# BMSSP WASM Integration Security Review

**Date:** 2026-01-25
**Auditor:** Security Architecture Agent
**Scope:** Comprehensive security review of BMSSP WASM integration for j-tree operations
**Version:** ADR-002-addendum-bmssp-integration (Proposed)
**Classification:** Internal Security Document

---

## Executive Summary

This security review examines the proposed integration of `@ruvnet/bmssp` (Bounded Multi-Source Shortest Path) WASM module with the ruvector-mincut j-tree hierarchy. The review covers WASM sandbox security, FFI boundary safety, input validation, resource exhaustion vectors, supply chain risks, error handling, and cryptographic considerations.

### Risk Summary Matrix

| Category | Critical | High | Medium | Low | Info |
|----------|----------|------|--------|-----|------|
| WASM Sandbox Security | 0 | 1 | 2 | 1 | 2 |
| FFI Boundary Safety | 0 | 2 | 1 | 2 | 1 |
| Input Validation | 0 | 1 | 3 | 2 | 1 |
| Resource Exhaustion | 0 | 1 | 2 | 1 | 2 |
| Supply Chain | 0 | 1 | 1 | 2 | 2 |
| Error Handling | 0 | 0 | 2 | 2 | 1 |
| Cryptographic | 0 | 0 | 1 | 1 | 2 |
| **Total** | **0** | **6** | **12** | **11** | **11** |

**Overall Risk Rating:** **MEDIUM-HIGH**

The integration introduces significant FFI boundary complexity and external dependency risks that require careful mitigation before production deployment.

---

## 1. WASM Sandbox Security

### 1.1 Memory Isolation Analysis

**Current Implementation (ruvector-mincut/src/wasm/agentic.rs):**

```rust
// FINDING: Static mutable global state pattern
#[cfg(target_arch = "wasm32")]
pub mod ffi {
    static mut INSTANCE: Option<AgenticMinCut> = None;

    #[no_mangle]
    pub extern "C" fn mincut_init(num_vertices: u16, num_edges: u16, strategy: u8) {
        unsafe {
            // Direct mutation of global state
            INSTANCE = Some(instance);
        }
    }
}
```

**Identified Issues:**

| ID | Severity | Issue | Location | CVSS 3.1 |
|----|----------|-------|----------|----------|
| WASM-SEC-001 | High | Static mutable state without synchronization | `agentic.rs:90-106` | 6.5 |
| WASM-SEC-002 | Medium | No memory isolation between BMSSP instances | Proposed integration | 5.3 |
| WASM-SEC-003 | Medium | WASM linear memory shared across all graph operations | `simd.rs:14-46` | 4.8 |
| WASM-SEC-004 | Low | No memory page limit enforcement | All WASM modules | 3.7 |

**WASM-SEC-001 Analysis:**

The current FFI implementation uses `static mut INSTANCE` which is not thread-safe. While WASM itself is single-threaded, the proposed BMSSP integration adds complexity:

```
Risk Scenario:
1. JavaScript calls mincut_init() with graph A
2. Before completion, another call modifies INSTANCE for graph B
3. Graph A computation uses corrupted state
```

**Mitigation Required:**
```rust
// RECOMMENDED: Use RefCell or OnceCell for safer state management
use core::cell::RefCell;

thread_local! {
    static INSTANCE: RefCell<Option<AgenticMinCut>> = RefCell::new(None);
}

#[no_mangle]
pub extern "C" fn mincut_init(num_vertices: u16, num_edges: u16, strategy: u8) {
    INSTANCE.with(|instance| {
        let mut inst = instance.borrow_mut();
        // Safe state mutation
        *inst = Some(AgenticMinCut::new());
        inst.as_mut().unwrap().init(num_vertices, num_edges, strategy.into());
    })
}
```

### 1.2 BMSSP WASM Memory Model

**Proposed BMSSP Integration (from ADR-002-addendum-bmssp-integration.md):**

```typescript
class WasmGraph {
    constructor(vertices: number, directed: boolean);
    add_edge(from: number, to: number, weight: number): boolean;
    compute_shortest_paths(source: number): Float64Array;
    free(): void;
}
```

**Security Concerns:**

1. **Memory Ownership Transfer:** `Float64Array` returned from `compute_shortest_paths` points to WASM linear memory. If the caller retains this reference after `free()`, use-after-free occurs.

2. **Double-Free Vulnerability:** No mechanism to prevent multiple `free()` calls on the same instance.

3. **Memory Leak Vector:** JavaScript garbage collection does not automatically call `free()` on WASM objects.

