From bd57041a0d7442d5049e0b143a139ff70b50b7a5 Mon Sep 17 00:00:00 2001 From: Ralf Anton Beier Date: Sat, 11 Jul 2026 08:22:27 +0200 Subject: [PATCH 1/4] docs(rivet): capture no_std interpreter direction (AD-NOSTD-INTERP-001, amends RFC #46) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Maintainer chose the hybrid direction from the #413 peer comparison: give kiln's interpreter a no_std mode for on-board embedded execution (gale/gust) ALONGSIDE the synth-AOT native path — competing head-to-head with NASA spacewasm and DLR-FT/wasm-interpreter instead of ceding that niche. - AD-NOSTD-INTERP-001 (design-decision): the hybrid decision + rationale (compiler-in-cert-TCB is harder than an interpreter; kiln already has bounded memory + fuel; std-dependence is a localized port — ~90 sync hits → kiln-sync, ~55 std:: → alloc, ~5 io → platform callbacks). Amends RFC #46's "there is no no_std interpreter"; reconciles REQ_FUNC_002/033 (marked implemented but not actually delivered). - REQ_NOSTD_INTERP (v0.6.0): the capability, phased (feasibility spike → sync/collections port → platform-callback I/O → live migration → cert parity). meld + synth are retained (build-time lowering + AOT hot path). Cross-repo: RFC #46 doc + BA sign-off, meld/synth positioning, gale/gust. Issue #415. Trace: AD-NOSTD-INTERP-001 --- .../requirements/architecture-decisions.yaml | 41 +++++++++++++++++++ safety/requirements/roadmap-requirements.yaml | 39 ++++++++++++++++++ 2 files changed, 80 insertions(+) diff --git a/safety/requirements/architecture-decisions.yaml b/safety/requirements/architecture-decisions.yaml index 9e8b28e7..9d72ebf0 100644 --- a/safety/requirements/architecture-decisions.yaml +++ b/safety/requirements/architecture-decisions.yaml @@ -68,6 +68,47 @@ artifacts: previous-id: ARCH_DEC_DEPLOY_001 implementation: kiln-platform/src/ + - id: AD-NOSTD-INTERP-001 + type: design-decision + title: Hybrid embedded execution — a no_std interpreter mode alongside synth-AOT (amends RFC #46) + description: > + Kiln shall provide a no_std deployment of its WebAssembly interpreter for + on-board embedded execution (gale/gust), IN ADDITION TO the synth-AOT + native path — not instead of it. meld (build-time component lowering) and + synth (AOT→native ELF for the perf-critical certified hot path) are retained; + this adds an interpreter deployment target for code that cannot or should + not be AOT-compiled (late-loaded modules, migrated instances, and cert + contexts that prefer an interpreter's smaller TCB over a compiler's). + status: proposed + tags: [architecture, embedded, no-std, interpreter, deployment, rfc46-amendment] + links: + - type: satisfies + target: REQ_NOSTD_INTERP + - type: satisfies + target: REQ_FUNC_002 + fields: + rationale: > + Peer comparison (#413): NASA spacewasm and DLR-FT interpret ON-BOARD with + no AOT; DLR states they chose an interpreter because a compiler defies + DO-178C/DO-332 design principles. Putting synth (a compiler) in the + embedded cert TCB is a materially harder cert story than an interpreter — + the incumbents avoided it deliberately. Kiln already has the ingredients + (capability-bounded memory + per-instruction fuel; kiln-runtime is + categorized no-std with a std feature and a no-op no_std stub); the no_std + gate is a choice. Measured std-dependence is localized and portable: + ~90 Mutex/RwLock/thread hits (→ kiln-sync), ~55 std:: hits (→ alloc + collections), only ~5 std::fs/io (→ platform callbacks). A focused port, + not a rewrite; target shape is DLR-FT's "in-place, almost no deps". + Amends RFC #46 ("there is no no_std interpreter"; embedded = synth-AOT + only) — requires an RFC #46 doc update + BA sign-off, and touches + meld/synth positioning and gale/gust (new on-board target + live + migration). Also reconciles the record: REQ_FUNC_002 (baremetal) and + REQ_FUNC_033 (kilnd-nostd) are marked implemented but the no_std + interpreter is not actually delivered today; this decision is the path to + making those claims true. Direction chosen by the maintainer 2026-07-11 + (hybrid over stay-course / migration-only). + upstream-ref: https://github.com/pulseengine/kiln/issues/415 + - id: AD-CRATE-001 type: design-decision title: Fine-grained crate organization diff --git a/safety/requirements/roadmap-requirements.yaml b/safety/requirements/roadmap-requirements.yaml index 7093c558..7254c4a0 100644 --- a/safety/requirements/roadmap-requirements.yaml +++ b/safety/requirements/roadmap-requirements.yaml @@ -543,3 +543,42 @@ artifacts: model: claude-opus-4-8 timestamp: 2026-07-08T22:48:04Z release: v0.7.0 + + - id: REQ_NOSTD_INTERP + type: requirement + title: Kiln interpreter runs no_std for on-board embedded execution (hybrid with synth-AOT) + description: > + Kiln's core-module interpreter shall build and run in a no_std environment + (no_std + alloc, then no_std + bounded-alloc) on embedded targets + (thumbv7em / gale / gust), so kiln can interpret WebAssembly ON-BOARD + alongside the synth-AOT native path — matching the deployment model of the + safety-critical interpreter field (NASA spacewasm, DLR-FT/wasm-interpreter, + #413) while carrying kiln's verification evidence (Verus / Lean / witness + MC/DC / sigil). meld (build-time component lowering) and synth (AOT→native + ELF for the certified hot path) are RETAINED; this adds an interpreter + deployment target for code that cannot or should not be AOT-compiled + (late-loaded modules, migrated instances, and cert contexts that prefer an + interpreter's smaller TCB over a compiler's). Phased: (1) feasibility spike + — a minimal core module interprets under no_std+alloc on thumbv7em with + fuel + bounded memory intact and binary size measured (go/no-go gate); + (2) port sync primitives (~90 Mutex/RwLock/thread hits → kiln-sync) and + collections (std → alloc) behind the std-feature boundary; (3) host/WASI + imports via the kiln-builtins platform-callback surface; (4) live-instance + migration (execution-state serialize/restore — DLR-FT parity, gale/gust + checkpoint-restart/failover; may be its own track); (5) cert-evidence parity + with the std interpreter. Corrects the record: REQ_FUNC_002 (baremetal) and + REQ_FUNC_033 (kilnd-nostd) are marked implemented, but RFC #46 routes + embedded through synth-AOT only and kiln-runtime is std-bound today — this + delivers the actual no_std interpreter. Amends RFC #46 (doc + BA sign-off). + status: proposed + release: v0.6.0 + tags: [interpreter, no-std, embedded, migration, rfc46-amendment, roadmap, direction] + links: + - type: derives-from + target: REQ_FUNC_002 + fields: + upstream-ref: https://github.com/pulseengine/kiln/issues/415 + provenance: + created-by: ai + model: claude-opus-4-8 + timestamp: 2026-07-11T00:00:00Z From d82b60c9dd4d11b6c5ab03f9802a0924d5c93796 Mon Sep 17 00:00:00 2001 From: Ralf Anton Beier Date: Sat, 11 Jul 2026 08:27:11 +0200 Subject: [PATCH 2/4] =?UTF-8?q?docs(rivet):=20refine=20no=5Fstd=20directio?= =?UTF-8?q?n=20=E2=80=94=20deploy=20kiln=20AS=20a=20wasm=20module=20via=20?= =?UTF-8?q?synth;=20on-board=20Component=20Model?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Maintainer refinement of AD-NOSTD-INTERP-001: - DEPLOYMENT MECHANISM: kiln (no_std/no_alloc) is compiled TO a wasm module that synth AOT-compiles to native — the same pipeline as user code. wasm = universal IR, synth = single compiler in the TCB, kiln-as-wasm itself attestable via witness MC/DC + scry + sigil. No separate no_std-Rust->native toolchain needed. - UNIQUE DIFFERENTIATOR: on-board interpreter runs the FULL Component Model (direct hosting, AD-COMPONENT-HOST-001) or core wasm — spacewasm/DLR-FT are core-only. Extends AD-COMPONENT-HOST-001's direct-hosting from QM/std-only to the embedded target. - GALE (OS) requirement: load the synth-compiled kiln + support runtime wasm loading (dynamic module/component load on-target). - OPEN QUESTIONS for the Phase-1 spike: does synth accept a module as large as kiln; interpreter-in-wasm-AOT'd-to-native perf; bootstrapping trust. Fallback: direct no_std-Rust build of kiln-runtime (same port work, different codegen). REQ_NOSTD_INTERP re-phased accordingly (feasibility spike now tests kiln-as-wasm ->synth; adds Component-Model-on-embedded + gale phases). Issue #415. Trace: AD-NOSTD-INTERP-001 --- .../requirements/architecture-decisions.yaml | 45 +++++++++++++--- safety/requirements/roadmap-requirements.yaml | 52 +++++++++++-------- 2 files changed, 67 insertions(+), 30 deletions(-) diff --git a/safety/requirements/architecture-decisions.yaml b/safety/requirements/architecture-decisions.yaml index 9d72ebf0..4edb0db3 100644 --- a/safety/requirements/architecture-decisions.yaml +++ b/safety/requirements/architecture-decisions.yaml @@ -70,15 +70,28 @@ artifacts: - id: AD-NOSTD-INTERP-001 type: design-decision - title: Hybrid embedded execution — a no_std interpreter mode alongside synth-AOT (amends RFC #46) + title: Hybrid embedded execution — a no_std interpreter mode alongside synth-AOT, deployed AS a wasm module via synth (amends RFC #46) description: > - Kiln shall provide a no_std deployment of its WebAssembly interpreter for - on-board embedded execution (gale/gust), IN ADDITION TO the synth-AOT - native path — not instead of it. meld (build-time component lowering) and - synth (AOT→native ELF for the perf-critical certified hot path) are retained; - this adds an interpreter deployment target for code that cannot or should - not be AOT-compiled (late-loaded modules, migrated instances, and cert - contexts that prefer an interpreter's smaller TCB over a compiler's). + Kiln shall provide a no_std/no_alloc deployment of its WebAssembly + interpreter for on-board embedded execution (gale/gust), IN ADDITION TO the + synth-AOT native path — not instead of it — as the alternative for payloads + where AOT is not wanted or wished (dynamic / late-loaded modules, migrated + instances, untrusted code, or cert contexts that prefer an interpreter's + smaller TCB over a compiler's). + DEPLOYMENT MECHANISM (the elegant part): kiln itself (no_std/no_alloc) is + compiled TO a wasm module, and synth AOT-compiles THAT to native for the + target — the SAME pipeline as user code. So wasm is the universal IR, synth + is the single compiler in the TCB, and kiln-as-wasm is itself + verifiable/attestable (witness MC/DC on the kiln wasm, scry invariants, + sigil) like any other module — no separate no_std-Rust→native toolchain is + needed. The synth-compiled kiln then loads and interprets wasm on-board. + UNIQUE DIFFERENTIATOR: this on-board interpreter runs the FULL Component + Model (kiln's direct runtime hosting per AD-COMPONENT-HOST-001) — or plain + core wasm — whereas the safety-critical peers (spacewasm, DLR-FT) are + core-module-only. It EXTENDS AD-COMPONENT-HOST-001's direct-hosting path + from QM/std-reference-only to the embedded target, so embedded gets a + runtime-Component-Model option alongside meld-dissolve-to-core. meld + (build-time lowering) and synth (AOT hot path) are retained. status: proposed tags: [architecture, embedded, no-std, interpreter, deployment, rfc46-amendment] links: @@ -107,6 +120,22 @@ artifacts: interpreter is not actually delivered today; this decision is the path to making those claims true. Direction chosen by the maintainer 2026-07-11 (hybrid over stay-course / migration-only). + cross-repo-gale: > + Imposes a GALE (OS) requirement: gale must (a) load and run the + synth-compiled kiln image, and (b) support RUNTIME wasm loading on-target + (dynamic module/component load, since on-board interpretation means + loading payloads at runtime, not just at build). File a gale-side + requirement + confirm the loader/OS-service surface before Phase 3. + open-questions: > + The kiln-as-wasm→synth deployment is elegant but unproven — the Phase-1 + feasibility spike must answer: (1) does synth accept and correctly AOT a + module as large/complex as the kiln interpreter; (2) interpreter-in-wasm + AOT'd-to-native performance vs a direct no_std-Rust→native build of kiln, + and vs the peers; (3) bootstrapping/toolchain-trust of compiling the + interpreter through the same pipeline it will later run. If wasm→synth + proves impractical, the fallback is a direct no_std-Rust build of + kiln-runtime for the target (the port work in REQ_NOSTD_INTERP is the same + either way; only the final codegen path differs). upstream-ref: https://github.com/pulseengine/kiln/issues/415 - id: AD-CRATE-001 diff --git