security_box 0.3.0 → 0.6.0

data/lib/security_box/guest_ext/Gemfile.lock

@@ -0,0 +1,31 @@
+PATH
+  remote: sb_rpc
+  specs:
+    sb_rpc (0.1.0)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    logger (1.7.0)
+    ruby_wasm (2.10.1)
+      logger
+    ruby_wasm (2.10.1-x86_64-linux)
+      logger
+
+PLATFORMS
+  ruby
+  x86_64-linux
+
+DEPENDENCIES
+  ruby_wasm (~> 2.10.1)
+  sb_rpc!
+
+CHECKSUMS
+  bundler (4.0.20) sha256=7978a8ac648767f5e635bc522445b79e80a52b907a39a36c2d8085ed6bc762ae
+  logger (1.7.0) sha256=196edec7cc44b66cfb40f9755ce11b392f21f7967696af15d274dde7edff0203
+  ruby_wasm (2.10.1) sha256=874e0acb783a8326bfb0db892004816c26963a4276a9f719791a8828e53a05f1
+  ruby_wasm (2.10.1-x86_64-linux) sha256=728e29dc688246572b56dcef1c7b131431d07865320c9b8434dd1ccdfd63db2b
+  sb_rpc (0.1.0)
+
+BUNDLED WITH
+  4.0.20

data/lib/security_box/guest_ext/sb_rpc/ext/sb_rpc/extconf.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+require "mkmf"
+
+create_makefile("sb_rpc")

data/lib/security_box/guest_ext/sb_rpc/ext/sb_rpc/sb_rpc.c

@@ -0,0 +1,29 @@
+#include <ruby.h>
+#include <stdint.h>
+
+/*
+ * Host bridge for security_box RPC.
+ *
+ * sb_rpc_call is resolved as a wasm import by the host
+ * (Wasmtime::Linker#func_new, module "sb", function "call"). The guest
+ * blocks inside this call while the host executes the registered handler;
+ * the host returns 0 on success (any other value signals a transport
+ * failure). The request/response payload travels via /work JSON files
+ * written/read by the guest-side Ruby wrapper (sb_rpc.rb in the image),
+ * keeping this C code free of any protocol knowledge.
+ */
+__attribute__((import_module("sb"), import_name("call")))
+extern int32_t sb_rpc_call(void);
+
+static VALUE
+sb_call(VALUE self)
+{
+    return INT2NUM(sb_rpc_call());
+}
+
+void
+Init_sb_rpc(void)
+{
+    VALUE mSBExt = rb_define_module("SBExt");
+    rb_define_singleton_method(mSBExt, "call", sb_call, 0);
+}

data/lib/security_box/guest_ext/sb_rpc/lib/sb_rpc.rb

@@ -0,0 +1,6 @@
+# Loaded by `require "sb_rpc"` inside the security_box guest image.
+#
+# The extension is statically linked into the ruby.wasm binary; requiring
+# the .so feature name triggers its Init_sb_rpc hook through the static
+# extension registry.
+require "sb_rpc.so"

data/lib/security_box/guest_ext/sb_rpc/sb_rpc.gemspec

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+Gem::Specification.new do |spec|
+  spec.name = "sb_rpc"
+  spec.version = "0.1.0"
+  spec.summary = "Host RPC bridge for security_box guest images"
+  spec.description =
+    "Exposes SBExt.call, a wasm import bridge the guest uses to invoke " \
+    "host-registered RPC handlers. The call blocks inside the sandbox while " \
+    "the host executes the handler; the request/response travel via JSON " \
+    "files in /work."
+  spec.authors = ["security_box"]
+  spec.license = "MIT"
+  spec.required_ruby_version = ">= 3.0"
+  spec.files = Dir["lib/**/*.rb", "ext/**/*.{c,h,rb}"] + ["sb_rpc.gemspec"]
+  spec.extensions = ["ext/sb_rpc/extconf.rb"]
+end

