makiri 0.5.1-aarch64-linux → 0.6.0-aarch64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dc9698d035a5e648a62aacda44694b0df5918e88cea61c52a061af4418976c7b
-  data.tar.gz: aae9379b5390003c757e98e77154c8d36e7620eaf9f0ad5b05a91af8816ba6a9
+  metadata.gz: 6c0a020c0e52029940d64a91b53ae459d08b1d53e3106c3b312b6c86601bc29a
+  data.tar.gz: 2d5bf5107d4de3892b70684aaad11b67f0f7eec74496e01132f79703db87262e
 SHA512:
-  metadata.gz: ef81933c52378d6368a71250397c4dd459a1fe106acf7e5974d96a82f7bee8bf74d0d1e74868d800a1efebfd0dfd8c6e99e82e689e92ce3e8b022f84a1b5bd16
-  data.tar.gz: 43d7cd497019cc3ed4f119e84d0f1a8608535187ae62f35caaa9cb2034f2021e425f8511e80e642fe861300db5c5041dc16f750767182a103aa0a44c51c0e920
+  metadata.gz: 6e0eda64911e48477808cf4b033b8f24fdbcb978558e27db9ea570bcd4364eb45e81e0a39b0c0e3ebe357aff622fb479e0c230b6c218f4f23ab760d3cd163cc8
+  data.tar.gz: 96f2da4e924ade762e57887c128bd70583330917a18f09abafd2721c2fdc61f647e5d1eb64544b8af753182c2e83d320b9dd2e02dcd384e3187ac27b3b27a352

data/.github/workflows/libfuzzer.yml

@@ -21,7 +21,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: [xml, xpath]
+        target: [xml, xpath, xml_xpath]
 
     steps:
       - name: Checkout (with vendored Lexbor submodule)

data/.github/workflows/verify.yml

@@ -0,0 +1,37 @@
+name: Verify
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  cbmc:
+    name: CBMC proofs
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout (with vendored Lexbor submodule)
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+
+      - name: Install CBMC
+        env:
+          CBMC_VERSION: "6.9.0"
+        run: |
+          curl -fsSLO "https://github.com/diffblue/cbmc/releases/download/cbmc-${CBMC_VERSION}/ubuntu-24.04-cbmc-${CBMC_VERSION}-Linux.deb"
+          sudo apt-get update
+          sudo apt-get install -y "./ubuntu-24.04-cbmc-${CBMC_VERSION}-Linux.deb"
+          cbmc --version
+
+      - name: Run verification suite
+        run: bundle exec rake verify

data/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [0.6.0] - 2026-07-05
+
+### Changed
+
+* Text and comment node content (`create_text_node`, `create_comment`,
+  `content=`) and attribute values (`[]=`, `set_attribute_ns`) now accept an
+  embedded NUL (U+0000) and store it verbatim, matching the WHATWG DOM and
+  browsers, instead of raising. Names, tag names, namespaces, CSS selectors, and
+  XPath expressions stay NUL-strict, and invalid UTF-8 is still rejected. XML
+  documents (`Makiri::XML`) are unchanged and still reject NUL everywhere, since
+  XML 1.0 has no legal U+0000 character.
+
 ## [0.5.1] - 2026-06-22
 
 ### Changed

data/README.md

@@ -267,6 +267,22 @@ Detailed, test-backed notes live in `spec/conformance/README.md`.
 * Type selectors are ASCII case-insensitive (CSS-correct for HTML; `LI` matches `<li>`)
   * `Nokogiri::HTML5` is case-sensitive there.
 
