OPERATION AND ASSURANCE

Safety and resource limits

PyCForge treats source as untrusted input, bounds analysis resources, and fails closed when proof or internal conformance is incomplete.

Diagnostics and results · File I/O and C ABI · Contract identities

Conversion does not execute source

PyCForge parses submitted Python as data. During conversion it does not:

import or execute source Python;
scan the host for modules or resolve source imports from the host;
open a path selected by the source program; or
compile, assemble, link, load, run, debug, profile, or deploy generated C.

File effects described in File I/O and C ABI belong to generated helpers and occur only if an external party later builds and runs the C outside PyCForge.

Default request ceilings

Resource	Default	Trusted hard ceiling
Source bytes	1,000,000	Request-bound
Source lines	100,000	Request-bound
Tokens / AST nodes	250,000 / 100,000	Request-bound
Nesting depth	128	128
Diagnostics	1,000	Request-bound
Trace / telemetry events	10,000 / 10,000	Request-bound
Source documents / import edges	64 / 4,096	64 / 4,096
Container elements / record fields	64 / 64	64 / 64
File-read bytes	1,048,576	16,777,216
Live owned bytes	2,097,152	16,777,217
Open files / file operations	8 / 1,024	8 / 1,024
Scope proof nodes / edges	100,000 / 400,000	100,000 / 400,000
Scope bindings / hoisted locals	50,000 / 10,000	50,000 / 10,000
Loop/scope traversal depth	128	128

max_live_owned_bytes must cover max_file_read_bytes + 1 for the terminating NUL. Requests can lower supported resource limits but cannot raise the implementation's trusted ceilings.

Fail-closed assurance

Unsupported source produces a coded rejection, not partial C.
The complete source bundle passes or fails as one unit.
Independent validators reconstruct critical facts instead of trusting analysis claims blindly.
Incomplete, contradictory, malformed, over-budget, or coherently tampered proof material blocks C publication.
Generated output stays read-only and requires an explicit save while current.

What the contract does not establish

Deterministic conversion is not by itself certification that an application is safe, secure, portable on every target, or functionally correct. A professional release process still needs independent review of the generated C, target-specific compilation diagnostics, static analysis, runtime tests in an isolated environment, dependency review, and platform qualification appropriate to the intended use.

Keep claims scoped. PyCForge's internal contract establishes bounded conversion and artifact conformance for its declared subset. It does not represent arbitrary Python compatibility or third-party toolchain certification.