draft: bounded local-concurrency policy for #107

[ORESoftware]

Refs #107

Companion governance and enforcement draft for zed-pkg/zed-cli#472 / PR zed-pkg/zed-cli#473.

What this draft now establishes

• explicit independent bounds for workers, queued jobs, and child processes;
• absolute worker/queue safety ceilings for user-configurable native concurrency;
• the rule that a lock alone does not make a queue resource-bounded;
• lazy bounded queue growth rather than unchecked eager reservation from user input;
• required saturation/backpressure, shutdown, nested-work, ownership, error, poison, and configuration semantics;
• explicit distinction between closing new external admission and allowing already-admitted work to complete required nested drain work;
• blocked-producer wakeup requirements when admission closes;
• fixed-pool nested-submission deadlock rules plus a recursion-depth requirement for inline execution;
• executor self-join prevention as an ownership/type-design concern;
• explicit timeout-vs-cancellation semantics;
• separate worker/process budgets;
• disallowed unbounded fan-out patterns and a narrow dedicated-thread exception process;
• minimum stress/concurrency tests;
• an initial adoption section reflecting the hardened zed-cli#473 design.

Enforcement added

This draft now includes an actual shared advisory scanner rather than policy text only:

• .ores-lint/concurrency-rust.sh reports suspicious Rust direct thread spawns, thread-builder spawns, and unbounded std/Tokio/crossbeam channels with exact source locations;
• the normal .ores-lint/lint.sh wrapper invokes it in advisory mode so this rollout cannot suddenly break the fleet from lexical false positives;
• repositories that explicitly adopt the policy can run the scanner directly with ORES_LINT_CONCURRENCY_STRICT=1;
• ORES_LINT_SKIP_CONCURRENCY_RUST=1 provides an explicit skip control;
• reviewed structurally bounded sites can use a narrow ores-concurrency: allow <reason> marker;
• .ores-lint/CONCURRENCY.md documents scope, strict adoption, exceptions, and the fact that a lexical match is review evidence rather than proof of a defect;
• .ores-lint version is bumped to 1.4.0 for the new scanner surface.

Cross-repository links

• Policy issue: Adopt bounded local-concurrency policy for Zed Rust task/process execution #107
• Implementation issue: Harden task concurrency with a fixed worker pool and bounded job queue zed-cli#472
• Hardened preliminary implementation PR: draft: bounded task scheduler primitive for #472 zed-cli#473

Review focus

Please review:

• whether the policy prevents O(input-size) resource fan-out without banning legitimate fixed dedicated threads;
• whether hard-ceiling/reject semantics are preferable to silent clamping;
• whether shutdown's external-vs-nested drain distinction is sufficiently explicit;
• whether the scanner's advisory-by-default / strict-opt-in model is appropriate for fleet rollout;
• whether the allow-marker rule is narrow enough to stay auditable;
• whether lifecycle/git-hook enforcement should call this scanner directly in strict mode after a repository has paid down existing findings.

This remains a draft while the zed-cli#473 scheduler design and this enforcement surface receive review.

[ORESoftware]

@claude please review this draft policy alongside zed-pkg/zed-cli#473. Focus on whether it actually prevents O(input-size) thread/task/process/queue fan-out without over-banning legitimate fixed dedicated threads, and whether the staged enforcement guidance is suitable for zed-pkg lifecycle hooks, git hooks, and .ores-lint.