SpaceWASM support

.mise/config.coverage.toml

@@ -43,7 +43,7 @@ version = "0.9.1"
 # only be asserted where that path runs. A crate belongs to exactly one list: naming it in both would let a
 # gap in one pipeline be answered by the other.
 native_cov_libs = """
-{{ "actix-web-config edge-toolkit et-otlp path sanitise test-helpers " ~
+{{ "actix-web-config core-guest edge-toolkit et-otlp math1 path sanitise test-helpers " ~
   "test-nats test-otlp test-recovery ws-runner-common" -}}
 """
 wasm_cov_libs = "wasi-guest web"

.mise/config.mingw.toml

@@ -34,13 +34,13 @@ version = "16.1.0posix-14.0.0-msvcrt-r3"
 [[tools.rust]]
 components = "clippy,rust-analyzer"
 profile = "minimal"
-targets = "wasm32-unknown-unknown,wasm32-wasip2,x86_64-pc-windows-gnu"
+targets = "wasm32-unknown-unknown,wasm32-wasip2,wasm32v1-none,x86_64-pc-windows-gnu"
 version = "stable-x86_64-pc-windows-gnullvm"
 
 [[tools.rust]]
 components = "rust-src,rustfmt"
 profile = "minimal"
-targets = "wasm32-unknown-unknown,wasm32-wasip2,x86_64-pc-windows-gnu"
+targets = "wasm32-unknown-unknown,wasm32-wasip2,wasm32v1-none,x86_64-pc-windows-gnu"
 version = "{{ vars.rust_nightly }}-x86_64-pc-windows-gnullvm"
 
 [vars]

.mise/config.msvc.toml

@@ -19,13 +19,13 @@
 [[tools.rust]]
 components = "clippy,rust-analyzer"
 profile = "minimal"
-targets = "wasm32-unknown-unknown,wasm32-wasip2,x86_64-pc-windows-msvc"
+targets = "wasm32-unknown-unknown,wasm32-wasip2,wasm32v1-none,x86_64-pc-windows-msvc"
 version = "stable-x86_64-pc-windows-gnullvm"
 
 [[tools.rust]]
 components = "rust-src,rustfmt"
 profile = "minimal"
-targets = "wasm32-unknown-unknown,wasm32-wasip2,x86_64-pc-windows-msvc"
+targets = "wasm32-unknown-unknown,wasm32-wasip2,wasm32v1-none,x86_64-pc-windows-msvc"
 version = "{{ vars.rust_nightly }}-x86_64-pc-windows-gnullvm"
 
 [vars]

.mise/config.rust.toml

@@ -106,7 +106,9 @@ shell = "{{ vars.task_shell }}"
 description = "Build the no_std crates for a bare-metal target"
 run = """
 features=et-modules-service/board,et-storage-service/board,et-ws-service/board,et-ws-wasi-runner/board
+features="$features,et-ws-wasi-runner/core-modules"
 set -- -p et-org -p edge-toolkit -p et-modules-service -p et-storage-service -p et-ws-service -p et-ws-wasi-runner
+set -- "$@" -p et-core-guest -p et-math1
 cargo build --lib --target thumbv8m.main-none-eabihf --no-default-features --features "$features" "$@"
 """
 shell = "{{ vars.task_shell }}"
@@ -245,6 +247,20 @@ coreutils cp "target/wasm32-wasip2/release/$wasm" "services/ws-modules/wasi-math
 """
 shell = "{{ vars.task_shell }}"
 
+[tasks.build-ws-core-math1-module]
+depends = ["build-et-cli"]
+description = "Build the Rust core math1 module as a Wasm 1.0 core module, for SpaceWasm"
+# Built for wasm32v1-none, whose prebuilt core and alloc are already the Wasm 1.0 that SpaceWasm runs.
+# So the module needs no lowering pass. It is not built for coverage: SpaceWasm hosts no file to dump a profile to.
+run = """
+cargo build --release -p et-ws-core-math1 --target wasm32v1-none
+coreutils mkdir -p services/ws-modules/core-math1/pkg
+wasm=et_ws_core_math1.wasm
+coreutils cp "target/wasm32v1-none/release/$wasm" "services/ws-modules/core-math1/pkg/$wasm"
+{{ vars.et_cli }} module-package-json --module-dir services/ws-modules/core-math1
+"""
+shell = "{{ vars.task_shell }}"
+
 [tasks.build-ws-wasi-math1-sender-module]
 depends = ["build-et-cli"]
 description = "Build the Rust WASI math1-sender module as a WASI Preview 2 component"

.mise/config.toml

@@ -230,7 +230,7 @@ zizmor = "latest"
 components = "clippy,rust-analyzer"
 os = ["linux", "macos"]
 profile = "minimal"
-targets = "riscv32imac-unknown-none-elf,thumbv8m.main-none-eabihf,wasm32-unknown-unknown,wasm32-wasip2"
+targets = "riscv32imac-unknown-none-elf,thumbv8m.main-none-eabihf,wasm32-unknown-unknown,wasm32-wasip2,wasm32v1-none"
 # Use `stable`, not `latest`, so every lane resolves through the same rustup channel.
 # mise's `latest` picks the max of rust-lang/rust's GitHub Releases, which are published by separate
 # automation that lags the `stable` rustup channel the Windows [[tools.rust]] entries resolve through. That
@@ -244,7 +244,7 @@ version = "stable"
 components = "rust-src,rustfmt,llvm-tools"
 os = ["linux", "macos"]
 profile = "minimal"
-targets = "wasm32-unknown-unknown,wasm32-wasip2"
+targets = "wasm32-unknown-unknown,wasm32-wasip2,wasm32v1-none"
 version = "{{ vars.rust_nightly }}"
 
 # The macos/x64 half of vector (see the aqua:vectordotdev/vector note above).
@@ -1263,12 +1263,19 @@ meta="$(cargo metadata --format-version 1 --no-deps)"
 pick='.packages[] | select(any(.dependencies[].name; . as $dep | any($names[]; . == $dep))) | "-p", .name'
 browser="$(printf '%s' "$meta" | jaq -r --argjson names '["wasm-bindgen"]' "$pick")"
 wasi="$(printf '%s' "$meta" | jaq -r --argjson names '["wit-bindgen", "et-wasi-guest"]' "$pick")"
+# The Wasm 1.0 guests, picked by the target their docs build for, as depending on et-core-guest picks the runner too.
+# shellcheck disable=SC2016
+core_pick='.packages[] | select(.metadata.docs.rs."default-target" == "wasm32v1-none") | "-p", .name'
+core="$(printf '%s' "$meta" | jaq -r "$core_pick")"
 rc=0
 # Both package lists are newline-separated `-p` / `<name>` words, and rely on word-splitting.
 # shellcheck disable=SC2086
 cargo clippy --keep-going --all-targets --target wasm32-unknown-unknown $browser || rc=1
 # shellcheck disable=SC2086
 cargo clippy --keep-going --all-targets --target wasm32-wasip2 $wasi || rc=1
+# Only the libraries: a test needs std, which wasm32v1-none does not have.
+# shellcheck disable=SC2086
+cargo clippy --keep-going --lib --target wasm32v1-none $core || rc=1
 exit "$rc"
 """
 shell = "{{ vars.task_shell }}"

.mise/config.windows.toml

@@ -106,13 +106,13 @@ url = "https://github.com/edge-toolkit/core/releases/download/gnupg-w32-v1/2.5.2
 [[tools.rust]]
 components = "clippy,rust-analyzer"
 profile = "minimal"
-targets = "riscv32imac-unknown-none-elf,thumbv8m.main-none-eabihf,wasm32-unknown-unknown,wasm32-wasip2"
+targets = "riscv32imac-unknown-none-elf,thumbv8m.main-none-eabihf,wasm32-unknown-unknown,wasm32-wasip2,wasm32v1-none"
 version = "stable-{{ vars.win_rust_host }}"
 
 [[tools.rust]]
 components = "rust-src,rustfmt"
 profile = "minimal"
-targets = "wasm32-unknown-unknown,wasm32-wasip2"
+targets = "wasm32-unknown-unknown,wasm32-wasip2,wasm32v1-none"
 version = "{{ vars.rust_nightly }}-{{ vars.win_rust_host }}"
 
