Wasm Cloud-Edge Collaboration: 5 Core Patterns for Distributed Wasm Architecture

Are You Also Facing These Problems?

Cloud-edge collaboration sounds great — process locally at the edge, manage centrally from the cloud, scale elastically. But once you hit production, the pain points pile up: edge nodes have limited resources, containers won't fit; cloud-edge data sync has high latency, consistency is hard to guarantee; task scheduling is complex, which task runs on which edge node is all manual; security policies are inconsistent, cloud and edge have different standards, vulnerabilities everywhere. The WasmCloud + Actor Model + NATS combo delivers Actor cold starts under 1ms, Wasm module footprints under 10MB, NATS sub-millisecond messaging, and capability providers with zero default permissions — this is what cloud-edge collaboration should look like.

Pain Point	Traditional Cloud-Edge	WasmCloud Cloud-Edge
Edge resource usage	100MB+ (container image)	5-30MB (Wasm module)
Task scheduling	Manual config + K8s scheduler	Actor model auto-discovery
Data sync	REST polling / MQTT	NATS pub-sub
Security policy	Docker + Seccomp	Capability provider zero-permission
Function migration	Rebuild & redeploy	Wasm module hot migration

---

Core Concepts

Concept	Full Name	Description
Cloud-Edge Collaboration	—	Cloud central management + edge local processing, collaborating on business logic
WasmCloud	—	Distributed Actor platform based on Wasm, supporting unified cloud-edge runtime
Actor Model	—	Each Actor has independent state, message-driven, location-transparent — naturally suited for distributed systems
NATS	—	Lightweight high-performance messaging system, pub-sub pattern, sub-millisecond latency
Capability Provider	—	Plugin providing external capabilities to Actors (KV store, HTTP, message queue, etc.)
Link Definition	—	Declarative binding between Actor and capability provider, controlling permissions and routing
Edge Node	—	WasmCloud host deployed at the edge, running Actors and Providers
Lattice Controller	—	Cloud control plane managing Actor scheduling and link definitions across all edge nodes

---

Problem Analysis: 5 Key Challenges

1. Edge Resource Scheduling: Edge nodes have limited CPU/memory — how to intelligently schedule Actors based on resource profiles
2. Data Consistency: Cloud-edge data sync via NATS — how to guarantee eventual consistency
3. Security Policy Sync: How to push cloud security policies to edge in real-time, how to unify capability provider permissions
4. Cross-Node Function Migration: How to hot-migrate Actors between edge nodes while preserving state
5. Fault Self-Healing: When an edge node goes down, how to automatically migrate Actors to healthy nodes with zero business impact

---

Step-by-Step: 5 Core Patterns

Pattern 1: WasmCloud Actor Development and Deployment

use wasmcloud_actor::prelude::*;
use serde::{Deserialize, Serialize};

#[derive(Deserialize)]
pub struct SensorData {
    pub device_id: String,
    pub temperature: f64,
    pub humidity: f64,
    pub timestamp: u64,
    pub region: String,
}

#[derive(Serialize)]
pub struct ProcessedResult {
    pub device_id: String,
    pub alert_level: String,
    pub processed_at: u64,
    pub node_id: String,
}

#[derive(Serialize, Deserialize)]
pub struct ActorConfig {
    pub temp_threshold: f64,
    pub humidity_threshold: f64,
    pub alert_enabled: bool,
}

struct EdgeProcessorActor;

impl EdgeProcessorActor {
    fn process_sensor_data(&self, data: &SensorData, config: &ActorConfig) -> ProcessedResult {
        let alert_level = if data.temperature > config.temp_threshold {
            "critical".to_string()
        } else if data.humidity > config.humidity_threshold {
            "warning".to_string()
        } else {
            "normal".to_string()
        };

        ProcessedResult {
            device_id: data.device_id.clone(),
            alert_level,
            processed_at: data.timestamp,
            node_id: get_node_id(),
        }
    }
}

fn get_node_id() -> String {
    std::env::var("WASMCLOUD_NODE_ID").unwrap_or_else(|_| "edge-unknown".to_string())
}

fn main() {
    let config = ActorConfig {
        temp_threshold: 85.0,
        humidity_threshold: 90.0,
        alert_enabled: true,
    };

    let sensor = SensorData {
        device_id: "sensor-001".to_string(),
        temperature: 92.5,
        humidity: 78.3,
        timestamp: 1718668800,
        region: "ap-east-1".to_string(),
    };

    let actor = EdgeProcessorActor;
    let result = actor.process_sensor_data(&sensor, &config);
    println!("{}", serde_json::to_string(&result).unwrap());
}

