security_box 0.3.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9949a172b6bf1ddf1eddd9756c8dcbad273d8f2409669304227bb2f981c9fef6
-  data.tar.gz: 499c948e3fd57c221f8aef7f8ad6dd63757b36e9d5a4a62d8c8a70823908f86d
+  metadata.gz: 999342421a33fdaba7863952bafad78dc8e87bac98a1ec02269fb2903be9d414
+  data.tar.gz: b119d9d14854ba07b2f99bd1c5d8c8e2e25db4f5f50370d1ecea41491ee8b673
 SHA512:
-  metadata.gz: 1cf51781bb108aa6849ae24bd1db5b812c7e0a7e94f0d1876eb1a860cabc4a6b00241fdc19b4b142b88da8bdf86ed6e9c5dc53009237f36706a4ff637fe96d5f
-  data.tar.gz: 39dfd3af95bc8bfd2e3bd79ac57b118ee706b2f7da3aee98854aea832094b29342e751b2a41bf630c593fd07289ecf7ac041b1d416682924f276a29be4a7259b
+  metadata.gz: 20c96a86adc927a31e1abbe16a6a6cae1b49b015f7078917a0cd1fccfab61e3f5afbc7e2b0a1f71bf546aa21bd40db7d063fb138f542f3c1d2c14f968cd93e05
+  data.tar.gz: 8eddad9955d7801ce2ce93531ba92d581f1686f07288012501bc933d47034502dc3a7a4089f992340a2173ed2230e3698c1b5fdbb1b1e575465ccda0c53f3004

