaml))
   #
-  # [<tt>Memory.new(files = {}, limit: 64 MiB, inodes:)</tt>]
+  # [<tt>Tmpfs.new(files = {}, size: 64 MiB, nr_inodes:)</tt>]
   #   Files held in memory for as long as the object lives, seeded from a
-  #   Hash of path to contents. Every invocation shares them.
-  # [<tt>Temporary.new(limit: 64 MiB, inodes:)</tt>]
-  #   Files held in memory that every invocation starts empty.
-  # [<tt>Directory.new(path)</tt>]
+  #   Hash of path to contents. Every invocation shares them; one that
+  #   should start empty mounts a new Tmpfs through Context#mount.
+  # [<tt>Bind.new(path)</tt>]
   #   A host directory and everything beneath it. Nothing outside it is
   #   reachable, a symbolic link pointing out included.
-  # [<tt>Overlay.new.layer(filesystem, access: :read)</tt>]
-  #   Layers stacked into one view, the first added on top, each +:read+
-  #   or +:read_write+ on its own. A change lands in a writable Layer, and
-  #   a read-only one stays as it was. Each +layer+ answers a new Overlay.
+  # [<tt>Overlay.new(lower: [filesystem, ...], upper: tmpfs)</tt>]
+  #   Read-only lower Layers, topmost first, under an upper Tmpfs that
+  #   takes every change, as Linux's overlayfs stacks them. Without
+  #   +upper+ the view is read-only and needs two lower Layers. It takes
+  #   at most 500 lower Layers and stacks at most two Overlays deep.
   #
-  # A Memory or Temporary is bounded as a tmpfs mount is: its files hold
-  # at most +limit+ bytes together, and it holds at most +inodes+ files and
+  # A Tmpfs is bounded as a tmpfs mount is: its files hold
+  # at most +size+ bytes together, and it holds at most +nr_inodes+ files and
   # directories, its root among them; +nil+ lifts either bound. Without
-  # +inodes+ it holds one for each 4 KiB of +limit+, and the root. Past
+  # +nr_inodes+ it holds one for each 4 KiB of +size+, and the root. Past
   # either, the guest raises Errno::ENOSPC.
   #
   # Any object answering +open+ and +stat+ mounts too, as a Filesystem
@@ -33,6 +33,37 @@ module Kobako
   # exactly, as a mount's block judges them as given. A name may hold a
   # <tt>\\</tt>, which the guest's paths never separate on, so one joined
   # to a Windows host path is the Filesystem's to refuse.
+  #
+  # Each method beyond +open+ and +stat+ is optional, and a change it lacks
+  # raises <tt>Errno::EROFS</tt> in the guest:
+  #
+  # [<tt>children(path)</tt>]
+  #   Entry names, as Dir.children gives them.
+  # [<tt>mkdir(path)</tt>, <tt>rmdir(path)</tt>, <tt>unlink(path)</tt>, <tt>rename(from, to)</tt>]
+  #   The changes a writable mount passes on.
+  #
+  # A +stat+ may also answer +dev+, else the Filesystem stands for one
+  # device, and +ftype+, which says a FIFO, a socket, or a device is one
+  # so the guest's open is refused without asking +open+.
+  #
+  # The file +open+ answers takes the guest's reads and writes, each named
+  # as +IO+ names it:
+  #
+  # [<tt>pread(length, offset)</tt>, +size+]
+  #   Required: the bytes there, +nil+ or EOFError at the end, and the
+  #   length.
+  # [<tt>pwrite(data, offset)</tt>, <tt>truncate(length)</tt>]
+  #   The bytes written, and nothing; without them a write raises
+  #   <tt>Errno::EROFS</tt>.
+  # [<tt>append(data)</tt>]
+  #   Writes all of +data+ at the end in one step, so another writer's
+  #   append never lands over it, and answers where the file then ends;
+  #   without it an append raises <tt>Errno::ENOTSUP</tt>.
+  # [+fsync+, +close+]
+  #   Nothing; without them there is nothing to flush or release.
+  # [+stat+]
+  #   What <tt>stat(path)</tt> answers, for the file's times and count of
+  #   names; without it the file has one name and no time.
   module Filesystem
   end
 end

data/lib/kobako/payload/arguments.rb

@@ -8,7 +8,7 @@ module Kobako
       def initialize(args: [], kwargs: {})
         raise ArgumentError, "payload args must be Array" unless args.is_a?(Array)
 
-        validate_kwargs!(kwargs)
+        validate_kwargs(kwargs)
         super
       end
 