data/lib/security_box/guest_rpc.rb

@@ -0,0 +1,132 @@
+# frozen_string_literal: true
+
+require "json"
+
+module SecurityBox
+  # Host side of the guest RPC channel (stage 6).
+  #
+  # The image statically links the sb_rpc gem, whose C extension declares
+  # the wasm import ("sb", "call"). The linker must define it for every
+  # instantiation — even when no handlers are configured, or instantiation
+  # fails on an unresolved import. Per-eval state (the /work tmpdir, the
+  # handler map and the call transcript) travels through Store data and
+  # reaches the closure via caller.store_data, so a single definition is
+  # safe to share across evaluations, threads and Ractor workers.
+  #
+  # Protocol (guest side: lib/security_box/guest/rpc.rb):
+  #   guest writes /work/rpc_req.json  {"name", "args"}
+  #   guest calls SBExt.call           (blocks inside the import)
+  #   host executes handlers[name], writes /work/rpc_resp.json
+  #   host returns 0 (any non-zero value is a transport failure)
+  #
+  # Nothing escapes the closure: a raising handler (or any failure in the
+  # bridge) becomes an {"ok": false, "error": {"class", "message"}}
+  # response the guest can rescue. Messages never include host details
+  # (no backtraces, no paths). Handler results are JSON round-tripped,
+  # like guest return values — never Marshal.
+  module GuestRpc
+    IMPORT_MODULE = "sb"
+    IMPORT_NAME = "call"
+    REQUEST_FILE = "rpc_req.json"
+    RESPONSE_FILE = "rpc_resp.json"
+    MAX_CALLS = 1_000
+    RESULT_LIMIT = 1 << 20
+
+    class << self
+      # Defines the import on `linker` (once per linker; state is
+      # per-Store). The closure captures nothing — Ractor-safe.
+      def define_import(linker)
+        linker.func_new(IMPORT_MODULE, IMPORT_NAME, [], [:i32]) do |caller|
+          serve(caller)
+        end
+        nil
+      end
+
+      # Per-eval Store data. `handlers` is the configuration's
+      # name => callable map, or nil when no rpcs are configured (guest
+      # calls still get a clean, rescuable error).
+      def store_data(workdir, handlers)
+        {
+          workdir: workdir,
+          rpc: handlers.nil? ? nil : { handlers: handlers, calls: [] }
+        }
+      end
+
+      private
+
+      def serve(caller)
+        data = caller.store_data
+        rpc = data[:rpc]
+        unless rpc
+          return fail_call(data, nil, "SB::UnknownTool",
+                           "no RPC handlers are configured for this sandbox")
+        end
+
+        request = JSON.parse(File.read(request_path(data)))
+        entry = { "name" => request["name"], "args" => request["args"] }
+        rpc[:calls] << entry
+        dispatch(data, rpc, request, entry)
+        0
+      rescue Exception => e # rubocop:disable Lint/RescueException
+        # Transport/boundary failure (unparsable request, broken /work):
+        # encoded as a tool error so the guest gets a rescuable exception
+        # instead of the host crashing through the wasm boundary.
+        fail_call(data, nil, e.class.name, e.message.to_s)
+      end
+
+      def dispatch(data, rpc, request, entry)
+        if rpc[:calls].size > MAX_CALLS
+          return fail_call(data, entry, "SB::ToolError",
+                           "too many RPC calls (limit #{MAX_CALLS})")
+        end
+
+        handler = rpc[:handlers][request["name"]]
+        if handler.nil?
+          return fail_call(data, entry, "SB::UnknownTool",
+                           "unknown rpc: #{request["name"]}")
+        end
+
+        result = jsonable(handler.call(request["args"]))
+        payload = { "ok" => true, "result" => result }
+        if JSON.generate(payload).bytesize > RESULT_LIMIT
+          return fail_call(data, entry, "SB::ToolError",
+                           "rpc result too large (limit #{RESULT_LIMIT} bytes)")
+        end
+
+        entry["ok"] = true
+        entry["result"] = result
+        write_response(data, payload)
+      rescue Exception => e # rubocop:disable Lint/RescueException
+        fail_call(data, entry, e.class.name, e.message.to_s)
+      end
+
+      def fail_call(data, entry, klass, message)
+        error = { "class" => klass, "message" => message }
+        # The entry (when present) is already in the transcript — mutate
+        # it in place instead of pushing a duplicate.
+        if entry
+          entry["ok"] = false
+          entry["error"] = error
+        end
+        write_response(data, { "ok" => false, "error" => error })
+        0
+      end
+
+      def request_path(data)
+        File.join(data[:workdir], REQUEST_FILE)
+      end
+
+      def write_response(data, payload)
+        File.write(File.join(data[:workdir], RESPONSE_FILE), JSON.generate(payload))
+      end
+
+      # Non-serializable handler results surface as inspect strings, like
+      # guest return values (PLAN.md: never Marshal guest/host payloads).
+      def jsonable(value)
+        JSON.parse(JSON.generate(value))
+      rescue StandardError, TypeError
+        value.inspect
+      end
+    end
+  end
+end

