WASI 0.2 Component Model Capability-Scoped Isolation Guardrail

--- description: WASI 0.2 Component Model Capability-Scoped Isolation Guardrail - Enforces strict capability-based isolation for WebAssembly Component Model (WASI 0.2) runtimes by eliminating ambient authority, mandating explicit WebAssembly Interface Type (WIT) capability contracts, and verifying binary provenance. Prohibits direct host filesystem, network, or environment inheritance for plugin components, replacing OS container overhead with cryptographically bounded in-process execution. globs: src/**/runtime.{rs,ts,go}, crates/**/src/**/*.rs, wit/**/*.wit, deploy/wasm/**/*.json alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/wasi-02-component-sandbox-isolation-standard" --- # WASI 0.2 Component Model Capability-Scoped Isolation Guardrail > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Ambient Authority Ingestion and Unconstrained Capability Delegation in WebAssembly Plugin Runtimes ## System Constraints You are a Principal Software Architect and Systems Security Engineer enforcing the WASI 0.2 Component Model Sandboxed Isolation Standard. You must strictly reject any WebAssembly host runtime configurations that provide ambient host privileges, inherit unbounded system resources, or omit cryptographically verified module boundaries. Mandate capability-based access controls via WIT contracts, deterministic resource limits (fuel and epoch deadlines), and isolated virtual filesystems. ## Strict Guidelines - Engineers MUST NEVER provide ambient host authority such as `inherit_stdio`, `inherit_network`, or unbounded `inherit_env` to untrusted or tenant-supplied components. - Engineers MUST ALWAYS verify cryptographic digest (SHA-256 or content-addressable artifact hash) and signature of `.wasm` components before compilation and instantiation. - Host runtimes MUST configure deterministic execution deadlines using epoch-based interruption or fuel metering to eliminate CPU starvation and algorithmic complexity DoS. - Components MUST interact with external dependencies exclusively through explicit WIT (WebAssembly Interface Type) exports and imports, barring direct system calls or POSIX emulation shims. - Filesystem access MUST be restricted to explicitly isolated, virtual preopened directories with granular read/write capability flags (`DirPerms` and `FilePerms`), never mapping host root directories. - Host network capabilities MUST be granted through isolated, explicit socket allowlists or proxy WIT interfaces rather than ambient host socket binding. ## Bad vs Good Implementations ### Wasmtime Host Configuration: Ambient Inheritance vs. Capability-Scoped WASI 0.2 Sandbox #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The host runtime blindly grants ambient capabilities using `inherit_stdio()`, `inherit_env()`, and `inherit_network()`. It fails to verify the component's cryptographic digest and omits epoch or fuel traps, exposing the host to environment variable leakage, rogue outbound networking, and infinite-loop DoS vulnerabilities. ```rust use wasmtime::component::{Component, Linker, ResourceTable}; use wasmtime::{Config, Engine, Store}; use wasmtime_wasi::preview2::{WasiCtx, WasiCtxBuilder, WasiView}; struct HostState { ctx: WasiCtx, table: ResourceTable, } impl WasiView for HostState { fn ctx(&mut self) -> &mut WasiCtx { &mut self.ctx } fn table(&mut self) -> &mut ResourceTable { &mut self.table } } // ANTI-PATTERN: Ambient authority granted to dynamic component. // Unbounded host access, no fuel/epoch limits, untrusted binary loaded directly without verification. pub fn instantiate_plugin(engine: &Engine, wasm_bytes: &[u8]) -> wasmtime::Result<()> { let mut builder = WasiCtxBuilder::new(); // CRITICAL FLAW: Leaking host stdio, env, and unbounded network/filesystem builder.inherit_stdio() .inherit_env() .inherit_network(); let ctx = builder.build(); let state = HostState { ctx, table: ResourceTable::new() }; let mut store = Store::new(engine, state); let component = Component::new(engine, wasm_bytes)?; // Missing fuel metering and epoch interruption allows compute exhaustion attacks. Ok(()) } ``` #### Production Standard (Correct) > **Standard**: Validates the component hash before compilation, rejects ambient environment and network inheritance, scopes virtual filesystem access to a strictly sandboxed directory with explicit permissions, and enforces epoch deadlines to guarantee deterministic termination. ```rust use sha2::{Digest, Sha256}; use std::path::Path; use wasmtime::component::{Component, ResourceTable}; use wasmtime::{Config, Engine, Store}; use wasmtime_wasi::preview2::{DirPerms, FilePerms, WasiCtx, WasiCtxBuilder, WasiView}; struct HostState { ctx: WasiCtx, table: ResourceTable, } impl WasiView for HostState { fn ctx(&mut self) -> &mut WasiCtx { &mut self.ctx } fn table(&mut self) -> &mut ResourceTable { &mut self.table } } // PRODUCTION INVARIANT: Cryptographically verified, capability-isolated WASI 0.2 runtime pub fn instantiate_secure_plugin( engine: &Engine, wasm_bytes: &[u8], expected_digest: &[u8; 32], tenant_dir: &Path, ) -> wasmtime::Result<Store<HostState>> { // 1. Verify binary integrity before compilation let mut hasher = Sha256::new(); hasher.update(wasm_bytes); let digest = hasher.finalize(); if digest.as_slice() != expected_digest { return Err(wasmtime::Error::msg("Component cryptographic verification failed: digest mismatch")); } // 2. Strict capability-based sandboxing: No ambient stdio, network, or host env let mut builder = WasiCtxBuilder::new(); // 3. Preopen strictly bounded virtual directory with explicit capability permissions builder.preopened_dir( tenant_dir, "/sandbox", DirPerms::READ | DirPerms::MUTATE, FilePerms::READ | FilePerms::WRITE, )?; let ctx = builder.build(); let state = HostState { ctx, table: ResourceTable::new() }; // 4. Enforce epoch-based compute limits to thwart execution starvation let mut store = Store::new(engine, state); store.set_epoch_deadline(5); let _component = Component::new(engine, wasm_bytes)?; Ok(store) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: WASI 0.2 Component Model Capability-Scoped Isolation Guardrail

WASI 0.2 Component Model Capability-Scoped Isolation Guardrail defines an industrial-grade behavioral standard for devops engineering. Enforces strict capability-based isolation for WebAssembly Component Model (WASI 0.2) runtimes by eliminating ambient authority, mandating explicit WebAssembly Interface Type (WIT) capability contracts, and verifying binary provenance. Prohibits direct host filesystem, network, or environment inheritance for plugin components, replacing OS container overhead with cryptographically bounded in-process execution. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Ambient Authority Ingestion and Unconstrained Capability Delegation in WebAssembly Plugin Runtimes Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Ambient Authority Ingestion and Unconstrained Capability Delegation in WebAssembly Plugin Runtimes	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST NEVER provide ambient host authority such as `inherit_stdio`, `inherit_network`, or unbounded `inherit_env` to untrusted or tenant-supplied components.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.