test+fix: host-safety property harness + soundness fixes (cyclic repr/eq, dynamic bases, native-op bombs)

[ivarvong]

Why

Trust in a sandbox comes from invariants it enforces and proves, not examples that happen to pass. The load-bearing invariant for pyex (a multitenant ocap sandbox running untrusted code) is: no guest can crash, hang, or unbound the host. That was tested only by a curated list of resource bombs (AdversarialTest). This PR asserts it as a universal property — and on its first run the property found three real host-safety holes, all fixed here.

The harness (test/pyex/host_safety_test.exs)

For any input — randomly generated, adversarial, or malformed — Pyex.run/2 must:

• return {:ok, _, _} or {:error, %Pyex.Error{}} (never let an Elixir-level exception/exit/throw escape),
• terminate within a wall-clock bound — an outer Task is the backstop, so a step/memory/timeout ceiling that fails to stop a program becomes a test failure, not a frozen suite,
• stay within its resource ceilings.

Plus a regression corpus pinning each host-crash-class input by name.

The three bugs it found (all fixed)

1. Self-referential repr/str hung the host. The recursion runs in native Elixir, outside the interpreter step loop — so no resource ceiling fired. a=[]; a.append(a); print(a) hung indefinitely. Fix: cycle-aware rendering (Protocols.with_cycle_guard + a transient Ctx.repr_seen set) emits [...]/{...} like CPython; gave eval_py_str a dict clause so str(dict) is cycle-aware too (it had been leaking <ref> through the non-cycle-aware fallback).

2. a == a on a self-referential container hung (structural comparison recursed forever). Fix: identity short-circuit — the same heap ref compares equal without materializing the value, matching CPython (which checks identity before __eq__).

3. type('T', (frozenset,), {})() crashed the host. Builtin bases that are {:builtin, _} constructors (not classes) weren't reified, leaked into the MRO, and an MRO walker had no clause for them → FunctionClauseError. Fix: c3_linearize drops any base that doesn't reify to a real class, so the MRO only ever contains {:class, _} — every MRO walker is made safe at once (defense at the source).

Note on conformance

The cycle fixes are CPython-conformant for == and for the cycle marker. Self-referential print(a) renders one nesting level deeper than CPython ([[[...]]] vs [[...]]) because the outermost container is passed already-dereferenced (no heap id to register); it terminates and clearly marks the cycle, which is the host-safety guarantee. The differential fuzz does not generate cyclic structures, so there is no conformance regression — confirmed below.

Gate

• mix format --check-formatted ✅
• mix compile --warnings-as-errors ✅
• mix test — full suite 6173 tests, 0 failures ✅
• 127-property CPython differential fuzz — 0 failures (conformance preserved) ✅
• mix dialyzer ✅ (the 5 "unnecessary skips" are pre-existing .dialyzer_ignore.exs entries, untouched)

🤖 Generated with Claude Code

https://claude.ai/code/session_019NokzcR7BiAigPgC78zpk9

[ivarvong]

Extended this PR with a wider host-safety sweep beyond the original three fixes. Triaging the broader surface (parser depth, single-step alloc/compute, blocking stdlib, stdlib cyclic inputs, callback reentrancy) surfaced four more operations that ran native and bypassed every resource ceiling:

• math.factorial(10**6) — unbounded bignum
• bytes(10**9) — unbounded allocation
• 'x'.rjust/ljust/center/zfill(10**9) — unbounded string build
• time.sleep(n) — capped at 30s but ignoring the run's timeout (a timeout: 1500 run could still block 30s)

All four are now bounded (caps mirroring the existing * 10M guard; time.sleep caps to min(30s, run timeout)), with named regressions + a resource-bomb generator added to the harness. Encouragingly, the same sweep confirmed deep parser nesting, cyclic deepcopy/json.dumps/membership, infinite itertools→list, and raising sorted/__hash__ callbacks were already host-safe.

Gate re-run green: full suite (6183), 127-property differential fuzz, Dialyzer.