+### Text input (mutation APIs)
+
+* Programmatic string arguments must be **valid UTF-8** (invalid bytes raise
+  `Makiri::Error`, never silently repaired - unlike HTML *parsing*, which decodes
+  leniently to U+FFFD).
+* An embedded **NUL (U+0000)** is **accepted in HTML data-family content** -
+  text/comment node content (`create_text_node`, `create_comment`, `content=`)
+  and attribute values (`[]=`, `set_attribute_ns`) - and stored/read back
+  verbatim, matching the WHATWG DOM / browsers (`document.createTextNode("\0")`).
+  It is still **rejected** in names, tag names, namespaces, PI target/data, CSS
+  selectors, and XPath expressions/variable names (a NUL there raises).
+  * On re-parse, the HTML tokenizer replaces a U+0000 in text/attributes with
+    U+FFFD (WHATWG), so a serialized-then-reparsed round-trip is not byte-identical.
+  * `Makiri::XML` rejects NUL everywhere: XML 1.0 has no legal U+0000 character,
+    so admitting it would produce non-well-formed XML.
+
 ## Conformance
 
 The XPath engine and XML parser are original code, so their correctness is held by

data/Rakefile

@@ -287,6 +287,12 @@ task :oom do
   puts "(injection build left in place; run `rake clean compile` to restore a normal build)"
 end
 
+desc "CBMC proofs over the Ruby/Lexbor-free carve-out (core + XML + XPath front; " \
+     "needs cbmc; see docs/formal_verification.ja.md and verify/Makefile)"
+task :verify do
+  sh "make -C verify smoke selftest cbmc"
+end
+
 desc "Run the performance benchmark (Makiri vs Nokogiri reference)"
 task bench: :compile do
   # Run outside the bundle so the bench-only gems (nokogiri, benchmark-ips)

data/lib/makiri/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Makiri
-  VERSION = "0.5.1"
+  VERSION = "0.6.0"
 end

data/script/check_c_safety.rb

@@ -83,6 +83,17 @@ RULES = [
     # buffer unnoticed.
     regex: /\(\s*mkr_verified_text_t\s*\)\s*\{|\bmkr_verified_text_t\s+\w+\s*=\s*\{/
   ),
+  Rule.new(
+    id: "borrowed_text_forge",
+    message: "mkr_borrowed_text_t must be built via mkr_borrowed_text()/mkr_borrowed_text_lit()/mkr_borrowed_text_from_*, not a raw struct literal",
+    # Same two forge shapes as verified_text_forge. Not a capability guard (a raw
+    # literal is semantically identical to the constructor); it funnels the
+    # "asserted-valid borrowed slice" through the single named constructor so the
+    # assertion stays auditable, matching mkr_text.h's stated intent ("replacing
+    # scattered casts"). core/** - where the constructors live - is globally
+    # ignore-pathed, so the definitions in mkr_text.h are exempt automatically.
+    regex: /\(\s*mkr_borrowed_text_t\s*\)\s*\{|\bmkr_borrowed_text_t\s+\w+\s*=\s*\{/
+  ),
   # --- HTML/XML representation boundary (see docs/html_xml_boundary_hardening) ---
   # These symbols assume one DOM representation; using them outside their
   # representation-correct / kind-checked home is how shared glue (XPath, NodeSet,

data/script/check_c_safety_allowlist.yml

@@ -99,19 +99,16 @@ ignore_paths:
 
 # --- parser-TU reader discipline (raw_scan_call / raw_cursor_member) ---
 allowlist:
-  - path: ext/makiri/xpath/mkr_xpath_funcs_body.h
-    rule: raw_scan_call
-    max: 3
-    reason: "mkr_lookup_function's three strcmp over compile-time function-name tables: both sides are NUL-terminated (table literals / owned AST text), and the lookup signature takes bare const char* from the evaluator."
-
-  # --- verified_text_forge: the two Ruby-free test entry points. Neither can use
-  #     mkr_verified_text_from_view (bridge = Ruby boundary), so each mints the
-  #     token itself and must supply the contract by construction. ---
-  - path: ext/makiri/xpath/mkr_xpath_xml_selftest.c
-    rule: verified_text_forge
-    max: 2
-    reason: "Selftest expressions are compile-time string literals: NUL-terminated, NUL-free, valid UTF-8 by construction."
+  # --- verified_text_forge: the Ruby-free test entry points that mint over a
+  #     runtime buffer (not a compile-time literal, which uses
+  #     mkr_verified_text_lit). Neither can use mkr_verified_text_from_view
+  #     (bridge = Ruby boundary), so each mints itself and must supply the
+  #     contract by construction. ---
   - path: ext/makiri/fuzz/xpath_fuzz.c
     rule: verified_text_forge
     max: 1
     reason: "The libFuzzer harness mints over an owned mkr_strndup copy, which supplies NUL-termination and no-interior-NUL; UTF-8 validity is deliberately left to the lexer's strict decoder (its rejection path is fuzz-target behavior)."
+  - path: ext/makiri/fuzz/xml_xpath_fuzz.c
+    rule: verified_text_forge
+    max: 1
+    reason: "The expression mint is over an owned mkr_strndup copy, which supplies NUL-termination and no-interior-NUL; UTF-8 validity is pre-checked (the harness filters invalid UTF-8 before parsing). Mirrors xpath_fuzz.c."

