Module wasm_policy 

WebAssembly policy modules via wasmtime (brief §8 sandboxing engine).

ABI (documented for policy authors):

• export memory (linear memory) and alloc(len: i32) -> ptr: i32;
• export evaluate(ptr: i32, len: i32) -> code: i32;
• the host writes the UTF-8 JSON {"tool": …, "arguments": …} at ptr;
• return 0 to allow, any other code to deny.

Containment: every evaluation runs in a fresh Store with a fuel budget and a linear-memory cap. Traps, missing exports, fuel exhaustion, and memory overruns all fail closed (deny) — a hostile or buggy policy can neither hang the pipeline nor allow by accident.

Structs

WasmPolicy

A compiled WASM policy.