kobako 0.28.0 → 0.29.0

data/crates/kobako-wasmtime/src/dispatch.rs

@@ -3,21 +3,19 @@
 //! A request under a tag the host does not serve is answered as
 //! unsupported, so a guest asking for a later operation can fall back.
 //!
-//! A failure lands on whoever is answerable for it. A trap the guest
-//! raises during a callback into it ends the invocation as that trap; any
-//! other failure is the guest's or the wire's, so the import answers 0,
-//! which the guest receives as a wire failure.
-//!
-//! Each 0 also writes one `[kobako-dispatch] <reason>` line to stderr,
-//! since the 0 itself carries no reason. It is the one place the driver
-//! logs, and normal operation never reaches it.
+//! A failure lands on whoever is answerable for it, and always says why.
+//! A trap the guest raises during a callback into it ends the invocation
+//! as that trap. A Call the host could not answer is answered as an
+//! internal failure naming why, and an answer too large for a message as
+//! the Service's own failure. Only an answer that cannot be written into
+//! guest memory at all ends the invocation, as a trap naming why.
 
 use wasmtime::Caller;
 
 use kobako_runtime::error::Trap;
 use kobako_runtime::yielder::Yielder;
 use kobako_transport::abi::pack_ptr_len;
-use kobako_transport::envelope::{Unsupported, Upcall, YieldReply};
+use kobako_transport::envelope::{Fault, FaultKind, Reply, Unsupported, Upcall, YieldReply};
 
 use crate::guest_mem;
 use crate::invocation::Invocation;
@@ -27,39 +25,58 @@ use crate::invocation::Invocation;
 /// stack on the Rust call stack with no shared slot.
 struct CallerYielder<'a, 'c> {
     caller: &'a mut Caller<'c, Invocation>,
+    frame: u32,
 }
 
 impl Yielder for CallerYielder<'_, '_> {
-    fn yield_to_block(&mut self, args: &[u8]) -> Result<YieldReply, Trap> {
-        let bytes = guest_mem::drive_yield(self.caller, args)
+    fn frame(&self) -> u32 {
+        self.frame
+    }
+
+    fn yield_to_block(&mut self, frame: u32, args: &[u8]) -> Result<YieldReply, Trap> {
+        let bytes = guest_mem::drive_yield(self.caller, frame, args)
             .map_err(|msg| Trap::Other(msg.to_string()))?;
         YieldReply::decode(&bytes).map_err(|err| Trap::Other(err.to_string()))
     }
 }
 
-/// Answer one `__kobako_upcall` call: the packed `(ptr<<32)|len` of the
-/// Reply, 0 for a failure the guest or the wire is answerable for, or the
-/// trap a callback into the guest raised.
+/// Answer one `__kobako_upcall` call with the packed `(ptr<<32)|len` of
+/// the Reply, or the trap a callback into the guest raised.
 pub(crate) fn handle(
     caller: &mut Caller<'_, Invocation>,
     req_ptr: i32,
     req_len: i32,
 ) -> wasmtime::Result<i64> {
-    let answer = try_handle(caller, req_ptr, req_len);
+    let reply = reply_to(caller, req_ptr, req_len)
+        .unwrap_or_else(|reason| Reply::Fault(Fault::new(FaultKind::Internal, reason)));
+    let written = write_reply(caller, &fit_in_message(reply).encode());
     if let Some(trap) = caller.data_mut().take_reentry_trap() {
         return Err(trap);
     }
-    Ok(answer.unwrap_or_else(|reason| {
-        eprintln!("[kobako-dispatch] {reason}");
-        0
-    }))
+    if let Some(trap) = caller.data().abandonment() {
+        return Err(trap);
+    }
+    written.map_err(wasmtime::Error::msg)
 }
 
