c-systems

# C Systems & Native Code Covers C11 and later for libraries, systems code, and native extensions. For C++ (RAII, templates, move semantics), see the `ia-cpp-systems` skill. ## Working rules - Preserve the repository's sanctioned idioms and ABI; do not turn a scoped fix into a restyle. - State ownership, check fallible calls, validate public boundaries, and assert internal invariants. - Bound traversal of external input and check sizes before allocation or narrowing. - Choose helpers only when they name a concept, own an error, or isolate a side effect. - Verify the actual rebuilt artifact; use instrumented tests for safety and representative release builds for performance. ## Repo conventions outrank this skill Read the repo's `AGENTS.md`/`CLAUDE.md`, its public headers, and two adjacent `.c` files before writing anything. Where they conflict with the rules below, they win, and the diff carries no note about it. This gate is load-bearing. Established C codebases sanction idioms these rules would otherwise flag: | Local idiom | Where it is correct | |---|---| | Tab indentation | php-src and its extensions, Linux kernel | | `goto cleanup` / `goto err` | Kernel, OpenSSL, curl, php-src: the dominant multi-resource release idiom | | Macros containing `return` | `RETURN_*`/`RETVAL_*` in PHP extensions, `Py_RETURN_*` in CPython | | Project status types | `zend_result`, `CURLcode`, `int` plus `errno`: do not invent a parallel enum beside one | Never widen a scoped task into a repo-wide restyle because adjacent untouched C predates a rule here. **When the target is a PHP extension** (`php_*.h`, `PHP_FUNCTION`, `zend_`, `config.m4`), load [php-extension-c.md](./references/php-extension-c.md) before applying any rule below. Layout, macros, the error model, memory, and assertions all carry extension-specific overrides, and the memory one in particular inverts the base guidance: extensions use a request-scoped allocator, not `malloc`/`free`. ## Verify - Build passes under the repo's warning profile with zero newly introduced warnings (greenfield: the full `-Wall -Wextra -Werror -Wconversion -Wshadow` bundle, zero warnings) - Test suite passes under `-fsanitize=address,undefined` with zero reports - `valgrind --leak-check=full --error-exitcode=1` clean where the suite links under it - Every new fallible call site checked; every new error value traced to one producer - Every new state-mutating leaf carries an assert - No new `goto` outside the repo's sanctioned form or the single-forward-jump cleanup; no recursion over external input; no loop over external input without a named bound ## Task-specific references Read the relevant reference before implementing or reviewing the matching behavior: - For module layout, naming, decomposition, control flow, errors, types, or macros: [implementation-structure.md](./references/implementation-structure.md). - For memory, external input, assertions, ABI changes, or shared-helper contracts: [runtime-safety.md](./references/runtime-safety.md). - For compiler setup, tests, build provenance, packaging, or performance claims: [build-and-measurement.md](./references/build-and-measurement.md). Existing specialized references, when the corresponding topic applies: - [php-extension-c.md](./references/php-extension-c.md). - [memory-safety.md](./references/memory-safety.md). - [correctness-traps.md](./references/correctness-traps.md). - [legibility-standard.md](./references/legibility-standard.md).