bashkit 0.14.5__tar.gz → 0.15.0__tar.gz

{bashkit-0.14.5 → bashkit-0.15.0}/Cargo.lock

@@ -386,7 +386,7 @@ checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
 [[package]]
 name = "bashkit"
-version = "0.14.5"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -441,7 +441,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-bench"
-version = "0.14.5"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "bashkit",
@@ -454,9 +454,19 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "bashkit-capi"
+version = "0.15.0"
+dependencies = [
+ "bashkit",
+ "serde",
+ "serde_json",
+ "tokio",
+]
+
 [[package]]
 name = "bashkit-cli"
-version = "0.14.5"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "bashkit",
@@ -470,7 +480,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-coreutils-port"
-version = "0.14.5"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "prettyplease",
@@ -484,7 +494,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-eval"
-version = "0.14.5"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -501,7 +511,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-js"
-version = "0.14.5"
+version = "0.15.0"
 dependencies = [
  "bashkit",
  "napi",
@@ -513,7 +523,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-python"
-version = "0.14.5"
+version = "0.15.0"
 dependencies = [
  "bashkit",
  "num-bigint",
@@ -525,7 +535,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-wasm"
-version = "0.14.5"
+version = "0.15.0"
 dependencies = [
  "bashkit",
  "console_error_panic_hook",
@@ -4317,9 +4327,9 @@ dependencies = [
 
 [[package]]
 name = "russh"
-version = "0.62.4"
+version = "0.62.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8b67b5a0d8068c89dcbe9d95df986af7a851d1f3c604525274c37468e60464f"
+checksum = "da7c230e0ed9cbeb92fbad6c8848985d6df2a1464c0dc247a021abd666e9005e"
 dependencies = [
  "aes 0.9.1",
  "aws-lc-rs",

{bashkit-0.14.5 → bashkit-0.15.0}/Cargo.toml

@@ -7,7 +7,7 @@ resolver = "2"
 members = ["crates/*"]
 
 [workspace.package]
-version = "0.14.5"
+version = "0.15.0"
 edition = "2024"
 license = "MIT"
 authors = ["Mykhailo Chalyi <mike@chaliy.name>", "Everruns"]

{bashkit-0.14.5 → bashkit-0.15.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bashkit
-Version: 0.14.5
+Version: 0.15.0
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License

{bashkit-0.14.5 → bashkit-0.15.0}/bashkit/__init__.py

@@ -51,11 +51,15 @@ from bashkit._bashkit import (
     BashTool,
     BuiltinContext,
     BuiltinResult,
+    CapabilityFingerprint,
     ExecResult,
     FileSystem,
+    PackedCommit,
     ScriptAnalysis,
     ScriptedTool,
     ShellState,
+    SnapshotDiff,
+    SnapshotGraph,
     create_langchain_tool_spec,
     get_version,
 )
@@ -69,11 +73,15 @@ __all__ = [
     "BuiltinContext",
     "BuiltinResult",
     "BashTool",
+    "CapabilityFingerprint",
     "ExecResult",
     "FileSystem",
+    "PackedCommit",
     "ShellState",
     "ScriptAnalysis",
     "ScriptedTool",
+    "SnapshotDiff",
+    "SnapshotGraph",
     "create_langchain_tool_spec",
     "get_version",
 ]

{bashkit-0.14.5 → bashkit-0.15.0}/bashkit/_bashkit.pyi

@@ -688,6 +688,38 @@ class Bash:
         """
         ...
 