-fn try_handle(
+/// An answer past the message cap is the Service's to change, as any other
+/// answer the host cannot write is.
+fn fit_in_message(reply: Reply) -> Reply {
+    let bytes = reply.encode().len();
+    match guest_mem::checked_payload_len(bytes) {
+        Ok(_) => reply,
+        Err(limit) => Reply::Fault(Fault::new(
+            FaultKind::Runtime,
+            format!("Sandbox could not write the Service's answer: {limit}"),
+        )),
+    }
+}
+
+fn reply_to(
     caller: &mut Caller<'_, Invocation>,
     req_ptr: i32,
     req_len: i32,
-) -> Result<i64, &'static str> {
+) -> Result<Reply, &'static str> {
     let req_bytes = guest_mem::read_request(caller, req_ptr, req_len)?;
     // The driver decodes the core envelope, here and in `CallerYielder`, so
     // the frontend never sees a frame; the payload inside it stays bytes
@@ -67,8 +84,9 @@ fn try_handle(
     let call = match Upcall::decode(&req_bytes) {
         Ok(Upcall::Call(call)) => call,
         Ok(_) => {
-            let refusal = Unsupported::new("the host does not serve this request");
-            return write_reply(caller, &refusal.encode());
+            return Ok(Reply::Unsupported(Unsupported::new(
+                "the host does not serve this request",
+            )))
         }
         Err(_) => {
             return Err(
@@ -89,15 +107,15 @@ fn try_handle(
     // handler. The borrow ends with the block, freeing the Caller for
     // `write_reply`; nested dispatch frames each build their own, so
     // the LIFO re-entry lives on the Rust stack — no shared slot.
+    let frame = caller.data_mut().open_call();
     let reply = {
-        let mut yielder = CallerYielder { caller };
+        let mut yielder = CallerYielder { caller, frame };
         handler.dispatch(call, &mut yielder)
-    }
-    .ok_or(
+    };
+    caller.data_mut().close_call();
+    reply.ok_or(
         "a Sandbox callback raised an exception instead of returning a fault — please report this as a kobako bug",
-    )?;
-
-    write_reply(caller, &reply.encode())
+    )
 }
 
 fn write_reply(caller: &mut Caller<'_, Invocation>, bytes: &[u8]) -> Result<i64, &'static str> {

data/crates/kobako-wasmtime/src/driver.rs

@@ -9,7 +9,6 @@
 
 use std::path::Path;
 use std::sync::Arc;
-use std::time::Instant;
 
 use wasmtime::{
     AsContextMut, InstancePre as WtInstancePre, ResourceLimiter, Store as WtStore, TypedFunc,
@@ -19,9 +18,11 @@ use crate::cache::shared_engine;
 use crate::config::Config;
 use crate::exports::{self, Exports};
 use crate::invocation::Invocation;
+use crate::wasi::Wasi;
 use crate::{capture, guest_mem, instance_pre, io, trap};
 use kobako_runtime::dispatch::DispatchHandler;
 use kobako_runtime::error::{InvokeError, SetupError, Trap};
+use kobako_runtime::grant::{Grant, GrantKind};
 use kobako_runtime::profile::Profile;
 use kobako_runtime::runtime::{Entry, Runtime as ContractRuntime};
 use kobako_runtime::snapshot::{Capture, Completion, Snapshot, Usage};
@@ -45,15 +46,22 @@ impl Driver {
     /// neither leaves the driver.
     pub fn new(path: &Path, config: Config) -> Result<Self, SetupError> {
         Ok(Self {
-            instance_pre: instance_pre::cached_instance_pre(path)?,
+            instance_pre: instance_pre::cached_instance_pre(path, config.setup_timeout)?,
             config,
         })
     }
 
-    fn new_store(&self) -> Result<WtStore<Invocation>, SetupError> {
-        let mut store = WtStore::new(shared_engine()?, Invocation::new(self.config.memory_limit));
+    /// The deadline and the `wall_time` bracket open with the Store, so
+    /// instantiating the guest and writing its request count against the
+    /// `timeout` as the export call does.
+    fn new_store(&self, wasi: Wasi) -> Result<WtStore<Invocation>, SetupError> {
+        let mut store = WtStore::new(
+            shared_engine()?,
+            Invocation::new(self.config.memory_limit, wasi),
+        );
         store.limiter(|state: &mut Invocation| -> &mut dyn ResourceLimiter { state.limiter_mut() });
-        store.epoch_deadline_callback(trap::epoch_deadline_callback);
+        trap::arm_deadline(&mut store, self.config.timeout);
+        store.data_mut().start_wall_clock();
         Ok(store)
     }
 
