External review — validation & disposition¶
A commissioned external review of afmpeg + ffmpeg-wasi (AI-assisted, dated 2026-07-01). The raw
reports are preserved here verbatim; this index records what we validated against the code and
where each finding went. Every finding was checked against ffmpeg-wasi/src/process.c +
afmpeg/pkg/afmpeg/runtime.go.
Reports¶
ARCHITECTURE_REVIEW.md— the consolidated report (perf + security + parity + the dual-backend proposal).feature_parity_review.md/_supplementary.md— feature gaps vs native FFmpeg.performance_review.md/_supplementary.md— perf characteristics + code-level bottlenecks.security_review.md/_supplementary.md— sandbox posture + hardening gaps.
Disposition¶
Already covered by our own roadmap (validated as real, no new spec — the review corroborates specs we'd already drafted):
| Finding | Verdict | Spec |
|---|---|---|
Stream copy (-c copy) missing — always re-encodes |
✅ confirmed | 0013 |
| Subtitles / data / attachments ignored (video+audio only) | ✅ confirmed | 0019 |
Seeking / trimming (-ss/-t/-to) missing |
✅ confirmed | 0014 |
| Metadata / chapters stripped | ✅ confirmed | 0020 |
Muxer options (-movflags) / forced output format (-f) |
✅ confirmed | 0015 |
Input -map stream selection (partial) |
✅ confirmed | 0013 + 0024 |
| Codec availability (small curated set) | ✅ confirmed | 0016 / 0018 |
| No hardware acceleration (WASM) | ✅ confirmed — non-goal | 0012 §2; reconsidered by 0028 |
| Single-thread / no SIMD | ✅ confirmed — non-goal | 0012 §2 / 0008 |
New valid findings — a PROPOSED spec each (for the include/decline discussion):
| Finding | Code evidence | Spec |
|---|---|---|
inputs[].options inert + no forced/raw input format |
avformat_open_input(…, NULL, NULL); afmpeg Input has only Path |
0024 |
No A/V-sync / frame-rate mode (VFR drift) — low severity (the fps filter mitigates) |
pull_sinks forwards buffersink PTS as-is |
0025 |
Hot-path inefficiency: per-packet AVFrame alloc, round-robin demux, 32 KB AVIO buffer |
pull_sinks alloc/free per packet; round-robin read loop; default AVIO |
0026 |
| Runtime hardening: no wazero memory limit (OOM), no hard timeout, cJSON guards | runtime.go New() lacks WithMemoryLimitPages; Run holds mu sans deadline |
0027 |
| Native backend for HW-accel (proposal: subprocess via HTTP bridge) | feasibility spike-validated; refined into our-own native driver (MUST) + deferred local-HTTP (MAY) | 0028 |
Notable corrections we made to the review:
- The dual-backend proposal (0028) revives R-AF-11, which we dropped in
0006 §2C — but the review's subprocess+HTTP approach
avoids the CGO objection that killed it, so it is genuinely re-openable. It is in real tension
with afmpeg's sandbox thesis; 0028 lays that out.
- A/V-sync (0025) is lower severity than a naive read suggests — the enabled fps filter
already lets a caller force CFR in-graph today.
- The memory-limit gap (0027) is the highest-priority new item: it directly undercuts the
"safely process untrusted media" value proposition.
The five PROPOSED specs are design-only and await an include/decline decision per item.