[VirtualMachinist]

W10 gate G0: the four security-review nits from W9. Stacked series G0 to G3; this is the bottom PR, based on main 874b3eb.

• Store (lock file): open_lock_file and open_existing refuse a symlink (dangling or not), a directory, a FIFO or any other non-regular file at the lock path. They check with symlink_metadata before opening and match (dev, ino) after, using std only. The refusal reuses the existing unsafe data-dir error, and its message names the role, never a path. tighten runs only on a verified file, lock_state reports the same refusal, and nothing is created or chmodded through a link.

• MCP bounds: every string argument of every tool has maxLength, checked in the server before any store read and counted in Unicode scalar values:

  • against: 256;
  • file, repo, path and each focus item: 4096;
  • query, symbol, id, from, to, kind and detail: 1024.

  Over-length input gets the usage failure NAME is longer than N characters, with no echo.

• min_lift: capped at 1000 in the CLI and MCP, with the message min_lift must be a number from 0 to 1000.

Every 874b3eb reply, error and tools/list entry stays byte-identical after removing the top-level meta, apart from the new bounds. No new package in Cargo.lock, no new crate, no unsafe, no new libc use.

Draft until the gate is graded, the checks are green and the security review clears the head.

🤖 Generated with Claude Code