@@ -63,7 +71,11 @@ impl Driver {
         let instance = self
             .instance_pre
             .instantiate(store.as_context_mut())
-            .map_err(|e| Trap::Other(format!("failed to instantiate the Sandbox runtime: {e}")))?;
+            .map_err(|e| {
+                trap::cap_trap(&e).unwrap_or_else(|| {
+                    Trap::Other(format!("failed to instantiate the Sandbox runtime: {e}"))
+                })
+            })?;
         let exports = Exports::resolve(&instance, store.as_context_mut());
         store.data_mut().set_exports(exports.clone());
         Ok(exports)
@@ -83,58 +95,41 @@ impl Driver {
         Params: wasmtime::WasmParams,
         Results: wasmtime::WasmResults,
     {
-        self.prime_caps(store, exports);
+        self.arm_memory_cap(store, exports);
         let result = export.call(store.as_context_mut(), params);
         disarm_caps(store);
         result
     }
 
     /// The pre-initialized image's allocation is folded into the memory
-    /// baseline rather than the budget.
-    fn prime_caps(&self, store: &mut WtStore<Invocation>, exports: &Exports) {
-        match self.config.timeout {
-            Some(timeout) => {
-                let deadline = Instant::now() + timeout;
-                store.data_mut().set_deadline(Some(deadline));
-                store.set_epoch_deadline(1);
-            }
-            None => {
-                store.data_mut().set_deadline(None);
-                store.set_epoch_deadline(trap::NO_TIMEOUT_EPOCH_DELTA);
-            }
-        }
+    /// baseline rather than the budget, so the cap arms only once the
+    /// image is in place.
+    fn arm_memory_cap(&self, store: &mut WtStore<Invocation>, exports: &Exports) {
         let baseline = match exports.memory {
             Some(m) => m.data_size(store.as_context_mut()),
             None => 0,
         };
         store.data_mut().arm_memory_cap(baseline);
-        store.data_mut().start_wall_clock();
     }
 
     /// Built the same for every `completion`: captures and usage must
     /// survive a trap just as they do an outcome.
     fn build_snapshot(&self, store: &WtStore<Invocation>, completion: Completion) -> Snapshot {
         let data = store.data();
-        let usage = Usage {
-            wall_time: data.wall_time().as_secs_f64(),
-            memory_peak: data.memory_peak(),
+        let mut usage = Usage::default();
+        usage.wall_time = data.wall_time().as_secs_f64();
+        usage.memory_peak = data.memory_peak();
+        let clip = |bytes, limit| {
+            let mut capture = Capture::default();
+            (capture.bytes, capture.truncated) = capture::clip_capture(bytes, limit);
+            capture
         };
-        let (stdout_bytes, stdout_truncated) =
-            capture::clip_capture(data.stdout_bytes(), self.config.stdout_limit);
-        let (stderr_bytes, stderr_truncated) =
-            capture::clip_capture(data.stderr_bytes(), self.config.stderr_limit);
-        Snapshot {
+        Snapshot::new(
             completion,
-            stdout: Capture {
-                bytes: stdout_bytes,
-                truncated: stdout_truncated,
-            },
-            stderr: Capture {
-                bytes: stderr_bytes,
-                truncated: stderr_truncated,
-            },
+            clip(data.wasi().stdout_bytes(), self.config.stdout_limit),
+            clip(data.wasi().stderr_bytes(), self.config.stderr_limit),
             usage,
-        }
+        )
     }
 }
 
@@ -148,12 +143,13 @@ impl ContractRuntime for Driver {
         entry: Entry<'_>,
         preamble: &Preamble,
         handler: Option<Arc<dyn DispatchHandler>>,
+        grants: &[Grant],
     ) -> Result<Snapshot, InvokeError> {
-        let mut store = self.new_store()?;
+        let wasi = Wasi::for_invocation(&self.config, &preamble.encode(), grants)?;
+        let mut store = self.new_store(wasi)?;
         if let Some(handler) = handler {
             store.data_mut().bind_on_dispatch(handler);
         }
-        io::install_wasi(&mut store, &self.config, &preamble.encode())?;
         let exports = self.instantiate(&mut store)?;
         let downcall = exports::require(exports.downcall.as_ref())?;
         let request = match entry {
@@ -174,24 +170,30 @@ impl ContractRuntime for Driver {
                 Ok(outcome) => Completion::Outcome(outcome),
                 Err(t) => Completion::Trap(t),
             },
-            Err(e) => Completion::Trap(trap::trap_from(e)),
+            Err(e) => Completion::Trap(trap::to_trap(e)),
         };
         Ok(self.build_snapshot(&store, completion))
     }
 
