# Platform hardening

SandboxedJs is a virtual OS runtime for browser clients and Node hosts. It is
not a recording application. Continue developing its own JavaScript module
engine, virtual kernel, filesystem, network and CPython WebAssembly integration;
do not replace them with Nodepod or Pyodide.

## Release gates

Completion requires evidence in both a real browser and a supported Node host.
A successful bundle alone does not establish browser runtime compatibility.

1. Runtime lifecycle: repeated boot, cancellation, child-process termination,
   disposal and startup failure leave no workers, timers, sockets or mounts.
2. Isolation: concurrent guests cannot observe each other's environment or
   filesystem. Worker execution and realm fallback must be tested separately.
3. Package workloads: install, run, edit and rebuild representative frontend
   and API projects. Test actual package imports rather than lookalike APIs.
4. Python: test dotenv loading, imports, subprocesses, HTTP servers and async
   I/O in the shipped interpreter. Resolve extension setup timeouts before
   claiming the complete Python suite passes.
5. Performance: measure cold and warm boot, installation, module loading,
   rebuild latency, memory after disposal and large console output. Record
   runtime version, host, workload and repetitions with each result.
6. Distribution: verify published ESM, CommonJS, worker and static browser
   assets, including missing assets and unsupported host features.

## Current findings

- Corrected environment support to expose `util.parseEnv`; the previous
  `process.parseEnv` addition did not match native Node. Added
  `process.loadEnvFile` and native-Node differential parser fixtures.
- Typed-array inspection now reads at most 100 entries instead of copying the
  entire array. DataView logging no longer attempts to iterate a non-iterable.
- The full test run was interrupted after Python extension setup timed out.
  Follow-up isolated EPERM on the test's loopback listener and fixed missing
  setup error handling. All 12 extension tests passed when loopback listening
  was permitted. This is still not a full release pass.
- Several Node modules still have stubs: cluster, dgram, diagnostics_channel,
  domain, http2, inspector, tls, v8, vm and worker_threads. Implement and test
  usable APIs before marking those modules supported.
- The Python thread/syscall limitation documented in
  browser-runtime-architecture.md needs interpreter-image work.
- Browser CORS, static asset hosting, cross-origin isolation requirements,
  native addons and platform-specific binaries remain constraints. Arbitrary
  packages cannot be promised to run solely from this JavaScript runtime.

The platform objective remains open. These gates are an implementation and
verification backlog, not a claim of complete Node, Python or Linux parity.