Skip to content

Commit d4a54df

Browse files
NathanFlurryNathanFlurry
committed
feat: US-002 - Fix crypto key generation (generateKeyPair for ed25519/ed448, generateKey symmetric)
1 parent aa28605 commit d4a54df

21 files changed

Lines changed: 3111 additions & 277 deletions

File tree

‎.agent/contracts/node-bridge.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -160,3 +160,11 @@ The bridge global key registry consumed by host runtime setup, bridge modules, a
160160
#### Scenario: Native V8 bridge registries stay aligned with async and sync lifecycle hooks
161161
- **WHEN** bridge modules depend on a host bridge global via async `.apply(..., { result: { promise: true } })` or sync `.applySync(...)` semantics
162162
- **THEN** the native V8 bridge function registries MUST expose a matching callable shape for that global (or an equivalent tested shim), and automated verification MUST cover the registry alignment
163+
164+
### Requirement: Dispatch-Multiplexed Bridge Errors Preserve Structured Metadata
165+
Bridge globals routed through the `_loadPolyfill` dispatch multiplexer SHALL preserve host error metadata needed for Node-compatible assertions.
166+
167+
#### Scenario: Host bridge throws typed crypto validation error
168+
- **WHEN** a dispatch-multiplexed bridge handler throws a host error with `name` and `code` (for example `TypeError` + `ERR_INVALID_ARG_VALUE`)
169+
- **THEN** the sandbox-visible error MUST preserve that `name` and `code`
170+
- **AND** the bridge MUST NOT collapse the error to a plain `Error` with only a message

‎docs-internal/arch/overview.md‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,133 @@
11
# Architecture Overview
22

