packages/ocap-kernel/src/vats/endowments.ts relies on specific behavioural properties of buildCommonEndowments from @metamask/snaps-execution-environments:
Date is attenuated such that a vat cannot read real wall-clock time unless endowedMath.random is substituted rather than passed through- timer factories are isolated per vat and support teardown
fetch is tearable-down, and only reaches hosts we allow
Nothing on our side asserts any of these. They are upstream implementation details that we treat as kernel guarantees. A change made for entirely sensible wallet reasons could weaken one of them, and we would not find out — our tests would still pass, because none of them test this.
Proposed: a conformance test in ocap-kernel that launches a vat and asserts the properties we actually depend on. Not testing the upstream implementation — testing our assumptions about it, so that if a version bump changes one, CI tells us instead of a reviewer discovering it later. This is our job regardless of who maintains the endowments.
It also gives us something concrete to hand a security reviewer asking "how do you know a vat cannot observe time or reach the network", which is currently answered by reading two packages.
Related: #1002 (deterministic vat profile) — this conformance test is most of what that profile needs in order to be verifiable rather than asserted.
packages/ocap-kernel/src/vats/endowments.tsrelies on specific behavioural properties ofbuildCommonEndowmentsfrom@metamask/snaps-execution-environments:Dateis attenuated such that a vat cannot read real wall-clock time unless endowedMath.randomis substituted rather than passed throughfetchis tearable-down, and only reaches hosts we allowNothing on our side asserts any of these. They are upstream implementation details that we treat as kernel guarantees. A change made for entirely sensible wallet reasons could weaken one of them, and we would not find out — our tests would still pass, because none of them test this.
Proposed: a conformance test in
ocap-kernelthat launches a vat and asserts the properties we actually depend on. Not testing the upstream implementation — testing our assumptions about it, so that if a version bump changes one, CI tells us instead of a reviewer discovering it later. This is our job regardless of who maintains the endowments.It also gives us something concrete to hand a security reviewer asking "how do you know a vat cannot observe time or reach the network", which is currently answered by reading two packages.
Related: #1002 (deterministic vat profile) — this conformance test is most of what that profile needs in order to be verifiable rather than asserted.