Hardware-as-a-Service
Validate a capability-limited .wasm module, simulate behavior for free, then run it inside a trusted ESP32-S3 sandbox. Public hardware runs open after runtime provisioning and adversarial testing.
System architecture
Jobs are coordinated in the cloud, while the device agent keeps the physical board behind the lab boundary.
Dashboard and API client
Requests · live output
Control plane hosted on Fly.io
Auth · validation · queue
Postgres
Users · jobs · logs
Object storage
R2 · local fallback
Python service inside the homelab
Outbound polling · isolation
Restricted physical execution target
Sandbox runtime · serial logs
Submit a WebAssembly module with a 128 KiB file and linear-memory ceiling. Native firmware remains administrator-only.
curl -F [email protected] \ -H "Authorization: Bearer $PAT" \ https://haas-lab.com/api/v1/sandbox/validate
The validator rejects WASI, arbitrary native imports, unbounded memory, and modules without the required entrypoint.
allowed: log, time, scoped GPIO, scoped storage denied: MMIO, raw system flash, unrestricted network
After provisioning completes, the agent will load the module into a persistent ESP32-S3 runtime instead of flashing user-native code.
module.wasm -> signed trusted runtime -> per-job storage reset -> bounded execution
The validation endpoint works in CI today. Hardware queue integration remains closed until the trusted runtime is provisioned.
# Validate a restricted module curl -X POST \ -H "Authorization: Bearer $PAT" \ -F [email protected] \ https://haas-lab.com/api/v1/sandbox/validate
import requests
with open("app.wasm", "rb") as module:
result = requests.post(
"https://haas-lab.com/api/v1/sandbox/validate",
headers={"Authorization": "Bearer pat_..."},
files={"module": module},
)
print(result.json())Skip the dev board, USB cables, and driver nightmares. We own the hardware; you own the firmware.
User modules cannot directly reach MMIO, system flash, or sockets. The trusted runtime mediates every hardware capability.
One curl command in your GitHub Actions workflow. Get serial output as a build artifact, fail the build on assertion errors.
Sign in with Google or GitHub. Public hardware execution is not open yet.