script-sandbox-worker
Responsibility
Section titled “Responsibility”script-sandbox-worker answers the versioned NATS request/reply subject
sens.flow.sandbox.execute.v1. It validates the request contract, verifies the
compiled-source checksum, and executes the synchronous function in QuickJS/WASM
with bounded source, input, output, heap, stack, and wall time.
The runtime does not expose imports, Node.js APIs, network, filesystem,
environment variables, Date, randomness, timers, or mutable host state. The
result must be a JSON object and pass its declared output contract before it can
return to a flow.
Deployment boundary
Section titled “Deployment boundary”The Pod is non-root, read-only, has no service-account token, database Secret, SMTP Secret, or persistent volume. Its egress NetworkPolicy permits only DNS and the exact NATS destination. Its NATS identity subscribes only to the sandbox subject and publishes only reply inboxes.
ScriptLoadRequestV1 initializes a compiled artifact without invoking run and
is a mandatory custom-block release gate. ScriptExecutionRequestV1 creates a
fresh runtime and context, invokes the pinned artifact, copies the bounded JSON
result, and releases every handle. NATS unavailability is retryable; timeout,
memory/stack exhaustion, script exceptions, invalid output and checksum
mismatch are not.
This defense in depth does not replace the documented QuickJS/WASM threat model and target-cluster review required before custom scripts are activated in production.