     /// Exactly the rung `Config` requested. `Hermetic` freezes ambient time
-    /// and entropy; both rungs wire no filesystem, environment, or network,
+    /// and entropy; both rungs wire no ambient filesystem, environment, or network,
     /// and the linker adds only `__kobako_upcall` beyond that WASI surface.
     fn profile(&self) -> Profile {
         self.config.profile
     }
 
+    /// A Mount becomes a preopen of kobako's own descriptor table, which
+    /// answers every preview1 call beneath it.
+    fn supports(&self, kind: GrantKind) -> bool {
+        matches!(kind, GrantKind::Mount)
+    }
+
     /// Bounded by the same caps as an invocation, on an instance of its
     /// own that no script ever runs on, so what it answers carries
     /// nothing a script could have written.
     fn compile(&self, preamble: &Preamble) -> Option<Vec<Vec<u8>>> {
-        let mut store = self.new_store().ok()?;
-        io::install_wasi(&mut store, &self.config, &preamble.encode()).ok()?;
+        let wasi = Wasi::for_compile(&self.config, &preamble.encode()).ok()?;
+        let mut store = self.new_store(wasi).ok()?;
         let exports = self.instantiate(&mut store).ok()?;
         let downcall = exports::require(exports.downcall.as_ref()).ok()?;
         let (ptr, len) =

data/crates/kobako-wasmtime/src/guest_mem.rs

@@ -1,6 +1,7 @@
-//! Guest linear-memory I/O for every host↔guest buffer handoff, whether
-//! the invocation body drives it through its `Store` or a host import
-//! drives it through its `Caller`.
+//! Guest linear-memory I/O for the ABI's buffer handoffs, whether the
+//! invocation body drives one through its `Store` or a dispatch or yield
+//! import drives one through its `Caller`. preview1 reads and writes its
+//! arguments through its own `GuestMemory`.
 //!
 //! The two shared steps answer an error kind, and each caller words it,
 //! because depth decides what the same problem means: before the export
@@ -92,7 +93,7 @@ fn callback_exports(caller: &Caller<'_, Invocation>) -> Result<Exports, &'static
 
 /// Keep a trap the guest raised during a callback into it for the dispatch
 /// import to end the invocation with, and answer the callback's own reason.
-fn trapped(
+fn keep_trap(
     caller: &mut Caller<'_, Invocation>,
     trap: wasmtime::Error,
     reason: &'static str,
@@ -136,7 +137,7 @@ pub(crate) fn write_from_callback(
     alloc_and_write(&mut *caller, &exports, bytes).map_err(|err| match err {
         WriteError::TooLarge => "payload exceeds the 16 MiB limit",
         WriteError::Incompatible(message) => message,
-        WriteError::Trapped(trap) => trapped(
+        WriteError::Trapped(trap) => keep_trap(
             caller,
             trap,
             "the Sandbox trapped while allocating memory for the request",
@@ -177,9 +178,14 @@ pub(crate) fn unpack_guest_buffer(packed: u64) -> (usize, usize) {
 
 pub(crate) fn drive_yield(
     caller: &mut Caller<'_, Invocation>,
+    frame: u32,
     args: &[u8],
 ) -> Result<Vec<u8>, &'static str> {
-    let request = Downcall::Yield(args.to_vec()).encode();
+    let request = Downcall::Yield {
+        frame,
+        args: args.to_vec(),
+    }
+    .encode();
     let len_i32 = checked_payload_len(request.len())?;
     let req_ptr = write_from_callback(caller, &request)? as i32;
 