**Recommended Pattern:**
```typescript
// SECURE: Wrap in managed object with destructor tracking
class SecureBmsspGraph implements Disposable {
    private graph: WasmGraph | null;
    private disposed = false;

    constructor(vertices: number, directed: boolean) {
        this.graph = new WasmGraph(vertices, directed);
    }

    [Symbol.dispose](): void {
        if (!this.disposed && this.graph) {
            this.graph.free();
            this.graph = null;
            this.disposed = true;
        }
    }

    computeShortestPaths(source: number): Float64Array {
        if (this.disposed) {
            throw new Error('Graph already disposed');
        }
        // Copy data out of WASM memory to prevent use-after-free
        const wasmResult = this.graph!.compute_shortest_paths(source);
        return Float64Array.from(wasmResult);
    }
}
```

### 1.3 Buffer Overflow in FFI Boundary

**SIMD Operations (simd.rs:13-46):**

```rust
#[cfg(target_arch = "wasm32")]
#[inline]
pub fn simd_popcount(bits: &[u64; 4]) -> u32 {
    unsafe {
        // Load 128-bit chunks
        let v0 = v128_load(bits.as_ptr() as *const v128);
        let v1 = v128_load(bits.as_ptr().add(2) as *const v128);
        // ...
    }
}
```

**Analysis:**
- Fixed-size array `[u64; 4]` ensures bounds are compile-time verified
- No runtime validation needed for this pattern
- **Status: SECURE**

**XOR Operation (simd.rs:56-75):**

```rust
#[cfg(target_arch = "wasm32")]
pub fn simd_xor(a: &BitSet256, b: &BitSet256) -> BitSet256 {
    unsafe {
        let mut result = BitSet256::new();
        let a0 = v128_load(a.bits.as_ptr() as *const v128);
        // Fixed-size struct, bounds guaranteed
        // ...
    }
}
```

**Analysis:**
- `BitSet256` has fixed `[u64; 4]` internal storage
- Pointer arithmetic is bounded by struct layout
- **Status: SECURE**

---

## 2. Input Validation

### 2.1 Vertex ID Bounds Checking

**Current State (compact/mod.rs):**

```rust
impl BitSet256 {
    #[inline(always)]
    pub fn insert(&mut self, v: CompactVertexId) {
        let idx = (v / 64) as usize;
        let bit = v % 64;
        if idx < 4 {  // BOUNDS CHECK PRESENT
            self.bits[idx] |= 1u64 << bit;
        }
    }

    #[inline(always)]
    pub fn contains(&self, v: CompactVertexId) -> bool {
        let idx = (v / 64) as usize;
        let bit = v % 64;
        idx < 4 && (self.bits[idx] & (1u64 << bit)) != 0  // BOUNDS CHECK PRESENT
    }
}
```

**Analysis:** BitSet256 properly validates vertex IDs against MAX_VERTICES_PER_CORE (256).

**BMSSP Integration Gap:**

| ID | Severity | Issue | Impact |
|----|----------|-------|--------|
| INPUT-001 | High | No validation for BMSSP vertex IDs exceeding u32::MAX | Integer overflow |
| INPUT-002 | Medium | Missing validation in `add_edge()` for self-loops | Algorithm correctness |
| INPUT-003 | Medium | No validation for duplicate edge insertion | Memory waste |
| INPUT-004 | Low | Vertex count mismatch between BMSSP and native | Incorrect results |

**Required Validation for BMSSP Integration:**

```rust
pub struct BmsspJTreeLevel {
    wasm_graph: WasmGraph,
    vertex_count: usize,
    // Add validation bounds
    max_vertex_id: u32,
}

impl BmsspJTreeLevel {
    pub fn add_edge(&mut self, src: u32, tgt: u32, weight: f64) -> Result<(), MinCutError> {
        // Vertex bounds validation
        if src >= self.max_vertex_id || tgt >= self.max_vertex_id {
            return Err(MinCutError::InvalidVertex(src.max(tgt) as u64));
        }

        // Self-loop validation
        if src == tgt {
            return Err(MinCutError::InvalidEdge(src as u64, tgt as u64));
        }

        // Weight validation (see 2.2)
        Self::validate_weight(weight)?;

        self.wasm_graph.add_edge(src, tgt, weight);
        Ok(())
    }
}
```

### 2.2 Edge Weight Validation

**Critical Floating-Point Cases:**

| Value | Risk | Impact |
|-------|------|--------|
| `NaN` | Algorithm produces undefined results | Incorrect cuts |
| `Infinity` | Path computation never terminates or overflows | DoS |
| `-Infinity` | Negative cycle detection fails | Incorrect results |
| Negative weights | Bellman-Ford required; Dijkstra incorrect | Algorithm mismatch |
| Subnormal values | Performance degradation | Timing side-channel |
| Zero | Division by zero in some algorithms | Crash |