[package]
name = "edge-processor-actor"
version = "0.1.0"
edition = "2021"

[dependencies]
wasmcloud-actor = "0.3"
serde = { version = "1", features = ["derive"] }
serde_json = "1"

[profile.release]
opt-level = 3
lto = true
codegen-units = 1
strip = true

rustup target add wasm32-unknown-unknown
cargo build --target wasm32-unknown-unknown --release

wash claim sign target/wasm32-unknown-unknown/release/edge_processor_actor.wasm \
  --name edge-processor \
  --issuer ./keys/account.nk \
  --subject ./keys/module.nk

wash start actor edge-processor \
  --hosts NEDGE01 \
  --link-name edge-processor

---

Pattern 2: Capability Providers and Link Definitions

use serde::{Deserialize, Serialize};
use std::collections::HashMap;

#[derive(Serialize, Deserialize, Clone)]
pub struct LinkDefinition {
    pub actor_id: String,
    pub provider_id: String,
    pub contract_id: String,
    pub link_name: String,
    pub values: HashMap<String, String>,
}

#[derive(Serialize, Deserialize, Clone)]
pub struct CapabilityConfig {
    pub contract_id: String,
    pub link_name: String,
    pub permissions: Vec<String>,
    pub env_mapping: HashMap<String, String>,
}

impl LinkDefinition {
    pub fn kv_binding(actor_id: &str, provider_id: &str) -> Self {
        let mut values = HashMap::new();
        values.insert("BUCKET".to_string(), "edge-data".to_string());
        values.insert("REGION".to_string(), "ap-east-1".to_string());

        LinkDefinition {
            actor_id: actor_id.to_string(),
            provider_id: provider_id.to_string(),
            contract_id: "wasmcloud:keyvalue".to_string(),
            link_name: "default".to_string(),
            values,
        }
    }

    pub fn http_binding(actor_id: &str, provider_id: &str) -> Self {
        let mut values = HashMap::new();
        values.insert("PORT".to_string(), "8080".to_string());

        LinkDefinition {
            actor_id: actor_id.to_string(),
            provider_id: provider_id.to_string(),
            contract_id: "wasmcloud:httpserver".to_string(),
            link_name: "default".to_string(),
            values,
        }
    }

    pub fn nats_binding(actor_id: &str, provider_id: &str) -> Self {
        let mut values = HashMap::new();
        values.insert("SUBSCRIPTION".to_string(), "edge.sensor.*".to_string());
        values.insert("CLUSTER_URI".to_string(), "nats://cloud-nats:4222".to_string());

        LinkDefinition {
            actor_id: actor_id.to_string(),
            provider_id: provider_id.to_string(),
            contract_id: "wasmcloud:messaging".to_string(),
            link_name: "cloud-sync".to_string(),
            values,
        }
    }
}

fn main() {
    let actor_id = "MBCFOPNG6DDWUTJYEQVP5A7PV7Y4MFSH5I2I2R4";
    let kv_provider = "VAG3QITQQ2ODAOWB5MTQ0JD6BX7T7NZ2FMX4NOOB";
    let http_provider = "VAG3QITQQ2ODAOWB5MTQ0JD6BX7T7NZ2FMX4NOOC";
    let nats_provider = "VAG3QITQQ2ODAOWB5MTQ0JD6BX7T7NZ2FMX4NOOD";

    let links = vec![
        LinkDefinition::kv_binding(actor_id, kv_provider),
        LinkDefinition::http_binding(actor_id, http_provider),
        LinkDefinition::nats_binding(actor_id, nats_provider),
    ];

    for link in &links {
        println!("Link: {} -> {} [{}:{}]",
            link.actor_id.chars().take(8).collect::<String>(),
            link.provider_id.chars().take(8).collect::<String>(),
            link.contract_id, link.link_name);
    }
}

