Skip to content
sigMAX logo SIGMAX Development Documentation v0.26 Secure Integrated Generator of Modular Architecture with execution Runtime
AdminRepository
About Documentation Contact
AdminRepository

WASM Sandbox

WASM Sandbox

Section titled “WASM Sandbox”

WebAssembly is used in sigMAX as a portable and isolated execution target for generated business logic.

The sandbox limits the execution boundary. Runtime imports expose only the primitives that are allowed by the binary contract and effective agreement.

Why WebAssembly

Section titled “Why WebAssembly”

WebAssembly is a low-level, portable binary format designed for compact representation and efficient execution.

For sigMAX, the useful properties are:

  • portable executable artifacts;
  • sandboxed execution;
  • explicit imports and exports;
  • deterministic compilation targets such as wasm32;
  • a narrow host boundary controlled by the runtime;
  • compatibility with generated code from a deterministic C subset;
  • a clear separation between executable logic and host infrastructure.

Core Model

Section titled “Core Model”
%%{init: {"theme": "base", "flowchart": {"nodeSpacing": 70, "rankSpacing": 90, "padding": 18}, "themeVariables": {"lineColor": "#f8fafc"}, "themeCSS": ".flowchart-link{stroke:#f8fafc!important;stroke-width:5px!important;stroke-linecap:round!important;filter:drop-shadow(0 1px 2px rgba(0,0,0,.65))}.marker{fill:#f8fafc!important;stroke:#f8fafc!important}.edgeLabel,.labelBkg,.edgeLabel span{background:transparent!important}.edgeLabel rect{fill:transparent!important;stroke:transparent!important}.edgeLabel p{background:transparent!important;color:#f8fafc!important;padding:0!important;font-size:13px!important;font-weight:700!important;line-height:1.15!important;text-shadow:0 1px 3px rgba(0,0,0,.95),0 0 5px rgba(0,0,0,.85)!important}"}}%%
flowchart LR
    classDef input fill:#fff4cc,stroke:#b7791f,stroke-width:2px,color:#111;
    classDef llm fill:#e8f0ff,stroke:#2b6cb0,stroke-width:2px,color:#111;
    classDef contract fill:#ede9fe,stroke:#6b46c1,stroke-width:2px,color:#111;
    classDef deterministic fill:#e6fffa,stroke:#2c7a7b,stroke-width:2px,color:#111;
    classDef container fill:#fef2f2,stroke:#c53030,stroke-width:2px,color:#111;
    classDef wasm fill:#ecfdf5,stroke:#2f855a,stroke-width:2px,color:#111;
    classDef runtime fill:#f7fafc,stroke:#2d3748,stroke-width:3px,color:#111;
    classDef agreement fill:#f0f9ff,stroke:#0369a1,stroke-width:2px,color:#111;
    Contract[/"Binary Contract"/]:::contract
    Agreement(["Effective Agreement"]):::agreement
    Runtime[("Rust<br/>runtime")]:::runtime
    Wasm["WASM<br/>module"]:::wasm
    Memory[("Linear<br/>memory")]:::deterministic
    Imports["Runtime primitives<br/>explicit imports"]:::input
    Policy{"Capability<br/>policy"}:::agreement
    Host["Host services<br/>state · HTTP · secrets · logs · metrics"]:::container
    Contract -->|"declares limits"| Runtime
    Agreement -->|"confirms state"| Runtime
    Runtime -->|"loads entrypoint"| Wasm
    Runtime -->|"exposes imports"| Imports
    Wasm -->|"reads · writes"| Memory
    Wasm -->|"calls import"| Imports
    Imports -->|"validates buffer"| Memory
    Imports -->|"checks capability"| Policy
    Policy -->|"allows · denies"| Runtime
    Runtime -->|"approved work"| Host
    Host -->|"bounded result"| Runtime
    linkStyle default stroke:#f8fafc,stroke-width:5px,color:#f8fafc

What Is Isolated

Section titled “What Is Isolated”

A WASM module works with its own linear memory.

Host memory is not directly addressable by the module. When data crosses the boundary, the runtime reads or writes bytes through explicit pointers, lengths and validation rules.

A module can only call host functions that the runtime provides as imports.

In sigMAX, these imports are runtime primitives. Examples include reading inputs, writing responses, emitting logs, extracting JSON values, using approved secrets, or invoking allowed services.

A module exposes callable functions through exports.

The runtime chooses which exported entrypoint to call for a route or component, then interprets the result through the contract and agreement model.

Sensitive operations require capabilities.

If a route is not allowed to use a primitive such as HTTP invocation, random bytes, secret HMAC, or time access, the runtime denies the call instead of forwarding it to the host.

What The Sandbox Does Not Do

Section titled “What The Sandbox Does Not Do”

The WASM sandbox is an execution boundary, not a complete application security model.

It does not automatically provide:

  • correct business rules;
  • authorization logic;
  • network policy;
  • secret governance;
  • TLS termination;
  • reverse proxy configuration;
  • Kubernetes isolation;
  • storage policy;
  • audit completeness.

Those responsibilities belong to contracts, agreements, runtime policy, infrastructure configuration, and Enterprise governance when applicable.

sigMAX Runtime Rules

Section titled “sigMAX Runtime Rules”

sigMAX treats WASM as one part of a larger controlled runtime model.

The runtime should:

  • load WASM modules from generated or validated artifacts;
  • expose only the imports required by the binary contract;
  • map route inputs into controlled memory or typed values;
  • validate pointer ranges, lengths and output buffers;
  • return stable error codes for invalid, denied, missing or unsupported operations;
  • emit evidence through logs, metrics, traces or agreements;
  • keep host services behind policy-controlled primitives.

Relationship With c_repr

Section titled “Relationship With c_repr”

Some typed values cross the WASM boundary through a C-compatible binary representation named c_repr.

This does not mean the host primitives are implemented in C. In sigMAX, host primitives belong to the Rust runtime. The c_repr layout is only a stable memory format used when generated WASM logic and the runtime need to agree on field offsets, numeric types, booleans and fixed-size strings.

References

Section titled “References”
Back to top