Skip to content

chore: wasmtime, wasmtime-wasi and the ADR-8 oracle 41 → 50.0.0 - #508

Merged
avrabe merged 1 commit into
spike/wasmtime-environ-oraclefrom
chore/wasmtime-50
Oct 21, 2026
Merged

avrabe merged 1 commit into
spike/wasmtime-environ-oraclefrom
chore/wasmtime-50

Conversation

@avrabe

@avrabe avrabe commented Oct 21, 2026

Copy link
Copy Markdown
Contributor

Stacked on #505, following cpetig's review there. It upgrades meld's dev-only wasmtime stack together with the differential oracle, as ADR-8's policy requires.

Change

crate from to
wasmtime (dev) 41.0.1 50.0.0
wasmtime-wasi (dev) 41.0.4 50.0.0
wasmtime-environ (dev, oracle) =41.0.4 =50.0.0

No crate becomes a normal dependency: cargo tree -e normal --workspace contains no wasmtime or cranelift crate. wasmtime 50 needs Rust 1.97. CI builds on stable, and meld's library minimum Rust version (1.85) is unaffected.

Port (API spelling only, no assertion changed)

  • Oracle harness:
    • GlobalInitializer::InstantiateModule has a second field;
    • Component::exports.raw_iter() yields (TryString, (ExportIndex, ComponentExternData));
    • Module::exports is keyed by Atom.
  • p3_bridge_runtime.rs: anyhow::bail! becomes wasmtime::bail!.
  • Removed deprecated post_return calls: six of them, now no-ops that would fail clippy -D warnings.
  • WAT fixtures: canonical options use the strict form (memory (core memory $i "n")) / (realloc (core func $i "n")), which the newer wat requires.

The oracle under 50: identical to 41

The shipped binary is unchanged

Lockfile resolution moves three normal dependencies: indexmap 2.13.1 → 2.14.2, hashbrown 0.16.1 → 0.17.1 and libc 0.2.184 → 0.2.191. This cannot be avoided, because wasmtime 50 requires them.

I built release binaries of the same source with the old and the new lockfile, and compared their output:

run identical
49 wit-bindgen fixtures, --memory multi --reproducible 49 / 49
the same with --component 49 / 49
#461 trio, --memory shared --pack-rebase --share-stack --reproducible 1 / 1

Without --reproducible, only the attestation's random id and timestamp differ, the same way two runs of one binary differ. The hashed module is identical.

Added: one more copy of hashbrown (0.17.1, via indexmap), next to the existing 0.15.5 (petgraph) and 0.16.1 (wasmparser).

Test plan

  • cargo fmt --all -- --check: exit 0
  • cargo clippy --workspace --all-targets -- -D warnings: exit 0, with and without --all-features
  • cargo test --workspace: 992 passed, 0 failed; the same 1015 test names as on 41
  • cargo test --workspace --all-features: 1001 passed, 0 failed

🤖 Generated with Claude Code

https://claude.ai/code/session_01WrmMqf1iuTS1UBEes5TmdC

…me-wasi, wasmtime-environ oracle pin)

Port tests to wasmtime 50 / wat strict component indices; oracle facts unchanged.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WrmMqf1iuTS1UBEes5TmdC
@avrabe
avrabe merged commit 65909e9 into spike/wasmtime-environ-oracle Oct 21, 2026
@avrabe
avrabe deleted the chore/wasmtime-50 branch October 21, 2026 09:09
avrabe added a commit that referenced this pull request Oct 21, 2026
…s 50.0.0

The direction was decided on 2026-10-20; the policy (exact pin,
upgrade together with wasmtime, tie-break, what the oracle must not do)
was accepted on 2026-10-21 in review of #505. The pin text now matches
the =50.0.0 that #508 moved to, and an upgrade log records that move.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WrmMqf1iuTS1UBEes5TmdC
avrabe added a commit that referenced this pull request Oct 21, 2026
…le (#505)

* spike(ADR-8): wasmtime-environ as a pinned, dev-only differential oracle for component resolution

meld keeps its own component resolution (parser, resolver, component_wrap
canonical options, merger). wasmtime-environ 41.0.4's component Translator,
already in the graph via the wasmtime dev-dependency, becomes a second,
independent implementation that meld is cross-tested against. It is never a
runtime dependency.

- meld-core/Cargo.toml: dev-dep `wasmtime-environ = "=41.0.4"` with
  compile + component-model (the version and features wasmtime already
  enables, so no new crate in the graph); feature `oracle`; the test has
  `required-features = ["oracle"]`, so the default suite never compiles it,
  while --all-features (CI coverage) runs it.
- meld-core/src/lib.rs: `OracleIndexMaps` and `Fuser::oracle_index_maps()`,
  a cfg(feature = "oracle") snapshot of memory_index_map and
  function_index_map that the pipeline writes and never reads.
- meld-core/tests/oracle_wasmtime_environ.rs: two comparisons.
  - Output side: per exported lift and per lowered host import, the source's
    resolution (wasmtime's graph, mapped through meld's maps) is compared
    with the oracle's reading of meld's --memory multi --component output,
    covering the lifted core function, memory, realloc, post-return,
    callback, encoding and async.
  - Resolver side: meld's resolver::core_func_sources and
    core_memory_sources reading of every source lift is compared with the
    oracle's reading of the same source.
- safety/adr/ADR-8: status proposed.

Results on main: every non-ignored fixture agrees. The fixtures are the
#481 and #484 WAT, the PR #490 alias chain, five wit-bindgen runtime
fixtures, compose and compose_record, and the #461 falcon trio. Three cases
are ignored, each with a reason:
- meld#486: on compose_record/provider.wasm, meld exits 0 with a lift that
  has no `memory`, and the oracle rejects it as invalid. The oracle found
  this on its first run.
- meld#485: on the issue's repro, the `run` export re-exports the import,
  and the oracle rejects it.
- falcon --component: meld refuses these inputs. This is the same error
  class as #476; the root cause is not confirmed.

Potency: the committed diff was applied to a fresh export of 9926d47
(7eaeccc^). The oracle flagged:
- #481: lift memory, source 1 against output 0;
- #484: lower memory, encoding and realloc;
- #490: the alias chain's memory and encoding.
An off-by-one injected into core_func_sources turned the resolver-side tests
red.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WrmMqf1iuTS1UBEes5TmdC

* docs(ADR-8): status open per the ADR schema; record the maintainer decision date

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WrmMqf1iuTS1UBEes5TmdC

* chore: upgrade dev-only wasmtime stack 41 -> 50.0.0 (wasmtime, wasmtime-wasi, wasmtime-environ oracle pin) (#508)

Port tests to wasmtime 50 / wat strict component indices; oracle facts unchanged.


Claude-Session: https://claude.ai/code/session_01WrmMqf1iuTS1UBEes5TmdC

Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

* docs(ADR-8): resolved -- maintainer accepted the oracle policy; pin is 50.0.0

The direction was decided on 2026-10-20; the policy (exact pin,
upgrade together with wasmtime, tie-break, what the oracle must not do)
was accepted on 2026-10-21 in review of #505. The pin text now matches
the =50.0.0 that #508 moved to, and an upgrade log records that move.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WrmMqf1iuTS1UBEes5TmdC

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant