feat(capi): implement PyCapsule destructor and name management - #8936

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

Walkthrough

The change stores capsule names and destructors in atomic pointers. It adds C API functions to retrieve a capsule destructor and to set a capsule’s destructor or name.

Changes

Capsule metadata updates

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Suggested reviewers: bschoenmaeckers

Security Blast Radius

• inferred — Misuse of these operations can affect capsule-backed native memory and resource cleanup within the embedding process. The caller must already supply a native capsule handle and, for callback replacement, a native function pointer.

Trust Boundaries and Controls

• inferred — Exact-type and name checks provide compatibility validation, not isolation from native callers already authorized to manipulate raw pointers. Metadata replacement alone does not establish a new trust-boundary crossing.

Resilience and Maintainability Implications

• observed — The reference-count teardown path marks objects finalized before callback invocation and accounts for resurrection. This supplies a cleanup guard, but the metadata methods themselves provide no compound transaction or synchronization beyond individual relaxed pointer operations.

Hardening Proposals

• proposed — Make the borrowed-name lifetime and publication requirements explicit, together with coordination requirements for name, payload, and destructor replacement. Clarify how callers keep callback code valid through finalization and synchronize concurrent metadata readers and writers.

❌ Failed checks (1 warning)

• X
• Mastodon
• Reddit
• LinkedIn