 [vars]

AGENTS.md

@@ -561,6 +561,10 @@ Languages:
   from `pkg/` as a static asset; the guest fetches it via the `storage` host import because
   componentize-py 0.23 doesn't bundle non-Python data files), then runs inference through ONNX
   Runtime via `wasi:nn/graph.load` + `inference.compute` and verifies the predicted class.
+- **Rust -> Wasm 1.0 core module (`wasm32v1-none`)**: core-math1 -- runs in `et-ws-wasi-runner` on NASA's SpaceWasm
+  interpreter rather than wasmtime, which the runner picks from the module's header. It imports the `et` functions
+  `et-core-guest` defines in place of a WIT world, and is built by `cargo build --target wasm32v1-none`, whose
+  prebuilt `core` and `alloc` are already Wasm 1.0, then `et-cli module-package-json`.
 
 ### Libraries (`libs/`)
 

CHANGELOG.md

@@ -7,6 +7,14 @@ Changelog 1.1.0.
 
 ### Added
 
+- `et-ws-wasi-runner` runs Wasm 1.0 core modules beside WASI components, on NASA's SpaceWasm interpreter, with its
+  new `core-modules` feature, on by default. It picks the engine from the fetched module's header, so a scenario's
+  `runner: wasi` covers both. A core module reaches the hub through the `et` imports, which the new `et-core-guest`
+  crate defines and wraps in a typed guest API for the `wasm32v1-none` target; `core-math1` is the first such module,
+  and `verification/local/input/core-math1.yaml` pairs it with the WASI trigger. A runner built without the feature
+  fails a core module with `RunnerError::CoreModulesDisabled`.
+- `et-math1` holds the math1 family's `FedAvg` kernel, input pointer and output JSON, which the Rust math1 twins and
+  triggers now share rather than each carrying a copy.
 - `generated/specs/rest.md` and `generated/specs/ws.md` document the REST API and the WebSocket protocol in Markdown:
   every operation, message and shared schema, with the side of the hub that sends each message. They are rendered
   from `rest.yaml` and `ws.yaml` and regenerated with them.

CHECKS.md

@@ -1,11 +1,11 @@
 # Checks
 
-- **Generated:** 2026-11-05
+- **Generated:** 2026-11-06
 - **Checks:** 83
 - **Tools:** 48
 - **Shell-script checks:** 10
 - **Checks with a repair pass:** 22
-- **Rules:** 368 custom local rules, or non-default strict linter settings
+- **Rules:** 369 custom local rules, or non-default strict linter settings
 - **Meta rules:** 20 of those rules are rules about rules
 
 Every check is listed across every `MISE_ENV`, filed under the tool it runs. Each entry names the env whose config
@@ -268,6 +268,11 @@ Rules, from `config/ast-grep/rules`:
 - `no-uds-listener` -- HTTP servers here listen on TCP only. A Unix-domain-socket listener gives requests no peer
   address, and the handlers take the client address from the socket peer rather than from client-supplied `Forwarded` /
   `X-Forwarded-For` headers -- so `ws_handler` refuses every request arriving on one. Bind a TCP address instead.
+- `no-unwrap-or-call` -- `.unwrap_or(...)` evaluates its argument even when the value it stands in for is there, so a
+  call written there runs every time. Reach the fallback another way: `let Some(value) = option else { ... }` or a
+  `match`, or `.unwrap_or_else(...)` when the fallback is real work -- clippy's `unnecessary_lazy_evaluations` objects
+  to a closure around a plain constructor. This mirrors `DeepSource RS-W1031`. clippy's `or_fun_call` lets an enum or
+  tuple-struct constructor such as `Ok(None)` through as cheap, so a constructor here gets past clippy alone.
 - `org-identity-lives-in-et-org` -- This constant spells out the organisation name or the crate prefix. Both belong to
   `et-org`, which is the one place either literal is written: take the value from `et_org::ORG`, `et_org::CRATE_PREFIX`,
   `et_org::NPM_SCOPE`, `et_org::REPOSITORY_URL` or `et_org::IMAGE_REGISTRY`, or build a longer string from them, rather