fix(rvm): restore execute-only memory budgets

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: Maksym Mishchenko

CHANGELOG.md

@@ -9,7 +9,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 - *(rvm)* add opt-in per-execution memory budgets for run-to-completion evaluation, including typed Rust and binding errors ([#792](https://github.com/microsoft/regorus/pull/792))
-- *(rvm,ffi,csharp)* add scoped evaluation-memory budgeting via `RegoVM::with_evaluation_memory_budget` and one-call data execution helpers for charging evaluation-specific data with execution ([#792](https://github.com/microsoft/regorus/pull/792))
 
 ## [0.11.0](https://github.com/microsoft/regorus/compare/regorus-v0.10.1...regorus-v0.11.0) - 2026-07-21
 

benches/rvm_benchmark.rs

@@ -61,7 +61,7 @@ use regorus::{Engine, Rc, Value};
 // hot path (memory_check, execution_timer_tick, instruction-limit compare).
 // ---------------------------------------------------------------------------
 
-#[cfg(feature = "allocator-memory-limits")]
+#[cfg(all(feature = "allocator-memory-limits", not(miri)))]
 const MEMORY_LIMIT_BYTES: u64 = 256 * 1024 * 1024;
 const TIME_LIMIT: Duration = Duration::from_secs(30);
 const TIMER_CHECK_INTERVAL: NonZeroU32 = NonZeroU32::new(16).unwrap();
@@ -375,16 +375,19 @@ fn compile_all_programs() -> Vec<BenchmarkProgram> {
 
 /// Apply the limits selected for one benchmark configuration.
 fn configure_limits(vm: &mut RegoVM, config: EvalConfig) {
+    #[cfg(any(miri, not(feature = "allocator-memory-limits")))]
+    let _ = config.memory_budget;
+
     if config.limits {
-        #[cfg(feature = "allocator-memory-limits")]
+        #[cfg(all(feature = "allocator-memory-limits", not(miri)))]
         regorus::set_global_memory_limit(Some(MEMORY_LIMIT_BYTES));
         vm.set_execution_timer_config(Some(ExecutionTimerConfig {
             limit: TIME_LIMIT,
             check_interval: TIMER_CHECK_INTERVAL,
         }));
         vm.set_max_instructions(INSTRUCTION_LIMIT);
     } else {
-        #[cfg(feature = "allocator-memory-limits")]
+        #[cfg(all(feature = "allocator-memory-limits", not(miri)))]
         regorus::set_global_memory_limit(None);
         vm.set_execution_timer_config(None);
         vm.set_max_instructions(usize::MAX);

bindings/csharp/API.md

@@ -98,14 +98,10 @@ public sealed class Rvm : IDisposable
 {
     public void SetMemoryBudgetConfig(MemoryBudgetConfig config);
     public void ClearMemoryBudgetConfig();
-
-    public string? ExecuteWithDataJson(string dataJson);
-    public string? ExecuteEntryPointWithDataJson(string entryPoint, string dataJson);
-    public string? ExecuteEntryPointWithDataJson(ulong index, string dataJson);
 }
 ```
 
-Ordinary `Execute` and `ExecuteEntryPoint` calls use the existing VM data and start a fresh budget for execution. Program compilation, program loading, and prior `SetDataJson`, `SetInputJson`, and `SetContextJson` calls are excluded; use this path for static or preloaded data.
+Ordinary `Execute` and `ExecuteEntryPoint` calls use the existing VM data and start a fresh budget for execution. Program compilation, program loading, and prior `SetDataJson`, `SetInputJson`, and `SetContextJson` calls occur before and outside the budget; use this path for static or preloaded data.
 
