docs(adr): ADR-0102 — sandbox CPU-time budget + per-invocation sync WASM engine (#3275)#3299
Merged
Merged
Conversation
…ASM engine (#3275) Records the two structural decisions spec'd in #3275, status Proposed: - D1: the per-invocation sandbox budget charges script CPU time (VM-active slices), with wall clock demoted to a generous 30s ceiling that only bounds stuck host calls. Knob names/defaults/precedence unchanged; only the dimension changes — raising the CPU budget no longer trades away host-latency tolerance (the #3259 conflation). - D2/D3: per-invocation *sync* WASM modules (asyncify's only consumer died with the #1867 deferred-promise redesign), instantiated from a once-compiled WebAssembly.Module; isolation invariant stated normatively. - D4: shared singleton module + per-invocation contexts REJECTED on threat model (cross-tenant blast radius of a QuickJS heap bug in shared linear memory) and RSS ratchet — recorded so it is not re-proposed. API facts verified against installed quickjs-emscripten@0.32.0 (see #3275). Status flips to Accepted when Phase 1 (#3295) merges; D3 (#3297) deferrable. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011iJLjqToxNv1aYP3syQtRp
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
size/s
documentation
os-zhuang
marked this pull request as ready for review
July 19, 2026 16:21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
docs/adr/0102-sandbox-cpu-budget-and-engine-variant.md(status Proposed) — the decision record for the sandbox follow-up spec'd in #3275, front-loaded so the implementing agents for #3295 / #3296 / #3297 build against a written contract instead of re-deriving it.What it records
body.timeoutMs,hookTimeoutMs/actionTimeoutMs,OS_SANDBOX_{HOOK,ACTION}_TIMEOUT_MS) keep names/defaults/precedence but change dimension: they meter VM-active slices; a separate 30s wall ceiling (aligned with the spec cap onScriptBody.timeoutMs) bounds stuck host calls only. Kills the Flaky:nested-write.integration.test.tssandbox hook exceeds the 250ms deadline on CI (Test Core) #3259 conflation where raising the knob for slow hosts also widened the CPU-DoS window, and stops billing nested hooks to their parent.@jitl/quickjs-wasmfile-release-sync) is already installed. The per-invocation isolation model is stated as a normative invariant.newVariant(RELEASE_SYNC, { wasmModule }), verified inquickjs-emscripten@0.32.0); explicitly deferrable.Notes
pnpm check:doc-authoringclean.Refs: #3275 (spec) · #3295 / #3296 / #3297 (phases) · #3259 / #3270 (history).
🤖 Generated with Claude Code
Generated by Claude Code