security: WASM max_memory_bytes configured but never enforced — no Store limiter set

Summary

max_memory_bytes flows from agent manifest → ResourceQuota → SandboxConfig (kernel.rs:2512) but hits a dead end. The comment at sandbox.rs:39 explicitly marks it as reserved for future enforcement:

/// Maximum WASM linear memory in bytes (reserved for future enforcement)

No Store::limiter() is set anywhere in the sandbox, so WASM modules can grow linear memory up to wasmtime's default (~4GB for 32-bit WASM) regardless of what max_memory_bytes is set to in the agent manifest.

Impact

An agent manifest with max_memory_bytes = 67108864 (64MB) provides no actual memory constraint. A malicious or buggy WASM skill could exhaust host memory. Fuel metering and epoch interruption protect against CPU time but not memory.

Suggested fix

Wire max_memory_bytes into wasmtime's resource limiter:

use wasmtime::ResourceLimiter;

struct MemoryLimiter { max_bytes: usize }

impl ResourceLimiter for MemoryLimiter {
    fn memory_growing(&mut self, current: usize, desired: usize, 
                      _max: Option<usize>) -> Result<bool> {
        Ok(desired <= self.max_bytes)
    }
    fn table_growing(&mut self, _cur: u32, _des: u32, 
                     _max: Option<u32>) -> Result<bool> {
        Ok(true)
    }
}

// In WasmSandbox::execute_sync:
store.limiter(|state| &mut state.memory_limiter);

Note

This is a documented gap ("reserved for future enforcement"). Opening as an issue to track implementation. Happy to submit a PR if this is ready to be addressed.