max_memory_mb: bound how much a run grows the process (#160)

[Masterplanner25]

Closes #160 (SEC-001).

NodusRuntime(max_memory_mb=256)

max_steps bounds instructions and timeout_ms bounds wall clock; neither stopped a script growing a list until the host got a MemoryError. Off by default like the other two.

Three of the issue's four approaches were measured and rejected

The numbers are the reason this reads RSS from the OS rather than counting allocations:

approach	measured
tracemalloc	64x slowdown (0.026s → 1.681s on a 300k loop), 11.9 µs/read — unusable even opt-in, and #173 already names throughput as the blocker
sys.getallocatedblocks()	0.8 µs, but counts blocks not bytes, so it cannot back a megabyte limit without inventing a conversion. Absent on PyPy
counting in the VM's value constructors	deterministic, but measures elements where an embedder asked for megabytes. Left on the table, not dismissed
RSS via the OS	4.4 µs, real megabytes, Windows and POSIX — chosen

Polled every 256 instructions: ~0.6% against Nodus's ~2.75 µs per instruction. It started at 2000 and came down because a string doubling in a loop reached a MemoryError between two checks.

What it cannot do

Said plainly in SECURITY_POSTURE.md §5 rather than left implied: polling bounds growth over time, not a single allocation. One enormous list is served before the next check fires. OS-level limits (ulimit -v, cgroups, a container cap) remain the answer for hard memory safety — this does not replace them. It also measures process RSS, so a host allocating on another thread is charged to the guest.

Refused at construction where the platform cannot be metered, rather than accepted and silently unenforced. A security control an operator believes they have is worse than none — the pattern #473 and #478 were both filed for.

The PyPy budget caught the first version

It added four VM instance attributes, and tests/test_vm_attribute_budget.py failed at 81 against the 80-attribute map limit — the cliff that cost ~9x throughput the last time it was crossed (#702, #488).

The fix was the one CLAUDE.md prescribes — shed attributes, don't raise the number. The runtime now reads the baseline at run start and hands the VM a single absolute ceiling, so four attributes became one, the interval became a class constant, and a modulo replaced the "last checked" counter. The design is better for the constraint.

Verification

The issue's own reproduction aborts with:

Memory limit exceeded: this run grew the process to 61 MB, past its 60 MB ceiling

(686s to get there — that is #173's throughput, not this check.)

Mutation	Result
Remove the per-instruction check	the same program is still running at 45s, where it stops in 1.7s
Accept an unenforceable limit instead of refusing	the refusal test fails

mypy also caught the narrowing loss from extracting the check into a helper — the same trap CLAUDE.md records from the bytecode-cache refactor — and the POSIX branch reaches resource through getattr, so it type-checks on Windows and on the Linux runner alike.

nodus_gate --all green across nine phases; ruff and mypy clean; 191 memory/embedding/sandbox/limit tests pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_01B4R857intVYD1fLgnN4uVn