Build it in edda
WebAssembly
WebAssembly's promise is a module that can only touch what its host hands it. That is not a porting target for edda — it is the capability model the language already enforces, compiled to a sandbox that agrees with it.
Two sandboxes, one story
WASI grants a module file descriptors and nothing more; edda grants a function capabilities and nothing more. An edda module's imports are exactly its main parameters, so what the host must provide is readable off one signature — and what the module can never do is readable off the same line.
What the language gives a module
Per-target code, checked
Capability availability is locked per target — subprocesses do not exist on wasm — and the comptime target branch elides unsupported code before typecheck. One source tree, no #ifdef soup.
No runtime to ship
Concrete monomorphised codegen, no reflection, no garbage collector: the module carries your code and the allocator you passed it, nothing else.
Contracts cross the boundary
A host embedding a verified module gets more than a sandbox: the module's refinement contracts were discharged at build time, so its behavior is bounded even on inputs the host never tested.