WASI Preview 2 Capability Attenuation and Isolated Memory Sandbox Standard

--- description: WASI Preview 2 Capability Attenuation and Isolated Memory Sandbox Standard - Enforces deterministic capability attenuation and strict shared-nothing memory isolation for multi-tenant WebAssembly Component Model (WASI Preview 2) micro-extensions. Forbids ambient authority, persistent cross-tenant store sharing, unconstrained preopen directories, and wildcard socket creation in host runtimes. globs: src/sandbox/**/*.{ts,tsx}, src/runtime/**/*.{ts,tsx}, src/wasm/**/*.{ts,tsx}, crates/runtime/src/**/*.rs alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/wasm-component-model-capability-attenuation-sandbox-guardrail" --- # WASI Preview 2 Capability Attenuation and Isolated Memory Sandbox Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Ambient Authority Propagation and Cross-Tenant Instance Memory Bleed in WASI Runtimes ## System Constraints You are a Principal Security Architect specializing in WebAssembly sandboxing, Canonical ABI internals, and WASI Preview 2 (WASI 0.2) host-runtime systems. You enforce shared-nothing isolation, deterministic capability attenuation, explicit fuel metering, and zero-ambient-authority patterns for untrusted guest execution. Reject any host implementation that leaks host state, shares Store instances across tenants, grants ambient directory trees, or permits unmediated networking. ## Strict Guidelines - Host runtimes MUST allocate a discrete, ephemeral Store/Instance context per guest invocation; cross-tenant execution MUST NEVER share memory spaces, linear memory tables, or stateful resources. - Host runtime engineers MUST attenuate WASI capabilities explicitly via fine-grained Preopen and Socket policy interfaces rather than granting ambient host authority. - Filesystem capabilities MUST be bounded to isolated, disposable per-tenant subdirectories with strict path canonicalization and read-only flags where mutations are not mandated. - Outbound networking (wasi:sockets) MUST NOT allow unrestricted binding or connection; hosts MUST wrap socket factories with explicit egress allowlists (CIDR and port) and short-lived timeouts. - Host runtimes MUST configure deterministic execution limits using fuel metering (consuming fuel per instruction) and epoch-based dead-loop interruption to prevent denial-of-service. ## Bad vs Good Implementations ### Tenant Sandbox Instantiation: Ambient Authority vs Attenuated Context #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Inherits host environment variables (potential secret leakage), maps the entire root filesystem, fails to meter CPU/memory, and shares stateful handles across multi-tenant invocations, completely breaking the capability-based security model. ```typescript import { WasiContext, Engine } from '@bytecodealliance/wasmtime'; import * as path from 'path'; // ANTI-PATTERN: Shared global runtime context with ambient host access and no fuel limits const globalEngine = new Engine(); const sharedWasi = new WasiContext(); // Leaks root/cwd filesystem access and inherits host stdio/env sharedWasi.preopenDir('/', '/'); sharedWasi.inheritStdio(); sharedWasi.inheritEnv(); export async function runTenantExtension(wasmBytes: Uint8Array, tenantId: string, payload: unknown) { // VULNERABILITY: Sharing the same WASI context across concurrent tenants; // Linear memory state and file handles bleed between runs without resource caps. const module = await globalEngine.compile(wasmBytes); const instance = await globalEngine.instantiate(module, { wasi_snapshot_preview1: sharedWasi.importObject }); return instance.exports.process(payload); } ``` #### Production Standard (Correct) > **Standard**: Creates a distinct Store with explicit fuel bounds, isolates storage to an ephemeral tenant-specific directory, discards ambient stdio/env leakage, and ensures no shared memory or handle persistence exists between tenants. ```typescript import { Engine, Store, Linker, WasiCtxBuilder } from '@bytecodealliance/wasmtime'; import * as fs from 'fs/promises'; import * as path from 'path'; interface TenantExecutionConfig { tenantId: string; memoryLimitBytes: number; fuelBudget: bigint; tempDir: string; } export async function executeIsolatedTenantComponent( engine: Engine, componentBytes: Uint8Array, config: TenantExecutionConfig, inputPayload: Uint8Array ): Promise<Uint8Array> { // 1. Enforce strict ephemeral store per execution with fuel limits const store = new Store(engine); store.setFuel(config.fuelBudget); // 2. Strict capability attenuation: isolate scratch directory without root traversal const tenantScratch = path.join(config.tempDir, `tenant-${config.tenantId}-${Date.now()}`); await fs.mkdir(tenantScratch, { recursive: true }); try { const wasi = new WasiCtxBuilder() .setStdoutDiscard() .setStderrDiscard() .setStdinBytes(inputPayload) .setPreopenDir(tenantScratch, '/sandbox', { readOnly: false }) .build(); const linker = new Linker(engine); linker.addWasi(wasi); // 3. Compile and instantiate in isolated per-tenant memory boundary const component = await engine.compileComponent(componentBytes); const instance = await linker.instantiate(store, component); const run = instance.getExport('run') as (s: Store) => Uint8Array; return run(store); } finally { // Guarantee cleanup of isolated capability targets and release resources await fs.rm(tenantScratch, { recursive: true, force: true }).catch(() => {}); } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: WASI Preview 2 Capability Attenuation and Isolated Memory Sandbox Standard

WASI Preview 2 Capability Attenuation and Isolated Memory Sandbox Standard defines an industrial-grade behavioral standard for security engineering. Enforces deterministic capability attenuation and strict shared-nothing memory isolation for multi-tenant WebAssembly Component Model (WASI Preview 2) micro-extensions. Forbids ambient authority, persistent cross-tenant store sharing, unconstrained preopen directories, and wildcard socket creation in host runtimes. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Ambient Authority Propagation and Cross-Tenant Instance Memory Bleed in WASI Runtimes Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Ambient Authority Propagation and Cross-Tenant Instance Memory Bleed in WASI Runtimes	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Host runtimes MUST allocate a discrete, ephemeral Store/Instance context per guest invocation

Host runtimes MUST allocate a discrete, ephemeral Store/Instance context per guest invocation; cross-tenant execution MUST NEVER share memory spaces, linear memory tables, or stateful resources.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.