**Required Validation:**

```rust
impl BmsspJTreeLevel {
    fn validate_weight(weight: f64) -> Result<(), MinCutError> {
        // Check for NaN
        if weight.is_nan() {
            return Err(MinCutError::InvalidParameter(
                "Edge weight cannot be NaN".to_string()
            ));
        }

        // Check for infinity
        if weight.is_infinite() {
            return Err(MinCutError::InvalidParameter(
                "Edge weight cannot be infinite".to_string()
            ));
        }

        // Check for negative weights (BMSSP assumes non-negative)
        if weight < 0.0 {
            return Err(MinCutError::InvalidParameter(
                format!("Edge weight {} must be non-negative", weight)
            ));
        }

        // Check for subnormal (optional, for performance)
        if weight != 0.0 && weight.abs() < f64::MIN_POSITIVE {
            // Normalize to zero or reject
            return Err(MinCutError::InvalidParameter(
                "Subnormal edge weights not supported".to_string()
            ));
        }

        Ok(())
    }
}
```

### 2.3 Graph Size Limits

**Current Limits (compact/mod.rs):**

```rust
pub const MAX_VERTICES_PER_CORE: usize = 256;
pub const MAX_EDGES_PER_CORE: usize = 384;
```

**BMSSP Proposed Limits (ADR-002-addendum):**

| Metric | Value | Memory Impact |
|--------|-------|---------------|
| Max vertices (browser) | 100K | ~4MB per graph |
| Max vertices (Node.js) | 1M | ~40MB per graph |
| Max edges | Unbounded | Risk: OOM |

**Recommended Limits:**

```rust
pub struct BmsspConfig {
    /// Maximum vertices allowed (default: 1M)
    pub max_vertices: u32,
    /// Maximum edges allowed (default: 10M)
    pub max_edges: u32,
    /// Maximum memory allocation in bytes (default: 100MB)
    pub max_memory_bytes: usize,
    /// Maximum path cache entries (default: 10K)
    pub max_cache_entries: usize,
}

impl Default for BmsspConfig {
    fn default() -> Self {
        Self {
            max_vertices: 1_000_000,
            max_edges: 10_000_000,
            max_memory_bytes: 100 * 1024 * 1024, // 100MB
            max_cache_entries: 10_000,
        }
    }
}
```

---

## 3. Resource Exhaustion

### 3.1 Memory Limits for Large Graphs

**Attack Vector:**

```javascript
// Malicious input: Create graph with maximum vertices
const graph = new WasmGraph(0xFFFFFFFF, false);
// WASM memory allocation: 4GB * 8 bytes = 32GB
// Result: Browser/Node.js OOM crash
```

**Mitigation:**

```rust
impl BmsspJTreeLevel {
    pub fn new(vertex_count: usize, config: &BmsspConfig) -> Result<Self, MinCutError> {
        // Memory estimation: vertices * sizeof(f64) * expected_edges_per_vertex
        let estimated_memory = vertex_count
            .checked_mul(8)  // sizeof(f64)
            .and_then(|v| v.checked_mul(10))  // avg 10 edges/vertex
            .ok_or_else(|| MinCutError::CapacityExceeded(
                "Memory estimation overflow".to_string()
            ))?;

        if estimated_memory > config.max_memory_bytes {
            return Err(MinCutError::CapacityExceeded(
                format!("Estimated memory {}B exceeds limit {}B",
                    estimated_memory, config.max_memory_bytes)
            ));
        }

        if vertex_count > config.max_vertices as usize {
            return Err(MinCutError::CapacityExceeded(
                format!("Vertex count {} exceeds limit {}",
                    vertex_count, config.max_vertices)
            ));
        }

        // Proceed with allocation
        Ok(Self { /* ... */ })
    }
}
```

### 3.2 CPU Time Limits for Pathological Inputs

**Attack Vectors:**

| Attack | Complexity | Example |
|--------|------------|---------|
| Dense complete graph | O(n^2 log n) | K_n with n=10K |
| Long chain graph | O(n^2) worst case | Linear path graph |
| Repeated queries same source | Cache miss flood | Source cycling |

**Pathological Graph Examples:**

```
1. Complete Graph K_n:
   - n=10,000 vertices
   - 50M edges
   - Single SSSP: ~500ms
   - All-pairs: ~5000 seconds

2. Adversarial Sparse Graph:
   - Carefully constructed to maximize relaxation steps
   - Can cause O(V*E) behavior in Dijkstra variants
```

**Mitigation - Timeout Mechanism:**

```rust
use std::time::{Duration, Instant};

pub struct TimeLimitedBmssp {
    inner: BmsspJTreeLevel,
    timeout: Duration,
}

impl TimeLimitedBmssp {
    pub fn compute_shortest_paths(&self, source: u32) -> Result<Vec<f64>, MinCutError> {
        let start = Instant::now();

        // For WASM, we cannot interrupt mid-computation
        // Instead, validate complexity before execution
        let estimated_ops = self.estimate_operations(source);
        let estimated_time = Duration::from_nanos(estimated_ops * 10); // ~10ns per op

        if estimated_time > self.timeout {
            return Err(MinCutError::CapacityExceeded(
                format!("Estimated time {:?} exceeds timeout {:?}",
                    estimated_time, self.timeout)
            ));
        }

        let result = self.inner.compute_shortest_paths(source);

        if start.elapsed() > self.timeout {
            // Log warning for monitoring
            tracing::warn!(
                source = source,
                elapsed = ?start.elapsed(),
                timeout = ?self.timeout,
                "BMSSP computation exceeded timeout"
            );
        }

        Ok(result)
    }

    fn estimate_operations(&self, _source: u32) -> u64 {
        let n = self.inner.vertex_count as u64;
        let m = self.inner.edge_count as u64;
        // BMSSP complexity: O(m * log^(2/3) n)
        let log_n = (n as f64).ln().max(1.0);
        let log_factor = log_n.powf(2.0 / 3.0);
        (m as f64 * log_factor) as u64
    }
}
```

### 3.3 Cache Size Bounds

**Current Cache (from ADR):**

```rust
pub struct BmsspJTreeLevel {
    path_cache: HashMap<(VertexId, VertexId), f64>,
    // ...
}
```

**Attack Vector:**
```
1. Query all n*(n-1)/2 pairs
2. Cache grows to O(n^2) entries
3. For n=100K: 10B entries * 24 bytes = 240GB
```

**Mitigation - LRU Cache with Bounded Size:**

```rust
use lru::LruCache;
use std::num::NonZeroUsize;

pub struct BmsspJTreeLevel {
    path_cache: LruCache<(VertexId, VertexId), f64>,
    cache_hits: u64,
    cache_misses: u64,
}

impl BmsspJTreeLevel {
    pub fn new(config: &BmsspConfig) -> Self {
        let cache_capacity = NonZeroUsize::new(config.max_cache_entries)
            .unwrap_or(NonZeroUsize::new(10_000).unwrap());

        Self {
            path_cache: LruCache::new(cache_capacity),
            cache_hits: 0,
            cache_misses: 0,
        }
    }

    pub fn min_cut(&mut self, s: VertexId, t: VertexId) -> f64 {
        // Normalize key for undirected graphs
        let key = if s <= t { (s, t) } else { (t, s) };

        if let Some(&cached) = self.path_cache.get(&key) {
            self.cache_hits += 1;
            return cached;
        }

        self.cache_misses += 1;

        // Compute and cache
        let distances = self.wasm_graph.compute_shortest_paths(s as u32);
        let cut_value = distances[t as usize];

        self.path_cache.put(key, cut_value);

        cut_value
    }
}
```

---

## 4. Supply Chain Security

### 4.1 @ruvnet/bmssp Package Integrity

**Package Analysis:**

| Attribute | Value | Risk |
|-----------|-------|------|
| npm package | `@ruvnet/bmssp` | Scoped package (trusted author) |
| Source repository | https://github.com/ruvnet/bmssp | Verify ownership |
| WASM binary size | 27KB | Small attack surface |
| Dependencies | None (standalone WASM) | Low transitive risk |

**Verification Steps Required:**

```bash
# 1. Verify package signature (if using npm provenance)
npm audit signatures @ruvnet/bmssp

# 2. Verify WASM binary hash
sha256sum node_modules/@ruvnet/bmssp/bmssp.wasm
# Expected: [document expected hash in SECURITY.md]

# 3. Verify source matches binary
cd node_modules/@ruvnet/bmssp
wasm-decompile bmssp.wasm > decompiled.wat
# Compare with reference build
```

**Package Lock Recommendation:**

```json
// package.json
{
  "dependencies": {
    "@ruvnet/bmssp": "1.0.0"
  },
  "overrides": {
    "@ruvnet/bmssp": "$@ruvnet/bmssp"
  }
}

// .npmrc
package-lock=true
save-exact=true
```

### 4.2 Known Vulnerabilities Check

| ID | Severity | Issue | Status |
|----|----------|-------|--------|
| SUPPLY-001 | High | No SBOM (Software Bill of Materials) | Action Required |
| SUPPLY-002 | Medium | WASM binary not reproducibly built | Action Required |
| SUPPLY-003 | Low | No npm provenance attestation | Recommended |
| SUPPLY-004 | Info | No security.txt in package | Informational |

