Core Architecture

RunVero acts as an air-gapped hypervisor for AI agent tools, enforcing capability-based security, instruction-level fuel limits, and cryptographic supply chain integrity.

flowchart TD
    Client["Client / Agent (CLI, Python SDK, Claude MCP)"]
    Gateway["Sentinel Gateway (Security Headers, Rate Limits, CORS)"]
    Host["RunVero Control Plane Host (Safe Rust)"]

    subgraph Sandbox["Isolated WebAssembly Sandbox (WASI 0.2)"]
        WasiContext["Virtualized WASI Context (No Ambient IO)"]
        FuelMeter["Deterministic Fuel Meter (Instruction Limits)"]
        MemoryCap["StoreLimits (e.g. 16 MiB Memory Ceiling)"]
        GuestTool["Target Tool (wasm32-wasip2 Component)"]
    end

    Bolt["Bolt SIMD Engine (Secret Vault Redaction)"]
    Output["Sanitized Output & Execution Breakdown"]

    Client --> Gateway
    Gateway --> Host
    Host --> WasiContext
    Host --> FuelMeter
    Host --> MemoryCap
    WasiContext --> GuestTool
    GuestTool --> Bolt
    Bolt --> Output

Architectural Layers

1. Sentinel Gateway Layer

The gateway exposes HTTP REST (/v1/execute) and MCP JSON-RPC (/mcp) endpoints:

• Defensive Security Headers: Enforces X-Content-Type-Options: nosniff, X-Frame-Options: DENY, and Cache-Control: no-store.
• Bounded Admissions: Rejects oversized request payloads and limits concurrent workers.
• CORS Defense: Blocks wildcard permissive CORS headers.

2. WASI 0.2 Component Sandbox

Built on Wasmtime, RunVero instantiates guest tools as WebAssembly components:

• No Ambient Filesystem: The host pre-opens only explicitly declared directory paths.
• No Ambient Networking: Guest components cannot open arbitrary raw sockets or resolve DNS.
• Epoch-Based Timeouts: A background epoch ticker guarantees that guests stuck in compute loops or blocked host calls are interrupted independently.

3. Bolt SIMD Secret Redaction

Credentials (API tokens, database strings) are held strictly in host memory:

• Guest tools receive opaque placeholders (e.g. {{RUNVERO_SECRET_0}}).
• Outbound requests substitute placeholders at line speed using SIMD Aho-Corasick algorithms.
• Raw secrets never touch the LLM context or execution logs.