fix(llm): reject prompt images that do not decode 🐛

[kp2pml30]

Auto-opened executor mirror of genlayerlabs/genvm-manager#57.

Carries the executor-side work for that manager PR. The manager branch update fast-forwards v0.3-dev to its pinned commit after landing.

Summary by CodeRabbit

• Bug Fixes
  • Execution prompts now stop with an out-of-memory error when available VM memory is below the required minimum. Existing restrictions on deterministic execution and prompts containing more than two images still apply.
  • WebAssembly execution now enforces call-depth and value-stack limits, stopping execution with a stack-overflow error when those limits are exceeded.
  • Zero-budget allocations are no longer used to fund external emissions. An exact internal allocation with no remaining budget remains selected, and emissions using it fail rather than falling back to a wildcard allocation.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: genlayerlabs/genvm-executor/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 2602b6bd-407c-4fef-bbb6-1e2e6fa3609e

📥 Commits

Reviewing files that changed from the base of the PR and between 84f9db9 and 49aa574.

⛔ Files ignored due to path filters (10)

• .git-third-party/manifest.json is excluded by !**/*.json
• executor/Cargo.lock is excluded by !**/*.lock, !**/*.lock
• tests/integration/storage/bootstrapper/bootstrapper.0.hash is excluded by !**/*.hash, !**/tests/**
• tests/integration/storage/bootstrapper/bootstrapper.0_0.hash is excluded by !**/*.hash, !**/tests/**
• tests/integration/storage/bootstrapper/bootstrapper.0_0_0.hash is excluded by !**/*.hash, !**/tests/**
• tests/integration/storage/bootstrapper/bootstrapper.0_0_0_0.hash is excluded by !**/*.hash, !**/tests/**
• tests/integration/storage/bootstrapper/bootstrapper.0_0_0_0_0.hash is excluded by !**/*.hash, !**/tests/**
• tests/integration/storage/bootstrapper/bootstrapper.0_0_0_0_0_0.hash is excluded by !**/*.hash, !**/tests/**
• tests/integration/storage/bootstrapper/bootstrapper.jsonnet is excluded by !**/tests/**
• tests/integration/storage/bootstrapper/bootstrapper.py is excluded by !**/tests/**

📒 Files selected for processing (7)

• .git-third-party/patches/executor/third-party/wasmtime/fvfcbfxe3ng3djg8
• .git-third-party/patches/executor/third-party/wasmtime/mgz066ws46rvhghv
• .git-third-party/patches/executor/third-party/wasmtime/nwdw669v5p3aamta
• .git-third-party/patches/executor/third-party/wasmtime/wyqzzn2hxndgbxbx
• .git-third-party/patches/executor/third-party/wasmtime/x77t41kns34hzzhb
• executor/src/wasi/genlayer_sdk/message.rs
• executor/src/wasi/genlayer_sdk/tests.rs

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The changes add an exec-prompt memory guard, update allocation matching for zero-budget nodes, and modify Wasmtime floating-point traps, semantic stack limits, and memory fingerprints.

Changes

Exec prompt memory guard

Layer / File(s)	Summary
Define and enforce the memory limit executor/crates/common/src/internal_constants.rs, executor/src/wasi/genlayer_sdk/mod.rs	Adds EXEC_PROMPT_MIN_SPACE with a value of 134217728. gl_call_exec_prompt traps with an out-of-memory VM error when remaining memory is below this limit.

Allocation matching and emission

Layer / File(s)	Summary
Update allocation candidate selection executor/src/wasi/genlayer_sdk/message.rs	Internal matching can select recipient-specific nodes with zero budget. External selection excludes recipient-specific nodes with an explicit zero budget.
Specify matching and emission outcomes executor/src/wasi/genlayer_sdk/tests.rs	Tests cover zero-budget exact and wildcard allocations, phase mismatch behavior, and emission failure before wildcard fallback.

Wasmtime runtime changes

Layer / File(s)	Summary
Configure floating-point trap behavior .git-third-party/patches/executor/third-party/wasmtime/wyqzzn2hxndgbxbx, .git-third-party/patches/executor/third-party/wasmtime/fvfcbfxe3ng3djg8, .git-third-party/patches/executor/third-party/wasmtime/x77t41kns34hzzhb	Adds deterministic-mode traps for floating-point operations when floats are disabled, renames the emitted trap to NondetInstruction, and allows the listed SIMD lane operations through the float guard.
Track semantic call and value stack limits .git-third-party/patches/executor/third-party/wasmtime/nwdw669v5p3aamta, .git-third-party/patches/executor/third-party/wasmtime/wyqzzn2hxndgbxbx	Adds reverse call and value limits, checks them on function entry, and restores them on returns, tail calls, exception entry, and store-context restoration.
Calculate and expose memory fingerprints .git-third-party/patches/executor/third-party/wasmtime/wyqzzn2hxndgbxbx, .git-third-party/patches/executor/third-party/wasmtime/mgz066ws46rvhghv	Adds on-demand fingerprint methods that hash unshared memory contents. Invocation no longer attaches fingerprints to errors.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 49aa5

The identified stack-limit concern is already handled, and no remaining issue in the supplied evidence requires resolution before merge.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to 49aa5

The changes affect contract execution and message-fee decisions, so they merit design review. No new permission bypass was established, but failure and recovery behavior across a complete execution remains uncertain.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The changed decisions can affect contract-initiated messages and Wasm executions handled by the executor. The supplied evidence does not establish a wider service, tenant, or deployment blast radius.

Trust Boundaries and Controls

• observed — The inspected external-message entrypoint retains permission and balance checks ahead of allocation selection, and fee consumption rechecks the selected node’s remaining budget. No newly reachable over-budget emission path was established.

Resilience and Maintainability Implications

• inferred — Local reservation cleanup and fee checks cover ordinary failure within emission, but they do not establish how the enclosing execution handles cancellation or failure after effects have been accumulated.

Hardening Proposals

• proposed — Establish the enclosing execution’s commit and rollback contract for emissions, consumed allocation counters, and fee accounting under cancellation and guest failure before relying on local ordering as an end-to-end guarantee.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 63.64% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 11 functions across 4 files. (5 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies prompt image rejection, which is related to the changes in prompt execution validation. It does not cover all changes, but the title need not summarize the full changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 63.64% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 11 functions across 4 files. (5 skipped: 5 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

Warning

Some tools did not complete. Review the errors below.

🔧 Clippy (1.98.1)

Clippy execution failed

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}