**Required Actions:**

1. **Generate SBOM:**
```bash
# Using syft
syft dir:node_modules/@ruvnet/bmssp -o spdx-json > bmssp-sbom.json
```

2. **Verify Reproducible Build:**
```bash
# Clone source
git clone https://github.com/ruvnet/bmssp.git
cd bmssp

# Build with deterministic settings
RUSTFLAGS="-C lto=thin" wasm-pack build --release

# Compare hash
sha256sum pkg/bmssp_bg.wasm
```

### 4.3 WASM Binary Verification

**Runtime Verification:**

```typescript
import { createHash } from 'crypto';

const EXPECTED_WASM_HASH = 'sha256:abc123...'; // Document this

async function verifyBmsspWasm(): Promise<boolean> {
    const wasmBytes = await fetch('/node_modules/@ruvnet/bmssp/bmssp.wasm')
        .then(r => r.arrayBuffer());

    const hash = createHash('sha256')
        .update(new Uint8Array(wasmBytes))
        .digest('hex');

    const expected = EXPECTED_WASM_HASH.replace('sha256:', '');

    if (hash !== expected) {
        console.error(`BMSSP WASM hash mismatch!
            Expected: ${expected}
            Got: ${hash}`);
        return false;
    }

    return true;
}

// Call before initializing BMSSP
if (!await verifyBmsspWasm()) {
    throw new Error('BMSSP WASM integrity check failed');
}
```

---

## 5. Error Handling

### 5.1 Panic Safety Across FFI Boundary

**Current Panic Handling (lib.rs:116):**

```rust
#![cfg_attr(not(feature = "wasm"), deny(unsafe_code))]
```

**Issue:** Panics in WASM are not handled - they become WASM traps that JavaScript cannot catch gracefully.

**Current FFI Error Handling (agentic.rs:148-149):**

```rust
#[no_mangle]
pub extern "C" fn mincut_get_result() -> u16 {
    unsafe { INSTANCE.as_ref().map(|i| i.min_cut()).unwrap_or(u16::MAX) }
}
```

**Analysis:**
- Uses `unwrap_or` for graceful degradation (good)
- Returns sentinel value (u16::MAX) on error
- No panic path in this function

**Identified Issues:**

| ID | Severity | Issue | Location |
|----|----------|-------|----------|
| ERR-001 | Medium | Panics in test code can propagate | `paper_impl.rs:613, 654` |
| ERR-002 | Medium | No structured error return from FFI | All FFI functions |
| ERR-003 | Low | Error messages may leak internal state | Error formatting |

**Recommended Error Handling Pattern:**

```rust
/// Error codes for FFI boundary
#[repr(u8)]
pub enum BmsspErrorCode {
    Success = 0,
    InvalidVertex = 1,
    InvalidWeight = 2,
    OutOfMemory = 3,
    Timeout = 4,
    InternalError = 255,
}

/// Result structure for FFI
#[repr(C)]
pub struct BmsspResult {
    pub error_code: u8,
    pub result: u16,
}

#[no_mangle]
pub extern "C" fn mincut_compute(s: u16, t: u16) -> BmsspResult {
    // Use catch_unwind to prevent panics crossing FFI
    let result = std::panic::catch_unwind(|| {
        unsafe {
            INSTANCE.as_mut()
                .map(|i| i.min_cut(s as usize, t as usize))
                .unwrap_or(u16::MAX)
        }
    });

    match result {
        Ok(value) => BmsspResult {
            error_code: BmsspErrorCode::Success as u8,
            result: value,
        },
        Err(_) => BmsspResult {
            error_code: BmsspErrorCode::InternalError as u8,
            result: u16::MAX,
        },
    }
}
```

### 5.2 Graceful Degradation on WASM Failure

**Fallback Strategy:**

```rust
/// Hybrid cut computation with fallback
pub struct HybridMinCut {
    /// Primary: BMSSP WASM acceleration
    bmssp: Option<BmsspJTreeLevel>,
    /// Fallback: Native Rust implementation
    native: SubpolynomialMinCut,
    /// Failure count for circuit breaker
    wasm_failures: AtomicU32,
    /// Circuit breaker threshold
    failure_threshold: u32,
}

impl HybridMinCut {
    pub fn min_cut(&mut self, s: VertexId, t: VertexId) -> CutResult {
        // Check circuit breaker
        if self.wasm_failures.load(Ordering::Relaxed) >= self.failure_threshold {
            return self.native_fallback(s, t);
        }

        // Try WASM first
        if let Some(ref mut bmssp) = self.bmssp {
            match bmssp.try_min_cut(s, t) {
                Ok(result) => {
                    // Reset failure count on success
                    self.wasm_failures.store(0, Ordering::Relaxed);
                    return result;
                }
                Err(e) => {
                    // Increment failure count
                    self.wasm_failures.fetch_add(1, Ordering::Relaxed);
                    tracing::warn!(error = ?e, "BMSSP failed, using fallback");
                }
            }
        }

        self.native_fallback(s, t)
    }

    fn native_fallback(&self, s: VertexId, t: VertexId) -> CutResult {
        CutResult::exact(self.native.min_cut_between(s, t))
    }
}
```

