Bound external result file reads

2026-08-10 18:30:28 +00:00
parent 99b2e1cd81
commit ab5a7e8e3d
22 changed files with 215 additions and 84 deletions
--- a/docs/integrations/seriatim.md
+++ b/docs/integrations/seriatim.md
@@ -41,6 +41,8 @@ Invocation fails on:
 - empty render output files.

 When report paths are provided/enabled, report files must parse as JSON.
+Each Seriatim JSON or rendered-text result is limited to 64 MiB and must be a
+regular file without symlinked path components.

 ## Deterministic Behavior
 - argument ordering is deterministic per command construction.