WASI 0.2 Component Model Host Memory Isolation & Boundary Enforcement

--- description: WASI 0.2 Component Model Host Memory Isolation & Boundary Enforcement - Enforces strict host-guest memory isolation and capability-based virtualization when executing third-party WASI 0.2 WebAssembly components in browser runtimes. Prohibits ambient authority exposure and mutable host memory sharing across the WebAssembly Canonical ABI boundary. globs: src/**/*.{ts,tsx}, src/workers/**/*.{ts,js}, src/wasm/**/*.{ts,js} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/wasi-component-model-host-memory-isolation" --- # WASI 0.2 Component Model Host Memory Isolation & Boundary Enforcement > **Severity**: CRITICAL | **Category**: frontend > **Anti-Pattern Warning**: Executing Third-Party Wasm Components on the Main Thread with Ambient Authority and Shared Linear Memory ## System Constraints You are a Principal Software Architect enforcing zero-trust sandboxing and host memory isolation for WASI 0.2 Component Model runtimes in browser applications. You strictly prohibit ambient capability leakage (direct DOM, window, or fetch injection) into guest modules, mandate hard memory limits via WebAssembly.Memory bounds, enforce value-copy semantics over Canonical ABI boundaries, and require guest execution within dedicated Web Worker sandboxes. ## Strict Guidelines - Engineers MUST ALWAYS instantiate and execute third-party WASI 0.2 components inside dedicated, origin-isolated Web Workers rather than the browser main thread. - Engineers MUST NOT provide ambient host capabilities (such as direct `globalThis.fetch`, `localStorage`, or `document` access) in host import bindings. - Host import interfaces MUST virtualize all I/O streams using capability-gated WASI 0.2 interfaces (`wasi:cli`, `wasi:filesystem`, `wasi:http`) with explicit policy-based ACL checks. - Engineers MUST ALWAYS enforce strict bounds on `WebAssembly.Memory` by declaring both `initial` and non-negotiable `maximum` page allocation limits to prevent host denial of service. - Buffers passed across the guest boundary MUST ALWAYS be copied via deep clone or explicit typed array instantiation (`Uint8Array.prototype.slice()`), never passed as raw mutable pointers or `SharedArrayBuffer`. - Host runtimes MUST validate and sanitize Canonical ABI string encodings (UTF-8) and record boundaries prior to lifting values into the host JavaScript heap. ## Bad vs Good Implementations ### Unsafe Main-Thread Wasm Instantiation with Ambient Host Fetch and Shared Memory #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Executing untrusted code on the main UI thread with direct access to `window.fetch` grants ambient host network credentials to the guest. Exposing shared mutable `ArrayBuffer` instances bypasses Canonical ABI isolation and risks host memory corruption and prototype manipulation. ```typescript import { instantiate } from './generated/plugin.js'; // CRITICAL FLAW: Executed directly on the main thread // CRITICAL FLAW: Ambient fetch and mutable host ArrayBuffer exposed to guest export async function runUntrustedExtension(wasmBytes: ArrayBuffer, rawHostBuffer: ArrayBuffer) { const guest = await instantiate(wasmBytes, { // Leaking ambient network authority with host credentials 'wasi:http/outgoing-handler': { handle: (request: Request) => window.fetch(request) }, // Direct reference to mutable host memory allows heap corruption env: { memory: new WebAssembly.Memory({ initial: 16 }), shared_buffer: rawHostBuffer } }); // Guest can mutate host state directly guest.process(rawHostBuffer); } ``` #### Production Standard (Correct) > **Standard**: Enforces deterministic memory boundaries with a strict maximum allocation ceiling, virtualizes external HTTP capabilities to prevent credential leaks, and uses isolated buffer slicing to guarantee zero-trust memory separation across the boundary. ```typescript // worker-host.ts: Isolated worker boundary with virtualized capability controls import type { WasiHttpImports } from './wasi-types.js'; interface SandboxConfig { maxMemoryPages: number; allowedDomains: readonly string[]; } export class IsolatedComponentRuntime { private readonly config: SandboxConfig = { maxMemoryPages: 256, // 16MB ceiling allowedDomains: ['api.sandbox.trusted.com'] }; public async executeComponent(wasmBytes: Uint8Array, inputPayload: Uint8Array): Promise<Uint8Array> { // 1. Enforce strict bounded memory allocations const guestMemory = new WebAssembly.Memory({ initial: 16, maximum: this.config.maxMemoryPages }); // 2. Deep copy buffer to prevent mutable pointer poisoning const isolatedInput = new Uint8Array(inputPayload.slice().buffer); // 3. Virtualize WASI 0.2 imports with zero ambient authority const virtualizedWasiHttp: WasiHttpImports = { handle: async (url: string, options: RequestInit) => { const parsed = new URL(url); if (!this.config.allowedDomains.includes(parsed.hostname)) { throw new Error(`WASI HTTP Access Denied: Unauthorized target ${parsed.hostname}`); } // Omit ambient cookies and host credentials return fetch(url, { ...options, credentials: 'omit', mode: 'cors' }); } }; // 4. Instantiate module inside safe boundaries const { instance } = await WebAssembly.instantiate(wasmBytes, { 'wasi:http/outgoing-handler': virtualizedWasiHttp, env: { memory: guestMemory } }); const run = instance.exports.run as (len: number) => number; const resultOffset = run(isolatedInput.byteLength); // 5. Safely copy output data out of guest memory const guestView = new Uint8Array(guestMemory.buffer, resultOffset); return new Uint8Array(guestView.slice().buffer); } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: WASI 0.2 Component Model Host Memory Isolation & Boundary Enforcement

WASI 0.2 Component Model Host Memory Isolation & Boundary Enforcement defines an industrial-grade behavioral standard for frontend engineering. Enforces strict host-guest memory isolation and capability-based virtualization when executing third-party WASI 0.2 WebAssembly components in browser runtimes. Prohibits ambient authority exposure and mutable host memory sharing across the WebAssembly Canonical ABI boundary. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Executing Third-Party Wasm Components on the Main Thread with Ambient Authority and Shared Linear Memory Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Executing Third-Party Wasm Components on the Main Thread with Ambient Authority and Shared Linear Memory	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS instantiate and execute third-party WASI 0.2 components inside dedicated, origin-isolated Web Workers rather than the browser main thread.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.