data/lib/security_box/pool.rb

@@ -0,0 +1,138 @@
+# frozen_string_literal: true
+
+module SecurityBox
+  # Bounded pool of :oneshot Sandboxes.
+  #
+  # What it gives you:
+  # - a hard cap on concurrent sandbox evaluations (`size`);
+  # - cheap checkout/checkin of pre-built Sandbox objects;
+  # - basic metrics (evals, total/average wall time).
+  #
+  # What it does NOT give you (measured in stage 4, docs/plan/stages/stage_4.md):
+  # parallelism. `invoke` holds the GVL for the whole guest lifetime, so
+  # concurrent evals on threads serialize. For real parallelism use
+  # RactorPool, which runs workers on Ractors with a shared Engine+Module.
+  #
+  # Usage:
+  #   pool = SecurityBox::Pool.new(:lean, size: 4)
+  #   pool.eval("1 + 1")                # => Result (checks out a sandbox)
+  #   pool.checkout { |sandbox| ... }   # manual checkout block
+  #   pool.shutdown
+  class Pool
+    attr_reader :size
+
+    def initialize(profile = nil, size: 4, **options)
+      @size = Integer(size)
+      raise ArgumentError, "size must be >= 1" if @size < 1
+
+      @config = resolve_config(profile, options)
+      @sandboxes = Queue.new
+      @mutex = Mutex.new
+      @created = 0
+      @closed = false
+      @metrics = { evals: 0, total_ms: 0.0 }
+    end
+
+    # Checks a sandbox out of the pool for the duration of the block.
+    # Blocks while all `size` sandboxes are busy.
+    def checkout
+      raise PoolClosed, "pool is closed" if closed?
+
+      sandbox = acquire
+      begin
+        yield sandbox
+      ensure
+        release(sandbox)
+      end
+    end
+
+    # Checks a sandbox out and runs `code` on it. Per-call overrides are
+    # forwarded to Sandbox#eval.
+    def eval(code, **overrides)
+      t0 = monotonic_ms
+      result = checkout { |sandbox| sandbox.eval(code, **overrides) }
+      record(monotonic_ms - t0)
+      result
+    end
+
+    # Snapshot of the counters:
+    # {size:, created:, evals:, total_ms:, avg_ms:}.
+    def metrics
+      @mutex.synchronize do
+        evals = @metrics[:evals]
+        { size: @size, created: @created, evals: evals,
+          total_ms: @metrics[:total_ms].round(2),
+          avg_ms: evals.zero? ? 0.0 : (@metrics[:total_ms] / evals).round(2) }
+      end
+    end
+
+    def closed?
+      @mutex.synchronize { @closed }
+    end
+
+    # Closes the pool. Sandboxes currently checked out keep working until
+    # released; threads blocked on an empty pool keep waiting (callers must
+    # ensure they do not shut down while checkouts are still being awaited).
+    def shutdown
+      @mutex.synchronize { @closed = true }
+    end
+
+    private
+
+    def resolve_config(profile, options)
+      case profile
+      when nil then Configuration.build(**options)
+      when Symbol, String then Registry.resolve(profile).with(**options)
+      when Configuration then profile.with(**options)
+      else raise ArgumentError, "profile must be a registered name or a Configuration, got #{profile.class}"
+      end
+    end
+
+    # Hands out an existing sandbox, creates a new one while under `size`, or
+    # blocks until another caller releases one. Sandbox creation happens
+    # outside the mutex (it may raise, e.g. ImageMissing).
+    def acquire
+      create = false
+      @mutex.synchronize do
+        raise PoolClosed, "pool is closed" if @closed
+
+        if @created < @size
+          @created += 1
+          create = true
+        end
+      end
+
+      if create
+        begin
+          return Sandbox.new(@config)
+        rescue StandardError
+          @mutex.synchronize { @created -= 1 }
+          raise
+        end
+      end
+
+      # All created sandboxes are busy: block until one is released. (The
+      # closed check here mirrors checkout's — a shutdown racing an acquire
+      # is still resolved by the release that eventually unblocks this pop.)
+      sandbox = @sandboxes.pop
+      raise PoolClosed, "pool is closed" if closed?
+
+      sandbox
+    end
+
+    def release(sandbox)
+      @sandboxes << sandbox
+    end
+
+    def record(duration_ms)
+      @mutex.synchronize do
+        @metrics[:evals] += 1
+        @metrics[:total_ms] += duration_ms
+      end
+    end
+
+    def monotonic_ms
+      Process.clock_gettime(Process::CLOCK_MONOTONIC) * 1000
+    end
+  end
+end