### 5.3 Information Leakage in Error Messages

**Current Error Types (error.rs):**

```rust
#[derive(Error, Debug)]
pub enum MinCutError {
    #[error("Invalid vertex ID: {0}")]
    InvalidVertex(u64),
    // Exposes internal vertex ID representation

    #[error("Internal algorithm error: {0}")]
    InternalError(String),
    // May expose internal state via string
}
```

**Recommended Sanitization:**

```rust
impl MinCutError {
    /// Return user-safe error message without internal details
    pub fn user_message(&self) -> &'static str {
        match self {
            MinCutError::EmptyGraph => "Graph is empty",
            MinCutError::InvalidVertex(_) => "Invalid vertex identifier",
            MinCutError::InvalidEdge(_, _) => "Invalid edge specification",
            MinCutError::DisconnectedGraph => "Graph is not connected",
            MinCutError::CutSizeExceeded(_, _) => "Result exceeds supported size",
            MinCutError::InvalidEpsilon(_) => "Invalid approximation parameter",
            MinCutError::InvalidParameter(_) => "Invalid parameter value",
            MinCutError::CallbackError(_) => "Callback execution failed",
            MinCutError::InternalError(_) => "Internal error occurred",
            MinCutError::ConcurrentModification => "Concurrent modification detected",
            MinCutError::CapacityExceeded(_) => "Capacity limit exceeded",
            MinCutError::SerializationError(_) => "Data serialization failed",
        }
    }
}

// For FFI: return only opaque error codes
#[no_mangle]
pub extern "C" fn mincut_get_last_error() -> u8 {
    // Return error code, not detailed message
    thread_local! {
        static LAST_ERROR: Cell<u8> = Cell::new(0);
    }
    LAST_ERROR.with(|e| e.get())
}
```

---

## 6. Cryptographic Considerations

### 6.1 Random Number Generation for Sampling

**Current RNG Usage (snn/attractor.rs:440-442):**

```rust
let mut rng_state = seed.wrapping_add(0x9e3779b97f4a7c15);
// ...
rng_state = rng_state.wrapping_mul(0x5851f42d4c957f2d).wrapping_add(1);
```

**Analysis:**
- Uses simple LCG (Linear Congruential Generator)
- Constants from SplitMix64
- **Not cryptographically secure** (by design - for performance)

**BMSSP Sampling Requirements:**

| Use Case | CSPRNG Required | Rationale |
|----------|-----------------|-----------|
| Vertex sampling for testing | No | Reproducibility more important |
| Random pivot selection | No | Any distribution works |
| Cryptographic commitments | Yes | Must be unpredictable |
| Audit trail generation | Yes | Prevent manipulation |

**Recommendation:**

```rust
/// RNG wrapper with appropriate strength for use case
pub enum BmsspRng {
    /// Fast, reproducible (default for graph algorithms)
    Fast(FastRng),
    /// Cryptographically secure (for audit/security features)
    Secure(SecureRng),
}

impl BmsspRng {
    /// Use fast RNG for graph algorithm internals
    pub fn for_algorithm() -> Self {
        BmsspRng::Fast(FastRng::from_seed([0u8; 8]))
    }

    /// Use secure RNG for audit trail
    pub fn for_audit() -> Self {
        BmsspRng::Secure(SecureRng::new())
    }
}
```

### 6.2 Determinism Requirements

**J-Tree Algorithm Determinism:**

| Operation | Must be Deterministic | Rationale |
|-----------|----------------------|-----------|
| Shortest path computation | Yes | Reproducible results |
| Cache key generation | Yes | Consistent lookups |
| Witness generation | Yes | Verifiable proofs |
| Performance sampling | No | Statistical validity |