@@ -188,7 +194,7 @@ pub(crate) fn drive_yield(
     let memory = exports.memory.ok_or(SANDBOX_RUNTIME_NOT_KOBAKO)?;
     let packed = yield_fn
         .call(&mut *caller, (req_ptr, len_i32))
-        .map_err(|trap| trapped(caller, trap, "the Sandbox trapped while invoking a block"))?;
+        .map_err(|trap| keep_trap(caller, trap, "the Sandbox trapped while invoking a block"))?;
     let (reply_ptr, reply_len) = unpack_guest_buffer(packed);
     if reply_len == 0 {
         return Err("the Sandbox returned an empty block result");

data/crates/kobako-wasmtime/src/imports.rs

@@ -0,0 +1,46 @@
+//! The host imports a Guest Binary resolves: the WASI preview1 set and
+//! the wire ABI's `__kobako_upcall`.
+//!
+//! Both closures read all their state from the `Invocation` inside the
+//! calling Store, never from a Runtime, so the wiring is the same for
+//! every Sandbox and `crate::instance_pre` can cache what it resolves.
+
+use wasmtime::{Caller, Linker};
+use wasmtime_wasi::p1;
+
+use crate::cache::shared_engine;
+use crate::invocation::Invocation;
+use crate::{dispatch, preview1};
+use kobako_runtime::error::SetupError;
+
+pub(crate) fn linker() -> Result<Linker<Invocation>, SetupError> {
+    let mut linker: Linker<Invocation> = Linker::new(shared_engine()?);
+
+    // Wire the wasmtime-wasi preview1 WASI imports against each
+    // invocation's own `Wasi` context, then answer every call that reads
+    // a descriptor from kobako's own table, which routes guest fd 1/2 to
+    // its capture pipes.
+    p1::add_to_linker_sync(&mut linker, |state: &mut Invocation| {
+        state.wasi_mut().ctx_mut()
+    })
+    .and_then(|_| preview1::shadow(&mut linker))
+    .map_err(|e| SetupError::Dead(format!("failed to set up the WASI runtime: {e}")))?;
+
+    // `__kobako_upcall`, `(ptr: i32, len: i32) -> i64` per
+    // docs/wire/abi.md § ABI Signatures; `dispatch::handle` owns what it
+    // answers.
+    linker
+        .func_wrap(
+            "env",
+            "__kobako_upcall",
+            |mut caller: Caller<'_, Invocation>,
+             req_ptr: i32,
+             req_len: i32|
+             -> wasmtime::Result<i64> {
+                dispatch::handle(&mut caller, req_ptr, req_len)
+            },
+        )
+        .map_err(|e| SetupError::Dead(format!("failed to set up the host callback bridge: {e}")))?;
+
+    Ok(linker)
+}

data/crates/kobako-wasmtime/src/instance_pre.rs

@@ -1,13 +1,10 @@
 //! Per-path cache of pre-instantiated wasmtime artifacts.
 //!
-//! The `Linker` wiring (the WASI preview1 import set plus the
-//! `__kobako_upcall` host import) and its type-check against the
-//! compiled Module are identical for every `Kobako::Runtime` on the
-//! same Guest Binary — both host closures read all their state from
-//! the `Invocation` inside the calling Store, never from the Runtime.
-//! Caching the resolved `InstancePre` per path — together with the ABI
-//! version check it guards (`crate::abi`) — takes both off the
-//! `Driver::new` hot path.
+//! The host imports (`crate::imports`) and their type-check against the
+//! compiled Module are identical for every `Kobako::Runtime` on the same
+//! Guest Binary. Caching the resolved `InstancePre` per path — together
+//! with the ABI version check it guards (`crate::abi`) — takes both off
+//! the `Driver::new` hot path.
 //!
 //! Concurrency: the same as `crate::cache` — the Mutex covers lookup and
 //! insert only, and a concurrent miss builds an equivalent `InstancePre`.
@@ -15,19 +12,24 @@
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
 use std::sync::{Mutex, OnceLock};
+use std::time::Duration;
 
-use wasmtime::{Caller, InstancePre, Linker};
-use wasmtime_wasi::p1;
+use wasmtime::InstancePre;
 
-use crate::cache::{cached_module, shared_engine};
+use crate::cache::cached_module;
 use crate::invocation::Invocation;
-use crate::{abi, dispatch, trap};
+use crate::{abi, imports, trap};
 use kobako_runtime::error::SetupError;
 
 static INSTANCE_PRE_CACHE: OnceLock<Mutex<HashMap<PathBuf, InstancePre<Invocation>>>> =
     OnceLock::new();
 
