Module adaptive_cheri_pointer 

AdaptiveCheriPointer<T> - CHERI-style capability pointer with software emulation for portability.

CHERI (Capability Hardware Enhanced RISC Instructions) augments every pointer with bounds, permissions, otype, and a sealed bit, enforced by hardware on every dereference. ARM Morello is the production silicon as of 2026; iOS may adopt the model.

CHERI is by design a RISC instruction-set extension. There is no equivalent capability ISA on x86 / x86_64. The x86-side equivalent is a Register-Aligned SIMD Pointer primitive: vector instructions express bounds + permission checks rather than emulating capability hardware that does not exist on the silicon.

Read vs Write: distinct types

This module separates capability semantics at the TYPE level rather than the runtime permission-bit level:

• ReadableCapability<T> - bounds-checked read-only view of T. Constructed from &[T] borrow. Compile-time guarantee: no write() method exists. Permissions silently strip the Write bit at construction (a ReadableCapability with Write perm is nonsensical).

• WritableCapability<T> - bounds-checked read+write access to T. Constructed from &mut [T] borrow (or owned Box<T>). !Copy + !Clone so the borrow checker prevents aliasing the unique-writer status.

• OwnedReadableCapability<T> / OwnedWritableCapability<T> - RAII wrappers that own a Box<T> and reclaim it on Drop. Use these when you want capability semantics over an owned value without manual Box::from_raw cleanup.

Constructor matrix

Type	Safe constructor	Unsafe constructor
ReadableCapability	from_slice	new (raw ptr)
WritableCapability	from_slice_mut	new (raw ptr)
OwnedReadableCapability	new(value), from_box	-
OwnedWritableCapability	new(value), from_box	-

Hardware backend

The hardware-capability backend (real CHERI primitives on ARM Morello, gated on target_arch = aarch64 + a cheri feature flag) is tracked by its own bead and uses the same ReadableCapability / WritableCapability surface so callers don’t need to change code when the hardware path lands.

Instruction-set emulation paths

The hardware backend can be developed and benched today without Morello silicon using QEMU-Morello + CHERI-LLVM toolchain, or CheriBSD images, or the Cheriot-RTOS RISC-V FPGA implementation.

Safety contract

All bounds arithmetic uses checked_add so a near-overflow base + length cannot wrap and bypass the check.

Adjacent capability-like hardware features on non-x86 silicon: ARM PAC (Pointer Authentication Codes), Apple Silicon MTE (Memory Tagging Extension), SPARC ADI (Application Data Integrity).

Structs

OwnedReadableCapability

RAII wrapper around a ReadableCapability<T> that owns the underlying Box<T> allocation and reclaims it on Drop.

OwnedWritableCapability

RAII wrapper around a WritableCapability<T> that owns the underlying Box<T> allocation and reclaims it on Drop.

ReadableCapability

Read-only bounds-checked capability. The Write permission bit is silently stripped at construction; no write() method exists.

WritableCapability

Read+Write bounds-checked capability. NOT Copy/Clone so the borrow checker prevents aliasing the unique-writer status.

Enums

CapabilityError

CapabilityPermission

Permission bits. Same shape across both Readable and Writable capabilities so narrow() can reason about them uniformly.