Volume 17, Number 4
Trust Without Exposure: Verifiable Observability with Capability-Native Webassembly at the Edge
Authors
Bala Subramanyan, Verifoxx, UK
Abstract
In modern data ecosystems, where edge autonomy, privacy, and verifiability are essential, enablingtrustworthy observability without compromising data control remains a significant challenge. This paper presents cWAMR, a capability-native WebAssembly runtime adapted for the CHERI (CapabilityHardware Enhanced RISC Instructions) architecture, enabling fine-grained, hardware-enforcedcompartmentalization of untrusted code. We demonstrate how cWAMR enables the construction of Verifiable Observability Pipelines (VoP)—modular, staged execution flows deployed across edge environments. Each pipeline stage is implementedas an isolated WebAssembly module running in a CHERI-sealed cWAMR compartment, with capability- based delegation enforcing tamper-evident data flow and memory safety without shared linear memory or enclave-based trust models. Deployed and validated on the Arm Morello platform under the UK DSbD initiative, cWAMR supports bothinterpreted and ahead-of-time WebAssembly execution, integrated with CHERI-aware systeminterfaces (cWASI). The result is a lightweight, privacy-aligned foundation for building observable, compliant edgepipelines—enabling cryptographically anchored provenance and lifecycle assurance without clouddependency or centralised attestation infrastructure.
Keywords
WebAssembly, CHERI, Capability-Based Security, Verifiable Observability, Memory Safety, DataProvenance, Privacy Preserving Pipelines, Data as a Product (DaaP)