 ```csharp
 using var vm = new Rvm();
@@ -121,11 +117,9 @@ catch (RegorusMemoryBudgetExceededException)
 }
 ```
 
-Use `ExecuteWithDataJson`, `ExecuteEntryPointWithDataJson(string, string)`, or `ExecuteEntryPointWithDataJson(ulong, string)` when evaluation-specific data should be charged with execution. These methods make one native call that includes native JSON parsing/storage for `dataJson`, execution, native JSON serialization, and native C-string allocation. Managed UTF-8 decoding and the managed C# `string` allocation after the native call returns are not charged.
-
-If scoped data replacement fails, the VM keeps its previous data. The previous and provisional native data can coexist transiently, so both count toward the peak live bytes observed by the budget.
+Native result JSON serialization and C-string allocation are included before an `Execute` or `ExecuteEntryPoint` call returns. Managed UTF-8 decoding and the managed C# `string` allocation after the native call returns are excluded.
 
-Memory budgets require a native library built with allocator memory tracking and are supported only for run-to-completion execution. `RegorusMemoryBudgetExceededException` is thrown when a budget is exceeded. `RegorusMemoryBudgetUnsupportedException` is thrown if a configured budget is used to start or resume suspendable execution. Enforcement is cooperative, so one instruction can overshoot before the next checkpoint. Same-thread baseline ratcheting can make the effective limit stricter after unrelated frees are observed; those frees are never credited back. Public multi-call begin/end scopes are intentionally absent because allocator counters are thread-local and abandoned or cross-thread scopes would be unsafe.
+Memory budgets require a native library built with allocator memory tracking and are supported only for run-to-completion execution. `RegorusMemoryBudgetExceededException` is thrown when a budget is exceeded. `RegorusMemoryBudgetUnsupportedException` is thrown if a configured budget is used to start or resume suspendable execution. Enforcement is cooperative, so one instruction can overshoot before the next checkpoint. Same-thread baseline ratcheting can make the effective limit stricter after unrelated frees are observed; those frees are never credited back. Failed terminal execution clears retained state, and a reused VM gets a fresh budget. Public multi-call begin/end scopes are intentionally absent because allocator counters are thread-local and abandoned or cross-thread scopes would be unsafe.
 
 ## Core Classes
 

bindings/csharp/README.md

@@ -107,7 +107,7 @@ Console.WriteLine($"allow: {result}");
 
 ### Per-execution memory budget
 
-RVM run-to-completion evaluation can use an optional additional live-memory budget. Each ordinary `Execute` or `ExecuteEntryPoint` call starts with a fresh budget for execution; program compilation, program loading, and prior `SetDataJson`, `SetInputJson`, and `SetContextJson` calls are not charged.
+RVM run-to-completion evaluation can use an optional additional live-memory budget. Each ordinary `Execute` or `ExecuteEntryPoint` call starts with a fresh budget for execution; program compilation, program loading, and prior `SetDataJson`, `SetInputJson`, and `SetContextJson` calls occur before and outside that budget.
 