data/suppressions/ruby.supp

@@ -125,6 +125,28 @@
   fun:mark_roots
 }
 
+# ---- incremental GC write barrier: uninitialised-value reads ----
+# An allocating Ruby C-API call from one of our cfuncs (e.g. rb_str_subseq in
+# mkr_xml_decode_input) fires the incremental-GC write barrier synchronously;
+# `gc_writebarrier_incremental` then reads an object's not-yet-written RVALUE
+# flag word via `RVALUE_BLACK_P` - the same uninit-flag false positive as the GC
+# drivers above, but reached through the barrier rather than a mark/sweep cycle,
+# so the driver-anchored entries miss it. Our code never touches RVALUE flags;
+# it only calls the allocating API, so anchoring on the barrier cannot mask a
+# real uninit read of ours.
+{
+  ruby-gc-cond-writebarrier_incremental
+  Memcheck:Cond
+  ...
+  fun:gc_writebarrier_incremental
+}
+{
+  ruby-gc-value8-writebarrier_incremental
+  Memcheck:Value8
+  ...
+  fun:gc_writebarrier_incremental
+}
+
 # ---- Ruby VM internal caches that are never freed before exit ----
 # The global constant-cache / inline method-cache id_table is allocated lazily
 # on method lookup and lives for the life of the VM, so RUBY_FREE_AT_EXIT still

