WASI 0.2 Component Model Zero-Trust Linear Memory Sandbox Isolation

--- description: WASI 0.2 Component Model Zero-Trust Linear Memory Sandbox Isolation - Enforces strict zero-trust compute isolation for third-party pluggable extensions running inside the host runtime via the WebAssembly Component Model and WASI 0.2 (Preview 2). Mandates explicit capability-oriented interface imports, strict fuel metering, epoch-based execution interruption, and disallows raw linear memory sharing or unmediated host syscall leaks across the canonical ABI boundary. globs: src/wasm/**/*.rs, src/runtime/**/*.rs, src/plugins/**/*.rs, src/wasm/**/*.ts, src/runtime/**/*.ts alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/wasm-component-wasi-p2-sandbox-guardrail" --- # WASI 0.2 Component Model Zero-Trust Linear Memory Sandbox Isolation > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Ambient Authority Leakage and Unmetered Linear Memory Access in In-Process Third-Party Wasm Plugins ## System Constraints You are a Principal Systems Architect enforcing WASI 0.2 and WebAssembly Component Model security invariants. Mandate zero ambient authority, canonical ABI mediated boundaries, fuel-based resource budgeting, and total isolation of linear memory instances for all untrusted third-party pluggable extensions executing in-process. ## Strict Guidelines - Engineers MUST ALWAYS instantiate guest components with completely isolated Wasm linear memories, prohibiting host-guest pointer casting or raw unsafe memory overlays. - Engineers MUST NOT grant ambient filesystem (wasi:filesystem/preopens) or network (wasi:sockets) capabilities to untrusted components; every resource must use explicit capability handle passing. - Services MUST configure epoch-based interruption or deterministic fuel consumption per invocation to prevent denial-of-service via infinite loops or memory allocation exhaustion. - Engineers MUST instantiate separate wasmtime::Store (or equivalent engine store) instances per request or tenant context to guarantee memory zeroing and state isolation. - Components NEVER bridge data across host boundaries using raw pointer arithmetic; all transfers MUST serialize through the WIT (Wasm Interface Type) Canonical ABI lift/lower semantics. ## Bad vs Good Implementations ### Unrestricted WASI Context and Shared Store vs Capability-Gated WASI 0.2 Component Isolation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Grants ambient root filesystem and stdio access, reuses a single shared store across executions without resetting state or linear memory, and lacks fuel or epoch-based interruption to bound compute resource consumption. ```rust // VULNERABLE: Ambient authority granted, unlimited memory/fuel, shared host runtime context use wasmtime::*; use wasmtime_wasi::sync::WasiCtxBuilder; pub struct PluginRunner { engine: Engine, shared_store: Store<()>, } impl PluginRunner { pub fn run_plugin(&mut self, module_bytes: &[u8]) -> anyhow::Result<()> { // Insecure: Inheriting host stdio and granting ambient access to root filesystem let wasi = WasiCtxBuilder::new() .inherit_stdio() .inherit_args()? .preopened_dir(std::fs::File::open("/")?, "/")? // Ambient access to host filesystem .build(); let module = Module::from_binary(&self.engine, module_bytes)?; // Anti-pattern: No fuel metering or epoch deadman timer, unconstrained memory limits let instance = Instance::new(&mut self.shared_store, &module, &[])?; let start = instance.get_typed_func::<(), ()>(&mut self.shared_store, "_start")?; start.call(&mut self.shared_store, ())?; Ok(()) } } ``` #### Production Standard (Correct) > **Standard**: Implements strict WASI 0.2 component execution: isolates linear memory with StoreLimits (capped at 16MB), enables fuel consumption to stop runaway computation, avoids granting any ambient filesystem or network handles, and ensures a fresh Store lifecycle per execution. ```rust // SECURE: Zero-trust WASI 0.2 Component Model with capability sandboxing, memory limits, and fuel tracking use wasmtime::component::{Component, Linker, ResourceTable}; use wasmtime::{Config, Engine, Store, StoreLimits, StoreLimitsBuilder}; use wasmtime_wasi::{WasiCtx, WasiCtxBuilder, WasiView}; struct HostState { wasi: WasiCtx, table: ResourceTable, limits: StoreLimits, } impl WasiView for HostState { fn ctx(&mut self) -> &mut WasiCtx { &mut self.wasi } fn table(&mut self) -> &mut ResourceTable { &mut self.table } } pub struct SecureComponentRuntime { engine: Engine, linker: Linker<HostState>, } impl SecureComponentRuntime { pub fn new() -> anyhow::Result<Self> { let mut config = Config::new(); config.wasm_component_model(true); config.consume_fuel(true); // Enforce deterministic execution quotas config.epoch_interruption(true); let engine = Engine::new(&config)?; let mut linker = Linker::new(&engine); wasmtime_wasi::add_to_linker_sync(&mut linker)?; Ok(Self { engine, linker }) } pub fn execute_untrusted_plugin(&self, component_bytes: &[u8]) -> anyhow::Result<()> { // Strict isolated context: no preopens, no network sockets, isolated memory limit let wasi = WasiCtxBuilder::new().build(); // Zero ambient capabilities let table = ResourceTable::new(); let limits = StoreLimitsBuilder::new() .memory_size(16 * 1024 * 1024) // Maximum 16MB linear memory .instances(1) .build(); let state = HostState { wasi, table, limits }; let mut store = Store::new(&self.engine, state); store.set_fuel(500_000)?; // Bound execution budget store.limiter(|s| &mut s.limits); let component = Component::from_binary(&self.engine, component_bytes)?; let instance = self.linker.instantiate(&mut store, &component)?; let run_fn = instance.get_typed_func::<(), ()>(&mut store, "run")?; run_fn.call(&mut store, ())?; Ok(()) } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: WASI 0.2 Component Model Zero-Trust Linear Memory Sandbox Isolation

WASI 0.2 Component Model Zero-Trust Linear Memory Sandbox Isolation defines an industrial-grade behavioral standard for security engineering. Enforces strict zero-trust compute isolation for third-party pluggable extensions running inside the host runtime via the WebAssembly Component Model and WASI 0.2 (Preview 2). Mandates explicit capability-oriented interface imports, strict fuel metering, epoch-based execution interruption, and disallows raw linear memory sharing or unmediated host syscall leaks across the canonical ABI boundary. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Ambient Authority Leakage and Unmetered Linear Memory Access in In-Process Third-Party Wasm Plugins Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Ambient Authority Leakage and Unmetered Linear Memory Access in In-Process Third-Party Wasm Plugins	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS instantiate guest components with completely isolated Wasm linear memories, prohibiting host-guest pointer casting or raw unsafe memory overlays.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.