@@ -32,7 +32,7 @@ module Kobako
 
       private
 
-      def validate_kwargs!(kwargs)
+      def validate_kwargs(kwargs)
         raise ArgumentError, "payload kwargs must be Hash" unless kwargs.is_a?(Hash)
 
         kwargs.each_key do |key|

data/lib/kobako/pool.rb

@@ -20,7 +20,7 @@ module Kobako
     # Raises ArgumentError when +slots+ is not a positive Integer or
     # +checkout_timeout+ is not a positive finite number.
     def initialize(slots:, checkout_timeout: DEFAULT_CHECKOUT_TIMEOUT_SECONDS, **sandbox_options, &setup)
-      validate_slots!(slots)
+      validate_slots(slots)
       @slots = slots
       @checkout_timeout = normalize_checkout_timeout(checkout_timeout)
       @sandbox_options = sandbox_options
@@ -69,13 +69,13 @@ module Kobako
           return [:build, nil]
         end
 
-        await_slot!(deadline)
+        await_slot(deadline)
         [:retry, nil]
       end
     end
 
     # Must run while holding +@mutex+.
-    def await_slot!(deadline)
+    def await_slot(deadline)
       remaining = deadline && (deadline - monotonic_now)
       if remaining && remaining <= 0
         raise PoolTimeoutError,
@@ -117,7 +117,7 @@ module Kobako
       Process.clock_gettime(Process::CLOCK_MONOTONIC)
     end
 
-    def validate_slots!(slots)
+    def validate_slots(slots)
       return if slots.is_a?(Integer) && slots.positive?
 
       raise ArgumentError, "slots must be a positive Integer, got #{slots.inspect}"

data/lib/kobako/sandbox.rb

@@ -43,7 +43,7 @@ module Kobako
       @extensions = Catalog::Extensions.new
       @grants = Catalog::Grants.new
       @sealed = false
-      @runtime = build_runtime!
+      @runtime = build_runtime
     end
 
     # Make +object+ reachable from the guest as the constant at +path+, a
@@ -62,7 +62,7 @@ module Kobako
     # +Kobako+ namespace, a path that collides with an existing binding, or a
     # call after the first invocation.
     def bind(path, object = Unresolved)
-      refuse_once_invoked!("bind")
+      refuse_once_invoked("bind")
       @services.bind(path, object)
       self
     end
@@ -74,7 +74,7 @@ module Kobako
     # Raises ArgumentError for a malformed Extension, a call after the first
     # invocation, or, at the first invocation, a missing dependency.
     def install(*extensions)
-      refuse_once_invoked!("install")
+      refuse_once_invoked("install")
 
       extensions.each { |extension| @extensions.install(extension, snippets: @snippets, services: @services) }
       self
@@ -85,18 +85,22 @@ module Kobako
     # +:read_write+; a write beneath a read-only mount fails as
     # <tt>Errno::EROFS</tt> in the guest. Returns +self+.
     #
-    # A given block decides, in +access+'s place, each open and each change
-    # that reaches the mount, asked at most once for each with the guest path
-    # and +:read+ or +:read_write+. A falsy answer,
+    # A given block judges each open and each change +access+ allows, asked
+    # with the guest path and +:read+ or +:read_write+, and can only refuse
+    # more; an open that may create asks +:read_write+ first, then what it
+    # opens for. A falsy answer,
     # or a StandardError, fails that call as <tt>Errno::EACCES</tt> in the
     # guest and leaves the script running.
     #
+    # A path may sit beneath another mount, and the guest reaches the
+    # innermost one.
+    #
     # Raises TypeError for a path that is no String or something other than
-    # a Filesystem, and ArgumentError for a malformed, duplicate, or nested
-    # path, an unknown access, or a call after the first invocation.
+    # a Filesystem, and ArgumentError for a malformed or duplicate path, an
+    # unknown access, or a call after the first invocation.
     def mount(at, filesystem, access: :read, &policy)
-      refuse_once_invoked!("mount")
-      Runtime.validate_mount!(at, access, filesystem)
+      refuse_once_invoked("mount")
+      Runtime.validate_mount(at, access, filesystem)
       @grants.register(Catalog::Mount.new(at: at, access: access, filesystem: filesystem, policy: policy))
       self
     end
@@ -114,7 +118,7 @@ module Kobako
     # after the first invocation. A snippet that fails to load fails every
     # invocation with SandboxError, or BytecodeError for bytecode.
     def preload(code: nil, name: nil, binary: nil)
-      refuse_once_invoked!("preload")
+      refuse_once_invoked("preload")
 
       @snippets.register(code: code, name: name, binary: binary)
       self
@@ -130,7 +134,7 @@ module Kobako
     # Raises ArgumentError for a malformed or duplicate flag, or a call after
     # the first invocation.
     def flag(name, value = "", advisory: false)
-      refuse_once_invoked!("flag")
+      refuse_once_invoked("flag")
 