data/verify/Makefile

@@ -0,0 +1,237 @@
+# Verification build for the XML + XPath carve-out.
+#
+# Fully separate from the gem's extconf build: nothing here touches ext/'s
+# Makefile or object files, and no Ruby VM or Lexbor library is linked (the
+# only Lexbor pieces are UNMODIFIED vendor encoding sources - the vanilla
+# constraint is about not patching, not about not compiling).
+#
+# Targets:
+#   make smoke      - build every CBMC harness as a plain executable and run it
+#                     (the link check: CBMC treats a missing function body as a
+#                     nondet return, so only the linker catches a wrong source list)
+#   make selftest   - build + run the carve-out selftest (XML parse + XPath eval,
+#                     no Ruby, no Lexbor lib)
+#   make cbmc       - the proven set (alloc/utf8/utf8-chain/utf8-words/span/
+#                     spanbuf/buf/hash/xml-chars/xpath-number; ~8 min total)
+#   make cbmc-deep  - the experimental set (xpath-lex/xpath-parse/xml-parse/
+#                     xml-expand).
+#                     These do NOT converge in practical time on current
+#                     bit-level solvers (measured: >10 min each even at 3-4
+#                     byte inputs, with MiniSat, kissat and Bitwuzla alike);
+#                     kept as tuning knobs for future solver/harness work,
+#                     e.g. make cbmc-xpath-parse XPATH_EXPR_MAX=4 XPATH_UNWIND=12
+#
+# Native libFuzzer targets live in ext/makiri/fuzz/ (their own Makefile + the
+# nightly libfuzzer.yml workflow), not here - this directory is proofs only.
+
+ROOT := ..
+EXT  := $(ROOT)/ext/makiri
+LXB  := $(ROOT)/vendor/lexbor/source
+
+CC     ?= cc
+CBMC   ?= cbmc
+CFLAGS ?= -O1 -g -Wall -Wextra
+# fmod & co. need an explicit -lm on Linux (folded into libc on macOS).
+LDLIBS ?= -lm
+INC    := -I $(EXT) -I $(LXB) -I .
+
+CORE_SRC  := $(EXT)/core/mkr_alloc.c $(EXT)/core/mkr_buf.c \
+             $(EXT)/core/mkr_core.c $(EXT)/core/mkr_utf8.c
+XML_SRC   := $(EXT)/xml/mkr_xml_chars.c $(EXT)/xml/mkr_xml_index.c \
+             $(EXT)/xml/mkr_xml_mutate.c $(EXT)/xml/mkr_xml_node.c \
+             $(EXT)/xml/mkr_xml_tree.c
+# Lexer/parser/number + shared support: what mkr_parse reaches.
+XPATH_FRONT_SRC := $(EXT)/xpath/mkr_xpath_lex.c $(EXT)/xpath/mkr_xpath_parse.c \
+                   $(EXT)/xpath/mkr_xpath_shared.c $(EXT)/xpath/mkr_xpath_number.c
+# The full engine: dispatcher + the XML monomorphization (HTML side is stub.c).
+XPATH_FULL_SRC  := $(XPATH_FRONT_SRC) $(EXT)/xpath/mkr_xpath.c \
+                   $(EXT)/xpath/mkr_xpath_engine_xml.c
+# Unmodified vendor sources for lxb_encoding_decode_valid_utf_8_single.
+LXB_ENC_SRC := $(LXB)/lexbor/encoding/decode.c $(LXB)/lexbor/encoding/multi_res.c \
+               $(LXB)/lexbor/encoding/range_res.c $(LXB)/lexbor/encoding/single_res.c
+
+ENGINE_SRC := $(CORE_SRC) $(XML_SRC) $(XPATH_FULL_SRC) $(LXB_ENC_SRC) stub.c
+
+BUILD := build
+
+# ---------------------------------------------------------------- smoke + selftest
+
+HARNESSES := alloc utf8 utf8-chain utf8-words span spanbuf buf hash xml-chars xml-expand xpath-number xpath-lex xpath-parse xml-parse
+
+smoke: $(HARNESSES:%=$(BUILD)/harness-%)
+	@for h in $^; do echo "== $$h"; $$h || exit 1; done
+	@echo "smoke: all harnesses link and run"
+
+$(BUILD)/harness-alloc: harness_alloc.c $(EXT)/core/mkr_alloc.c | $(BUILD)
+	$(CC) $(CFLAGS) $(INC) $^ -o $@ $(LDLIBS)
+$(BUILD)/harness-utf8: harness_utf8.c $(EXT)/core/mkr_utf8.c | $(BUILD)
+	$(CC) $(CFLAGS) $(INC) $^ -o $@ $(LDLIBS)
+$(BUILD)/harness-utf8-chain: harness_utf8_chain.c $(EXT)/core/mkr_utf8.c | $(BUILD)
+	$(CC) $(CFLAGS) $(INC) $^ -o $@ $(LDLIBS)
+$(BUILD)/harness-utf8-words: harness_utf8_words.c $(EXT)/core/mkr_utf8.c | $(BUILD)
+	$(CC) $(CFLAGS) $(INC) $^ -o $@ $(LDLIBS)
+$(BUILD)/harness-span: harness_span.c | $(BUILD)
