# TinyRustLM Architecture

> The current authority boundaries for Rust, WebAssembly, browser UI, companion operations, and evidence.

- Site: TinyRustLM
- Canonical: https://TinyRustLM.mirust.com/architecture/
- Version: 1.8.0
- Updated UTC: 2026-08-28T20:20:00Z

## Rust authority

Rust owns hostile-safe parsing, model and tensor semantics, Tokenizer2, Template2, Prompt2, Sampling2, inference mathematics, conversion, independent inspection boundaries, and direct-piece admission. The same semantic authority is compiled for native and WebAssembly execution.

- Checked bounded parsing
- Independent artifact inspection
- Typed errors
- No permissive repair

## Browser authority

The browser presents the conversation workspace and transports bounded typed commands and events. A dedicated worker owns model and KV state. Cancellation stops actual work; a terminated or poisoned worker is replaced and reopens immutable verified bytes before another generation.

- Dedicated worker ownership
- Exactly-once rendering identity
- Real cancellation
- Fresh-worker verification

## Companion boundary

An installed local companion may perform explicit acquisition, conversion, verification, and storage operations through a narrow authenticated origin-bound API. It does not accept arbitrary commands, paths, or unrestricted URLs from a page.

- Origin-bound session
- Least privilege
- Explicit user presence
- No text-file handoff as acquisition