The Boundaries That Make It Usable
Obscura is a browser engine that may execute arbitrary page JavaScript, reach external networks, retain credentials, and expose a live control plane. The question here is how its boundaries contain the resulting failure modes without pretending to be a complete sandbox. The useful judgment is to separate engine controls—deadlines, watchdogs, network gates, bounded allocations, and identity policy—from responsibilities that still belong to deployment and operations.
A single page can fail in several ways. It can run JavaScript that never yields, keep scheduling work, request a body too large to retain, redirect through too many hops, or cause queues and capture surfaces to grow. It can also point the browser at an internal address, mix credentials across contexts, expose an unauthenticated MCP endpoint, or present a browser identity that does not match its network transport. Treating all of these as “the page timed out” hides the cause and leads to the wrong remedy.
Availability failures need different controls
The most important distinction is between asynchronous waiting and synchronous execution. A normal async timeout can stop awaiting a network request or event-loop future when control returns to the runtime. It cannot preempt JavaScript that is executing a tight loop on the V8 thread and never reaches an await point. Obscura uses a V8 termination watchdog for that case: a separate thread can terminate the isolate when the synchronous budget expires, after which the runtime clears the termination state before reuse.
This is a hard availability backstop, not a statement that the page is harmless. A page that burns the budget may leave partial DOM state, and a caller must not interpret that state as proof that the application completed. The right outcome may be to discard the result, record a partial failure, or retry with a workload-specific policy. The watchdog’s job is to return control and protect the rest of the service from one unyielding operation.
Other page behaviors require other boundaries. A microtask storm can keep cooperative event-loop turns ready without a single obvious long network request. An endless timer or animation can prevent naive “wait until idle” logic from returning. A large response can exhaust memory even if the page is otherwise responsive. A navigation chain can consume time through repeated redirects. A CDP client that stops reading can cause deferred messages or WebSocket handoffs to accumulate. A full-page screenshot can request a surface whose dimensions make rasterization itself the failure.
Obscura addresses these as separate resource problems. Event-loop pumps have absolute budgets and quiescence policies. Navigation and script phases have deadlines. Heap-limit handling can terminate and recover the isolate. Response bodies are read under size limits. Navigation chains, live frames, deferred messages, pending handoffs, connections, and render captures have caps. The controls overlap, but they are not redundant: time, heap, retained bytes, surface pixels, and connection capacity fail at different points.