WASM Guard Runtime for Chio.

This crate allows operators to author guards in any language that compiles to WebAssembly (Rust, AssemblyScript, Go, C) and load them into the Chio kernel at runtime via chio.yaml configuration.

Dual-mode support

The host transparently supports two WASM formats:

• Core modules (raw ABI): traditional modules that export evaluate(ptr, len) -> i32. These are loaded through WasmtimeBackend with host-provided functions.
• Component Model components (WIT-based): modules compiled against the chio:guard@0.1.0 WIT interface. These are loaded through ComponentBackend with type-safe bindings generated by wasmtime::component::bindgen!.

Format detection happens automatically at load time via [detect_wasm_format]. The [create_backend] factory inspects binary magic bytes and routes to the correct backend. Callers do not need to know which format a .wasm file uses.

Core module ABI

Each core .wasm guard module exports a single function:

evaluate(request_ptr: i32, request_len: i32) -> i32

The host serializes the guard request as JSON into guest memory, calls evaluate, and interprets the return value:

• 0 = Allow
• 1 = Deny (guard-specific reason returned through shared memory)
• any negative value = error (fail-closed)

Fuel metering limits CPU consumption. When fuel runs out the guard is treated as denied (fail-closed).

Feature flags

• wasmtime-runtime: Enables the wasmtime-backed runtime. Without this feature only the trait-based abstractions are available, which is useful for testing or providing alternative backends.