+    def commit(
+        self,
+        parents: list[str] | None = None,
+        meta: dict[str, str] | None = None,
+        have: list[str] | None = None,
+        exclude_filesystem: bool = False,
+        exclude_functions: bool = False,
+    ) -> PackedCommit:
+        """Capture state as a content-addressed commit for session history.
+
+        Pass ``have`` (ids your store already holds) to keep commits
+        incremental. A fork is a commit whose parent is not the branch tip.
+        """
+        ...
+
+    def checkout(
+        self,
+        commit_id: str,
+        objects: dict[str, bytes],
+        policy: str = "superset",
+    ) -> None:
+        """Restore the state a commit describes, pulling objects from a store.
+
+        ``policy`` is ``"superset"`` (default), ``"strict"``, or ``"force"``.
+        Nothing is mutated if the checkout fails.
+        """
+        ...
+
+    def capabilities(self) -> CapabilityFingerprint:
+        """Fingerprint this instance's environment."""
+        ...
+
     def snapshot(
         self,
         exclude_filesystem: bool = False,
@@ -1696,3 +1728,110 @@ def get_version() -> str:
         True
     """
     ...
+
+class PackedCommit:
+    """A commit plus the objects a host needs to persist."""
+
+    @property
+    def id(self) -> str:
+        """Content address of this commit — store it per message."""
+        ...
+
+    @property
+    def objects(self) -> dict[str, bytes]:
+        """Objects to persist, keyed by hex object id."""
+        ...
+
+    @property
+    def object_count(self) -> int:
+        """Number of new objects this commit emitted."""
+        ...
+
+    @property
+    def stored_bytes(self) -> int:
+        """Total encoded size of the new objects."""
+        ...
+
+    @property
+    def is_self_contained(self) -> bool:
+        """Whether this commit carries every object needed to restore it."""
+        ...
+
+    def to_bytes(self) -> bytes:
+        """Serialize into one self-contained blob, like ``snapshot()``.
+
+        Raises ``BashError`` for an incremental commit, which omits objects.
+        """
+        ...
+
+class SnapshotDiff:
+    """What changed between two commits."""
+
+    @property
+    def files_added(self) -> list[str]: ...
+    @property
+    def files_modified(self) -> list[str]: ...
+    @property
+    def files_removed(self) -> list[str]: ...
+    @property
+    def shell_changed(self) -> bool: ...
+    def is_empty(self) -> bool:
+        """True when nothing changed."""
+        ...
+
+class CapabilityFingerprint:
+    """The environment that produced a commit."""
+
+    @property
+    def bashkit_version(self) -> str: ...
+    @property
+    def builtins(self) -> list[str]: ...
+    @property
+    def features(self) -> list[str]: ...
+    @property
+    def fs_backend(self) -> str: ...
+
+class SnapshotGraph:
+    """Read-only operations over a snapshot object graph.
+
+    Every method takes the objects it needs — bashkit never reaches into host
+    storage — and walks only as far as the supplied store reaches.
+    """
+
+    @staticmethod
+    def parents(commit_id: str, objects: dict[str, bytes]) -> list[str]:
+        """Commits this one descends from."""
+        ...
+
+    @staticmethod
+    def meta(commit_id: str, objects: dict[str, bytes]) -> dict[str, str]:
+        """Host metadata attached when the commit was made."""
+        ...
+
+    @staticmethod
+    def capabilities(commit_id: str, objects: dict[str, bytes]) -> CapabilityFingerprint:
+        """Capability fingerprint of the producing instance."""
+        ...
+
+    @staticmethod
+    def ancestry(commit_id: str, objects: dict[str, bytes], limit: int = 100) -> list[str]:
+        """Walk ancestry newest-first, stopping at ``limit`` or a missing commit."""
+        ...
+
+    @staticmethod
+    def plan_checkout(commit_id: str, objects: dict[str, bytes]) -> list[str]:
+        """Object ids needed to check out this commit that ``objects`` lacks.
+
+        Call repeatedly — each wave reveals the next — until it returns ``[]``.
+        """
+        ...
+
+    @staticmethod
+    def reachable(commit_id: str, objects: dict[str, bytes]) -> list[str]:
+        """Every object this commit reaches, for host-side garbage collection."""
+        ...
+
+    @staticmethod
+    def diff(commit_a: str, commit_b: str, objects: dict[str, bytes]) -> SnapshotDiff:
+        """Compare two commits."""
+        ...

{bashkit-0.14.5 → bashkit-0.15.0}/crates/bashkit/Cargo.toml

@@ -206,6 +206,10 @@ harness = false
 name = "file_ops"
 harness = false
 
+[[bench]]
+name = "snapshot_history"
+harness = false
+
 [[bench]]
 name = "sqlite"
 harness = false

{bashkit-0.14.5 → bashkit-0.15.0}/crates/bashkit/README.md

@@ -532,6 +532,13 @@ See [crates/bashkit-bench/README.md](crates/bashkit-bench/README.md) for methodo
 
 ## Language Bindings
 
+### C API
+
+The experimental `libbashkit` native C ABI exposes opaque handles, synchronous
+execution, and binary-safe virtual filesystem access. See
+[`crates/bashkit-capi`](crates/bashkit-capi/README.md), including two runnable C
+examples.
+
 ### Python
 
 Python bindings with LangChain integration are available in [crates/bashkit-python](crates/bashkit-python/README.md).

