use std/io use std/vec.Vec struct Counter { value: i32 } blocking func main(): i32! { var counters = Vec [Counter { value: 1 }, Counter { value: 2 }, Counter { value: 3 }] for counter in &+counters { counter.value += 10 } var borrowed_total: i32 = 0 for counter in &counters { borrowed_total += counter.value } var moved_total: i32 = 0 for counter in move counters { moved_total += counter.value } let message = "borrowed: ${borrowed_total}, moved: ${moved_total}\n" io.print(&message)? return 0 }

func main(): i32 { let value = load_value() catch failure { fallback_for(failure.message()) } if value == 42 { return 0 } return 1 } func load_value(): i32! { return error.new("example.unavailable", "the primary value is unavailable") } func fallback_for(message: &str): i32 { return 42 }

use std/task use std/time use std/time.Duration async func delayed(value: i32): i32 { await time.sleep(Duration.from_milliseconds(1)) return value } async func main(): i32! { let (left, right) = await task.join(delayed(20), delayed(22)) if left + right != 42 { return error.new("example.unexpected_total", "joined tasks returned the wrong total") } return 0 }

use std/io use std/url.Url blocking func main(): i32! { let url = Url.parse("HTTP://Example.COM:80/a/../status?q=ready#fragment")? let canonical = url.to_string() let authority = url.authority() let target = url.request_target() io.println(&canonical)? io.println(&authority)? io.println(&target)? return 0 }

nocter-archive-extraction

Responsibility

Materialize one bounded gzip-compressed tar archive into an empty physical directory without allowing archive data to escape or reinterpret the destination filesystem.

Contract

Callers supply the compressed bytes, an empty staging directory, and explicit resource limits. The crate validates physical entry kinds and normalized relative paths while materializing regular files and directories. It does not interpret package, release, manifest, trust, or publication semantics.

Invariants

Absolute, parent-relative, non-Unicode, duplicate, and non-portable paths are rejected.
Symbolic links, hard links, devices, FIFOs, and other special entries are rejected.
Entry count, expanded regular-file bytes, path depth, and compressed input bytes are bounded.
Existing destination content is never overwritten.
Executable intent is reduced to portable 0755 or 0644 file modes on Unix.
Callers publish or discard the staging directory; extraction itself never selects a final path.

nocter-archive-extraction#

Responsibility#

Contract#

Invariants#

nocter-archive-extraction

Responsibility

Contract

Invariants