+	$(CC) $(CFLAGS) $(INC) $^ -o $@ $(LDLIBS)
+$(BUILD)/harness-spanbuf: harness_spanbuf.c | $(BUILD)
+	$(CC) $(CFLAGS) $(INC) $^ -o $@ $(LDLIBS)
+$(BUILD)/harness-buf: harness_buf.c $(EXT)/core/mkr_buf.c $(EXT)/core/mkr_alloc.c | $(BUILD)
+	$(CC) $(CFLAGS) $(INC) $^ -o $@ $(LDLIBS)
+$(BUILD)/harness-hash: harness_hash.c | $(BUILD)
+	$(CC) $(CFLAGS) $(INC) $^ -o $@ $(LDLIBS)
+$(BUILD)/harness-xpath-number: harness_xpath_number.c $(EXT)/xpath/mkr_xpath_number.c $(EXT)/core/mkr_alloc.c | $(BUILD)
+	$(CC) $(CFLAGS) $(INC) $^ -o $@ $(LDLIBS)
+# mkr_parse's limit checks + limits_init_defaults live in mkr_xpath.c (the
+# dispatcher), which references both engine instances - so the smoke link
+# takes the full engine (stub.c supplies the HTML side).
+$(BUILD)/harness-xpath-parse: harness_xpath_parse.c $(ENGINE_SRC) | $(BUILD)
+	$(CC) $(CFLAGS) $(INC) $^ -o $@ $(LDLIBS)
+$(BUILD)/harness-xpath-lex: harness_xpath_lex.c $(ENGINE_SRC) | $(BUILD)
+	$(CC) $(CFLAGS) $(INC) $^ -o $@ $(LDLIBS)
+$(BUILD)/harness-xml-parse: harness_xml_parse.c $(XML_SRC) $(CORE_SRC) | $(BUILD)
+	$(CC) $(CFLAGS) $(INC) $^ -o $@ $(LDLIBS)
+$(BUILD)/harness-xml-chars: harness_xml_chars.c $(XML_SRC) $(CORE_SRC) | $(BUILD)
+	$(CC) $(CFLAGS) $(INC) $^ -o $@ $(LDLIBS)
+$(BUILD)/harness-xml-expand: harness_xml_expand.c $(XML_SRC) $(CORE_SRC) | $(BUILD)
+	$(CC) $(CFLAGS) $(INC) $^ -o $@ $(LDLIBS)
+
+selftest: $(BUILD)/selftest
+	$(BUILD)/selftest
+
+$(BUILD)/selftest: selftest_main.c $(ENGINE_SRC) $(EXT)/xpath/mkr_xpath_xml_selftest.c | $(BUILD)
+	$(CC) $(CFLAGS) $(INC) $^ -o $@ $(LDLIBS)
+
+$(BUILD):
+	mkdir -p $(BUILD)
+
+# ---------------------------------------------------------------- CBMC proofs
+#
+# Every proof gets --bounds-check --pointer-check (memory safety) and
+# --signed-overflow-check (UB); --unsigned-overflow-check is added ONLY where
+# wrapping would be a bug (the size arithmetic) - the UTF-8 validator's
+# word-at-a-time scan and hash-style code wrap on purpose, and unsigned wrap
+# is defined C. --malloc-may-fail --malloc-fail-null verifies the fail-closed
+# OOM branches. Unwind bounds are per-harness knobs; --unwinding-assertions
+# turns "too small a bound" into a failure instead of a silent partial proof.
+
+CBMC_MEM := --bounds-check --pointer-check --signed-overflow-check \
+            --div-by-zero-check --unwinding-assertions --object-bits 12
+CBMC_OOM := --malloc-may-fail --malloc-fail-null
+# libc bodies CBMC lacks on this platform (see the file's comment).
+CBMC_MODELS := cbmc_models.c
+
+# mkr_grow_capacity doubles from 8, so <= ~60 iterations before the cap check.
+ALLOC_UNWIND ?= 64
+cbmc-alloc:
+	$(CBMC) harness_alloc.c $(CBMC_MODELS) $(EXT)/core/mkr_alloc.c $(INC) \
+	  $(CBMC_MEM) $(CBMC_OOM) --unsigned-overflow-check --conversion-check \
+	  --unwind $(ALLOC_UNWIND)
+
+UTF8_UNWIND ?= 12
+cbmc-utf8:
+	$(CBMC) harness_utf8.c $(CBMC_MODELS) $(EXT)/core/mkr_utf8.c $(INC) \
+	  $(CBMC_MEM) --unwind $(UTF8_UNWIND)
+
+# Chain length and unwind grow together (unwind must exceed the byte count;
+# see the harness header for the measured length/time trade-off).
+UTF8_CHAIN_MAX    ?= 12
+UTF8_CHAIN_UNWIND ?= 16
+cbmc-utf8-chain:
+	$(CBMC) harness_utf8_chain.c $(CBMC_MODELS) $(EXT)/core/mkr_utf8.c $(INC) \
+	  -DVERIFY_UTF8_CHAIN_MAX=$(UTF8_CHAIN_MAX) \
+	  $(CBMC_MEM) --unwind $(UTF8_CHAIN_UNWIND)
+
+cbmc-utf8-words:
+	$(CBMC) harness_utf8_words.c $(CBMC_MODELS) $(EXT)/core/mkr_utf8.c $(INC) \
+	  $(CBMC_MEM) --unwind 20
+
+SPAN_UNWIND ?= 12
+cbmc-span:
+	$(CBMC) harness_span.c $(CBMC_MODELS) $(INC) \
+	  $(CBMC_MEM) --unwind $(SPAN_UNWIND)
+
+cbmc-spanbuf:
+	$(CBMC) harness_spanbuf.c $(CBMC_MODELS) $(INC) \
+	  $(CBMC_MEM) --unwind $(SPAN_UNWIND)
+
+cbmc-buf:
+	$(CBMC) harness_buf.c $(CBMC_MODELS) $(EXT)/core/mkr_buf.c $(EXT)/core/mkr_alloc.c $(INC) \