wash start provider wasmcloud.azurecr.io/kvredis:0.27.0 \
  --hosts NEDGE01 \
  --link-name default

wash start provider wasmcloud.azurecr.io/httpserver:0.20.0 \
  --hosts NEDGE01 \
  --link-name default

wash start provider wasmcloud.azurecr.io/nats:0.18.0 \
  --hosts NEDGE01 \
  --link-name cloud-sync

wash link put MBCFOPNG6DDWUTJYEQVP5A7PV7Y4MFSH5I2I2R4 \
  VAG3QITQQ2ODAOWB5MTQ0JD6BX7T7NZ2FMX4NOOB \
  wasmcloud:keyvalue default \
  --bucket edge-data --region ap-east-1

wash link put MBCFOPNG6DDWUTJYEQVP5A7PV7Y4MFSH5I2I2R4 \
  VAG3QITQQ2ODAOWB5MTQ0JD6BX7T7NZ2FMX4NOOC \
  wasmcloud:httpserver default \
  --port 8080

---

Pattern 3: Cloud-Edge Messaging with NATS

use serde::{Deserialize, Serialize};
use std::collections::HashMap;
use std::sync::atomic::{AtomicU64, Ordering};
use std::sync::Arc;

#[derive(Serialize, Deserialize, Clone)]
pub struct EdgeMessage {
    pub subject: String,
    pub payload: Vec<u8>,
    pub reply_to: Option<String>,
    pub headers: HashMap<String, String>,
    pub timestamp: u64,
}

#[derive(Serialize, Deserialize)]
pub struct SyncCommand {
    pub command_id: String,
    pub command_type: String,
    pub target_node: String,
    pub config_version: u64,
    pub payload: Vec<u8>,
}

pub struct NatsEdgeBridge {
    node_id: String,
    pending_acks: AtomicU64,
    delivered: AtomicU64,
}

impl NatsEdgeBridge {
    pub fn new(node_id: &str) -> Self {
        NatsEdgeBridge {
            node_id: node_id.to_string(),
            pending_acks: AtomicU64::new(0),
            delivered: AtomicU64::new(0),
        }
    }

    pub fn publish_sensor_data(&self, subject: &str, data: &[u8]) -> EdgeMessage {
        let mut headers = HashMap::new();
        headers.insert("source-node".to_string(), self.node_id.clone());
        headers.insert("content-type".to_string(), "application/json".to_string());

        self.delivered.fetch_add(1, Ordering::SeqCst);

        EdgeMessage {
            subject: subject.to_string(),
            payload: data.to_vec(),
            reply_to: Some(format!("edge.ack.{}", self.node_id)),
            headers,
            timestamp: current_timestamp(),
        }
    }

    pub fn handle_cloud_command(&self, cmd: &SyncCommand) -> Result<(), String> {
        match cmd.command_type.as_str() {
            "config_update" => {
                println!("[{}] Config update v{} received", self.node_id, cmd.config_version);
                Ok(())
            }
            "actor_migrate" => {
                println!("[{}] Actor migration to {}", self.node_id, cmd.target_node);
                self.pending_acks.fetch_add(1, Ordering::SeqCst);
                Ok(())
            }
            "security_policy" => {
                println!("[{}] Security policy synced", self.node_id);
                Ok(())
            }
            _ => Err(format!("Unknown command: {}", cmd.command_type)),
        }
    }

    pub fn stats(&self) -> (u64, u64) {
        (self.delivered.load(Ordering::SeqCst), self.pending_acks.load(Ordering::SeqCst))
    }
}

fn current_timestamp() -> u64 {
    use std::time::{SystemTime, UNIX_EPOCH};
    SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs()
}

fn main() {
    let bridge = NatsEdgeBridge::new("edge-ap-east-1");

    let sensor_data = br#"{"device":"sensor-001","temp":92.5}"#;
    let msg = bridge.publish_sensor_data("edge.sensor.ap-east-1", sensor_data);
    println!("Published: {} ({} bytes)", msg.subject, msg.payload.len());

    let cmd = SyncCommand {
        command_id: "cmd-001".to_string(),
        command_type: "config_update".to_string(),
        target_node: "edge-ap-east-1".to_string(),
        config_version: 42,
        payload: vec![],
    };
    bridge.handle_cloud_command(&cmd).unwrap();

    let (delivered, pending) = bridge.stats();
    println!("Stats: delivered={}, pending_acks={}", delivered, pending);
}