data/CHANGELOG.md

@@ -5,6 +5,134 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.0] - 2026-09-21
+
+### Added
+
+- **Host RPC for code mode (stage 6)**: guest code can call host-registered
+  handlers with a regular, blocking function call:
+  `SB.call("github.search", q: "x")`. The call invokes the wasm import
+  (`sb`/`call`, declared by the new `sb_rpc` C extension statically linked
+  into the image) and blocks while the host executes the handler — no
+  callbacks, no rounds, no replay: the code reads as plain sequential Ruby
+  to the LLM that generated it.
+- `c.rpc "name" => handler` in the register DSL (and `rpcs:` in
+  `Configuration.build` / per-call `eval` overrides, replacing like `env:`).
+  Handlers receive the JSON-parsed request args (string keys) and must
+  return a JSON-serializable value (non-serializable results surface as
+  inspect strings). `SecurityBox::Rpcs` validates the set (non-empty unique
+  String names, `#call`-able handlers, at most 64); handlers are host-only
+  state — excluded from `#fingerprint` and unsupported on `RactorPool`
+  (Procs cannot cross a Ractor boundary; raises `InvalidConfiguration`).
+- `Result#rpcs`: a frozen transcript of the calls
+  (`{"name", "args", "ok", "result"|"error"}`), for agent debugging.
+- Sanitized failure mapping: a raising handler becomes a guest-rescuable
+  `SB::ToolError` (`SB::UnknownTool` for unregistered names, including the
+  "no handlers configured" case) carrying only `class` + `message` — no
+  backtrace, no host details. Unknown names never crash the host.
+- Bridge limits: at most 1000 RPC calls per eval and 1 MiB per response
+  (`SecurityBox::GuestRpc::MAX_CALLS`/`RESULT_LIMIT`), enforced host-side.
+
+### Changed
+
+- **Image build**: the image is now built from the pinned Ruby 4.0 source
+  with the guest gems of `lib/security_box/guest_ext` (Gemfile + `sb_rpc`)
+  statically linked (`rbwasm build` + `rbwasm pack`), replacing the packed
+  prebuilt release tarball. Size: 115MB → ~50MB; memory floor: ~95.5MiB →
+  ~36MiB (576 pages); first build downloads the Ruby source, wasi-sdk and
+  binaryen (cached in `build/`).
+- Epoch timer: the engine's native `start_epoch_interval` (a Ruby timer
+  thread cannot run while `invoke` holds the GVL — stage-4 evidence
+  reconfirmed). With a working timer, `timeout_ms` measurably covers boot +
+  guest compute + RPC handler time (the guest traps at the first epoch
+  check after the deadline passes; the handler itself is not interrupted).
+
+### Notes
+
+- The RPC import must be defined on every linker even when no handlers are
+  configured (the image declares the import); guest calls then receive a
+  clean, rescuable `SB::UnknownTool` instead of a failed instantiation.
+- Guest boot fuel is ~0.9e9 (measured with the new image, consistent with
+  the stage-3 calibration).
+
+## [0.5.0] - 2026-09-20
+
+### Added
+
+- Folder mounts (read-only by default): `c.mount "host/path" => "/data"` in the
+  register DSL (or `mounts:` in `Configuration.build`), with `c.mount_rw` for an
+  opt-in writable mount. Guest code can read a mounted host directory
+  (`File.read`, `Dir[]`, `File.open`); write attempts into a read-only mount fail
+  guest-side with `Errno::EPERM` and leave the host directory untouched.
+- `Configuration#mounts`: a frozen array of frozen `{host:, guest:, mode:}` hashes.
+  Mounts are config values — they flow through `#with`, `#fingerprint` (equal
+  mounts → equal fingerprint) and RactorPool requests. Relative host paths are
+  expanded against `Dir.pwd` at DSL time.
+- Mount validation (`SecurityBox::InvalidConfiguration` on violation): mode must be
+  `:read_only`/`:read_write` (wasmtime silently accepts unknown symbols, so the mode
+  is never trusted to the runtime); guest paths must be absolute and normalized
+  (no `..`, no trailing `/`, not `/`); guest paths must not overlap the reserved
+  `/work`, `/usr` or `/src` trees (exact or nested — a collision with the embedded
+  VFS is silently shadowed, a mount inside `/usr` breaks the guest boot, and inside
+  `/work` it would create a read-only subtree); duplicate guest paths are rejected
+  (wasmtime's last-mount-wins is silently surprising); at most 16 mounts.
+- Per-eval host-path validation: a mount whose host directory vanished returns a
+  `:sandbox_error` Result with a `security_box:` note instead of raising
+  `Wasmtime::Error` out of `#eval` (the store creation now also sits inside the
+  eval's rescue, so wasmtime setup failures can never raise).
+
+### Changed
+
+- `Sandbox#eval` (and pool equivalents) accept `mounts:` as a per-call override
+  (replaces the configuration's mounts, like `env:`).
+- README: new "Folder mounts" section + updated isolation matrix and defense notes
+  (a mounted folder's content is fully readable by guest code).
+
+### Investigation (no change needed, documented)
+
+- Q6 probe (stage 5): the embedded VFS is **not** guest-writable (`File.write`
+  into `/usr`, `/src` or `/` fails with `Errno::ENOENT`; deletes with `ENOTSUP`),
+  so no prelude File-write restriction is warranted; WASI remains the primary
+  enforcement. Symlink escapes from a mounted directory are blocked by wasmtime
+  (`Errno::EPERM`); the guest cannot even create symlinks. Measured mount cost:
+  none (warm-boot p50 ~260ms with 0/1/4/8 mounts). Evidence and probes in
+  `docs/plan/stages/stage_5.md` and `bin/spike_stage5_mounts.rb`.
+
+## [0.4.0] - 2026-09-15
+
+### Added
+
+- `SecurityBox::Pool` (`SecurityBox.pool`): a bounded pool of `:oneshot` sandboxes —
+  hard cap on concurrent evals (`size:`), sandbox reuse, `checkout` block and metrics
+  (`created`/`evals`/`total_ms`/`avg_ms`). Evals serialize on the GVL (documented).
+- `SecurityBox::RactorPool` (`SecurityBox.ractor_pool`): real parallelism — worker
+  Ractors sharing one Ractor-shareable Engine + compiled Module (stage-3 "Plan C").
+  Measured ≈0.52–0.53 parallel/serial wall ratio at 4 workers on 6 cores (~1.9x),
+  RSS ≈57MB; per-call overrides, statuses and trap recovery behave like
+  `Sandbox#eval`; a dead worker degrades to a `:sandbox_error` Result instead of a
+  hang.
+- `Configuration#fuel_ms`: rate-based fuel budgeting (~4e6 fuel/ms from the stage-3
+  calibration table + ~1e9 boot allowance), exposed via `Configuration#effective_fuel`
+  and usable per call. `fuel` and `fuel_ms` are mutually exclusive in the builder DSL
+  and in `#with`; switch back with `with(fuel_ms: nil, fuel: ...)`.
+- `docs/plan/stages/stage_4.md` with the worker-mode feasibility investigation.
+
+### Changed
+
+- The eval core was extracted from `Sandbox` into `SecurityBox::EvalRun` (shared by
+  `Sandbox` and `RactorPool` workers); `Sandbox` is now a thin, thread-safe wrapper.
+- README: the "Ractor note" roadmap item is delivered; concurrency guidance rewritten
+  around `Pool`/`RactorPool`.
+
+### Investigation (negative result, documented)
+
+- `:worker` mode (long-lived instance amortizing the ~240ms boot) is infeasible on
+  wasmtime-rb 48 (sync WASI): `invoke` holds the GVL during compute *and* while the
+  guest is blocked on a WASI read; epoch deadlines never fire inside a blocking
+  syscall; and per-request limits would require mutating a live Store from another
+  thread (unsafe). Evidence and probes in `docs/plan/stages/stage_4.md` and
+  `bin/spike_stage4_worker.rb`.
+
 ## [0.3.0] - 2026-09-14
 
