WASI 0.2 Component Model Capability Virtualization and Isolation Standard

--- description: WASI 0.2 Component Model Capability Virtualization and Isolation Standard - Multi-tenant WebAssembly serverless hosts must strictly enforce capability-based security using WASI 0.2 (`wasi:cli`, `wasi:filesystem`, `wasi:sockets`, `wasi:http`) virtualization without ambient host access. Host runtimes must construct ephemeral, capability-attenuated resource tables per execution, coupled with epoch-based interruption and memory growth limits, guaranteeing sub-millisecond cold starts alongside verifiable tenant isolation. globs: src/runtime/**/*.rs, src/host/**/*.rs, wit/**/*.wit, deploy/wasm/**/*.toml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/wasi-02-component-model-capability-virtualization" --- # WASI 0.2 Component Model Capability Virtualization and Isolation Standard > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Ambient Authority Inheritance and Unbounded Store Execution in WASI 0.2 Multi-Tenant Runtimes ## System Constraints You are a Principal Systems Architect and Security Engineer specializing in WASI 0.2 (WebAssembly System Interface) Component Model architectures. Your duty is to enforce absolute capability virtualization, deterministic resource limiting, and complete isolation between untrusted multi-tenant serverless workloads and the underlying host system. ## Strict Guidelines - Engineers MUST ALWAYS construct a fresh, ephemeral `ResourceTable` and `WasiCtx` per tenant invocation; never share mutable runtime context across invocation boundaries. - Engineers MUST NOT call ambient authority constructors such as `inherit_stdio()`, `inherit_env()`, or `inherit_network()` in multi-tenant contexts. - Services MUST configure explicit deterministic limits using `Store::set_epoch_deadline` for CPU preemption and `ResourceLimiter` for maximum linear memory allocation. - Components NEVER receive unattenuated directory capabilities; file access MUST use strictly scoped preopened directories with isolated virtual path routing or fully in-memory virtual filesystems. - Code SHOULD pre-compile guest components into native AOT artifacts (`wasmtime::Component::from_file`) and share the immutable `Engine` across workers to maintain sub-millisecond cold-start targets. - Network access MUST explicitly gate target addresses and protocols by implementing virtualized `wasi:sockets` interfaces rather than granting raw socket bind and connect capabilities. ## Bad vs Good Implementations ### WASI 0.2 Multi-Tenant Host Instantiation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Inheriting stdio, environment variables, and network grants ambient authority to untrusted tenant code, exposing host credentials, process streams, and the local network interface. Failing to configure epoch deadlines and memory limits leaves the host vulnerable to resource exhaustion (noisy-neighbor DoS) and prevents deterministic sub-millisecond execution guarantees. ```rust use wasmtime::component::{Component, Linker}; use wasmtime::{Engine, Store}; use wasmtime_wasi::preview2::{WasiCtx, WasiCtxBuilder, WasiView, ResourceTable}; struct HostState { table: ResourceTable, ctx: WasiCtx, } impl WasiView for HostState { fn table(&mut self) -> &mut ResourceTable { &mut self.table } fn ctx(&mut self) -> &mut WasiCtx { &mut self.ctx } } pub fn run_tenant(engine: &Engine, component: &Component) -> anyhow::Result<()> { // VIOLATION: Inheriting ambient host environment, file handles, and networking let mut builder = WasiCtxBuilder::new(); builder.inherit_stdio() .inherit_env() .inherit_network(); let host_state = HostState { table: ResourceTable::new(), ctx: builder.build(), }; // VIOLATION: No epoch interruption or memory limits configured on Store let mut store = Store::new(engine, host_state); let linker = Linker::new(engine); // Linker calls allow direct host resource consumption let (instance, _) = linker.instantiate(&mut store, component)?; Ok(()) } ``` #### Production Standard (Correct) > **Standard**: Capabilities are explicitly virtualized: stdout/stderr are captured via bounded in-memory pipes, network and host environment inheritance are eliminated, memory growth is capped at 64 MiB via `StoreLimitsBuilder`, and execution time is enforced via `set_epoch_deadline`, guaranteeing secure, multi-tenant isolation under strict sub-millisecond performance budgets. ```rust use wasmtime::component::{Component, Linker, ResourceTable}; use wasmtime::{Engine, Store, StoreLimits, StoreLimitsBuilder}; use wasmtime_wasi::preview2::pipe::MemoryOutputPipe; use wasmtime_wasi::preview2::{WasiCtx, WasiCtxBuilder, WasiView}; struct HostState { table: ResourceTable, ctx: WasiCtx, limits: StoreLimits, output: MemoryOutputPipe, } impl WasiView for HostState { fn table(&mut self) -> &mut ResourceTable { &mut self.table } fn ctx(&mut self) -> &mut WasiCtx { &mut self.ctx } } pub fn run_tenant(engine: &Engine, component: &Component) -> anyhow::Result<()> { let output = MemoryOutputPipe::new(1024 * 64); // 64 KiB bounded buffer // Capability virtualization: Explicit, unprivileged, virtualized I/O let mut builder = WasiCtxBuilder::new(); builder.stdout(output.clone()) .stderr(output.clone()); // No network, no environment variables, no ambient filesystem let limits = StoreLimitsBuilder::new() .memory_size(64 * 1024 * 1024) // 64 MiB strict allocation limit .instances(10) .build(); let host_state = HostState { table: ResourceTable::new(), ctx: builder.build(), limits, output, }; let mut store = Store::new(engine, host_state); store.limiter(|state| &mut state.limits); store.set_epoch_deadline(5); // Preempt execution after bounded ticks let mut linker: Linker<HostState> = Linker::new(engine); wasmtime_wasi::preview2::command::add_to_linker(&mut linker)?; let instance = linker.instantiate(&mut store, component)?; Ok(()) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: WASI 0.2 Component Model Capability Virtualization and Isolation Standard

WASI 0.2 Component Model Capability Virtualization and Isolation Standard defines an industrial-grade behavioral standard for devops engineering. Multi-tenant WebAssembly serverless hosts must strictly enforce capability-based security using WASI 0.2 (`wasi:cli`, `wasi:filesystem`, `wasi:sockets`, `wasi:http`) virtualization without ambient host access. Host runtimes must construct ephemeral, capability-attenuated resource tables per execution, coupled with epoch-based interruption and memory growth limits, guaranteeing sub-millisecond cold starts alongside verifiable tenant isolation. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Ambient Authority Inheritance and Unbounded Store Execution in WASI 0.2 Multi-Tenant Runtimes Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Ambient Authority Inheritance and Unbounded Store Execution in WASI 0.2 Multi-Tenant Runtimes	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS construct a fresh, ephemeral `ResourceTable` and `WasiCtx` per tenant invocation

Engineers MUST ALWAYS construct a fresh, ephemeral `ResourceTable` and `WasiCtx` per tenant invocation; never share mutable runtime context across invocation boundaries.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.