DEV Community

Cover image for Rotifer v0.5.5-v0.6: Sandbox, Registry & Cold Start
Rotifer Protocol
Rotifer Protocol

Posted on • Edited on • Originally published at rotifer.dev

Rotifer v0.5.5-v0.6: Sandbox, Registry & Cold Start

#ai #webassembly #security #opensource

Two releases in one day. v0.5.5 makes the WASM sandbox real — genes that were only validated now actually execute in wasmtime with fuel metering. v0.6 turns the website into a live gene registry with detail pages, developer profiles, and 51 genes ready at launch.

v0.5.5: The Sandbox Gets Real

Why Now?

Until v0.5.5, gene execution had a gap: the CLI validated phenotypes and computed fitness scores, but the actual WASM execution was simulated. Genes were evaluated but not truly sandboxed. This was acceptable during early development when we needed to iterate on the type system and algebra engine quickly. But with the cloud registry live (v0.4) and developers publishing genes that others would download and run, simulated execution was no longer sufficient. Real sandboxing became a security prerequisite.

L0 Kernel Gate

Every gene execution now passes through an L0 Gate check before it runs:

  • Domain whitelist validation
  • Resource limit enforcement
  • Network and filesystem access control
  • Append-only audit trail (.rotifer/audit.jsonl) 
rotifer l0-check my-gene  # dry-run L0 gate without executing
Enter fullscreen mode Exit fullscreen mode

WASM Sandbox Execution

Compiled genes now execute through the real wasmtime sandbox instead of Node.js evaluation:

rotifer test my-gene          # prefers WASM sandbox; Node.js fallback for uncompiled
rotifer agent run my-agent    # WASM sandbox by default
rotifer agent run --no-sandbox  # explicit Node.js fallback
rotifer arena submit my-gene  # real F(g) metrics from sandbox
Enter fullscreen mode Exit fullscreen mode

Each execution returns fuel_consumed, memory_peak_kb, and duration_ms — real resource metrics, not estimates.

AlgebraExecutor Integration

The Rust five-operator algebra engine is now exposed to the CLI via NAPI:

rotifer agent create --composition Seq   # sequential pipeline
rotifer agent create --composition Par --par-merge merge  # parallel with merge
Enter fullscreen mode Exit fullscreen mode

F(g) Fitness Formula v2

The fitness score F(g) formula switched from additive to multiplicative:

Old (additive average):

$$
F_{old}(g) = \frac{\text{success_rate} + \text{latency_score} + \text{resource_efficiency}}{3}
$$

New (multiplicative):

$$
F(g) = \frac{S_r \cdot \ln(1 + C_{util}) \cdot (1 + R_{rob})}{L \cdot R_{cost}}
$$

Any single zero-valued factor drives the entire score to zero — no mutual compensation. A gene that's fast but incorrect gets F(g) = 0, not F(g) = 0.33.

Why Multiplicative?

The additive model had a fundamental flaw: it allowed good performance in one dimension to mask failure in another. A gene with 0% success rate but excellent speed and efficiency would still score 0.33 — high enough to rank above genes that actually work but are slightly slow. The multiplicative model enforces a simple principle: you must be competent in every dimension to survive. This mirrors biological natural selection, where a fast animal that can't eat still starves.

Compliance Testing 

rotifer test --compliance  # runs 6 structural checks
Enter fullscreen mode Exit fullscreen mode

C1: Sandbox execution · C2: Fuel consumption · C3: L0Gate pass · C4: Phenotype completeness · C5: F(g) computability · C6: IR segment integrity.

v0.6: The Registry Goes Live

Gene Detail Pages

Every gene now has a dedicated page at /genes/[name]/ with:

  • README rendering (Markdown → HTML via marked)
  • Phenotype schema display (inputSchema / outputSchema)
  • Stats: version, gene reputation score R(g), downloads, WASM size, dates
  • One-click install command copy

Developer Profile Pages

Every developer has a page at /developers/[user]/ showing developer score R(d), stats, and published gene list.

Gene Registry Upgrade

The /genes/ listing page now fetches from the Cloud API with:

  • Client-side fuzzy search (name + description)
  • Domain and fidelity filters
  • Sort by newest / reputation / downloads
  • Fallback to static genes.json if Cloud API is unavailable

5 Native Showcase Genes

Gene Domain Function
text-summarizer text.summarize Extractive text summarization
json-validator data.validate JSON Schema validation with error paths
markdown-formatter text.format Markdown formatting normalization
code-complexity code.analyze Cyclomatic complexity analysis
url-extractor text.extract URL extraction and categorization

Gene Cold Start: The 51

The registry launches with 51 genes: 40 Skill Import + 5 Genesis + 5 Native showcase + 1 test gene.

The 40 Skill Import genes were curated from a larger pool of candidates. The selection criteria: each gene must have a distinct domain that doesn't overlap with existing genes, a clear and specific use case (no vague "general assistant" skills), and instructions that produce measurably different outputs when compared against alternatives. Genes that were too similar to existing entries, too broad in scope, or too dependent on specific external services were excluded.

By the Numbers

  • 165 → 188 TS tests; 224 Rust tests
  • All new pages available in English and Chinese

Get Started 

npm install -g @rotifer/playground
Enter fullscreen mode Exit fullscreen mode

Looking Ahead

v0.5.5 and v0.6 together completed the transition from development tool to production ecosystem. Real sandboxing meant genes could be trusted. The multiplicative fitness formula meant rankings reflected genuine capability. And the live registry with 51 genes meant developers had something worth browsing on day one.

Top comments (0)