I think the Theseus design would accommodate this in 4 different ways: 1. native Rust modules 2. arbitrary code running in WASM sandbox 3. arbitrary code run

I think the Theseus design would accommodate this in 4 different ways: 1. native Rust modules 2. arbitrary code running in WASM sandbox 3. arbitrary code running in KVM virtualization, perhaps with a Linux kernel there to provide a backwards-compat ABI 4. one can compile the WASM+untrusted app into trustworthy machine code (still implementing the WASM sandboxing logic for the untrusted component); I recall Firefox did this with some image handling C++ code they didn't find trustworthy enough I know the Theseus project is working toward WASM support.