 ### Added

data/README.md

@@ -15,9 +15,12 @@ tries to escape.
 
 ## How it works
 
-1. A `ruby.wasm` image is packed with the Ruby runtime + stdlib + a small guest
-   entrypoint (`lib/security_box/guest/main.rb`) plus a hardening prelude
-   (`lib/security_box/guest/prelude.rb`).
+1. A `ruby.wasm` image is built from the pinned Ruby 4.0 source with the guest
+   gems of `lib/security_box/guest_ext` statically linked (`rbwasm build`),
+   then packed with the guest entrypoint (`lib/security_box/guest/main.rb`)
+   plus a hardening prelude (`lib/security_box/guest/prelude.rb`). The
+   `sb_rpc` gem declares the `sb`/`call` wasm import used by the host RPC
+   channel (see "Host RPC (code mode)" below).
 2. On every `#eval`, the host creates an exclusive tmpdir, writes the user code to it, and
    mounts it read-write as `/work` inside the sandbox. It also generates a per-eval
    random token and passes it to the guest via `SB_TOKEN`.
@@ -50,23 +53,24 @@ gem "security_box"
 ```
 
 The gem ships a prebuilt sandbox image (`lib/security_box/assets/security_box.wasm`,
-about 110MB), so no network access or build tools are needed at install or at
+about 50MB), so no network access or build tools are needed at install or at
 runtime.
 
 ### Rebuilding the image (development only)
 
-If you change `lib/security_box/guest/*.rb` or bump the pinned ruby.wasm
-release, repack the sandbox image:
+If you change `lib/security_box/guest/*.rb` or anything under
+`lib/security_box/guest_ext/` (guest gems), rebuild the sandbox image:
 
 ```bash
 bundle install
 bundle exec rake security_box:build_image
 ```
 
-This downloads the pinned ruby.wasm release (`2.10.1`, see the `Rakefile`) and
-packs it with the guest script into `lib/security_box/assets/security_box.wasm`.
-The task skips repacking when the image is already fresh. The image is not
-committed to git.
+The first build downloads the Ruby source tarball, wasi-sdk and binaryen into
+`build/` (network required, cached afterwards), builds Ruby 4.0 with the guest
+gems statically linked and packs `lib/security_box/guest` as `/src`. The task
+skips rebuilding when the image is already fresh. The image is not committed to
+git.
 
 You can point the library at a different image with the `SECURITY_BOX_IMAGE`
 environment variable or by passing `image_path:` in the configuration — useful
@@ -119,7 +123,8 @@ sandbox.eval("3 * 3").value # => 9
 ### Per-call limits
 
 Options can be passed per call (derived from the configuration without mutating it):
-`timeout_ms`, `fuel`, `memory_size`, `stdout_limit`, `stderr_limit`.
+`timeout_ms`, `fuel`, `fuel_ms`, `memory_size`, `stdout_limit`, `stderr_limit`,
+`mounts`.
 
 ```ruby
 # Wall-clock limit via epoch interruption
@@ -155,6 +160,45 @@ result.error["backtrace"]        # => ["sandbox:1:in 'Object#boom'", "sandbox:1:
 The backtrace contains guest frames only (sandbox-internal locations, capped at
 20 frames) — nothing from the host filesystem leaks.
 