a/safety/requirements/roadmap-requirements.yaml b/safety/requirements/roadmap-requirements.yaml index 7254c4a0..b8532b4f 100644 --- a/safety/requirements/roadmap-requirements.yaml +++ b/safety/requirements/roadmap-requirements.yaml @@ -548,28 +548,36 @@ artifacts: type: requirement title: Kiln interpreter runs no_std for on-board embedded execution (hybrid with synth-AOT) description: > - Kiln's core-module interpreter shall build and run in a no_std environment - (no_std + alloc, then no_std + bounded-alloc) on embedded targets - (thumbv7em / gale / gust), so kiln can interpret WebAssembly ON-BOARD - alongside the synth-AOT native path — matching the deployment model of the - safety-critical interpreter field (NASA spacewasm, DLR-FT/wasm-interpreter, - #413) while carrying kiln's verification evidence (Verus / Lean / witness - MC/DC / sigil). meld (build-time component lowering) and synth (AOT→native - ELF for the certified hot path) are RETAINED; this adds an interpreter - deployment target for code that cannot or should not be AOT-compiled - (late-loaded modules, migrated instances, and cert contexts that prefer an - interpreter's smaller TCB over a compiler's). Phased: (1) feasibility spike - — a minimal core module interprets under no_std+alloc on thumbv7em with - fuel + bounded memory intact and binary size measured (go/no-go gate); - (2) port sync primitives (~90 Mutex/RwLock/thread hits → kiln-sync) and - collections (std → alloc) behind the std-feature boundary; (3) host/WASI - imports via the kiln-builtins platform-callback surface; (4) live-instance - migration (execution-state serialize/restore — DLR-FT parity, gale/gust - checkpoint-restart/failover; may be its own track); (5) cert-evidence parity - with the std interpreter. Corrects the record: REQ_FUNC_002 (baremetal) and - REQ_FUNC_033 (kilnd-nostd) are marked implemented, but RFC #46 routes - embedded through synth-AOT only and kiln-runtime is std-bound today — this - delivers the actual no_std interpreter. Amends RFC #46 (doc + BA sign-off). + Kiln's interpreter shall build and run in a no_std/no_alloc environment on + embedded targets (thumbv7em / gale / gust), so kiln can interpret + WebAssembly ON-BOARD alongside the synth-AOT native path — the alternative + for payloads where AOT is not wanted (dynamic/late-loaded, migrated, + untrusted, or smaller-TCB cert contexts) — matching the deployment model of + the safety-critical interpreter field (NASA spacewasm, DLR-FT, #413) while + carrying kiln's verification evidence (Verus / Lean / witness MC/DC / scry / + sigil). DEPLOYMENT: kiln (no_std/no_alloc) is compiled TO a wasm module that + synth AOT-compiles to native for the target — the same pipeline as user + code (wasm = universal IR, synth = single compiler, kiln-as-wasm itself + attestable). UNIQUE SCOPE: the on-board interpreter runs the FULL Component + Model (direct hosting, AD-COMPONENT-HOST-001) or plain core wasm — peers are + core-only; this extends AD-COMPONENT-HOST-001's direct-hosting from + QM/std-only to embedded. meld + synth (AOT hot path) are RETAINED. Phased: + (1) feasibility spike — compile a minimal kiln interpreter to wasm, synth-AOT + it to native, interpret a core module under no_std+alloc on thumbv7em with + fuel + bounded memory intact; measure size + perf vs a direct no_std-Rust + build and vs the peers (go/no-go gate, incl. does synth accept a module this + large); (2) port sync primitives (~90 Mutex/RwLock/thread → kiln-sync) and + collections (std → alloc/bounded) behind the std-feature boundary; (3) host/ + WASI imports via the kiln-builtins platform-callback surface + a GALE OS + requirement for runtime wasm loading (dynamic module/component load) and for + running the synth-compiled kiln image; (4) Component-Model-on-embedded (bring + the direct-hosting path no_std); (5) live-instance migration (state serialize/ + restore — DLR-FT parity, gale/gust checkpoint-restart/failover; own track); + (6) cert-evidence parity with the std interpreter. Corrects the record: + REQ_FUNC_002 (baremetal) and REQ_FUNC_033 (kilnd-nostd) are marked + implemented, but RFC #46 routes embedded through synth-AOT only and + kiln-runtime is std-bound today — this delivers the actual no_std interpreter. + Amends RFC #46 (doc + BA sign-off). status: proposed release: v0.6.0 tags: [interpreter, no-std, embedded, migration, rfc46-amendment, roadmap, direction] From 304575bef6485b1a9221be0fe9b58a2c3301b4ef Mon Sep 17 00:00:00 2001 From: Ralf Anton Beier Date: Sat, 11 Jul 2026 08:34:31 +0200 Subject: [PATCH 3/4] =?UTF-8?q?docs(rivet):=20no=5Fstd=20direction=20?