**Ensuring Determinism:**

```rust
impl BmsspJTreeLevel {
    /// Compute shortest paths with deterministic tie-breaking
    pub fn compute_shortest_paths_deterministic(&self, source: u32) -> Vec<f64> {
        // BMSSP uses Dijkstra variant - inherently deterministic
        // for same input graph and source

        // Ensure vertex iteration order is deterministic
        let result = self.wasm_graph.compute_shortest_paths(source);

        // Verify determinism in debug builds
        #[cfg(debug_assertions)]
        {
            let result2 = self.wasm_graph.compute_shortest_paths(source);
            assert_eq!(result, result2, "Non-deterministic shortest path computation");
        }

        result
    }
}
```

---

## 7. Recommended Mitigations Summary

### 7.1 Immediate Actions (P0 - Before Integration)

| ID | Action | Effort | Impact |
|----|--------|--------|--------|
| P0-1 | Add vertex ID bounds validation | 2 hours | High |
| P0-2 | Add edge weight validation (NaN, Inf, negative) | 2 hours | High |
| P0-3 | Implement memory allocation limits | 4 hours | High |
| P0-4 | Document expected WASM binary hash | 1 hour | Medium |
| P0-5 | Add `catch_unwind` to FFI functions | 4 hours | Medium |

### 7.2 Short-Term Actions (P1 - First Release)

| ID | Action | Effort | Impact |
|----|--------|--------|--------|
| P1-1 | Implement LRU cache with bounded size | 4 hours | Medium |
| P1-2 | Add timeout estimation for operations | 8 hours | Medium |
| P1-3 | Create SBOM for BMSSP package | 2 hours | Low |
| P1-4 | Implement circuit breaker for WASM failures | 4 hours | Medium |
| P1-5 | Add memory ownership wrapper for JavaScript | 4 hours | Medium |

### 7.3 Long-Term Actions (P2 - Future Releases)

| ID | Action | Effort | Impact |
|----|--------|--------|--------|
| P2-1 | Implement reproducible WASM build verification | 1 week | Medium |
| P2-2 | Add fuzzing targets for BMSSP integration | 1 week | Medium |
| P2-3 | Consider WASM Component Model migration | 2 weeks | Low |
| P2-4 | Implement comprehensive audit logging | 1 week | Low |

---

## 8. Code Changes Required

### 8.1 New File: `src/wasm/bmssp_security.rs`

```rust
//! Security wrappers for BMSSP WASM integration
//!
//! Provides input validation, resource limits, and error handling
//! for safe BMSSP integration.

use crate::error::{MinCutError, Result};
use std::time::{Duration, Instant};

/// Security configuration for BMSSP integration
#[derive(Debug, Clone)]
pub struct BmsspSecurityConfig {
    /// Maximum vertices allowed
    pub max_vertices: u32,
    /// Maximum edges allowed
    pub max_edges: u32,
    /// Maximum memory in bytes
    pub max_memory_bytes: usize,
    /// Maximum cache entries
    pub max_cache_entries: usize,
    /// Operation timeout
    pub timeout: Duration,
    /// Enable WASM binary verification
    pub verify_wasm_hash: bool,
    /// Expected WASM binary hash (SHA-256)
    pub expected_wasm_hash: Option<String>,
}

impl Default for BmsspSecurityConfig {
    fn default() -> Self {
        Self {
            max_vertices: 1_000_000,
            max_edges: 10_000_000,
            max_memory_bytes: 100 * 1024 * 1024,
            max_cache_entries: 10_000,
            timeout: Duration::from_secs(30),
            verify_wasm_hash: true,
            expected_wasm_hash: None,
        }
    }
}

/// Validate edge weight for BMSSP compatibility
pub fn validate_edge_weight(weight: f64) -> Result<()> {
    if weight.is_nan() {
        return Err(MinCutError::InvalidParameter(
            "Edge weight cannot be NaN".into()
        ));
    }
    if weight.is_infinite() {
        return Err(MinCutError::InvalidParameter(
            "Edge weight cannot be infinite".into()
        ));
    }
    if weight < 0.0 {
        return Err(MinCutError::InvalidParameter(
            "Edge weight must be non-negative".into()
        ));
    }
    Ok(())
}

/// Validate vertex ID is within bounds
pub fn validate_vertex_id(vertex: u32, max_vertices: u32) -> Result<()> {
    if vertex >= max_vertices {
        return Err(MinCutError::InvalidVertex(vertex as u64));
    }
    Ok(())
}

/// Estimate memory usage for graph
pub fn estimate_memory_usage(vertices: usize, edges: usize) -> usize {
    // Vertex array: vertices * sizeof(f64)
    let vertex_memory = vertices.saturating_mul(8);
    // Edge list: edges * (2 * sizeof(u32) + sizeof(f64))
    let edge_memory = edges.saturating_mul(16);
    // Cache overhead estimate
    let cache_overhead = vertices.saturating_mul(24);

    vertex_memory
        .saturating_add(edge_memory)
        .saturating_add(cache_overhead)
}
```

