[bfrancojr]

Part of #36. It covers the PXF and SBE limits and the harness flag. #36 stays open for the spec-repo PR that unskips the 8 PXF/SBE limit rows (I'll open it once this merges) and for your PB-rows decision.

What changes for callers

• pxf.unmarshal, unmarshal_full, unmarshal_bytes, unmarshal_full_bytes, bind_row and DatasetReader.from_bytes take max_message_size, max_nesting_depth, max_numeric_literal_digits, max_bytes_literal_length, max_repeated_count and max_big_float_exponent. They are keyword arguments, as you decided on Per-call decoder limits: expose cpp's UnmarshalOptions limits and check_decode --limit #36, passed to protowire-cpp's pxf::UnmarshalOptions. 0 keeps the default; negative is a ValueError.
• sbe.Codec(...) and Codec.from_message(...) take max_message_size and max_repeated_count once, for every call, as cpp's sbe::CodecOptions does.
• DatasetReader.scan binds each row under the reader's limits, so a cell the reader accepted under a raised limit isn't refused at bind time.
• scripts/check_decode.py --limit MaxMessageSize=1024 (Go names, as the manifest spells them). pxf takes all six, sbe two, pb-render MaxNestingDepth. A limit the format can't apply exits 2 rather than running the row without it. pb takes none: google.protobuf has no such settings.

Evidence

Built against protowire-cpp v2.0.0 (tree of cc25129 = 4e96aba):

• pytest: 180 passed, 1 xfailed. That is main's 152, plus 24 in test_pxf_decode_limits.py and 4 in test_sbe_limits.py.
  • Each PXF limit is shown lowered: refused just under the input, accepted at it.
  • Five are also shown raised: the default refuses the input, the raised limit accepts it. The two 64 MiB cases (message size, bytes literal) run in under a second, peaking near 570 MB.
  • max_nesting_depth is raised through lists (depth 120, 60 protobuf levels), because a chain of submessages past 100 hits the protobuf runtime's own limit (pxf.unmarshal: a document at the depth limit fails in upb when a literal sits at the bottom #40).
• check_decode on every manifest row with limits: all 8 pxf/sbe rows match their expect. The 4 pb rows exit 2, --limit ... is not supported for pb.
• cross_security_check.sh, REQUIRE_PORTS=python, spec at corpus: run python on four rows it passes on protowire-cpp v2.0.0 protowire#587 with python removed locally from those 8 rows' skip: exit 0, Ran 136 (port, corpus) pairs. Without the local edit it's 128.

Not covered, and why

• max_repeated_count is not tested raised: its default is 64 Mi elements.
• SBE limits are tested lowered only. A group count is a uint16 on the wire, far below the 64 Mi default, and an Order message is a few dozen bytes.

Found on the way, filed

• DatasetReader ignores UnmarshalOptions::max_bytes_literal_length when it parses a row protowire-cpp#160: DatasetReader parses rows under the default max_bytes_literal_length, not the caller's; protowire-go applies the caller's. That's pinned here as a strict xfail, so the test flips when cpp is fixed. scan still applies the limit when it binds.
• MaxBytesLiteralLength: a b"…" literal decoding to exactly the limit is refused when its base64 is padded protowire#588: Go and cpp estimate a b"…" literal's decoded length as chars / 4 * 3, so a padded literal decoding to exactly the limit is refused. It's cross-port and needs a spec decision, so it isn't fixed here. The tests here use unpadded sizes.

Still open (owner)

• Per-call decoder limits: expose cpp's UnmarshalOptions limits and check_decode --limit #36's PB rows: route Python's PB decode through cpp, or mark the rows store-only with a skip_reason.

[bfrancojr]

CI 18/18 pass on 9df29f7 (run 42276895455). protowire-cpp at 4e96aba release: cut v2.0.0 (#155).

• ubuntu-latest / py3.10: 175 passed, 5 skipped, 1 xfailed. That's main's 147 plus the 28 here; the xfail is the protowire-cpp#160 pin.
• windows-latest / py3.13: 109 passed, 71 skipped, 1 xfailed. Main's Windows leg is 85 passed, 67 skipped, so the 24 PXF limit tests ran on Windows. The 4 SBE ones skip there, as every protoc-built test does on Windows today. That gap is filed as ci: Windows test legs skip 67 tests because protoc is not on PATH #43, with the fix in ci: put vcpkg's protoc on PATH for the Windows test legs #44.