= =?UTF-8?q?=E2=80=94=20async=20precedent=20+=20tiered=20TCB=20+=20cross-li?= =?UTF-8?q?nk=20gust/gale?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - PRECEDENT (de-risk): kiln-async already proves the no_std/no_alloc embedded path (forbid-unsafe, thumbv7em staticlib, linked into gale, v0.3.2). The interpreter port follows an established pattern; the direct no_std-Rust build is the PROVEN baseline (low-regret). Only kiln-as-wasm->synth is spike-gated. - TIERED TCB (resolves the interpreter-vs-compiler-TCB tension): core-only minimal interpreter (small TCB, competes with peers) + opt-in Component-Model layer (differentiator). Chosen per deployment. - CROSS-REPO: added gust (gale-gust) + loom to rivet externals + synced. Discovered gust already tracks the toolchain-in-TCB trust argument (= my open-question #3) and a phase-2 kiln integration (STKH-002/SYSREQ-KILN-002/SWREQ-KILN-003); gale's north-star is CM-on-kiln/gust bare-metal via kiln-async. kiln-as-wasm->synth is philosophically identical to gust's kernel-as-dissolved-wasm. REQ_NOSTD_INTERP now depends-on gust:SYSREQ-KILN-002. The genuinely-new gust ask = RUNTIME wasm loading (interpreter path), coordinated via a gust gh issue. Trace: AD-NOSTD-INTERP-001 --- .gitignore | 3 ++ rivet.yaml | 12 +++++++ .../requirements/architecture-decisions.yaml | 36 ++++++++++++++----- safety/requirements/roadmap-requirements.yaml | 17 +++++++++ 4 files changed, 59 insertions(+), 9 deletions(-) diff --git a/.gitignore b/.gitignore index 2a79f827..e17e9e39 100644 --- a/.gitignore +++ b/.gitignore @@ -61,3 +61,6 @@ MODULE.bazel.lock /simple.wat /minimal.wat /file_ops_component.wat + +# Rivet external project cache +.rivet/repos/ diff --git a/rivet.yaml b/rivet.yaml index 2d271d24..0a28371a 100644 --- a/rivet.yaml +++ b/rivet.yaml @@ -74,6 +74,18 @@ externals: ref: main prefix: gale + gust: + git: https://github.com/pulseengine/gale-gust.git + path: /Volumes/Home/git/pulseengine/gale-gust + ref: main + prefix: gust + + loom: + git: https://github.com/pulseengine/loom.git + path: /Volumes/Home/git/pulseengine/loom + ref: main + prefix: loom + sigil: git: https://github.com/pulseengine/sigil.git path: /Volumes/Home/git/pulseengine/sigil diff --git a/safety/requirements/architecture-decisions.yaml b/safety/requirements/architecture-decisions.yaml index 4edb0db3..51d0ce50 100644 --- a/safety/requirements/architecture-decisions.yaml +++ b/safety/requirements/architecture-decisions.yaml @@ -92,6 +92,14 @@ artifacts: from QM/std-reference-only to the embedded target, so embedded gets a runtime-Component-Model option alongside meld-dissolve-to-core. meld (build-time lowering) and synth (AOT hot path) are retained. + TIERED TCB (resolves the interpreter-vs-compiler-TCB tension): ship two + tiers, not one monolith — (i) a CORE-ONLY minimal interpreter with a small + auditable TCB that competes with spacewasm/DLR-FT on their own terms (and + beats them on verification evidence), and (ii) an OPT-IN Component-Model + layer (the differentiator, ~31k LOC) enabled only where the TCB budget and + cert context allow. This keeps the "smaller TCB than a compiler" claim and + the "Component Model on-board" claim from fighting each other — chosen per + deployment. status: proposed tags: [architecture, embedded, no-std, interpreter, deployment, rfc46-amendment] links: @@ -126,16 +134,26 @@ artifacts: (dynamic module/component load, since on-board interpretation means loading payloads at runtime, not just at build). File a gale-side requirement + confirm the loader/OS-service surface before Phase 3. + precedent: > + The no_std/no_alloc embedded deployment is NOT speculative — kiln-async + (REQ_ASYNC_SCHED) already proves it: it is