data/lib/security_box/ractor_pool.rb

@@ -0,0 +1,214 @@
+# frozen_string_literal: true
+
+require "securerandom"
+
+module SecurityBox
+  # Pool of Ractor workers sharing one Engine + compiled Module (stage-3 Q2
+  # "Plan C"): the pool builds a dedicated runtime pair, makes it
+  # Ractor-shareable, and N worker Ractors each keep a private Linker. Per
+  # eval a worker creates Store + Instance (~0.2ms), applies the request's
+  # fuel/epoch/memory limits (safe: the worker owns its store), and invokes.
+  #
+  # This is the only supported way to run evaluations in parallel: `invoke`
+  # holds the GVL for the whole guest lifetime (stage-4 Q1), so threads
+  # serialize (see Pool).
+  #
+  # Protocol (Ruby 3.4+/4.0 Ractor port model):
+  # - eval builds a request {id, code, token, config} and sends it to the
+  #   worker with the fewest in-flight requests (worker << request);
+  # - workers run the shared EvalRun core and push
+  #   {id, worker, result} back to the main Ractor (Ractor.main << ...);
+  # - a main-side collector thread receives from the main Ractor port and
+  #   routes each result to the Queue of the thread waiting for it (results
+  #   are matched by request id; this thread must be the only main-port
+  #   receiver in the process);
+  # - every request terminates (epoch + fuel), and a pop deadline converts a
+  #   dead worker into a :sandbox_error result instead of a hang.
+  #
+  # Trade-offs (measured, stage-3 Q2 / stage-4): one module deserialize per
+  # pool (~0.5s via the disk cache); each worker's eval still pays the
+  # ~240ms guest boot. Ratios at 2/4 Ractors on 6 cores: 0.56 / 0.28 wall vs
+  # serial, RSS ~111MB with the shared runtime.
+  #
+  # Usage:
+  #   pool = SecurityBox::RactorPool.new(:lean, size: 4)
+  #   pool.eval("1 + 1")     # => Result
+  #   pool.shutdown
+  class RactorPool
+    STOP = :security_box_stop
+    POP_SLACK_MS = 10_000
+
+    attr_reader :size
+
+    def initialize(profile = nil, size: 4, **options)
+      @size = Integer(size)
+      raise ArgumentError, "size must be >= 1" if @size < 1
+
+      @config = resolve_config(profile, options)
+      raise InvalidConfiguration, "rpcs are not supported on RactorPool (handlers cannot cross a Ractor boundary)" unless @config.rpcs.empty?
+
+      @mutex = Mutex.new
+      @pending = {} # request id => Queue
+      @in_flight = Array.new(@size, 0)
+      @closed = false
+      @next_id = 0
+      @metrics = { evals: 0, total_ms: 0.0, timeouts: 0 }
+
+      engine, module_ = Runtime.build_shareable(
+        image_path: @config.image_path,
+        epoch_interval_ms: @config.epoch_interval_ms
+      )
+      @workers = Array.new(@size) do |index|
+        build_worker(engine, module_, index)
+      end
+      start_collector_thread
+    end
+
+    # Runs `code` on one of the workers and blocks until its Result arrives.
+    # Per-call overrides follow Sandbox#eval (same Configuration#with rules).
+    #
+    # RPC handlers are not supported here (v1): they are host Procs that
+    # cannot cross a Ractor boundary. A configuration with rpcs raises
+    # InvalidConfiguration at construction.
+    def eval(code, **overrides)
+      raise PoolClosed, "pool is closed" if closed?
+
+      config = overrides.empty? ? @config : @config.with(**overrides)
+      raise InvalidConfiguration, "rpcs are not supported on RactorPool (handlers cannot cross a Ractor boundary)" unless config.rpcs.empty?
+
+      request = {
+        id: next_id,
+        code: code,
+        token: SecureRandom.hex(16),
+        config: config
+      }
+      queue = Queue.new
+      worker_index = @mutex.synchronize do
+        @pending[request[:id]] = queue
+        index = @in_flight.each_with_index.min_by { |count, _| count }.last
+        @in_flight[index] += 1
+        index
+      end
+
+      begin
+        @workers[worker_index] << request
+        deadline_ms = config.timeout_ms + POP_SLACK_MS
+        result = queue.pop(timeout: deadline_ms / 1000.0)