NATS_SERVER="nats://cloud-nats:4222"

nats sub "edge.sensor.>" --server $NATS_SERVER

nats pub "cloud.cmd.edge-ap-east-1" \
  '{"command_id":"cmd-001","command_type":"config_update","target_node":"edge-ap-east-1","config_version":42,"payload":[]}' \
  --server $NATS_SERVER

wash call MBCFOPNG6DDWUTJYEQVP5A7PV7Y4MFSH5I2I2R4 \
  HandleMessage \
  --subject "edge.sensor.ap-east-1" \
  --data '{"device":"sensor-001","temp":92.5}'

---

Pattern 4: Edge Task Scheduling and Load Balancing

use serde::{Deserialize, Serialize};
use std::collections::HashMap;
use std::sync::atomic::{AtomicU64, Ordering};

#[derive(Serialize, Deserialize, Clone)]
pub struct EdgeNode {
    pub node_id: String,
    pub region: String,
    pub cpu_capacity: u32,
    pub memory_mb: u32,
    pub cpu_used: u32,
    pub memory_used_mb: u32,
    pub actor_count: u32,
    pub is_healthy: bool,
}

#[derive(Serialize, Deserialize, Clone)]
pub struct TaskSpec {
    pub task_id: String,
    pub cpu_required: u32,
    pub memory_required_mb: u32,
    pub preferred_region: String,
    pub priority: u8,
    pub max_latency_ms: u64,
}

pub struct EdgeScheduler {
    nodes: Vec<EdgeNode>,
    round_robin_counter: AtomicU64,
}

impl EdgeScheduler {
    pub fn new(nodes: Vec<EdgeNode>) -> Self {
        EdgeScheduler {
            nodes,
            round_robin_counter: AtomicU64::new(0),
        }
    }

    pub fn schedule(&self, task: &TaskSpec) -> Option<&EdgeNode> {
        let candidates: Vec<&EdgeNode> = self.nodes.iter()
            .filter(|n| n.is_healthy)
            .filter(|n| n.cpu_capacity - n.cpu_used >= task.cpu_required)
            .filter(|n| n.memory_mb - n.memory_used_mb >= task.memory_required_mb)
            .filter(|n| n.region == task.preferred_region || task.preferred_region.is_empty())
            .collect();

        if candidates.is_empty() {
            let fallback: Vec<&EdgeNode> = self.nodes.iter()
                .filter(|n| n.is_healthy)
                .filter(|n| n.cpu_capacity - n.cpu_used >= task.cpu_required)
                .filter(|n| n.memory_mb - n.memory_used_mb >= task.memory_required_mb)
                .collect();
            return fallback.first().copied();
        }

        candidates.iter()
            .min_by_key(|n| {
                let cpu_usage = (n.cpu_used as f64 / n.cpu_capacity as f64 * 100.0) as u32;
                let mem_usage = (n.memory_used_mb as f64 / n.memory_mb as f64 * 100.0) as u32;
                cpu_usage + mem_usage + n.actor_count
            })
            .copied()
    }

    pub fn schedule_round_robin(&self, task: &TaskSpec) -> Option<&EdgeNode> {
        let healthy: Vec<&EdgeNode> = self.nodes.iter()
            .filter(|n| n.is_healthy)
            .filter(|n| n.cpu_capacity - n.cpu_used >= task.cpu_required)
            .collect();

        if healthy.is_empty() {
            return None;
        }

        let idx = self.round_robin_counter.fetch_add(1, Ordering::SeqCst) as usize % healthy.len();
        Some(healthy[idx])
    }
}

fn main() {
    let nodes = vec![
        EdgeNode {
            node_id: "edge-ap-east-1".to_string(),
            region: "ap-east-1".to_string(),
            cpu_capacity: 4000, memory_mb: 2048,
            cpu_used: 1200, memory_used_mb: 800, actor_count: 5, is_healthy: true,
        },
        EdgeNode {
            node_id: "edge-ap-southeast-1".to_string(),
            region: "ap-southeast-1".to_string(),
            cpu_capacity: 2000, memory_mb: 1024,
            cpu_used: 500, memory_used_mb: 300, actor_count: 2, is_healthy: true,
        },
        EdgeNode {
            node_id: "edge-us-west-1".to_string(),
            region: "us-west-1".to_string(),
            cpu_capacity: 4000, memory_mb: 2048,
            cpu_used: 3800, memory_used_mb: 1900, actor_count: 15, is_healthy: true,
        },
    ];

