docs: "Resource Exhaustion" section in architecture overview is outdated — memory/process limits now exist

[SequeI]

docs/cli/internals/overview.mdx (Security Considerations → "Resource Exhaustion") currently says:

nono does not limit CPU, memory, or disk usage. A malicious agent could attempt denial-of-service through resource exhaustion.

This is no longer accurate. nono now supports resource limits via ResourceLimits (crates/nono/src/resource/mod.rs), enforced by the CLI supervisor through cgroup v2 (crates/nono-cli/src/resource_cgroup.rs):

• memory_bytes → cgroup memory.max (+ memory.swap.max=0, memory.oom.group=1)
• max_processes → cgroup pids.max

Caveats that should be reflected in the corrected text:

• Enforcement is cgroup v2-based, so it's Linux-only — macOS (Seatbelt) has no equivalent enforcement yet.
• Disk usage and CPU usage are still not limited — only memory and process/thread count are capped today.
• A max_processes breach doesn't kill anything; the kernel just refuses new fork/clone with EAGAIN, whereas a memory breach kills the whole cgroup (memory.oom.group=1).

Proposed fix: update the section to accurately describe current enforcement scope and remaining gaps, e.g.:

Resource Exhaustion

On Linux, nono can enforce memory and process-count ceilings on the sandboxed process tree via cgroup v2 (memory.max, pids.max). CPU and disk usage are not limited, and there is no equivalent enforcement on macOS yet. A malicious agent could still attempt denial-of-service through CPU or disk exhaustion, or resource exhaustion on macOS.

[nogent-nolabs-ai]

🛡️ nogent issue triage

Assessment: needs-code-change

Suggested resolution: Update docs/cli/internals/overview.mdx to accurately describe the cgroup v2 resource limits on Linux, as well as the remaining platform-specific limitations (no cgroup equivalent on macOS, no disk/CPU limits).

Notes for maintainers: The reporter is correct; memory and process limits were implemented via cgroup v2 for Linux under crates/nono-cli/src/resource_cgroup.rs, making the current documentation in docs/cli/internals/overview.mdx outdated.

_{Automated triage suggestion. Not a maintainer decision.}

[nogent-nolabs-ai]

🛡️ nogent issue triage

Assessment: needs-code-change

Suggested resolution: Update the 'Resource Exhaustion' section in docs/cli/internals/overview.mdx to reflect current cgroup v2-based resource limits on Linux, as proposed in the issue.

Notes for maintainers: This is a straightforward documentation correction. The reporter's summary of the current Linux-only cgroup v2 resource limits (memory.max and pids.max) and their exact behaviors is accurate.

_{Automated triage suggestion. Not a maintainer decision.}