3+
## Architectural Model: Inverted VM
4+
5+
Traditional virtual machines (Firecracker, QEMU) place the OS **inside** the VM — a hypervisor
6+
virtualizes hardware, and a guest kernel (Linux) runs on top:
7+
8+
```
9+
Traditional: VM contains OS
10+
11+
┌────────────────────┐
12+
│ Hypervisor / VM │ (Firecracker, QEMU, KVM)
13+
│ │
14+
│ ┌──────────────┐ │
15+
│ │ Guest OS │ │ (Linux kernel)
16+
│ │ │ │
17+
│ │ ┌────────┐ │ │
18+
│ │ │ Apps │ │ │ (ELF binaries)
19+
│ │ └────────┘ │ │
20+
│ └──────────────┘ │
21+
└────────────────────┘
22+
```
23+
24+
Secure Exec inverts this: the OS is the **outer** layer, and execution engines (V8, WASM) are
25+
plugged **into** it. The kernel runs in the host process and mediates all I/O. There is no
26+
hypervisor — the isolation boundary is the V8 isolate and WASM sandbox, not hardware virtualization:
27+
28+
```
29+
Secure Exec: OS contains VMs
30+
31+
┌──────────────────────────────────────────────┐
32+
│ Virtual OS (packages/core/kernel/) │
33+
│ VFS, process table, FD table, │
34+
│ sockets, pipes, signals, permissions │
35+
│ │
36+
│ ┌─────────────────┐ ┌───────────────────┐ │
37+
│ │ V8 Isolate │ │ WASM Runtime │ │
38+
│ │ (Node.js) │ │ (V8 WebAssembly)│ │
39+
│ │ │ │ │ │
40+
│ │ JS scripts │ │ POSIX binaries │ │
41+
│ └─────────────────┘ └───────────────────┘ │
42+
└──────────────────────────────────────────────┘
43+
```
44+
45+
### Comparison: Containers vs MicroVMs vs Secure Exec
46+
47+
```
48+
Container (Docker)
49+
50+
┌───────────────────────────────────────────┐
51+
│ Host Linux Kernel (shared) │
52+
│ │
53+
│ ┌─────────────────┐ ┌────────────────┐ │
54+
│ │ Namespace + │ │ Namespace + │ │
55+
│ │ cgroup jail │ │ cgroup jail │ │
56+
│ │ │ │ │ │
57+
│ │ ┌───────────┐ │ │ ┌──────────┐ │ │
58+
│ │ │ App 1 │ │ │ │ App 2 │ │ │
59+
│ │ │ ELF bins │ │ │ │ ELF bins │ │ │
60+
│ │ └───────────┘ │ │ └──────────┘ │ │
61+
│ └─────────────────┘ └────────────────┘ │
62+
└───────────────────────────────────────────┘
63+
Kernel is shared. Kernel vuln = all containers escape.
64+
65+
66+
MicroVM (Firecracker)
67+
68+
┌───────────────────────────────────────────┐
69+
│ Host Linux Kernel │
70+
│ │
71+
│ ┌─────────────────┐ ┌────────────────┐ │
72+
│ │ KVM / VT-x │ │ KVM / VT-x │ │
73+
│ │ (hypervisor) │ │ (hypervisor) │ │
74+
│ │ │ │ │ │
75+
│ │ ┌────────────┐ │ │ ┌──────────┐ │ │
76+
│ │ │ Guest │ │ │ │ Guest │ │ │
77+
│ │ │ Linux │ │ │ │ Linux │ │ │
78+
│ │ │ Kernel │ │ │ │ Kernel │ │ │
79+
│ │ │ │ │ │ │ │ │ │
80+
│ │ │ ┌──────┐ │ │ │ │ ┌──────┐ │ │ │
81+
│ │ │ │ App │ │ │ │ │ │ App │ │ │ │
82+
│ │ │ └──────┘ │ │ │ │ └──────┘ │ │ │
83+
│ │ └────────────┘ │ │ └──────────┘ │ │
84+
│ └─────────────────┘ └────────────────┘ │
85+
└───────────────────────────────────────────┘
86+
Each VM has its own kernel. Hypervisor vuln = escape.
87+
88+
89+
Secure Exec
90+
91+
┌───────────────────────────────────────────┐
92+
│ Host Process (Node.js / Browser) │
93+
│ │
94+
│ ┌─────────────────┐ ┌────────────────┐ │
95+
│ │ Virtual OS │ │ Virtual OS │ │
96+
│ │ (SEOS kernel) │ │ (SEOS kernel) │ │
97+
│ │ │ │ │ │
98+
│ │ ┌────────────┐ │ │ ┌──────────┐ │ │
99+
│ │ │ V8 / WASM │ │ │ │ V8 / WASM│ │ │
100+
│ │ │ │ │ │ │ │ │ │
101+
│ │ │ JS / WASM │ │ │ │ JS / WASM│ │ │
102+
│ │ │ programs │ │ │ │ programs │ │ │
103+
│ │ └────────────┘ │ │ └──────────┘ │ │
104+
│ └─────────────────┘ └────────────────┘ │
105+
└───────────────────────────────────────────┘
106+
Each instance has its own kernel. V8/WASM vuln = escape.
107+
```
108+
109+
| | Container | MicroVM | Secure Exec |
110+
|--------------------|----------------------|-----------------------|-----------------------|
111+
| **Isolation** | Namespaces + cgroups | Hardware (VT-x/KVM) | V8 isolate + WASM |
112+
| **Kernel** | Shared host kernel | Dedicated guest kernel| Virtual POSIX kernel |
113+
| **Attack surface** | Host kernel syscalls | Hypervisor interface | JS/WASM sandbox |
114+
| **Boot time** | ~100ms | ~125ms | <5ms |
115+
| **Overhead** | Near-native | ~3-5% CPU/memory | V8/WASM overhead |
116+
| **Runs in browser**| No | No | Yes |
