wai-quantum-service: sandboxed workers, IPv6 clients counted by /64, a per-client memory cap #464
2026-10-25
wai-quantum-service: sandboxed workers, IPv6 clients counted by /64, a per-client memory cap
All checks were successful
standards workspaces build + test / which workspaces this change touches (pull_request) Successful in 8s
WAI energy receipts / does this change touch it (pull_request) Successful in 7s
wai-quantum service / does this change touch it (pull_request) Successful in 6s
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Successful in 2m38s
wai-quantum service / service · linux (pull_request) Successful in 50s
WAI energy receipts / energy receipts · linux (pull_request) Successful in 9m45s
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 3m52s
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Successful in 7m25s
standards workspaces build + test / macOS energy backends (pull_request) Successful in 9m4s
WAI energy receipts / energy receipts · macos (pull_request) Successful in 4m37s
wai-quantum service / service · macos (pull_request) Successful in 42s
The audit of the public job service found three ways past its limits: - Each IPv6 address counted as its own client. A subscriber is usually given a /64 whole, so rotating through it handed out fresh per-client limits with every request. A client is now an IPv4 address or an IPv6 /64; an IPv4 address carried in IPv6 counts as itself. - Three active jobs from one client could hold the whole 96 GiB budget. One client's queued and running jobs may now hold at most one job's worth together (WAI_QSVC_CLIENT_GB, default the job size), so any client can still run its largest job, and no client holds the rest. - A worker ran as the service's user with everything that user can reach, so a flaw in parsing a submitted circuit would have been code running as the account that owns the build host. On macOS each worker now runs under sandbox-exec: no network, no file writes, no program but itself. It needs none of them, since it reads its job on stdin and writes its result on stdout. WAI_QSVC_SANDBOX=0 turns it off for debugging. GET /v1 and the MCP server publish the new limit, and the README documents all three. Co-Authored-By: Claude Opus 5.5 <[email protected]>