safejson thesis: JSON parsing as a security boundary with pre-scan limits and strict semantic hooks.
flowchart LR
A0["Bytes/Text"]
A1["UTF-8 Decode"]
A2["Streaming Pre-scan"]
A3["stdlib json.loads"]
A4["Semantic Hooks"]
A5["Typed Errors"]
A0 --> A1
A1 --> A2
A2 --> A3
A3 --> A4
A4 --> A5
- Keep the public API small enough to inspect in one sitting.
- Make demos run locally without network credentials.
- Put correctness checks in tests, conformance scripts, or benchmark scripts instead of relying on README claims.
- Prefer explicit failure modes over surprising implicit behavior.