Evidence

Measured on every change

Each figure below comes from a command in a repository. If a number changed, a CI gate has already failed.

The official test suite

The YAML project publishes a suite of 406 cases: valid documents with the JSON they must produce, and invalid documents that must be refused. The core runs all of them on every push with no skip list. The result is 406 of 406.

Since September 2026 the same cases run through every companion crate's own surface, from the same vendored suite at the same core commit:

Entry point Result Outside its contract
noyalib library, JSON projection 406 of 406 none
noyavalidate exit code 406 of 406 none
noyalib-lsp diagnostics 406 of 406 none
noyalib-mcp tool result 195 of 195 addressable 211 cases have no top-level key to read
noyalib-serde-yaml shim 367 of 367 24 multi-document cases, 15 non-scalar keys the original also refused
noyalib-wasm JSON model 382 of 382 24 multi-document cases; parse is single-document

The first run of that gate found two real defects: the language server flagged valid multi-document files, and the MCP server reported a key with an empty value as missing. Both were fixed before the next release. Reproduce any row with cargo test --test yaml_test_suite in that crate.

Memory safety

Every crate root carries #![forbid(unsafe_code)], so the compiler refuses any unsafe block. The parser is also run under Miri, which checks for undefined behaviour the compiler cannot see, on every pull request.

Fuzzing

Fifteen libFuzzer targets cover the scanner, the parser, the serialiser, the lossless editor, the schema validator and the round trip through Value. Two of them build without the standard library, so the no_std path is fuzzed too. Each push replays the seed corpus; a weekly job runs for longer. The unterminated-tag bug fixed in v0.0.34 was found by that fuzzer in its first minute.

Limits for untrusted input

Nesting depth, alias count, alias-to-anchor ratio, node count and document size all have defaults, and each is an error rather than a crash when it is exceeded. The limits are configurable per parser. The policies document lists them.

The family scorecard

A script in the core runs 131 probes across the six repositories: tests, lints, formatting, audits, vetting, REUSE compliance, strict docs, README examples, pinned actions, signed releases, SBOMs, open alerts and the state of the main branch. The latest run scored A+ at 97.9%. Rerun it with scripts/ecosystem-scorecard.sh; the ecosystem document holds the full table.

External checks