 ```csharp
 using var vm = new Rvm();
@@ -126,17 +126,9 @@ catch (RegorusMemoryBudgetExceededException ex)
 }
 ```
 
-Use the one-call `Execute*WithDataJson` methods when evaluation-specific data should be charged in the same native budget scope as execution:
+The native execution budget includes result JSON serialization and C-string allocation before the native call returns. Managed UTF-8 decoding and C# `string` allocation after that return are not charged.
 
-```csharp
-var result = vm.ExecuteWithDataJson(Data);
-var named = vm.ExecuteEntryPointWithDataJson("data.demo.allow", Data);
-var indexed = vm.ExecuteEntryPointWithDataJson(0UL, Data);
-```
-
-Those methods include native JSON parsing/storage for `dataJson`, execution, native result JSON serialization, and native C-string allocation. Managed UTF-8 decoding and C# `string` allocation after the native call returns are not charged. If scoped data replacement fails, the previous VM data is preserved, but the previous and provisional data may coexist transiently and count toward peak live bytes.
-
-The budget is cooperative and may overshoot between VM checks. Same-thread allocation-counter baseline ratcheting can make the effective limit stricter after unrelated frees are observed; those frees are not credited back. Budgets are not supported in suspendable execution mode. `ClearMemoryBudgetConfig` restores the previous unlimited per-execution behavior. Public multi-call begin/end scopes are intentionally absent because allocator counters are thread-local. The process-wide limit exposed by `MemoryLimits` remains a separate safeguard.
+The budget is cooperative and may overshoot between VM checks. Same-thread allocation-counter baseline ratcheting can make the effective limit stricter after unrelated frees are observed; those frees are not credited back. Budgets are not supported in suspendable execution mode. `ClearMemoryBudgetConfig` restores the previous unlimited per-execution behavior. Public multi-call begin/end scopes are intentionally absent because allocator counters are thread-local. Failed terminal execution clears retained state, and a reused VM starts a fresh budget. The process-wide limit exposed by `MemoryLimits` remains a separate safeguard.
 
 ## Azure RBAC Condition Evaluation
 

bindings/csharp/Regorus.Tests/RvmMemoryBudgetTests.cs

@@ -30,17 +30,6 @@ package limits.memory
 
     private const string PreloadedResultEntryPoint = "data.limits.memory.large_string";
 
-    private const string DataResultPolicy = """
-package limits.memory
-
-main := data.value
-named := data.value
-""";
-
-    private const string MainEntryPoint = "data.limits.memory.main";
-
-    private const string NamedEntryPoint = "data.limits.memory.named";
-
     [TestMethod]
     public void Memory_budget_must_be_non_zero()
     {
@@ -96,122 +85,6 @@ public void Serialization_budget_failure_leaves_error_state()
         StringAssert.Contains(state, "Error { error: MemoryBudgetExceeded");
     }
 
-    [TestMethod]
-    public void Execute_with_data_json_runs_main_entry_point()
-    {
-        using var program = CreateDataResultProgram();
-        using var vm = CreateRvm(program);
-
-        var result = vm.ExecuteWithDataJson(CreateValueData("one-call"));
-
-        Assert.AreEqual("\"one-call\"", result);
-    }
-
-    [TestMethod]
-    public void Execute_entry_point_with_data_json_runs_named_and_indexed_entry_points()
-    {
-        using var program = CreateDataResultProgram();
-        using var vm = CreateRvm(program);
-
-        Assert.AreEqual("\"named\"", vm.ExecuteEntryPointWithDataJson(NamedEntryPoint, CreateValueData("named")));
-        Assert.AreEqual("\"indexed\"", vm.ExecuteEntryPointWithDataJson(0, CreateValueData("indexed")));
-    }
-
-    [TestMethod]
-    public void Execute_with_data_json_exceeding_data_budget_throws_typed_exception()
-    {
-        using var program = CreateDataResultProgram();
-        using var vm = CreateRvm(program);
-        vm.SetMemoryBudgetConfig(new MemoryBudgetConfig(TightMemoryBudgetBytes));
-
-        Assert.ThrowsException<RegorusMemoryBudgetExceededException>(
-            () => vm.ExecuteWithDataJson(CreateOversizedValueData()));
-    }
-
-    [TestMethod]
-    public void Execute_with_data_json_failed_replacement_preserves_previous_vm_data()
-    {
-        using var program = CreateDataResultProgram();
-        using var vm = CreateRvm(program);
-        vm.SetDataJson(CreateValueData("previous"));
-        vm.SetMemoryBudgetConfig(new MemoryBudgetConfig(TightMemoryBudgetBytes));
-
-        Assert.ThrowsException<RegorusMemoryBudgetExceededException>(