bashkit-0.15.0/crates/bashkit/benches/results/criterion-snapshot-history-baseline-linux-x86_64-1785444523.md

@@ -0,0 +1,118 @@
+# criterion — snapshot_history — baseline
+
+First run of `cargo bench -p bashkit --bench snapshot_history`, establishing the
+baseline for the content-addressed snapshot object graph.
+
+- **Host**: Intel Xeon @ 2.80 GHz, 4 vCPU, Linux x86_64 (no SHA-NI)
+- **Command**: `cargo bench -p bashkit --bench snapshot_history -- --warm-up-time 1 --measurement-time 2`
+- **Workload**: `N` small text files under `/w/src`, plus one 20 000-line file
+  under `/w/docs` so both the inline and chunked paths are exercised
+- **Moniker**: `baseline` — first measurement of this bench, nothing to diff against
+
+## Size — the number that motivated the work
+
+Bytes for the same state, and the marginal cost of one more commit after
+appending to a single file.
+
+| files | v1 JSON | v2 packed | ratio | incremental commit |
+|------:|--------:|----------:|------:|-------------------:|
+| 10 | 330 594 | 43 816 | 7.55x | 1 151 |
+| 100 | 354 896 | 56 600 | 6.27x | 4 419 |
+| 500 | 464 496 | 113 756 | 4.08x | 18 929 |
+
+The packed format alone is 4-7.5x smaller. The number that decides whether
+per-message history is affordable is the last column: storing another commit
+after a one-file edit costs **1.1 KB / 4.4 KB / 19 KB**, against a 330-464 KB
+full v1 snapshot — 287x, 80x, and 24x cheaper respectively.
+
+The ratio narrows as file count grows because the tree is a **single flat
+object** listing every path, so each commit re-stores the whole tree. At 500
+files that tree dominates the incremental cost. Splitting trees per directory
+(git-style) would make it O(changed paths + depth) instead of O(total files);
+see the known gaps in `knowledge/foundations/snapshot-history.md`.
+
+## Capture
+
+| workload | v1 JSON | v2 packed | v2 incremental |
+|---|---:|---:|---:|
+| 10 files | 2.02 ms | 4.41 ms | **715 µs** |
+| 100 files | 2.21 ms | 5.81 ms | **853 µs** |
+| 500 files | 2.88 ms | 11.25 ms | **1.46 ms** |
+
+Packed capture is 2-4x *slower* than v1: it hashes, chunks, and deflates
+everything, where v1 only serialized. That is the price of content addressing,
+paid on the checkpoint/resume path.
+
+The steady-state path is the incremental column — a warm store, so unchanged
+objects are hashed but neither compressed nor emitted. It is 1.4-2.8x faster
+than a v1 full snapshot *and* orders of magnitude smaller, which is the
+combination session history needs.
+
+## Restore
+
+| workload | v1 JSON | v2 packed | v2 checkout |
+|---|---:|---:|---:|
+| 10 files | 2.78 ms | 1.38 ms | **1.16 ms** |
+| 100 files | 3.00 ms | 1.74 ms | **1.43 ms** |
+| 500 files | 4.04 ms | 3.70 ms | **3.05 ms** |
+
+v2 restores faster than v1 at every size — decoding a binary container beats
+parsing a JSON integer array per byte. `checkout` from a store beats unpacking
+a container because it skips container framing entirely.
+
+## Graph operations
+
+100-file workspace, two commits.
+
+| operation | time |
+|---|---:|
+| `diff` | 149 µs |
+| `plan_checkout` (warm store) | 1.26 ms |
+| `reachable` | 1.27 ms |
+
+`diff` compares content addresses rather than content, so it never reads file
+data — which is why it is an order of magnitude cheaper than the walks.
+
+## Reading these numbers
+
+Capture time is dominated by SHA-256, and this host has no SHA-NI (measured
+~215 MB/s, against ~1.5-2 GB/s expected on hardware that has it). Expect the
+packed-capture regression to shrink materially on production hardware. Nothing
+here is hash-bound on the restore side.
+
+
+## Large binary files
+
+Separate probe (`cargo run --release -p bashkit --example large_binary_probe`),
+incompressible pseudo-random content, single file, same host. Not a criterion
+bench — one-shot timings, so treat them as magnitudes.
+
+| size | objects | stored | commit | checkout | 16-byte edit | peak RSS |
+|-----:|--------:|-------:|-------:|---------:|-------------:|---------:|
+| 1 MB | 51 | 1.00x | 22 ms | 10 ms | 8.8 KB | 13 MB |
+| 8 MB | 436 | 1.00x | 123 ms | 61 ms | 77 KB | 62 MB |
+| 32 MB | 1 776 | 1.00x | 489 ms | 257 ms | 80 KB | 230 MB |
+| 64 MB | 3 575 | 1.00x | 1 003 ms | 556 ms | 152 KB | 455 MB |
+
+What this shows:
+
+- **Chunking earns its keep on binary.** A 16-byte edit in the middle of a
+  64 MB file costs 152 KB, not 64 MB — roughly 440x better than re-storing.
+  Content round-trips byte for byte.
+- **Incompressible data is stored raw** (1.00x), as intended: deflate is not
+  allowed to inflate an object.
+- **Commit throughput is ~64 MB/s** after the compressibility probe landed.
+  Before it, deflating incompressible chunks and discarding every result cost
+  2 439 ms at 64 MB — the probe cut that to 1 003 ms with identical output.
+- **Peak RSS runs ~5x file size** during commit (the figures above include the
+  probe's own two copies of the payload). `VfsSnapshot` clones every file's
+  content before the object encoder sees it, so a streaming `vfs_snapshot` is
+  what would fix this.
+- **The per-edit floor is the file manifest**, at 32 bytes per chunk — about
+  2 KB per MB of file, re-stored whole on every edit. That is what dominates
+  the 152 KB figure at 64 MB, not the changed chunk. Chunking the manifest
+  itself would remove it, the same shape as the flat-tree limit above.
+
+Practical read: files up to a few MB are comfortable. Tens of MB work but cost
+seconds of commit time and hundreds of MB of transient memory, so a workspace
+built around large binaries wants the streaming snapshot first.