+	  $(CBMC_MEM) $(CBMC_OOM) --unwind 16
+
+# The sizer only shifts, so unlike the mul/div guards this closes at full
+# width; the loop runs at most one step per size_t bit.
+HASH_UNWIND ?= 66
+cbmc-hash:
+	$(CBMC) harness_hash.c $(CBMC_MODELS) $(INC) \
+	  $(CBMC_MEM) --unwind $(HASH_UNWIND)
+
+# XML character classes: predicate inclusions over all code points + the
+# validators cross-checked against the independent UTF-8 validator. CBMC only
+# needs mkr_xml_chars.c + mkr_utf8.c (the other xml/ entries the header
+# declares stay bodyless - unreachable from this harness).
+XML_CHARS_UNWIND ?= 12
+cbmc-xml-chars:
+	$(CBMC) harness_xml_chars.c $(CBMC_MODELS) $(EXT)/xml/mkr_xml_chars.c $(EXT)/core/mkr_utf8.c $(INC) \
+	  $(CBMC_MEM) --unwind $(XML_CHARS_UNWIND)
+
+# The XPath Number scanner/converter. The cbmc_models.c strtod ("conversion
+# unavailable") steers from_extent down its own fallback chain - the isolating
+# reparse and the hand assembly, i.e. exactly our code - on every input; the
+# libc-success path is trusted, not verified (like memcpy).
+cbmc-xpath-number:
+	$(CBMC) harness_xpath_number.c $(CBMC_MODELS) $(EXT)/xpath/mkr_xpath_number.c $(EXT)/core/mkr_alloc.c $(INC) \
+	  $(CBMC_MEM) $(CBMC_OOM) --unwind 12
+
+cbmc: cbmc-alloc cbmc-utf8 cbmc-utf8-chain cbmc-utf8-words cbmc-span cbmc-spanbuf cbmc-buf cbmc-hash cbmc-xml-chars cbmc-xpath-number
+	@echo "cbmc: all proofs passed"
+
+# ------------------------------------------------- experimental (cbmc-deep)
+#
+# The whole-entry parser/lexer proofs below are formulated and smoke-checked,
+# but no current solver closes them in practical time (see the header). CBMC
+# gets mkr_xpath.c for the limit checks but NOT the engine instances or the
+# vendor encoding tables (nothing there is reachable from mkr_parse; the eval
+# entries mkr_xpath.c references stay bodyless - unreachable from these
+# harnesses). Expression/input length and unwind grow together.
+
+XPATH_EXPR_MAX ?= 6
+XPATH_UNWIND   ?= 16
+cbmc-xpath-lex:
+	$(CBMC) harness_xpath_lex.c $(CBMC_MODELS) $(XPATH_FRONT_SRC) $(EXT)/xpath/mkr_xpath.c $(CORE_SRC) $(INC) \
+	  -DVERIFY_XPATH_EXPR_MAX=$(XPATH_EXPR_MAX) \
+	  $(CBMC_MEM) --unwind $(XPATH_UNWIND)
+
+cbmc-xpath-parse:
+	$(CBMC) harness_xpath_parse.c $(CBMC_MODELS) $(XPATH_FRONT_SRC) $(EXT)/xpath/mkr_xpath.c $(CORE_SRC) $(INC) \
+	  -DVERIFY_XPATH_EXPR_MAX=$(XPATH_EXPR_MAX) \
+	  $(CBMC_MEM) $(CBMC_OOM) --unwind $(XPATH_UNWIND)
+
+XML_INPUT_MAX ?= 6
+XML_UNWIND    ?= 16
+cbmc-xml-parse:
+	$(CBMC) harness_xml_parse.c $(CBMC_MODELS) $(XML_SRC) $(CORE_SRC) $(INC) \
+	  -DVERIFY_XML_INPUT_MAX=$(XML_INPUT_MAX) \
+	  $(CBMC_MEM) $(CBMC_OOM) --unwind $(XML_UNWIND)
+
+# Entity/char-ref expansion over nondet valid-UTF-8 input (the document it
+# writes into is parsed from a concrete 4-byte input, so only the expansion
+# input is nondet). Does not converge: 7-byte input, --unwind 12, still in
+# BMC when the 420 s alarm killed it (measured; higher unwinds are strictly
+# larger). No $(CBMC_OOM): a NULL doc is treated as early-exit, OOM injection
+# is not what this harness is about.
+# Also measured: 5-byte input still did not converge in 6 min - the cost is
+# the whole-parser+arena state behind the doc handle, not the input length.
+XML_EXPAND_MAX    ?= 7
+XML_EXPAND_UNWIND ?= 12
+cbmc-xml-expand:
+	$(CBMC) harness_xml_expand.c $(CBMC_MODELS) $(XML_SRC) $(CORE_SRC) $(INC) \
+	  -DVERIFY_XML_EXPAND_MAX=$(XML_EXPAND_MAX) \
+	  $(CBMC_MEM) --unwind $(XML_EXPAND_UNWIND)
+
+cbmc-deep: cbmc-xpath-lex cbmc-xpath-parse cbmc-xml-parse cbmc-xml-expand
+
+clean:
+	rm -rf $(BUILD)
+
+.PHONY: smoke selftest cbmc cbmc-alloc cbmc-utf8 cbmc-utf8-chain cbmc-utf8-words cbmc-span \
+        cbmc-spanbuf cbmc-buf cbmc-hash cbmc-xml-chars cbmc-xpath-number \
+        cbmc-deep cbmc-xpath-lex cbmc-xpath-parse cbmc-xml-parse cbmc-xml-expand clean