-            () => vm.ExecuteWithDataJson(CreateOversizedValueData()));
-
-        var state = vm.GetExecutionState();
-        Assert.IsNotNull(state);
-        StringAssert.Contains(state, "Error { error: MemoryBudgetExceeded");
-
-        vm.ClearMemoryBudgetConfig();
-
-        Assert.AreEqual("\"previous\"", vm.ExecuteEntryPoint(MainEntryPoint));
-    }
-
-    [TestMethod]
-    public void Execute_with_malformed_data_json_leaves_error_state_and_preserves_previous_vm_data()
-    {
-        using var program = CreateDataResultProgram();
-        using var vm = CreateRvm(program);
-        vm.SetDataJson(CreateValueData("previous"));
-
-        Assert.ThrowsException<InvalidOperationException>(() => vm.ExecuteWithDataJson("{"));
-
-        var state = vm.GetExecutionState();
-        Assert.IsNotNull(state);
-        StringAssert.Contains(state, "Error { error:");
-
-        Assert.AreEqual("\"previous\"", vm.ExecuteEntryPoint(MainEntryPoint));
-    }
-
-    [TestMethod]
-    public void Execute_with_data_json_reuses_vm_with_a_fresh_budget_after_success_and_failure()
-    {
-        using var program = CreateDataResultProgram();
-        using var vm = CreateRvm(program);
-        vm.SetMemoryBudgetConfig(new MemoryBudgetConfig(TightMemoryBudgetBytes));
-
-        Assert.AreEqual("\"first\"", vm.ExecuteWithDataJson(CreateValueData("first")));
-        Assert.ThrowsException<RegorusMemoryBudgetExceededException>(
-            () => vm.ExecuteWithDataJson(CreateOversizedValueData()));
-        Assert.AreEqual("\"second\"", vm.ExecuteWithDataJson(CreateValueData("second")));
-    }
-
-    [TestMethod]
-    public void Execute_with_data_json_uses_unlimited_default_and_cleared_budget()
-    {
-        using var program = CreateDataResultProgram();
-        using var vm = CreateRvm(program);
-
-        Assert.AreEqual("\"default\"", vm.ExecuteWithDataJson(CreateValueData("default")));
-
-        vm.SetMemoryBudgetConfig(new MemoryBudgetConfig(TightMemoryBudgetBytes));
-        Assert.ThrowsException<RegorusMemoryBudgetExceededException>(
-            () => vm.ExecuteWithDataJson(CreateOversizedValueData()));
-
-        vm.ClearMemoryBudgetConfig();
-
-        var result = vm.ExecuteWithDataJson(CreateOversizedValueData());
-        Assert.IsFalse(string.IsNullOrWhiteSpace(result));
-    }
-
-    [TestMethod]
-    public void Execute_with_data_json_counts_native_result_serialization_but_not_managed_string_copy()
-    {
-        using var program = CreateLargeResultProgram();
-        using var vm = CreateRvm(program);
-        vm.SetInputJson(CreateLargeResultInput());
-        vm.SetMemoryBudgetConfig(new MemoryBudgetConfig(512 * 1024));
-
-        Assert.ThrowsException<RegorusMemoryBudgetExceededException>(() => vm.ExecuteWithDataJson("{}"));
-
-        vm.ClearMemoryBudgetConfig();
-
-        var result = vm.ExecuteWithDataJson("{}");
-        Assert.IsNotNull(result);
-        Assert.AreEqual((2 * 1024 * 1024) + 2, result!.Length);
-    }
-
     [TestMethod]
     public void Suspendable_execution_rejects_memory_budget()
     {
@@ -222,38 +95,6 @@ public void Suspendable_execution_rejects_memory_budget()
         Assert.ThrowsException<RegorusMemoryBudgetUnsupportedException>(() => vm.Execute());
     }
 
-    private static Program CreateDataResultProgram()
-    {
-        var modules = new[] { new PolicyModule("data_result.rego", DataResultPolicy) };
-        return Program.CompileFromModules("{}", modules, new[] { MainEntryPoint, NamedEntryPoint });
-    }
-
-    private static Program CreateLargeResultProgram()
-    {
-        const string policy = """
-package limits.memory
-
-large_string := input.large_string
-""";
-        var modules = new[] { new PolicyModule("large_result.rego", policy) };
-        return Program.CompileFromModules("{}", modules, new[] { "data.limits.memory.large_string" });
-    }
-
-    private static string CreateLargeResultInput()
-    {
-        return JsonSerializer.Serialize(new { large_string = new string('x', 2 * 1024 * 1024) });
-    }
-
-    private static string CreateValueData(string value)
-    {
-        return JsonSerializer.Serialize(new { value });
-    }
-
-    private static string CreateOversizedValueData()
-    {
-        return CreateValueData(new string('x', 2 * 1024 * 1024));
-    }
-
     private static Program CreateProgram()
     {
         var modules = new[] { new PolicyModule("memory_budget.rego", Policy) };

bindings/csharp/Regorus/NativeMethods.cs

@@ -204,24 +204,6 @@ internal static unsafe partial class API
         [DllImport(LibraryName, EntryPoint = "regorus_rvm_execute_entry_point_by_index", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
