Revive naab_unit_tests; fix SafeRegex timeout and nested-quantifier bypass

[b-macker]

Summary

naab_unit_tests (GoogleTest, 19 files, 589 tests) was declared in CMake but no CI job or script ever built it, and 5 of its files had quietly stopped compiling. Getting it running again surfaced one hang. Following that hang into the real naab-lang binary showed that a single regex.matches call can run past every configured time limit. This PR revives the suite, fixes that defect, and writes up every other failure in docs/unit-test-findings.md.

Changes

• SafeRegex now stops at its time budget (src/utils/safe_regex.cpp).
  • Before: executeWithTimeout() threw once wait_for expired, but a std::async future's destructor blocks until the task finishes, so the throw only happened after the runaway regex completed. On a 28-character input that was 30 s against a 1 s budget; --timeout 5 also fired only at 30.5 s.
  • Now the work runs on a detached thread that owns copies of its inputs. The old lambdas captured their inputs by reference, so detaching those would have been a use-after-free.
  • A regex can't be interrupted, only abandoned, so at most 4 timed-out workers can be left running. Past that cap, new regex calls are refused with an error.
• Nested-quantifier detection is a group-tracking scanner. The old single regex check was defeated by redundant parentheses: ((a+))+b passed validation. Scored on an 18-pattern table, the old check got 10/18 (5 catastrophic patterns missed, and 3 ordinary ones like (?:ab)+ wrongly refused). The new scanner gets 18/18.
• Unit tests compile again. Five files are ported to the NaabVal API through small adapters; every assertion is unchanged. Details:
  • rust_ffi_test.cpp had stale hand-written prototypes. ffiToValue differed from the real function only in return type, which isn't part of the mangled name, so it linked and would have read a NaabVal as a shared_ptr.
  • The polyglot fixture now sets up a sandbox policy. Without one, the runtime correctly refuses every block (fail-closed).
  • Parser and interpreter test sources are wrapped in main {}. All 96 of those failures were the top-level parse error. With the wrap, 4 remain, and all 4 are language rules rather than bugs.
• New suite tests/security/test_regex_timeout_bound.sh, registered in run-all-tests.sh.
• docs/unit-test-findings.md: every failure traced to a cause, with reachability checked against the real binary.

Test Plan

• test_regex_timeout_bound.sh passes 7/7. It checks elapsed time, not just the error text, because the broken build printed the same timeout message 29 s late. Run against the old implementation, 4 arms fail and the 3 controls pass.
• ((a+))+b is now rejected immediately. (a|a)+b on a 31-character input stops at 1.0 s; raw std::regex needs minutes on that input.
• No regressions from the stricter validator: 40 regex-using .naab tests and 8 governance/security suites that use regex all pass.
• Unit binary: 558 of 587 pass, the whole run takes 2.4 s, and the only hang left is the known AsyncCallbackPool deadlock (2 tests, excluded from that run).
• Error-message leak check 874/0; coverage-visibility gate 4/4.

Related Issues

Portability item 8. Still open, all recorded in the findings doc:

• Embedded Python ignores --timeout; a <<python>> busy loop ran its full 20 s against --timeout 3.
• CI doesn't run the unit binary yet; that will need an exclusion list.
• About 108 stale tests still need rewriting.
• Lower priority: the async executors ignore their timeout argument, AsyncCallbackPool deadlocks, a zero-second timer in the unrestricted preset, and naab::Context has no polyglot executors registered.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ELUfjXZvx8kzXo1UJjrAhC

[github-actions]

NAAb Governance Report

Metric	Count
Files checked	16
Passed	16
Failed	0

All governance checks passed!

_{Generated by NAAb Governance Engine v4.0}