docs(wit): document capability and component contracts

components/wasi-clock-probe/src/lib.rs

@@ -1,4 +1,12 @@
+//! Fixture proving that ambient WASI clock imports are denied by the sandbox.
+//!
+//! Calling `std::time::Instant::now` causes this Component to import WASI
+//! monotonic-clock directly. Wasmeld only links explicitly approved capability
+//! packages, so registration or startup must reject this fixture.
+
 mod bindings {
+    // The declared service WIT contains no WASI clock capability; the direct
+    // standard-library use below deliberately creates an undeclared import.
     wit_bindgen::generate!({
         path: "wit",
         world: "wasi-clock-probe-component",

components/wasi-clock-probe/wit.lock

@@ -4,5 +4,5 @@ schema_version = 1
 name = "wasmeld:service"
 version = "0.1.0"
 source = "path+../../wit/service"
-sha256 = "d5497307bbcd1e159f7707f385b488a6f2e26362d5256d5bc1080ac603a51305"
+sha256 = "1b2069606ccbf5202789667570bc824f702f34b147aa38e81c2ab677444ffa0e"
 replaced = true

components/wasi-clock-probe/wit/world.wit

@@ -1,5 +1,7 @@
 package component:wasi-clock-probe@0.1.0;
 
+/// The declared world grants only the base service contract. Any direct WASI
+/// clock import introduced by implementation code remains undeclared.
 world wasi-clock-probe-component {
   include wasmeld:service/service-component@0.1.0;
 }