WASI mode

sub build script.sub --wasi -o app.wasm
wasmtime --dir=. app.wasm -- arg1 arg2     # or Node's WASI, or Wasmer

The module imports only wasi_snapshot_preview1. The permissions are also added as custom sections (sub.manifest, sub.mode) for tools to read.

Subtype needs	WASI mapping	What WASI cannot enforce
read, write	path_open, fd_read, fd_write, fd_readdir below the folders given with --dir	which files inside a granted folder; only the module’s own check
env	environ_get	the runtime passes the whole environment it was given
clock, random	clock_time_get, random_get	WASI cannot say “no clock”
run	none: WASI cannot start programs	the call fails
net	none in preview1	fetch is unavailable

What is and is not guaranteed

A denied effect is never attempted, because the module’s own check runs first. But that check lives inside the module the embedder runs, so someone who modifies the .wasm can remove it.

Only the default mode, where the sub host checks every effect, keeps the guarantee against a tampered module. Use WASI mode when the runtime’s own folder and environment grants are the boundary, and sub run when Subtype’s are.