bashkit-0.15.0/crates/bashkit/benches/snapshot_history.rs

@@ -0,0 +1,213 @@
+//! Snapshot history benchmark: what a per-message snapshot actually costs.
+//!
+//! Measures the two questions that decide whether storing a snapshot per
+//! conversation turn is affordable:
+//!
+//! 1. **Time** — encode and restore latency for the v1 JSON format, the v2
+//!    packed container, and an incremental commit against a warm store.
+//! 2. **Size** — bytes on the wire for the same state in each format, and the
+//!    marginal cost of one more commit after a small edit.
+//!
+//! The size table is printed once at startup, since criterion only reports
+//! time. Results belong in `crates/bashkit/benches/results/` as
+//! `criterion-snapshot-history-<moniker>-<timestamp>.md`.
+
+use bashkit::{Bash, CheckoutPolicy, CommitOptions, ObjectId, SnapshotOptions};
+use criterion::{BenchmarkId, Criterion, Throughput, criterion_group, criterion_main};
+use std::collections::HashMap;
+use tokio::runtime::Runtime;
+
+type Store = HashMap<ObjectId, Vec<u8>>;
+
+/// Workspace sizes, in files. A conversational agent's sandbox usually sits at
+/// the low end; the large case shows how the cost scales.
+const FILE_COUNTS: &[usize] = &[10, 100, 500];
+
+/// Build a workspace with `files` text files plus one large file, so both the
+/// inline and chunked paths are exercised.
+fn workspace(rt: &Runtime, files: usize) -> Bash {
+    let mut bash = Bash::builder()
+        .limits(bashkit::ExecutionLimits::new().max_commands(1_000_000))
+        .build();
+    rt.block_on(async {
+        bash.exec("mkdir -p /w/src /w/docs").await.unwrap();
+        for i in 0..files {
+            bash.exec(&format!(
+                "echo 'module {i}: the quick brown fox jumps over the lazy dog' > /w/src/f{i}.txt"
+            ))
+            .await
+            .unwrap();
+        }
+        // One file big enough to chunk, so chunk-level dedup is measured too.
+        bash.exec("seq 1 20000 > /w/docs/big.txt").await.unwrap();
+    });
+    bash
+}
+
+/// Seed a store with a full commit and return it alongside the commit id.
+fn warm_store(bash: &Bash) -> Store {
+    let packed = bash.commit(CommitOptions::new()).unwrap();
+    packed.into_objects().collect()
+}
+
+/// Print the size comparison the timing benchmarks cannot show.
+fn report_sizes(rt: &Runtime) {
+    println!("\n=== snapshot size comparison ===");
+    println!(
+        "{:>6} | {:>10} | {:>10} | {:>7} | {:>14}",
+        "files", "v1 json", "v2 packed", "ratio", "incremental"
+    );
+    println!(
+        "{:->6}-+-{:->10}-+-{:->10}-+-{:->7}-+-{:->14}",
+        "", "", "", "", ""
+    );
+
+    for &files in FILE_COUNTS {
+        let mut bash = workspace(rt, files);
+
+        let v1 = bash
+            .snapshot_state(SnapshotOptions::default())
+            .to_bytes()
+            .unwrap()
+            .len();
+        let v2 = bash.snapshot().unwrap().len();
+
+        // Cost of the next commit after touching a single file — the number
+        // that decides whether per-message history is affordable.
+        let store = warm_store(&bash);
+        rt.block_on(async {
+            bash.exec("echo 'edited' >> /w/src/f0.txt").await.unwrap();
+        });
+        let incremental = bash
+            .commit(CommitOptions::new().have(store.keys()))
+            .unwrap()
+            .stored_bytes();
+
+        println!(
+            "{files:>6} | {v1:>10} | {v2:>10} | {:>6.2}x | {incremental:>14}",
+            v1 as f64 / v2 as f64
+        );
+    }
+    println!();
+}
+
+fn bench_capture(c: &mut Criterion) {
+    let rt = Runtime::new().unwrap();
+    report_sizes(&rt);
+
+    let mut group = c.benchmark_group("snapshot_capture");
+    for &files in FILE_COUNTS {
+        let bash = workspace(&rt, files);
+        group.throughput(Throughput::Elements(files as u64));
+