+        raise ThreadError, "no result" if result.nil? # Queue#pop timeout
+        record(result)
+        result
+      rescue ThreadError, Ractor::ClosedError
+        # Worker died, stalled beyond the deadline, or was shut down mid-flight:
+        # report instead of hang or leak the error.
+        @mutex.synchronize { @metrics[:timeouts] += 1 }
+        Result.worker_unavailable(worker_index)
+      ensure
+        @mutex.synchronize do
+          @in_flight[worker_index] -= 1 if @in_flight[worker_index] > 0
+          @pending.delete(request[:id])
+        end
+      end
+    end
+
+    # Snapshot of the counters: {size:, evals:, total_ms:, avg_ms:, timeouts:}.
+    def metrics
+      @mutex.synchronize do
+        evals = @metrics[:evals]
+        { size: @size, evals: evals, total_ms: @metrics[:total_ms].round(2),
+          avg_ms: evals.zero? ? 0.0 : (@metrics[:total_ms] / evals).round(2),
+          timeouts: @metrics[:timeouts] }
+      end
+    end
+
+    def closed?
+      @mutex.synchronize { @closed }
+    end
+
+    # Asks all workers to stop. Evals already in flight finish; new evals
+    # raise PoolClosed.
+    def shutdown
+      @mutex.synchronize { @closed = true }
+      @workers.each { |worker| worker << STOP }
+    end
+
+    private
+
+    def resolve_config(profile, options)
+      case profile
+      when nil then Configuration.build(**options)
+      when Symbol, String then Registry.resolve(profile).with(**options)
+      when Configuration then profile.with(**options)
+      else raise ArgumentError, "profile must be a registered name or a Configuration, got #{profile.class}"
+      end
+    end
+
+    def build_worker(engine, module_, worker_index)
+      Ractor.new(engine, module_, worker_index, name: "security_box-worker-#{worker_index}") do |eng, mod, index|
+        linker = Wasmtime::Linker.new(eng).tap do |l|
+          Wasmtime::WASI::P1.add_to_linker_sync(l)
+          # The image statically links the sb_rpc extension, so the
+          # "sb"/"call" import must be defined even though configs are
+          # stripped of rpcs before crossing the Ractor boundary
+          # (guest calls get a rescuable error via caller.store_data).
+          SecurityBox::GuestRpc.define_import(l)
+        end
+        loop do
+          request = Ractor.receive
+          break if request == :security_box_stop
+
+          begin
+            result = SecurityBox::EvalRun.run(
+              engine: eng, module_: mod, linker: linker,
+              config: request[:config], code: request[:code], token: request[:token]
+            )
+          rescue StandardError => e
+            result = SecurityBox::Result.new(
+              status: :sandbox_error,
+              stderr: "security_box: worker #{index} crashed: #{e.class}: #{e.message}\n"
+            )
+          end
+          Ractor.main << { id: request[:id], worker: index, result: result }
+        end
+        Ractor.main << { type: :stopped, worker: index }
+      end
+    end
+
+    def start_collector_thread
+      @collector_thread = Thread.new do
+        stopped = 0
+        loop do
+          message = Ractor.receive
+          if message[:type] == :stopped
+            stopped += 1
+            break if stopped >= @size
+          else
+            route(message)
+          end
+        end
+      end
+      @collector_thread.name = "security_box-collector"
+    end
+
+    def route(message)
+      @mutex.synchronize do
+        @in_flight[message[:worker]] -= 1 if @in_flight[message[:worker]] > 0
+        queue = @pending.delete(message[:id])
+        queue << message[:result] if queue
+      end
+    end
+
+    def record(result)
+      @mutex.synchronize do
+        @metrics[:evals] += 1
+        @metrics[:total_ms] += result.duration_ms.to_f
+      end
+    end
+
+    def next_id
+      @mutex.synchronize do
+        @next_id += 1
+        @next_id
+      end
+    end
+  end
+end