    let scheduler = EdgeScheduler::new(nodes);

    let task = TaskSpec {
        task_id: "task-sensor-001".to_string(),
        cpu_required: 500,
        memory_required_mb: 256,
        preferred_region: "ap-east-1".to_string(),
        priority: 5,
        max_latency_ms: 50,
    };

    if let Some(node) = scheduler.schedule(&task) {
        println!("Scheduled {} -> {} (cpu: {}/{}, mem: {}/{})",
            task.task_id, node.node_id,
            node.cpu_used, node.cpu_capacity,
            node.memory_used_mb, node.memory_mb);
    }
}

---

Pattern 5: Fault Detection and Auto-Recovery

use serde::{Deserialize, Serialize};
use std::collections::HashMap;
use std::sync::atomic::{AtomicU64, AtomicBool, Ordering};
use std::time::{Duration, Instant};

#[derive(Serialize, Deserialize, Clone)]
pub struct HealthCheck {
    pub node_id: String,
    pub status: String,
    pub actor_count: u32,
    pub last_heartbeat_ms: u64,
    pub error_count: u32,
}

#[derive(Serialize, Deserialize, Clone)]
pub struct FailoverPlan {
    pub failed_node: String,
    pub target_node: String,
    pub actor_ids: Vec<String>,
    pub priority: u8,
    pub estimated_downtime_ms: u64,
}

pub struct FaultDetector {
    heartbeat_timeout_ms: u64,
    max_error_count: u32,
    auto_failover: AtomicBool,
    failover_count: AtomicU64,
}

impl FaultDetector {
    pub fn new(heartbeat_timeout_ms: u64, max_error_count: u32) -> Self {
        FaultDetector {
            heartbeat_timeout_ms,
            max_error_count,
            auto_failover: AtomicBool::new(true),
            failover_count: AtomicU64::new(0),
        }
    }

    pub fn check_node_health(&self, check: &HealthCheck) -> NodeHealthStatus {
        let heartbeat_stale = check.last_heartbeat_ms > self.heartbeat_timeout_ms;
        let too_many_errors = check.error_count >= self.max_error_count;

        if heartbeat_stale || too_many_errors {
            NodeHealthStatus::Unhealthy
        } else if check.error_count > 0 {
            NodeHealthStatus::Degraded
        } else {
            NodeHealthStatus::Healthy
        }
    }

    pub fn create_failover_plan(
        &self,
        failed_node: &str,
        healthy_nodes: &[&str],
        actors: &[String],
    ) -> Option<FailoverPlan> {
        if !self.auto_failover.load(Ordering::SeqCst) {
            return None;
        }

        let target = healthy_nodes.first()?;
        self.failover_count.fetch_add(1, Ordering::SeqCst);

        Some(FailoverPlan {
            failed_node: failed_node.to_string(),
            target_node: (*target).to_string(),
            actor_ids: actors.to_vec(),
            priority: 1,
            estimated_downtime_ms: 2000,
        })
    }

    pub fn stats(&self) -> u64 {
        self.failover_count.load(Ordering::SeqCst)
    }
}

#[derive(PartialEq)]
pub enum NodeHealthStatus {
    Healthy,
    Degraded,
    Unhealthy,
}

fn main() {
    let detector = FaultDetector::new(30000, 5);

    let checks = vec![
        HealthCheck {
            node_id: "edge-ap-east-1".to_string(),
            status: "ok".to_string(),
            actor_count: 5, last_heartbeat_ms: 2000, error_count: 0,
        },
        HealthCheck {
            node_id: "edge-ap-southeast-1".to_string(),
            status: "degraded".to_string(),
            actor_count: 3, last_heartbeat_ms: 5000, error_count: 2,
        },
        HealthCheck {
            node_id: "edge-us-west-1".to_string(),
            status: "error".to_string(),
            actor_count: 8, last_heartbeat_ms: 45000, error_count: 10,
        },
    ];