data/verify/cbmc_models.c

@@ -0,0 +1,38 @@
+/* Plain-C bodies for libc functions CBMC's built-in library does not model on
+ * this platform (a bodyless callee havocs its return value, turning every
+ * downstream pointer check into a false failure). Compiled ONLY into the CBMC
+ * runs, never into the smoke/selftest/fuzzer builds (those link the real libc).
+ * Each body is the obvious reference implementation, so proving against it is
+ * proving against the function's contract. */
+#ifdef __CPROVER__
+
+#include <stddef.h>
+#include <stdlib.h> /* the SDK's strtod declaration carries an asm alias
+                     * (_strtod on macOS); defining without it leaves the
+                     * callee bodyless under its aliased name */
+#include <string.h>
+
+void *
+memchr(const void *s, int c, size_t n)
+{
+    const unsigned char *p = s;
+    for (size_t i = 0; i < n; ++i) {
+        if (p[i] == (unsigned char)c) return (void *)(p + i);
+    }
+    return NULL;
+}
+
+/* strtod, modeled as "libc conversion unavailable" (no bytes consumed). This
+ * is a deliberate choice, not a shortcut: correctly-rounded decimal parsing is
+ * libc territory we trust rather than verify (like memcpy), and this model
+ * steers every caller down its own fallback - for mkr_xpath_number_from_extent
+ * that means the isolating-reparse and hand-assembly paths, i.e. exactly OUR
+ * code, get proven on all inputs. */
+double
+strtod(const char *nptr, char **endptr)
+{
+    if (endptr != NULL) *endptr = (char *)nptr;
+    return 0.0;
+}
+
+#endif /* __CPROVER__ */