### 8.2 Updates to `src/wasm/mod.rs`

```rust
//! WASM bindings and optimizations for agentic chip
//!
//! Provides:
//! - SIMD-accelerated boundary computation
//! - Agentic chip interface
//! - Inter-core messaging
//! - BMSSP security wrappers (new)

pub mod agentic;
pub mod simd;
pub mod bmssp_security;  // Add this line

pub use agentic::*;
pub use simd::*;
pub use bmssp_security::*;  // Add this line
```

---

## 9. Testing Requirements

### 9.1 Security Test Cases

```rust
#[cfg(test)]
mod security_tests {
    use super::*;

    #[test]
    fn test_nan_weight_rejected() {
        let result = validate_edge_weight(f64::NAN);
        assert!(result.is_err());
    }

    #[test]
    fn test_infinity_weight_rejected() {
        let result = validate_edge_weight(f64::INFINITY);
        assert!(result.is_err());
    }

    #[test]
    fn test_negative_weight_rejected() {
        let result = validate_edge_weight(-1.0);
        assert!(result.is_err());
    }

    #[test]
    fn test_vertex_bounds_check() {
        let result = validate_vertex_id(100, 50);
        assert!(result.is_err());
    }

    #[test]
    fn test_memory_estimation_overflow() {
        let mem = estimate_memory_usage(usize::MAX, usize::MAX);
        // Should not panic, should saturate
        assert!(mem <= usize::MAX);
    }
}
```

### 9.2 Fuzzing Targets

```rust
// fuzz/fuzz_targets/bmssp_input.rs
#![no_main]
use libfuzzer_sys::fuzz_target;

fuzz_target!(|data: &[u8]| {
    if data.len() < 16 { return; }

    // Parse fuzzer input
    let vertex_count = u32::from_le_bytes(data[0..4].try_into().unwrap());
    let edge_count = u32::from_le_bytes(data[4..8].try_into().unwrap());

    // Validate with security checks
    let config = BmsspSecurityConfig::default();
    let _ = validate_vertex_id(vertex_count, config.max_vertices);
    let _ = estimate_memory_usage(vertex_count as usize, edge_count as usize);
});
```

---

## 10. Verification Checklist

### Pre-Integration Checklist

- [ ] All P0 mitigations implemented
- [ ] WASM binary hash documented
- [ ] Input validation tests passing
- [ ] Memory limit tests passing
- [ ] Panic safety verified with `catch_unwind`
- [ ] No `unwrap()` in FFI code
- [ ] Error codes documented for JavaScript consumers
- [ ] SBOM generated for BMSSP package

### Pre-Production Checklist

- [ ] P1 mitigations implemented
- [ ] Fuzzing targets created and run for 24+ hours
- [ ] Circuit breaker tested under failure conditions
- [ ] Memory leak tests passing (long-running)
- [ ] Timeout mechanism validated
- [ ] Security review by second party
- [ ] Penetration testing completed

---

## 11. Conclusion

The proposed BMSSP WASM integration offers significant performance benefits for j-tree operations but introduces several security considerations that require mitigation:

**Primary Concerns:**
1. FFI boundary safety with static mutable state
2. Input validation gaps for vertex IDs and edge weights
3. Resource exhaustion vectors through unbounded allocation
4. Supply chain risks from external WASM dependency

**Recommended Approach:**
1. Implement all P0 mitigations before initial integration
2. Use defense-in-depth with validation at multiple layers
3. Maintain native Rust fallback for graceful degradation
4. Establish ongoing monitoring and circuit breaker patterns

**Overall Assessment:** The integration is viable with the recommended security mitigations in place. The performance benefits (10-15x speedup) justify the additional security engineering investment.

---

## Appendix A: Security Review Sign-Off

| Role | Name | Date | Signature |
|------|------|------|-----------|
| Security Architect | ___________________ | ________ | ________ |
| Lead Developer | ___________________ | ________ | ________ |
| QA Lead | ___________________ | ________ | ________ |

## Appendix B: References

1. ADR-002: Dynamic Hierarchical j-Tree Decomposition
2. ADR-002-addendum-bmssp-integration: BMSSP WASM Integration Proposal
3. BMSSP Paper: "Breaking the Sorting Barrier for SSSP" (arXiv:2501.00660)
4. npm package: https://www.npmjs.com/package/@ruvnet/bmssp
5. RuVector Security Audit Report (2026-01-18)
6. OWASP WASM Security Guidelines
7. Rust FFI Safety Guidelines

---

*This security review was conducted as part of the ADR-002-addendum-bmssp-integration proposal review process.*