117+
| **Guest format** | ELF binaries | ELF binaries | JS scripts + WASM |
118+
| **Escape risk** | Kernel vuln = escape | Hypervisor vuln = escape | V8 vuln = escape |
119+
120+
Key architectural differences:
121+
- **Containers** share the host kernel — a kernel vulnerability lets every container escape. The kernel is the trust boundary and the attack surface simultaneously.
122+
- **MicroVMs** run a dedicated guest kernel inside hardware virtualization. Stronger isolation (hypervisor boundary), but 100ms+ boot time and no browser support.
123+
- **Secure Exec** provides its own virtual kernel in userspace. No shared kernel attack surface (the virtual kernel is per-instance), no hardware requirements, millisecond boot. The tradeoff is that isolation depends on V8/WASM sandbox correctness rather than hardware enforcement.
124+
125+
The WASI extensions (`native/wasmvm/crates/wasi-ext/`) bridge WASM syscalls into the OS kernel.
126+
The Node.js bridge (`packages/nodejs/src/bridge/`) does the same for V8 isolate code. Both are
127+
thin translation layers — the real implementation lives in the kernel.
128+
129+
## Package Map
130+
3131
```
4132
Kernel-first API (createKernel + mount + exec)
5133
packages/core/

‎docs-internal/todo.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,10 @@ Priority order is:
1212

1313
---
1414

15+
## Rename
16+
17+
- [ ] Rename `wasmvm` back to `seos` (Secure Exec OS) across the codebase (packages, directories, imports, docs)
18+
1519
docs-internal/proposal-kernel-consolidation.md
1620
docs-internal/specs/custom-bindings.md
1721
docs-internal/specs/cli-tool-e2e.md

‎docs/nodejs-conformance-report.mdx‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,18 +12,18 @@ description: Node.js v22 test/parallel/ conformance results for the secure-exec
1212
| Node.js version | 22.14.0 |
1313
| Source | v22.14.0 (test/parallel/) |
1414
| Total tests | 3532 |
15-
| Passing (genuine) | 730 (20.7%) |
15+
| Passing (genuine) | 737 (20.9%) |
1616
| Passing (vacuous self-skip) | 34 |
17-
| Passing (total) | 764 (21.6%) |
18-
| Expected fail | 2697 |
17+
| Passing (total) | 771 (21.8%) |
18+
| Expected fail | 2690 |
1919
| Skip | 71 |
2020
| Last updated | 2026-03-25 |
2121

2222
## Failure Categories
2323

2424
| Category | Tests |
2525
| --- | --- |
26-
| implementation-gap | 1396 |
26+
| implementation-gap | 1389 |
2727
| unsupported-module | 737 |
2828
| requires-v8-flags | 239 |
2929
| requires-exec-path | 200 |
@@ -70,7 +70,7 @@ description: Node.js v22 test/parallel/ conformance results for the secure-exec
7070
| constants | 1 | 0 | 1 | 0 | 0.0% |
7171
| corepack | 1 | 0 | 1 | 0 | 0.0% |
7272
| coverage | 1 | 0 | 1 | 0 | 0.0% |
73-
| crypto | 99 | 42 (13 vacuous) | 57 | 0 | 42.4% |
73+
| crypto | 99 | 49 (13 vacuous) | 50 | 0 | 49.5% |
7474
| cwd | 3 | 0 | 3 | 0 | 0.0% |
7575
| data | 1 | 0 | 1 | 0 | 0.0% |
7676
| datetime | 1 | 0 | 1 | 0 | 0.0% |
@@ -245,11 +245,11 @@ description: Node.js v22 test/parallel/ conformance results for the secure-exec
245245
| wrap | 4 | 0 | 4 | 0 | 0.0% |
246246
| x509 | 1 | 0 | 1 | 0 | 0.0% |
247247
| zlib | 53 | 17 | 33 | 3 | 34.0% |
248-
| **Total** | **3532** | **764** | **2697** | **71** | **22.1%** |
248+
| **Total** | **3532** | **771** | **2690** | **71** | **22.3%** |
249249

250250
## Expectations Detail
251251

252-
### implementation-gap (715 entries)
252+
### implementation-gap (708 entries)
253253

254254
**Glob patterns:**
255255

@@ -260,7 +260,7 @@ description: Node.js v22 test/parallel/ conformance results for the secure-exec
260260
- `test-https-*.js` — https depends on tls — most tests fail on missing TLS fixture files or crypto API gaps
261261
- `test-http2-*.js` — http2 module bridged via kernel — most tests fail on API gaps, missing fixtures, or protocol handling
262262

263-
*709 individual tests — see expectations.json for full list.*
263+
*702 individual tests — see expectations.json for full list.*
264264

265265
### unsupported-module (190 entries)
266266

0 commit comments

Comments
 (0)