SBF: a checked host boundary for child calls

SBF: a checked host boundary for child calls A sequence diagram generated by Archify. suspend + request decode ABI + caller scope PDA + privilege decision authorized child call result + staged images validate images + aliases accept child effects transaction-local view refresh memory + resume Parent SBF · GPU execution lane · Sequence participant Parent SBF GPU execution lane Typed host · sequence-bound dispatch · Sequence participant Typed host sequence-bound dispatch CPI policy · scope + privileges · Sequence participant CPI policy scope + privileges Child program · native or recursive GPU · Sequence participant Child program native or recursive GPU Journal · transaction-local effects · Sequence participant Journal transaction-local effects

A child receives bounded authority

  • • PDA signers derive from the caller. Account scope, writable privileges and aliases are checked before child effects reach the transaction journal.

Guest failure and engine failure differ

  • • A catchable child error rolls back its effects. An engine defect halts execution. Neither a native nor a GPU child commits directly to QMDB.