+### Host RPC (code mode)
+
+Guest code can call host-registered handlers with a regular, **blocking**
+function call — the shape model-generated "code mode" agents need:
+
+```ruby
+SecurityBox.register(:agent) do |c|
+  c.rpc "github.search" => ->(args) { mcp.call_tool("github", "search", args) }
+  c.rpc "github.get"    => ->(args) { mcp.call_tool("github", "get_file", args) }
+  c.fuel_ms 200
+  c.timeout_ms 5_000   # covers boot + guest compute + handler time
+end
+
+box = SecurityBox.spawn(:agent)
+box.eval(<<~CODE)
+  hits = SB.call("github.search", q: "ruby wasm").items
+  SB.call("github.get", path: hits.first.path)
+CODE
+```
+
+- `SB.call(name, args)` blocks inside the sandbox (a wasm import provided by
+  the statically linked `sb_rpc` gem) while the host executes the handler;
+  from the guest's perspective it is just a function returning a value.
+- Handlers receive the JSON-parsed args (string keys) and must return a
+  JSON-serializable value (non-serializable results surface as inspect
+  strings).
+- A raising handler becomes a guest-rescuable `SB::ToolError`
+  (`SB::UnknownTool` for unregistered names) carrying only `class` +
+  `message` — no backtrace, no host details. Calling an RPC on a sandbox
+  with no handlers configured is also a clean, rescuable error.
+- `Result#rpcs` carries the frozen per-eval transcript
+  (`{"name", "args", "ok", "result"|"error"}`) for agent debugging.
+- Limits: at most 1000 calls per eval and 1MiB per response.
+- Handlers are host-only state: excluded from `#fingerprint`, not supported
+  on `RactorPool` (they cannot cross a Ractor boundary), and must be
+  thread-safe when a `Pool` is used concurrently.
+- Per-call override (replaces, like `env:`):
+  `SecurityBox.eval(code, rpcs: { "calc" => ->(args) { ... } })`.
+
 ### Named profiles
 
 Reusable configurations registered once and spawned as often as needed:
@@ -182,6 +226,49 @@ Profiles are immutable: duplicate names and unknown names raise
 `SecurityBox::Configuration#fingerprint` gives every configuration a stable
 identity (equal settings → equal fingerprint), used to share runtime artifacts.
 
+### Folder mounts
+
+Host folders can be mounted into the sandbox explicitly. **Mounts are read-only
+by default**; `mount_rw` is the opt-in writable form:
+
+```ruby
+SecurityBox.register(:reader) do |c|
+  c.mount    "./data" => "/data"   # read-only (host path expanded at DSL time)
+  c.mount_rw "./state" => "/state" # opt-in writable
+end
+
+box = SecurityBox.spawn(:reader)
+box.eval('File.read("/data/input.csv")')      # guest reads mounted content
+box.eval('File.write("/state/last.txt", Time.now.to_i)')
+
+# Per-call override (replaces the configuration's mounts, like env:)
+SecurityBox.eval('File.read("/data/a.txt")',
+                 mounts: [{ host: "./data", guest: "/data", mode: :read_only }])
+```
+
+Rules (violations raise `SecurityBox::InvalidConfiguration` at registration):
+
+- A mount is one `{host:, guest:, mode:}` pair; `mode` is `:read_only` or
+  `:read_write` and the DSL defaults to read-only.
+- Guest paths must be absolute and normalized, must not overlap the reserved
+  `/work` (sandbox tmpdir), `/usr` (embedded stdlib) or `/src` (entrypoint)
+  trees — exact or nested — and must be unique.
+- At most 16 mounts per configuration.
+- The host path must exist and be a directory at eval time; otherwise the eval
+  returns `:sandbox_error` with a `security_box:` note on stderr (instead of
+  raising).
+
+Security notes:
+
+- **A mounted folder's content is fully readable by guest code** — only mount
+  directories whose content you are willing to expose to the executed code.
+- Read-only mounts are enforced by wasmtime: writes fail guest-side with
+  `Errno::EPERM` and the host directory is never touched. Symlinks inside a
+  mounted directory cannot escape it (wasmtime caps path resolution at the
+  preopen root), and guest code cannot create symlinks at all.
+- Mounted content can also be **written by the guest** in `mount_rw` mounts —
+  treat a writable mount as part of the guest's blast radius.
+
 ### Configuration
 