    for check in &checks {
        let status = detector.check_node_health(check);
        let label = match status {
            NodeHealthStatus::Healthy => "HEALTHY",
            NodeHealthStatus::Degraded => "DEGRADED",
            NodeHealthStatus::Unhealthy => "UNHEALTHY",
        };
        println!("[{}] {} - {}", label, check.node_id, check.status);
    }

    if let Some(plan) = detector.create_failover_plan(
        "edge-us-west-1",
        &vec!["edge-ap-east-1", "edge-ap-southeast-1"],
        &vec!["actor-a".to_string(), "actor-b".to_string()],
    ) {
        println!("Failover: {} -> {} ({} actors)",
            plan.failed_node, plan.target_node, plan.actor_ids.len());
    }

    println!("Total failovers: {}", detector.stats());
}

wash get hosts

wash get claims

wash scale actor MBCFOPNG6DDWUTJYEQVP5A7PV7Y4MFSH5I2I2R4 \
  --hosts NEDGE01,NEDGE02 \
  --max 3

wash stop actor MBCFOPNG6DDWUTJYEQVP5A7PV7Y4MFSH5I2I2R4 \
  --host-id NEDGE03

---

Pitfall Guide

❌ Pitfall 1: Actors directly accessing external resources, bypassing capability providers

// ❌ Wrong: Actor makes HTTP requests internally, bypassing security controls
// reqwest::get("http://api.example.com/data").await

// ✅ Correct: Access through capability providers via declarative link definitions
// wash link put <actor> <http-provider> wasmcloud:httpserver

❌ Pitfall 2: Poorly designed NATS Subjects causing message storms

# ❌ Wrong: All edge nodes subscribe to the same wildcard Subject
# nats sub "edge.>"

# ✅ Correct: Segment Subjects by region and function
# nats sub "edge.sensor.ap-east-1"
# nats sub "edge.cmd.ap-east-1"

❌ Pitfall 3: Link definitions without timeout and retry

# ❌ Wrong: Link definition without timeout — Actor blocks indefinitely when Provider is unavailable

# ✅ Correct: Set reasonable timeout and retry strategy
wash link put <actor> <provider> wasmcloud:keyvalue default \
  --timeout 5000 \
  --retry-count 3 \
  --retry-delay 1000

❌ Pitfall 4: Scheduling all Actors to one edge node without resource profiling

# ❌ Wrong: All Actors scheduled to the same edge node
# wash start actor <actor> --hosts NEDGE01

# ✅ Correct: Spread scheduling based on resource profiles
# wash start actor <actor> --hosts NEDGE01,NEDGE02 --spread

❌ Pitfall 5: Failover without verifying target node health

# ❌ Wrong: Migrate to any node after failure — risk of cascading failure

# ✅ Correct: Check target node health and resource capacity first
# wash get hosts --healthy-only
# wash scale actor <actor> --hosts <healthy-host>

---

Error Troubleshooting

Error Message	Cause	Solution
actor start failed: invalid claim	Actor signature expired or key mismatch	Re-sign with wash claim sign
link definition not found	No link binding between Actor and Provider	Create binding with wash link put
provider start failed: image pull	Provider image pull failed	Check network and image registry address
NATS: connection refused	NATS Server not running or wrong address	Check NATS service status and CLUSTER_URI
NATS: subscription timeout	Message subscription timeout, no consumers	Confirm subscriber is running
capability denied: wasmcloud:keyvalue	Actor not authorized for KV capability	Add KV link binding with wash link put
host not found: NEDGE03	Target host ID doesn't exist or is offline	Confirm available hosts with wash get hosts
actor scale failed: insufficient resources	Edge node has insufficient resources	Reduce Actor memory/CPU requirements or scale up nodes
heartbeat timeout: 30000ms	Edge node heartbeat timeout	Check node network and WasmCloud daemon
failover failed: no healthy target	All edge nodes are unhealthy	Scale up new nodes or repair existing ones

---

Advanced Optimization

1. Actor State Snapshots and Hot Migration

use serde::{Deserialize, Serialize};

