Bound TinyCalc formula and JSON resource use - #120

Summary

• Bound repeated formula-reference work through a recalculation-local cache and deterministic work budget.
• Reject JSON worksheets above 128 KiB or 16 nesting levels before materializing or replacing worksheet state.
• Add regression, compatibility, security, documentation-impact, threat-model, help, and statistics evidence.

Scope

• MicroCalc.Core (Domain/Engine)
• Tests
• Docs
• MicroCalc.Tui UI behavior
• CI/CD configuration

Problem

The Standard Security Scan identified two denial-of-service resource paths: repeated acyclic formula references could grow evaluation work exponentially, and JSON input was fully loaded before application-level size validation.

Solution

Formula evaluation now shares successful intermediate values only within one recalculation and accounts top-level evaluations, references, cache hits, and range visits against a deterministic budget. JSON loading uses one sequential file handle, a 128 KiB precheck plus bounded max-plus-one read, direct UTF-8 deserialization with depth 16, and staged state replacement.

Compatibility is preserved for valid formulas, cycle detection, maximum application-generated worksheets, small unknown JSON properties, and atomic failure behavior. No public API, dependency, serialized schema, SBOM, or runtime product-AI change is introduced.

Security evidence

• Findings: csf_c54f3d1ce3e3ec728a5fb57f and csf_7264301dfe8ca7dc4a0ae14d
• Applicable: NIST SSDF, CWE-20, CWE-400, ISO/IEC 27002 A.8.27 and A.8.28, STRIDE denial of service, CAPEC-153
• N/A: OWASP ASVS and Zero Trust because TinyCalc is a local TUI/library; AI-SBOM because AI is development tooling only; VEX because no affected dependency advisory is being dispositioned

Test Plan

Automated

• 97 focused Core regression tests
• Full solution: 226 Core plus 461 TUI tests, 0 failures
• Core coverage: 85.77% line, 83.81% branch
• Affected coverage: SpreadsheetJsonStorage 98.64% line; FormulaEvaluator 90.00% line; EvaluationSession and EvaluationContext 100%
• TUI smoke: SMOKE_OK
• DocFX: 0 warnings, 0 errors
• Bash and PowerShell Documentation Impact validators
• Workspace Homogeneity Guardian: 29/29
• Statistics renderer idempotent
• Pre-push secret scan clean

Manual

• Changed documentation checked through text-oriented rendering
• No interactive TUI behavior changed

Behavioral Notes

• Excessive formula work now returns Berechnungsbudget überschritten instead of consuming unbounded resources.
• Oversized or excessively nested documents now fail before worksheet replacement.
• Limits may need reevaluation if the worksheet specification grows.

Risks

• A legitimate future worksheet format could exceed the new limits; regression coverage confirms the current maximum generated worksheet remains loadable.
• Cache errors could obscure cycles or stale values; dedicated tests cover both loaded self-cycles and stale non-constant formula values.
• A full automated axe run was unavailable; DocFX and the text-oriented accessibility check passed.

Checklist

• Code follows repository conventions
• Tests added and updated
• Documentation updated
• CI is green