WASI 0.2 Component Model Capability-Oriented Sandboxing Invariant

--- description: WASI 0.2 Component Model Capability-Oriented Sandboxing Invariant - Enforces strict capability-oriented security for WASI 0.2 (Preview 2) component hosts executing untrusted guest extensions. Forbids ambient authority by disallowing direct network socket binding, host filesystem preopens, and unfiltered host I/O, requiring explicit virtualized resource linkers and strict store memory limiters. globs: src/**/*.rs, crates/**/*.rs, src/**/*.ts alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/wasi-02-capability-sandboxing-invariant" --- # WASI 0.2 Component Model Capability-Oriented Sandboxing Invariant > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Ambient Authority Leakage via Unrestricted WASI Preview 2 Host Linker and Context Preopens ## System Constraints You are a Principal Security Architect enforcing WASI 0.2 Component Model Capability-Oriented Sandboxing Invariants. Untrusted guest WebAssembly modules must execute under zero-ambient-authority rules. You must prevent any ambient host access, direct socket binds, host directory preopens, and unconstrained host resource consumption in WASI 0.2 runtimes. ## Strict Guidelines - Engineers MUST NOT grant ambient network capabilities (e.g., `inherit_network`, `wasi:sockets/tcp`, `wasi:sockets/udp`) to untrusted component instances. - Engineers MUST explicitly constrain filesystem access by providing in-memory ephemeral directory implementations or read-only sandboxed capabilities rather than preopening physical host directories. - Engineers MUST configure a strict `ResourceLimiter` or `StoreLimits` for each `Store<T>` to bound instance memory allocation, table elements, and growth rates at the byte level. - Code MUST NEVER bind host standard I/O (stdin, stdout, stderr) directly via `inherit_stdio()`; use isolated memory-backed streams or discarded/sink buffers instead. - Runtime linkers MUST selectively link only explicit, least-privilege WIT interfaces instead of exposing the entire `wasmtime_wasi::add_to_linker_sync` or full Preview 2 interface suite. - Components NEVER receive unchecked outbound HTTP capabilities; `wasi:http/outgoing-handler` MUST route through an egress-filtering, authenticated, and rate-limited host proxy handler. ## Bad vs Good Implementations ### Host Configuration for WASI 0.2 Untrusted Component Instantiation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Inheriting host stdio, network capabilities, and raw host directory preopens violates capability-based security. The untrusted guest can open arbitrary outbound sockets, read sensitive host files, and exhaust host system memory without restriction. ```rust use wasmtime::component::{Component, Linker}; use wasmtime::{Config, Engine, Store}; use wasmtime_wasi::{WasiCtx, WasiCtxBuilder, WasiView}; struct HostState { ctx: WasiCtx, } impl WasiView for HostState { fn ctx(&mut self) -> &mut WasiCtx { &mut self.ctx } } // VULNERABLE: Ambient authority granted to untrusted guest extension pub fn run_untrusted_plugin(engine: &Engine, component: &Component) -> anyhow::Result<()> { let mut linker = Linker::new(engine); wasmtime_wasi::add_to_linker_sync(&mut linker)?; let wasi = WasiCtxBuilder::new() .inherit_stdio() // Leaks host stdio handles .inherit_network() // Leaks full host network socket creation .preopened_dir("/tmp/plugin_scratch", ".", wasmtime_wasi::DirPerms::all(), wasmtime_wasi::FilePerms::all())? // Direct physical host directory leak .build(); let mut store = Store::new(engine, HostState { ctx: wasi }); // Missing memory bounds and gas limits; susceptible to host DoS let instance = linker.instantiate(&mut store, component)?; Ok(()) } ``` #### Production Standard (Correct) > **Standard**: Removes ambient network capabilities by omitting `inherit_network()`, eliminates raw host directory traversal, caps stdio output buffers in memory, and strictly restricts linear memory consumption to 16 MiB via `StoreLimits`. ```rust use wasmtime::component::{Component, Linker, ResourceTable}; use wasmtime::{Config, Engine, Store, StoreLimits, StoreLimitsBuilder}; use wasmtime_wasi::{WasiCtx, WasiCtxBuilder, WasiView}; use wasmtime_wasi::pipe::MemoryOutputPipe; struct HostState { ctx: WasiCtx, table: ResourceTable, limits: StoreLimits, } impl WasiView for HostState { fn ctx(&mut self) -> &mut WasiCtx { &mut self.ctx } } // HARDENED: Byte-level capability-oriented isolation pub fn run_untrusted_plugin(engine: &Engine, component: &Component) -> anyhow::Result<()> { let mut linker = Linker::new(engine); // Link only minimal required WASI interfaces (forbid wasi:sockets) wasmtime_wasi::bindings::filesystem::types::add_to_linker(&mut linker, |s: &mut HostState| s)?; wasmtime_wasi::bindings::cli::environment::add_to_linker(&mut linker, |s: &mut HostState| s)?; let stdout_capture = MemoryOutputPipe::new(1024 * 64); // 64 KiB buffer max let wasi = WasiCtxBuilder::new() .stdout(stdout_capture) // Network is completely omitted; no ambient socket interfaces provided // Filesystem is restricted to in-memory/isolated context only .build(); let limits = StoreLimitsBuilder::new() .memory_size(16 * 1024 * 1024) // 16 MiB max linear memory .instances(1) .tables(5) .build(); let mut store = Store::new(engine, HostState { ctx: wasi, table: ResourceTable::new(), limits, }); store.limiter(|state| &mut state.limits); let instance = linker.instantiate(&mut store, component)?; Ok(()) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: WASI 0.2 Component Model Capability-Oriented Sandboxing Invariant

WASI 0.2 Component Model Capability-Oriented Sandboxing Invariant defines an industrial-grade behavioral standard for security engineering. Enforces strict capability-oriented security for WASI 0.2 (Preview 2) component hosts executing untrusted guest extensions. Forbids ambient authority by disallowing direct network socket binding, host filesystem preopens, and unfiltered host I/O, requiring explicit virtualized resource linkers and strict store memory limiters. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Ambient Authority Leakage via Unrestricted WASI Preview 2 Host Linker and Context Preopens Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Ambient Authority Leakage via Unrestricted WASI Preview 2 Host Linker and Context Preopens	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST NOT grant ambient network capabilities (e.g., `inherit_network`, `wasi

Engineers MUST NOT grant ambient network capabilities (e.g., `inherit_network`, `wasi:sockets/tcp`, `wasi:sockets/udp`) to untrusted component instances.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.