#[derive(Serialize, Deserialize, Clone)]
pub struct ActorSnapshot {
    pub actor_id: String,
    pub state_version: u64,
    pub state_data: Vec<u8>,
    pub source_node: String,
    pub checkpoint_timestamp: u64,
}

impl ActorSnapshot {
    pub fn create(actor_id: &str, state: &[u8], source_node: &str) -> Self {
        ActorSnapshot {
            actor_id: actor_id.to_string(),
            state_version: current_timestamp(),
            state_data: state.to_vec(),
            source_node: source_node.to_string(),
            checkpoint_timestamp: current_timestamp(),
        }
    }

    pub fn restore(&self) -> &[u8] {
        &self.state_data
    }
}

fn current_timestamp() -> u64 {
    use std::time::{SystemTime, UNIX_EPOCH};
    SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs()
}

2. NATS JetStream Persistent Messaging

nats stream add edge-events \
  --subjects "edge.sensor.>,edge.cmd.>" \
  --storage file \
  --retention limits \
  --max-msgs 1000000 \
  --max-age 72h \
  --replicas 3

nats consumer add edge-events cloud-processor \
  --target "edge.sensor.>" \
  --ack explicit \
  --max-deliver 3 \
  --replay instant

3. Security Policy Auto-Sync

use serde::{Deserialize, Serialize};
use std::collections::HashMap;

#[derive(Serialize, Deserialize, Clone)]
pub struct SecurityPolicy {
    pub policy_id: String,
    pub version: u64,
    pub allowed_contracts: Vec<String>,
    pub denied_contracts: Vec<String>,
    pub max_actor_memory_mb: u32,
    pub network_restrictions: Vec<String>,
}

impl SecurityPolicy {
    pub fn edge_default() -> Self {
        SecurityPolicy {
            policy_id: "edge-default".to_string(),
            version: 1,
            allowed_contracts: vec![
                "wasmcloud:keyvalue".to_string(),
                "wasmcloud:httpserver".to_string(),
                "wasmcloud:messaging".to_string(),
            ],
            denied_contracts: vec![],
            max_actor_memory_mb: 64,
            network_restrictions: vec!["internal-only".to_string()],
        }
    }
}

4. Multi-Region Lattice Topology

wash up --nats-nseed ./keys/nats-edge.nk \
  --nats-host nats://cloud-nats:4222 \
  --label region=ap-east-1 \
  --label tier=edge

wash up --nats-nseed ./keys/nats-cloud.nk \
  --nats-host nats://cloud-nats:4222 \
  --label region=ap-east-1 \
  --label tier=cloud

---

Comparison

Dimension	WasmCloud	KubeEdge	OpenYurt	AWS IoT Greengrass
Runtime	Wasm Actor	Docker container	Docker container	Lambda / Docker
Cold start	<1ms	300ms+	300ms+	100ms+
Resource footprint	5-30MB	100MB+	100MB+	50MB+
Messaging	NATS built-in	MQTT / REST	CloudHub	MQTT
Security model	Capability provider zero-permission	K8s RBAC	K8s RBAC	IAM Policy
Function migration	Wasm hot migration	Pod rebuild	Pod rebuild	Lambda redeploy
Scheduling	Actor auto-discovery	K8s scheduler	K8s scheduler	Greengrass deploy
Language support	Rust/C/Go/JS	Any	Any	Python/JS/Java
Edge autonomy	Lattice autonomy	EdgeHub autonomy	YurtHub autonomy	Offline operation
Best for	Lightweight cloud-edge	K8s-native edge	K8s-native edge	AWS ecosystem edge

---

Summary: Cloud-edge collaboration is not simply "cloud dispatches, edge executes." From WasmCloud Actor development and deployment, to capability provider link definitions for zero-permission security, to NATS pub-sub for sub-millisecond cloud-edge messaging, to edge task scheduling and load balancing, to fault detection and auto-recovery — the 5 core patterns cover the full production lifecycle of distributed Wasm architecture. Core principles: Actor model is naturally distributed, capability providers default to zero permissions, NATS unifies the messaging plane, declarative link definitions, and fault self-healing with zero business impact. The future of cloud-edge collaboration is Wasm.

---

Recommended Online Tools

• JSON Data Formatter: /en/json/format
• Hash Calculator: /en/encode/hash
• Base64 Encoder/Decoder: /en/encode/base64
• cURL to Code Converter: /en/dev/curl-to-code