no_std/no_alloc, forbid(unsafe), + and ships as a thumbv7em-none-eabi staticlib linked into gale (v0.3.2). So + the interpreter's no_std port follows an ESTABLISHED pattern, and a direct + no_std-Rust→native staticlib for gale is the PROVEN baseline deployment + (what kiln-async does today) — making this direction low-regret. synth-AOT + of wasm modules is separately proven via the jess pipeline (adopt → + meld_fuse → synth_compile → renode/QEMU, async-scheduler-plan.md). open-questions: > - The kiln-as-wasm→synth deployment is elegant but unproven — the Phase-1 - feasibility spike must answer: (1) does synth accept and correctly AOT a - module as large/complex as the kiln interpreter; (2) interpreter-in-wasm - AOT'd-to-native performance vs a direct no_std-Rust→native build of kiln, - and vs the peers; (3) bootstrapping/toolchain-trust of compiling the - interpreter through the same pipeline it will later run. If wasm→synth - proves impractical, the fallback is a direct no_std-Rust build of - kiln-runtime for the target (the port work in REQ_NOSTD_INTERP is the same - either way; only the final codegen path differs). + Only the ELEGANT variant (kiln-as-wasm→synth, vs the proven direct + no_std-Rust build) is unproven — the Phase-1 spike must answer: (1) does + synth accept + correctly AOT a module as large/complex as the kiln + interpreter; (2) interpreter-in-wasm-AOT'd-to-native perf vs the direct + no_std-Rust build and vs the peers; (3) bootstrapping/toolchain-trust of + compiling the interpreter through the same pipeline it runs. Fallback if + wasm→synth is impractical: the direct no_std-Rust build (kiln-async's + proven path) — the port work in REQ_NOSTD_INTERP is identical either way; + only the final codegen differs. So the port is committed; only the codegen + path is spike-gated. upstream-ref: https://github.com/pulseengine/kiln/issues/415 - id: AD-CRATE-001 diff --git a/safety/requirements/roadmap-requirements.yaml b/safety/requirements/roadmap-requirements.yaml index b8532b4f..72dee11a 100644 --- a/safety/requirements/roadmap-requirements.yaml +++ b/safety/requirements/roadmap-requirements.yaml @@ -584,8 +584,25 @@ artifacts: links: - type: derives-from target: REQ_FUNC_002 + - type: depends-on + target: gust:SYSREQ-KILN-002 fields: upstream-ref: https://github.com/pulseengine/kiln/issues/415 + cross-repo: > + Aligns with existing sibling work (rivet externals synced): gust's whole + thesis is "kernel = verified wasm dissolved to native, TCB = ~4-fn shim", + and gust already tracks the wasm->native-toolchain-in-TCB trust argument + (my open-question #3 is gust's existing concern) and a phase-2 kiln + integration (gust:STKH-002 eliminate-C-FFI, gust:SYSREQ-KILN-002 + end-to-end verified compilation pipeline, gust:SWREQ-KILN-003 synth ARM + codegen). gale's north-star is "the dissolved CM composition runs on the + kiln/gust stack, kiln-async drives it bare metal" — confirming the + no_std/no_alloc embedded precedent. The kiln-as-wasm->synth idea is + PHILOSOPHICALLY IDENTICAL to gust's kernel-as-dissolved-wasm, so it fits + the existing architecture rather than fighting it. The genuinely-NEW ask + for gust is narrowly RUNTIME wasm loading (load a module/component + on-target at runtime for the interpreter path) — distinct from gust's + build-time dissolve — tracked as a gust gh issue for coordination. provenance: created-by: ai model: claude-opus-4-8 From 17ee224be13fc4b280601dc6ad5055169d07b350 Mon Sep 17 00:00:00 2001 From: Ralf Anton Beier Date: Sat, 11 Jul 2026 08:35:52 +0200 Subject: [PATCH 4/4] chore(rivet): correct gust external git URL (gust artifacts live in the gale repo) Trace: skip --- rivet.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/rivet.yaml b/rivet.yaml index 0a28371a..b177ce0d 100644 --- a/rivet.yaml +++ b/rivet.yaml @@ -75,7 +75,9 @@ externals: prefix: gale gust: - git: https://github.com/pulseengine/gale-gust.git + # gust artifacts live in the gale repo (gale-gust is a gale checkout); distinct + # prefix for the OS/gust artifact set. + git: https://github.com/pulseengine/gale.git path: /Volumes/Home/git/pulseengine/gale-gust ref: main prefix: gust