       @flags.register(name, value, advisory: advisory)
       self
@@ -145,7 +149,7 @@ module Kobako
     # Handle or a non-Symbol keyword. A failed run raises as #eval does.
     def run(target, *args, **kwargs, &block)
       request = Transport::Run.new(entrypoint: target, args: args, kwargs: kwargs)
-      Codec.within_value_budget(@options.value_budget) { new_invocation.run(request, &block) }
+      Codec.within_value_budget(@options.value_budget) { begin_invocation.run(request, &block) }
     end
 
     # Evaluate +code+, mruby source as a String, and return the Execution,
@@ -160,27 +164,19 @@ module Kobako
     def eval(code, &block)
       raise SandboxError, "code must be a String, got #{code.class}" unless code.is_a?(String)
 
-      Codec.within_value_budget(@options.value_budget) { new_invocation.eval(code, &block) }
+      Codec.within_value_budget(@options.value_budget) { begin_invocation.eval(code, &block) }
     end
 
     private
 
     # A runtime whose declared posture falls below the request never runs
     # guest code.
-    def build_runtime!
+    def build_runtime
       runtime = Kobako::Runtime.from_path(@wasm_path, **@options.to_h)
-      @options.enforce_floor!(runtime.profile)
+      @options.enforce_floor(runtime.profile)
       runtime
     end
 
-    # Per-invocation state lives on the Context, so nothing an invocation
-    # does is written back onto the shared config.
-    def new_invocation
-      begin_invocation!
-      Context.new(runtime: @runtime, services: @services, extensions: @extensions, grants: @grants,
-                  preamble: preamble(@snippets.entries))
-    end
-
     # The one place the Preamble's parts are put together, for a compile
     # and for every invocation alike.
     def preamble(snippets)
@@ -189,17 +185,21 @@ module Kobako
 
     # Registration closes at the first invocation, so every invocation ships
     # the same Services, snippets, flags, Extensions and mounts.
-    def refuse_once_invoked!(verb)
+    def refuse_once_invoked(verb)
       raise ArgumentError, "cannot #{verb} after first Sandbox invocation" if @sealed
     end
 
     # Sealing before the dependency check keeps a Sandbox whose check failed
     # closed to further registration. The sealed snippets are compiled once,
-    # before the first invocation replays them.
-    def begin_invocation!
+    # before the first invocation replays them. Per-invocation state lives on
+    # the Context it answers, so nothing an invocation does is written back
+    # onto the shared config.
+    def begin_invocation
       @sealed = true
-      @extensions.assert_dependencies!
+      @extensions.assert_dependencies
       @snippets.compile { |entries| @runtime.compile(preamble(entries)) }
+      Context.new(runtime: @runtime, services: @services, extensions: @extensions, grants: @grants,
+                  preamble: preamble(@snippets.entries))
     end
   end
 end

data/lib/kobako/sandbox_options.rb

@@ -74,8 +74,7 @@ module Kobako
     end
 
     # The least guest memory one value occupies, so a guest payload may hold
-    # one value for each of these bytes of +memory_limit+
-    # (docs/wire/payload-msgpack.md § Value Budget).
+    # one value for each of these bytes of +memory_limit+.
     VALUE_BYTES = 16
     private_constant :VALUE_BYTES
 
@@ -85,7 +84,7 @@ module Kobako
 
     # Both fallbacks fail closed: an unknown declaration ranks below every
     # request, and an unknown request refuses every declaration.
-    def enforce_floor!(declared) # :nodoc:
+    def enforce_floor(declared) # :nodoc:
       return if (PROFILES.index(declared) || -1) >= (PROFILES.index(profile) || PROFILES.size)
 
       raise Kobako::SetupError, "runtime declares isolation profile #{declared.inspect}, " \

data/lib/kobako/snippet/bytecode.rb

@@ -4,7 +4,7 @@ module Kobako
   module Snippet
     class Bytecode < Data.define(:body) # :nodoc:
       # Names the snippet form the guest replays this entry as. The wire's
-      # discriminant byte is assigned by the core envelope, not here.
+      # discriminant byte is assigned by the Envelope, not here.
       KIND = :bytecode
     end
   end

data/lib/kobako/snippet/source.rb

@@ -4,7 +4,7 @@ module Kobako
   module Snippet
     class Source < Data.define(:name, :body) # :nodoc:
       # Names the snippet form the guest replays this entry as. The wire's
-      # discriminant byte is assigned by the core envelope, not here.
+      # discriminant byte is assigned by the Envelope, not here.
       KIND = :source
     end
   end