         internal static extern RegorusResult regorus_rvm_execute_entry_point_by_index(RegorusRvm* vm, UIntPtr index);
 
-        /// <summary>
-        /// Set the data document and execute the program in one native call.
-        /// </summary>
-        [DllImport(LibraryName, EntryPoint = "regorus_rvm_execute_with_data", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
-        internal static extern RegorusResult regorus_rvm_execute_with_data(RegorusRvm* vm, byte* data_json);
-
-        /// <summary>
-        /// Set the data document and execute a named entry point in one native call.
-        /// </summary>
-        [DllImport(LibraryName, EntryPoint = "regorus_rvm_execute_entry_point_by_name_with_data", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
-        internal static extern RegorusResult regorus_rvm_execute_entry_point_by_name_with_data(RegorusRvm* vm, byte* entry_point, byte* data_json);
-
-        /// <summary>
-        /// Set the data document and execute an entry point by index in one native call.
-        /// </summary>
-        [DllImport(LibraryName, EntryPoint = "regorus_rvm_execute_entry_point_by_index_with_data", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
-        internal static extern RegorusResult regorus_rvm_execute_entry_point_by_index_with_data(RegorusRvm* vm, UIntPtr index, byte* data_json);
-
         /// <summary>
         /// Resume execution.
         /// </summary>

bindings/csharp/Regorus/Rvm.cs

@@ -212,57 +212,6 @@ public void ClearMemoryBudgetConfig()
             });
         }
 
-        /// <summary>
-        /// Set evaluation-specific data JSON and execute the program in one native call.
-        /// </summary>
-        public string? ExecuteWithDataJson(string dataJson)
-        {
-            return Utf8Marshaller.WithUtf8(dataJson, dataPtr =>
-            {
-                return UseHandle(vmPtr =>
-                {
-                    return CheckAndDropResult(API.regorus_rvm_execute_with_data((RegorusRvm*)vmPtr, (byte*)dataPtr));
-                });
-            });
-        }
-
-        /// <summary>
-        /// Set evaluation-specific data JSON and execute a named entry point in one native call.
-        /// </summary>
-        public string? ExecuteEntryPointWithDataJson(string entryPoint, string dataJson)
-        {
-            return Utf8Marshaller.WithUtf8(entryPoint, entryPtr =>
-            {
-                return Utf8Marshaller.WithUtf8(dataJson, dataPtr =>
-                {
-                    return UseHandle(vmPtr =>
-                    {
-                        return CheckAndDropResult(API.regorus_rvm_execute_entry_point_by_name_with_data(
-                            (RegorusRvm*)vmPtr,
-                            (byte*)entryPtr,
-                            (byte*)dataPtr));
-                    });
-                });
-            });
-        }
-
-        /// <summary>
-        /// Set evaluation-specific data JSON and execute an entry point by index in one native call.
-        /// </summary>
-        public string? ExecuteEntryPointWithDataJson(ulong index, string dataJson)
-        {
-            return Utf8Marshaller.WithUtf8(dataJson, dataPtr =>
-            {
-                return UseHandle(vmPtr =>
-                {
-                    return CheckAndDropResult(API.regorus_rvm_execute_entry_point_by_index_with_data(
-                        (RegorusRvm*)vmPtr,
-                        (UIntPtr)index,
-                        (byte*)dataPtr));
-                });
-            });
-        }
-
         /// <summary>
         /// Resume execution with an optional value.
         /// </summary>

bindings/ffi/CHANGELOG.md

@@ -8,11 +8,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- Add `regorus_rvm_set_memory_budget_config`, `RegorusMemoryBudgetConfig`, and appended statuses for memory-budget exhaustion and unsupported suspendable execution.
-- Add one-call RVM data execution APIs: `regorus_rvm_execute_with_data`,
-  `regorus_rvm_execute_entry_point_by_name_with_data`, and
-  `regorus_rvm_execute_entry_point_by_index_with_data`. Their memory-budget scope covers data
-  preparation, execution, and native result production.
+- Add execute-only RVM memory-budget configuration through
+  `regorus_rvm_set_memory_budget_config`, `RegorusMemoryBudgetConfig`, and appended statuses for
+  exhaustion and unsupported suspendable execution. Native execute result serialization and C-string
+  allocation are included in the configured budget.
 
 ## [0.1.0](https://github.com/microsoft/regorus/releases/tag/regorus-ffi-v0.1.0) - 2024-02-08