+        group.bench_with_input(BenchmarkId::new("v1_json", files), &files, |b, _| {
+            b.iter(|| {
+                bash.snapshot_state(SnapshotOptions::default())
+                    .to_bytes()
+                    .unwrap()
+            });
+        });
+
+        group.bench_with_input(BenchmarkId::new("v2_packed", files), &files, |b, _| {
+            b.iter(|| bash.snapshot().unwrap());
+        });
+
+        // The steady-state case for session history: a warm store, so only
+        // changed content is encoded.
+        let store = warm_store(&bash);
+        group.bench_with_input(BenchmarkId::new("v2_incremental", files), &files, |b, _| {
+            b.iter(|| {
+                bash.commit(CommitOptions::new().have(store.keys()))
+                    .unwrap()
+            });
+        });
+    }
+    group.finish();
+}
+
+fn bench_restore(c: &mut Criterion) {
+    let rt = Runtime::new().unwrap();
+    let mut group = c.benchmark_group("snapshot_restore");
+
+    for &files in FILE_COUNTS {
+        let bash = workspace(&rt, files);
+        group.throughput(Throughput::Elements(files as u64));
+
+        let v1 = bash
+            .snapshot_state(SnapshotOptions::default())
+            .to_bytes()
+            .unwrap();
+        group.bench_with_input(BenchmarkId::new("v1_json", files), &files, |b, _| {
+            b.iter(|| {
+                let mut target = Bash::new();
+                target
+                    .restore_snapshot_with_policy(&v1, CheckoutPolicy::Force)
+                    .unwrap();
+            });
+        });
+
+        let v2 = bash.snapshot().unwrap();
+        group.bench_with_input(BenchmarkId::new("v2_packed", files), &files, |b, _| {
+            b.iter(|| {
+                let mut target = Bash::new();
+                target
+                    .restore_snapshot_with_policy(&v2, CheckoutPolicy::Force)
+                    .unwrap();
+            });
+        });
+
+        // Checkout from a store, which is how a fork or a rewind is served.
+        let store = warm_store(&bash);
+        let id = bash.commit(CommitOptions::new()).unwrap().id();
+        group.bench_with_input(BenchmarkId::new("v2_checkout", files), &files, |b, _| {
+            b.iter(|| {
+                let mut target = Bash::new();
+                target.checkout(id, &store, CheckoutPolicy::Force).unwrap();
+            });
+        });
+    }
+    group.finish();
+}
+
+fn bench_history_ops(c: &mut Criterion) {
+    let rt = Runtime::new().unwrap();
+    let mut group = c.benchmark_group("snapshot_history_ops");
+
+    let mut bash = workspace(&rt, 100);
+    let mut store = Store::new();
+    let first = {
+        let packed = bash.commit(CommitOptions::new()).unwrap();
+        let id = packed.id();
+        store.extend(packed.into_objects());
+        id
+    };
+    rt.block_on(async {
+        bash.exec("echo more >> /w/src/f1.txt; rm /w/src/f2.txt; echo new > /w/src/added.txt")
+            .await
+            .unwrap();
+    });
+    let second = {
+        let packed = bash
+            .commit(CommitOptions::new().parent(first).have(store.keys()))
+            .unwrap();
+        let id = packed.id();
+        store.extend(packed.into_objects());
+        id
+    };
+
+    // Diff compares content addresses, so it never reads file content.
+    group.bench_function("diff", |b| {
+        b.iter(|| bashkit::SnapshotGraph::diff(first, second, &store).unwrap());
+    });
+    group.bench_function("plan_checkout_warm", |b| {
+        b.iter(|| bashkit::SnapshotGraph::plan_checkout(second, &store).unwrap());
+    });
+    group.bench_function("reachable", |b| {
+        b.iter(|| bashkit::SnapshotGraph::reachable(second, &store).unwrap());
+    });
+
+    group.finish();
+}
+
+criterion_group!(benches, bench_capture, bench_restore, bench_history_ops);
+criterion_main!(benches);