data/lib/kobako/transport/dispatcher.rb

@@ -60,7 +60,7 @@ module Kobako
       # stays uncaught and traps the invocation rather than being masked as a
       # rescuable fault.
       rescue StandardError => e
-        [:fault, *caught_fault(e, failure)] # : [Symbol, String, String?]
+        [:fault, *fault_of(e, failure)] # : [Symbol, String, String?]
       ensure
         yielder&.invalidate
       end
@@ -97,7 +97,7 @@ module Kobako
         # The guest's own block failing is not the Service's to report at
         # all, so the Yielder that raised it is asked first — it recognises
         # its own by identity and words the failure the guest's way.
-        def caught_fault(error, failure)
+        def fault_of(error, failure)
           block_failure = failure.fault_text(error)
           return fault("block", block_failure) if block_failure
 
@@ -111,7 +111,7 @@ module Kobako
         # unsplatted for methods that take no keywords.
         def invoke(exposure, method, args, kwargs, yielder)
           name = method.to_sym
-          reject_unreachable!(exposure, name)
+          reject_unreachable(exposure, name)
           target = exposure.object
           block = yielder&.to_proc
           if kwargs.empty?
@@ -124,7 +124,7 @@ module Kobako
         # Both the ambient-surface floor and the reference's Exposure answer
         # through Reflection, so a rejected name discloses nothing about
         # which of the two refused.
-        def reject_unreachable!(exposure, name)
+        def reject_unreachable(exposure, name)
           reason = Reflection.refusal(exposure, name)
           raise UndefinedTargetError, reason if reason
         end
@@ -163,7 +163,7 @@ module Kobako
         # Service can change — so it is named here, where the direction is
         # known, instead of falling to the boundary's codec floor.
         def encode_ok(value, handles)
-          Kobako::Codec::Nesting.assert_within_bound!(value)
+          Kobako::Codec::Nesting.assert_within_bound(value)
           Kobako::Codec::Encoder.encode(value)
         rescue Kobako::Codec::UnsupportedTypeError
           encode_ok(handles.alloc(value), handles)

data/lib/kobako/transport/exposure.rb

@@ -32,7 +32,7 @@ module Kobako
       # once (a Handle table), so two objects of one class enumerate it once.
       def self.of(object, surfaces = {})
         klass = CLASS_OF.bind_call(object)
-        names = narrows_itself?(object, klass) ? nil : default_names(object, klass, surfaces)
+        names = narrows_itself?(object, klass) ? nil : resolve_default_names(object, klass, surfaces)
         new(object: object, names: names)
       end
 
@@ -59,7 +59,7 @@ module Kobako
 
         # A callable keeps its callable names; a class-level surface or a
         # forwarder has no surface of its own to expose.
-        def default_names(object, klass, surfaces)
+        def resolve_default_names(object, klass, surfaces)
           case object
           when Proc, Method then CALLABLE
           when Module, Delegator then NOTHING

data/lib/kobako/transport/reflection.rb

@@ -77,20 +77,20 @@ module Kobako
         # A name with no method never reaches +instance_method+, which would
         # keep a guest-chosen name as a Symbol for the life of the process.
         def ambient_refusal(target, name)
-          return refused(name) if name == :method_missing
+          return service_refusal(name) if name == :method_missing
 
           klass = lookup_class(target)
-          return defined_refusal(target, name, klass) if klass.public_method_defined?(name)
+          return public_method_refusal(target, name, klass) if klass.public_method_defined?(name)
           return "no public method #{name.inspect} on target" unless target.respond_to?(name)
-          return refused(name) if klass.method_defined?(name) || klass.private_method_defined?(name)
+          return service_refusal(name) if klass.method_defined?(name) || klass.private_method_defined?(name)
 
           owner_refusal(target, name, klass)
         end
 
-        def defined_refusal(target, name, klass)
+        def public_method_refusal(target, name, klass)
           method = klass.instance_method(name)
           owner_refusal(target, name, method.owner) ||
-            (authored_for?(target, name, method, klass) ? nil : refused(name))
+            (authored_for?(target, name, method, klass) ? nil : service_refusal(name))
         end
 
         # A bound callable keeps its callable names and a record its member
@@ -102,7 +102,7 @@ module Kobako
           (klass <= Struct || klass <= Data) && target.members.include?(name)
         end
 
-        def refused(name)
+        def service_refusal(name)
           "method #{name.inspect} is not a Service method"
         end
 
@@ -110,7 +110,7 @@ module Kobako
           return nil unless ambient_owner?(owner, target)
           return nil if GADGET_OWNERS.include?(owner) && CALLABLE_ALLOW.include?(name)
 
-          refused(name)
+          service_refusal(name)
         end
 
         # The class a method lookup on +target+ starts at. A plain object's