 `SecurityBox::Configuration` is immutable; use `.build` to create and `#with` to derive:
@@ -189,12 +276,15 @@ identity (equal settings → equal fingerprint), used to share runtime artifacts
 ```ruby
 config = SecurityBox::Configuration.build(
   fuel: 10_000_000_000,             # deterministic CPU budget
+  fuel_ms: nil,                     # or a millisecond-based budget (mutually exclusive with fuel)
   timeout_ms: 2_000,                # wall-clock limit (epoch interruption)
   memory_size: 512 * 1024 * 1024,   # wasm linear memory limit
   stdout_limit: 1 << 20,            # stdout capture capacity in bytes
   stderr_limit: 1 << 16,            # stderr capture capacity in bytes
   epoch_interval_ms: 25,            # epoch timer granularity
-  env: { "LANG" => "C" }            # guest environment (empty by default)
+  env: { "LANG" => "C" },           # guest environment (empty by default)
+  mounts: [],                       # host-folder mounts (see "Folder mounts")
+  rpcs: {}                          # name => callable host RPC handlers
 )
 
 lean = config.with(timeout_ms: 500, fuel: 5_000_000)
@@ -221,32 +311,93 @@ string.
 |---|---|
 | `File.write("/etc/passwd", ...)` | `Errno::ENOENT` (guest does not see the host FS) |
 | `Dir["/*"]` | `[]` (empty root) |
+| `File.write` into a read-only mount | `Errno::EPERM` (wasmtime-enforced; host dir untouched) |
+| symlink escape from a mounted directory | `Errno::EPERM` (path resolution capped at the preopen root) |
 | `system("ls")` / backticks / `IO.popen` / `Process.spawn` | `SecurityError` (hardening prelude) |
 | `Kernel#open(...)` | `SecurityError` (pipe form; use `File.open`) |
 | `fork` | `NotImplementedError` |
 | `Thread.new` | `NotImplementedError` (WASI p1 has no threads) |
 | `require "socket"` | `LoadError` (no network) |
 | `ENV` | `{}` (token read and scrubbed by the prelude) |
+| `SB.call("missing")` | `SB::UnknownTool` (guest-rescuable; host never crashes) |
+| `SB.call` with no handlers configured | `SB::UnknownTool` ("no RPC handlers are configured…") |
+| handler raising | guest sees `SB::ToolError` with `class` + `message` only |
+| >1000 RPC calls or >1MiB result | `SB::ToolError` (guest-rescuable, host-side enforced) |
 | forge `out.json` via `at_exit` / fake sentinel | rejected (token mismatch → `:sandbox_error`) |
 | infinite loop | killed by epoch deadline or fuel budget |
 
 Notes:
 
 - The guest Ruby version is the one from ruby.wasm (4.0), not necessarily the host's.
-- Concurrency: `invoke` holds the GVL, so executions serialize per host process. Scale
-  horizontally with multiple processes (e.g., Puma workers); a stuck guest still can't
-  hang the process thanks to the epoch deadline.
-- Ractor note: wasmtime `Engine`/`Module` are Ractor-shareable and Ractors run wasm in
-  parallel (measured ≈3.6x with 4 Ractors on 6 cores); a supported Ractor pool is on
-  the roadmap (see `docs/plan/stages/stage_3.md`).
-- Memory: the packed image declares a 1528-page (~95.5 MiB) minimum; `memory_size`
-  below that fails instantiation (reported as `:sandbox_error`). Practical minimum is
-  ~128–144MB for small workloads; the 512MB default leaves comfortable headroom.
+- Mounts widen the trust surface: a mounted folder's content is fully readable by
+  guest code (see "Folder mounts" above). Read-only by default; nothing outside
+  `/work` is writable without an explicit `mount_rw`.
+- Concurrency: `invoke` holds the GVL, so executions on threads serialize — use
+  `RactorPool` (below) for parallelism inside one process, or scale horizontally with
+  multiple processes (e.g., Puma workers). A stuck guest still can't hang the process
+  thanks to the epoch deadline.
+- Ractor: wasmtime `Engine`/`Module` are Ractor-shareable and Ractors run wasm in
+  parallel — measured ≈1.9x wall-time speedup at 4 workers on 6 cores through
+  `RactorPool` (see `docs/plan/stages/stage_3.md` and `stage_4.md`).
+- Memory: the image (stage-6 `rbwasm build` flow) declares a ~576-page (~36 MiB)
+  minimum; `memory_size` below that fails instantiation (reported as
+  `:sandbox_error`). Practical minimum is ~48–64MB for small workloads; the
+  512MB default leaves comfortable headroom.
 - Fuel budgeting: compute workloads burn ~4–8e9 fuel/s (tight loops up to ~8.4e9/s)
   and every eval costs ~1e9 fuel for boot — see the calibration table in
   `docs/plan/stages/stage_3.md`. Consequently `fuel` below ~1e9 cannot even boot, and
   `timeout_ms` below ~300ms times out during the guest boot (~500ms is a practical
-  floor).
+  floor). Prefer thinking in milliseconds? Use `fuel_ms` (below).
+
+## Concurrency
+
+Two pools are available, with honestly different guarantees (measured in stage 4 —
+`invoke` holds the GVL, so a long-lived `:worker` instance is impossible on the current
+wasmtime-rb; one wasm boot per eval stays on the hot path):
+
+### `Pool` — bounded concurrency on threads
+
+```ruby
+pool = SecurityBox.pool(:lean, size: 4)
+pool.eval("40 + 2").value    # => 42
+pool.checkout { |sandbox| sandbox.eval("1 + 1") }
+pool.metrics                 # => {size:, created:, evals:, total_ms:, avg_ms:}
+pool.shutdown
+```
+
+Caps concurrent evals at `size` and reuses sandbox objects, but evals serialize on the
+GVL — one at a time.
+
+### `RactorPool` — real parallelism
+
+```ruby
+pool = SecurityBox.ractor_pool(:lean, size: 4)
+pool.eval("40 + 2").value    # => 42
+pool.shutdown
+```
+
+Worker Ractors share one Engine + compiled Module and run wasm truly in parallel
+(~1.9x wall-time speedup at 4 workers on 6 cores; measured ≈0.53 parallel/serial wall
+ratio across 1M–4M-iteration workloads). Per-call overrides, user errors, timeouts and
+fuel exhaustion behave exactly like `Sandbox#eval`, and the worker survives traps and
+keeps serving. Costs one module deserialize at creation (~0.5s via the disk cache);
+each eval still pays the ~240ms guest boot.
+
+### `fuel_ms` — rate-based fuel budgeting
+
+Instead of counting raw fuel, budget approximate wall-time of compute:
+
+```ruby
+config = SecurityBox::Configuration.build(fuel_ms: 100) # ≈100ms of compute + boot allowance
+SecurityBox.spawn(config).eval("i = 0; while i < 5_000_000; i += 1; end").status
+# => :fuel_exhausted (5M tight iterations ≈ 2.4e9 fuel > the 100ms budget)
+```
+
+`fuel_ms` converts to fuel with the conservative stage-3 calibration rate
+(4e6 fuel/ms ≈ 4e9 fuel/s) plus a ~1e9 boot allowance (`Configuration#effective_fuel`).
+The epoch `timeout_ms` remains the mandatory wall-clock backstop. `fuel` and `fuel_ms`
+are mutually exclusive in the builder DSL and in `#with` overrides; a `fuel_ms`
+configuration can be switched back with `with(fuel_ms: nil, fuel: ...)`.
 
 ## Running the tests
 
@@ -276,6 +427,13 @@ prints a timing report:
 bundle exec ruby bin/spike.rb
 ```
 