-pub(crate) fn cached_instance_pre(path: &Path) -> Result<InstancePre<Invocation>, SetupError> {
+/// The probe runs only on the first load of a path, so only that load's
+/// `setup_timeout` bounds it; a path already verified is not set up again.
+pub(crate) fn cached_instance_pre(
+    path: &Path,
+    setup_timeout: Option<Duration>,
+) -> Result<InstancePre<Invocation>, SetupError> {
     let cache = INSTANCE_PRE_CACHE.get_or_init(|| Mutex::new(HashMap::new()));
 
     if let Some(pre) = cache
@@ -40,46 +42,16 @@ pub(crate) fn cached_instance_pre(path: &Path) -> Result<InstancePre<Invocation>
     }
 
     let module = cached_module(path)?;
-    let linker = build_linker()?;
+    let linker = imports::linker()?;
     let pre = linker
         .instantiate_pre(&module)
         .map_err(trap::instantiate_err)?;
     // Verify before the insert, so a rejected artifact is never
     // remembered as a usable template.
-    abi::verify(&pre)?;
+    abi::verify(&pre, setup_timeout)?;
     cache
         .lock()
         .expect("instance_pre cache mutex poisoned")
         .insert(path.to_path_buf(), pre.clone());
     Ok(pre)
 }
-
-fn build_linker() -> Result<Linker<Invocation>, SetupError> {
-    let mut linker: Linker<Invocation> = Linker::new(shared_engine()?);
-
-    // Wire the wasmtime-wasi preview1 WASI imports. Routes guest fd 1/2
-    // to the MemoryOutputPipes set up before each run via
-    // `Driver::invoke`. The closure pulls a `&mut WasiP1Ctx` out of
-    // Invocation; the panic semantics live inside `Invocation::wasi_mut`
-    // so the wiring stays honest about its precondition.
-    p1::add_to_linker_sync(&mut linker, |state: &mut Invocation| state.wasi_mut())
-        .map_err(|e| SetupError::Dead(format!("failed to set up the WASI runtime: {e}")))?;
-
-    // `__kobako_upcall`, `(ptr: i32, len: i32) -> i64` per
-    // docs/wire/abi.md § ABI Signatures; `dispatch::handle` owns what it
-    // answers.
-    linker
-        .func_wrap(
-            "env",
-            "__kobako_upcall",
-            |mut caller: Caller<'_, Invocation>,
-             req_ptr: i32,
-             req_len: i32|
-             -> wasmtime::Result<i64> {
-                dispatch::handle(&mut caller, req_ptr, req_len)
-            },
-        )
-        .map_err(|e| SetupError::Dead(format!("failed to set up the host callback bridge: {e}")))?;
-
-    Ok(linker)
-}

data/crates/kobako-wasmtime/src/invocation.rs

@@ -4,9 +4,8 @@
 //! Owned as the data of each per-invocation `wasmtime::Store`
 //! and threaded through every host import —
 //! the `__kobako_upcall` dispatcher reads the bound dispatch handler,
-//! while `Driver::invoke` installs the invocation's WASI
-//! context + pipes (via `io::install_wasi`) before the guest
-//! export call.
+//! and the WASI imports read the invocation's `Wasi` context, which the
+//! Store is created with.
 //!
 //! The slot also carries the per-invocation wall-clock deadline and the
 //! memory cap `MemoryLimiter`, both read from the wasmtime
@@ -16,28 +15,22 @@
 use std::sync::Arc;
 use std::time::{Duration, Instant};
 
-use wasmtime_wasi::p1::WasiP1Ctx;
-use wasmtime_wasi::p2::pipe::MemoryOutputPipe;
-
 use kobako_runtime::dispatch::DispatchHandler;
 
 use crate::exports::Exports;
 use crate::limiter::MemoryLimiter;
+use crate::wasi::Wasi;
 
