Module adaptive_cheri_pointer 

AdaptiveCheriPointer<T> - CHERI-style capability pointer with software emulation for portability.

CHERI (Capability Hardware Enhanced RISC Instructions) augments every pointer with bounds, permissions, otype, and a sealed bit, enforced by hardware on every dereference. ARM Morello is the production silicon as of 2026; iOS may adopt the model.

CHERI is by design a RISC instruction-set extension. There is no equivalent capability ISA on x86 / x86_64. The x86-side equivalent is a Register-Aligned SIMD Pointer primitive: vector instructions express bounds + permission checks rather than emulating capability hardware that does not exist on the silicon.

Read vs Write: distinct types

This module separates capability semantics at the type level rather than the runtime permission-bit level:

• ReadableCapability<T> - bounds-checked read-only view of T. Constructed from &[T] borrow. Compile-time guarantee: no write() method exists. Permissions silently strip the Write bit at construction (a ReadableCapability with Write perm is nonsensical).

• WritableCapability<T> - bounds-checked read+write access to T. Constructed from &mut [T] borrow (or owned Box<T>). !Copy + !Clone so the borrow checker prevents aliasing the unique-writer status.

• OwnedReadableCapability<T> / OwnedWritableCapability<T> - RAII wrappers that own a Box<T> and reclaim it on Drop. Use these when you want capability semantics over an owned value without manual Box::from_raw cleanup.

Constructor matrix

Type	Safe constructor	Unsafe constructor
ReadableCapability	from_slice	new (raw ptr)
WritableCapability	from_slice_mut	new (raw ptr)
OwnedReadableCapability	new(value), from_box	-
OwnedWritableCapability	new(value), from_box	-

Backend

Bounds and permissions are checked in software on every target. The crate has no hardware CHERI backend and uses no Morello capability instructions.

Safety contract

All bounds arithmetic uses checked_add so a near-overflow base + length cannot wrap and bypass the check.

Adjacent capability-like hardware features on non-x86 silicon: ARM PAC (Pointer Authentication Codes), Apple Silicon MTE (Memory Tagging Extension), SPARC ADI (Application Data Integrity).

Structs

OwnedReadableCapability

RAII wrapper around a ReadableCapability<T> that owns the underlying Box<T> allocation and reclaims it on Drop.

OwnedWritableCapability

RAII wrapper around a WritableCapability<T> that owns the underlying Box<T> allocation and reclaims it on Drop.

ReadableCapability

Read-only bounds-checked capability. The Write permission bit is silently stripped at construction; no write() method exists.

WritableCapability

Read+Write bounds-checked capability. Not Copy/Clone so the borrow checker prevents aliasing the unique-writer status.

Enums

CapabilityError

CapabilityPermission

Permission bits. Same shape across both Readable and Writable capabilities so narrow() can reason about them uniformly.