+## Samples
+
+- [`samples/ruby_llm/reader_agent`](samples/ruby_llm/reader_agent/README.md) — an
+  LLM agent built with [RubyLLM](https://github.com/crmne/ruby_llm) whose code-execution
+  tool runs model-generated Ruby inside the sandbox, demonstrating folder mounts
+  (read-only vs read-write) end to end.
+
 ## Documentation
 
 - `docs/PLAN.md` — architecture, roadmap and threat model
@@ -284,3 +442,10 @@ bundle exec ruby bin/spike.rb
   integrity, compiled-module disk cache)
 - `docs/plan/stages/stage_3.md` — stage 3 findings (named profiles, Ractor
   parallelism, memory floor, fuel calibration, backtrace)
+- `docs/plan/stages/stage_4.md` — stage 4 findings (worker-mode feasibility, pools,
+  `fuel_ms`)
+- `docs/plan/stages/stage_5.md` — stage 5 findings (folder mounts: read-only
+  enforcement, reserved-path collisions, symlink escapes, mount cost)
+- `docs/plan/stages/stage_6.md` — stage 6 findings (blocking host RPC via a
+  wasm import, `SB.call` code-mode contract, epoch semantics, new image
+  build flow)

data/lib/security_box/assets/security_box.wasm

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: data/lib/security_box/assets/security_box.wasm
-size: 115877509 bytes
-sha256: d7af08b7b11f5ac8bf9b4b8e9cb2ac6ca3e5c977f0dcdfea3551627247589a70
+size: 52249212 bytes
+sha256: 6a6b265e2c1e79f871ccee925a8ea63310cdf433fcffb061369c72f64fd5301c