{bashkit-0.14.5 → bashkit-0.15.0}/crates/bashkit/docs/threat-model.md

@@ -152,6 +152,7 @@ let bash = Bash::builder()
 | Subshell snapshot amplification (TM-DOS-092) | Deeply nested `( … )` | `max_subshell_depth` counter (default 32) | MITIGATED |
 | jq unbounded generator (TM-DOS-093) | `jq -n 'repeat(1)'` / `range(0;1e18)` | Cap output at `max_stdout_bytes`; poll deadline every 4096 values | FIXED |
 | Persistent history memory DoS (TM-DOS-094) | Unbounded command history in long-lived instances | `ExecutionLimits` caps history entries/bytes/output | FIXED |
+| Multi-component glob amplification (TM-DOS-095) | `/*/*/*/*` multiplies the candidate set at each component | Reject patterns deeper than `max_path_depth`; cap live candidates at `max_file_count` | FIXED |
 
 ### Sandbox Escape (TM-ESC-*)
 
@@ -532,6 +533,7 @@ All unexpected errors are caught and converted to safe, human-readable messages.
 | Memory addr in errors (TM-INT-005) | Debug output shows addresses | Display impl hides addresses | MITIGATED |
 | Stack trace exposure (TM-INT-006) | Panic unwinds show call stack | `catch_unwind` prevents propagation | MITIGATED |
 | /dev/urandom empty with head -c (TM-INT-007) | `head -c 16 /dev/urandom` returns empty | Fix virtual device pipe handling | **MITIGATED** |
+| C ABI unwind (TM-INT-008) | Rust panic enters a foreign runtime or leaks details | Catch every exported operation and return a generic error | **MITIGATED** |
 
 **Panic Recovery:**
 
@@ -808,11 +810,19 @@ serialization API both handle key material and integrity tags.
 | Hash agility (TM-SNAP-003) | A snapshot claims a hash algorithm the reader does not implement | Algorithm ID in the container header, rejected when unknown | MITIGATED |
 | Chunk or decompression bomb (TM-SNAP-004) | A small snapshot expands into an unbounded allocation during checkout | Per-object decompression capped; filesystem limits validated before any mutation | MITIGATED |
 | Malformed object graph (TM-SNAP-005) | Cyclic parents, absurd declared entry counts, or a chunk served where a tree is expected | Kind tags checked against context, declared counts bounded before allocation, ancestry walks track visited commits | MITIGATED |
+| Capability mismatch on restore (TM-SNAP-006) | State captured with tools or features the restoring instance lacks is restored into it silently | Per-commit capability fingerprint with a `Superset` default policy, plus state-evidence checks that fire under every policy | MITIGATED |
 
 `from_bytes` uses `SHA-256(BKSNAP01 || payload)` (the tag is a public constant,
 so it detects accidental corruption, not forgery); `from_bytes_keyed` uses
 `HMAC-SHA256(secret_key, payload)` with a caller-provided key for authenticity.
 
+Within a commit graph every object is named by `SHA-256(kind || payload)` and
+re-verified when loaded, so authenticating the root commit transitively
+authenticates the shell state, tree, and file chunks beneath it. Note that
+object identity covers *decoded* content, not its compressed framing: a host
+may recompress its store freely, while bytes appended after a compressed stream
+are rejected.
+
 ### RealFs Mount Security (TM-FS-*)
 
 The `realfs` feature can mount real host directories into the VFS. Mounts are