data/lib/security_box/registry.rb

@@ -21,7 +21,12 @@ module SecurityBox
 
           builder = Configuration::Builder.new
           block&.call(builder)
-          @profiles[key] = Configuration.build(**base_of(from), **builder.changes)
+          base = base_of(from)
+          if base[:fuel_ms] && builder.changes.key?(:fuel)
+            raise InvalidConfiguration,
+                  "base profile #{from.inspect} uses fuel_ms; override fuel_ms (or clear it with fuel_ms: nil) instead of fuel"
+          end
+          @profiles[key] = Configuration.build(**base, **builder.changes)
         end
       end
 

data/lib/security_box/result.rb

@@ -8,12 +8,17 @@ module SecurityBox
   #   :fuel_exhausted — CPU budget exhausted
   #   :memory_limit   — exceeded the store memory_size
   #   :sandbox_error  — sandbox failure (unexpected trap, missing/invalid envelope)
+  #
+  # `rpcs` (stage 6): the host-side transcript of guest RPC calls, one
+  # frozen {"name", "args", "ok", "result"|"error"} entry per call, or nil
+  # when no rpcs were configured (or none were called).
   class Result
     attr_reader :status, :value, :error, :stdout, :stderr,
-                :fuel_used, :duration_ms, :guest_duration_ms
+                :fuel_used, :duration_ms, :guest_duration_ms, :rpcs
 
     def initialize(status:, value: nil, error: nil, stdout: "", stderr: "",
-                   fuel_used: nil, duration_ms: nil, guest_duration_ms: nil)
+                   fuel_used: nil, duration_ms: nil, guest_duration_ms: nil,
+                   rpcs: nil)
       @status = status
       @value = value
       @error = error
@@ -22,6 +27,7 @@ module SecurityBox
       @fuel_used = fuel_used
       @duration_ms = duration_ms
       @guest_duration_ms = guest_duration_ms
+      @rpcs = rpcs
       freeze
     end
 
@@ -29,6 +35,13 @@ module SecurityBox
       @status == :ok
     end
 
+    # Factory for the "the worker never answered" sandbox failure (dead or
+    # stalled Ractor worker, or the pop deadline elapsed).
+    def self.worker_unavailable(worker_index)
+      new(status: :sandbox_error,
+          stderr: "security_box: RactorPool worker #{worker_index} did not answer\n")
+    end
+
     def to_h
       {
         status: @status,
@@ -38,7 +51,8 @@ module SecurityBox
         stderr: @stderr,
         fuel_used: @fuel_used,
         duration_ms: @duration_ms,
-        guest_duration_ms: @guest_duration_ms
+        guest_duration_ms: @guest_duration_ms,
+        rpcs: @rpcs
       }
     end
   end

data/lib/security_box/runtime.rb

@@ -41,6 +41,23 @@ module SecurityBox
         end
       end
 
+      # Builds a dedicated (not memoized) Engine + Module pair prepared for
+      # use across Ractors: the epoch timer is started and the precompile
+      # key is touched BEFORE freezing, then both artifacts are made
+      # Ractor-shareable (stage-3 Q2 "Plan C"). The pair is not stored in the
+      # class memos — freezing shared artifacts would affect every Sandbox —
+      # so each RactorPool pays one module deserialize (~0.5s via the disk
+      # cache). Callers must treat the returned pair as immutable.
+      def build_shareable(image_path:, epoch_interval_ms:)
+        engine = build_engine(epoch_interval_ms)
+        module_ = ModuleCache.load_module(engine, image_path) ||
+                  ModuleCache.compile_and_store(engine, image_path)
+        engine.precompile_compatibility_key # touch before make_shareable
+        Ractor.make_shareable(engine)
+        Ractor.make_shareable(module_)
+        [engine, module_]
+      end
+
       private
 
       def build_engine(epoch_interval_ms)