 /// Per-invocation host state, owned by the invocation's own Store.
 /// Threaded through every host import callback.
 ///
-/// All field access is mediated by methods on this type — the WASI ctx
-/// is rebuilt fresh before each invocation via
-/// `Invocation::install_wasi`, the dispatch handler is set once via
-/// `Invocation::bind_on_dispatch`, and captured stdout/stderr bytes
-/// are read after the invocation via `Invocation::stdout_bytes` /
-/// `Invocation::stderr_bytes`. The fields are private so the mutation
-/// surface stays narrow.
+/// All field access is mediated by methods on this type — the `Wasi`
+/// context arrives with the invocation, the dispatch handler is set once
+/// via `Invocation::bind_on_dispatch`, and the captures are read back
+/// through `Invocation::wasi` after the run. The fields are private so
+/// the mutation surface stays narrow.
 pub(crate) struct Invocation {
-    wasi: Option<WasiP1Ctx>,
-    stdout_pipe: Option<MemoryOutputPipe>,
-    stderr_pipe: Option<MemoryOutputPipe>,
+    wasi: Wasi,
     on_dispatch: Option<Arc<dyn DispatchHandler>>,
     deadline: Option<Instant>,
     limiter: MemoryLimiter,
@@ -45,14 +38,13 @@ pub(crate) struct Invocation {
     wall_time: Duration,
     reentry_trap: Option<wasmtime::Error>,
     exports: Option<Exports>,
+    open_calls: u32,
 }
 
 impl Invocation {
-    pub(crate) fn new(memory_limit: Option<usize>) -> Self {
+    pub(crate) fn new(memory_limit: Option<usize>, wasi: Wasi) -> Self {
         Self {
-            wasi: None,
-            stdout_pipe: None,
-            stderr_pipe: None,
+            wasi,
             on_dispatch: None,
             deadline: None,
             limiter: MemoryLimiter::new(memory_limit),
@@ -60,6 +52,7 @@ impl Invocation {
             wall_time: Duration::ZERO,
             reentry_trap: None,
             exports: None,
+            open_calls: 0,
         }
     }
 
@@ -89,45 +82,41 @@ impl Invocation {
         self.reentry_trap.take()
     }
 
-    pub(crate) fn install_wasi(
-        &mut self,
-        wasi: WasiP1Ctx,
-        stdout: MemoryOutputPipe,
-        stderr: MemoryOutputPipe,
-    ) {
-        self.wasi = Some(wasi);
-        self.stdout_pipe = Some(stdout);
-        self.stderr_pipe = Some(stderr);
+    /// Count a Call the host is about to answer and name its frame, as the
+    /// guest counts the Calls it has open.
+    pub(crate) fn open_call(&mut self) -> u32 {
+        self.open_calls += 1;
+        self.open_calls - 1
+    }
+
+    pub(crate) fn close_call(&mut self) {
+        self.open_calls -= 1;
     }
 
     pub(crate) fn bind_on_dispatch(&mut self, handler: Arc<dyn DispatchHandler>) {
         self.on_dispatch = Some(handler);
     }
 
-    pub(crate) fn stdout_bytes(&self) -> Vec<u8> {
-        self.stdout_pipe
-            .as_ref()
-            .map(|p| p.contents().to_vec())
-            .unwrap_or_default()
+    /// A clone, so the borrow on the `Caller` is released and the
+    /// dispatcher can re-borrow it to write the Reply.
+    pub(crate) fn on_dispatch(&self) -> Option<Arc<dyn DispatchHandler>> {
+        self.on_dispatch.clone()
     }
 
-    pub(crate) fn stderr_bytes(&self) -> Vec<u8> {
-        self.stderr_pipe
+    /// The trap ending an invocation its host gave up on.
+    pub(crate) fn abandonment(&self) -> Option<wasmtime::Error> {
+        self.on_dispatch
             .as_ref()
-            .map(|p| p.contents().to_vec())
-            .unwrap_or_default()
+            .is_some_and(|handler| handler.abandoned())
+            .then(|| wasmtime::Error::msg("the host abandoned the invocation"))
     }
 
-    /// A clone, so the borrow on the `Caller` is released and the
-    /// dispatcher can re-borrow it to write the Reply.
-    pub(crate) fn on_dispatch(&self) -> Option<Arc<dyn DispatchHandler>> {
-        self.on_dispatch.clone()
+    pub(crate) fn wasi(&self) -> &Wasi {
+        &self.wasi
     }
 
-    pub(crate) fn wasi_mut(&mut self) -> &mut WasiP1Ctx {
-        self.wasi
-            .as_mut()
-            .expect("WASI context not initialised — the driver must install it before any WASI use")
+    pub(crate) fn wasi_mut(&mut self) -> &mut Wasi {
+        &mut self.wasi
     }
 
     pub(crate) fn set_deadline(&mut self, deadline: Option<Instant>) {