Contract-Driven AI Framework: How Traverse Lets You Build Business Capabilities on WASM for Browser, Edge, and Cloud

I'm Denis Shokhirev, Agentic AI Systems Architect based in Freiburg im Breisgau, Germany, running DennisCraft AI Studio. My stack: Claude, Supabase, n8n, Doppler, self-hosted Postgres. Recently, I had to ship the same AI scoring logic for a B2B client across browser (for privacy), edge (for latency), and cloud (for scale). Each environment needed the same business rules—rewriting pipelines for every platform wastes time and introduces subtle bugs.

The Contract-Driven Pattern in Traverse

At the heart of this framework is a strict contract between inputs, logic, and outputs for every business capability. This isn't just a YAML doc—it's a typed schema (TypeScript interfaces or OpenAPI), enforced at build and test time. That contract ensures a business function remains valid and testable across all runtimes—browser, edge, and cloud.

Why Classic AI Pipelines Break Down

• Business logic is scattered: some in backend, some in frontend, some at the edge. Behavior drifts fast.
• Tests rarely cover every environment: edge-specific bugs make it to production.
• Upgrades are risky—changing code for one runtime may break another.

Example: TypeScript Contract

export interface ScoringInput {
  dealId: string;
  features: Record<string, number>;
}

export interface ScoringOutput {
  score: number;
  riskLevel: 'low' | 'medium' | 'high';
}

Every AI capability must accept and return these structures, validated by TypeScript tools (tRPC, Zod).

Why WebAssembly (WASM) for Unified Logic

WebAssembly enables compiling business logic (Rust, Go, AssemblyScript) into a universal binary that runs in-browser, on edge (Cloudflare Workers), and in the cloud (Supabase Edge Functions). In my recent deployments, moving scoring logic to WASM delivered:

• No code duplication—no need to maintain JS for frontend and Python for backend.
• Consistent, testable behavior: one binary, one source of truth.
• Simpler security audits—single codebase, single threat surface.

Minimal Rust WASM Module

use wasm_bindgen::prelude::*;

#[wasm_bindgen]
pub fn score_deal(features: &JsValue) -> JsValue {
    // Deserialize, score, serialize
}

Compile with wasm-pack build and load the same module in React, edge workers, or cloud functions.

Testing and Security: What Actually Catches Issues

Production AI needs more than unit tests. Static analysis and runtime checks are essential. On three of my recent agent deployments, bandit and semgrep caught CWE-89 (SQL Injection) patterns in LLM-generated Postgres code. Without a contract-driven, single-runtime approach, these issues would have made it to the edge, where detection is much harder.

CI/CD Integration with Supabase

semgrep --config=auto src/
bandit -r src/
docker build -t dealscore:wasm .
supabase functions deploy dealscore

The pipeline ensures only binaries that pass tests and static checks are deployed to edge or cloud.

Browser, Edge, Cloud: Comparing Environments

Contract-driven WASM makes it possible to run the same business logic everywhere without maintaining multiple versions.

FAQ

Which stack is best for building WASM business capabilities?

I prefer Rust for its stability and static typing. AssemblyScript is easier for frontend devs, but needs more manual validation.

Can you run LLMs inside WASM?

Only small models or inference via API. Large models (GPT-3+) are too big for browser or edge WASM runtimes.

How do you validate contracts across environments?

Use tRPC, Zod, or OpenAPI—schemas are synchronized, and mismatches are caught at build time.

How do you mitigate security issues with LLM-generated code?

semgrep, bandit, and gitleaks are mandatory in CI. Never deploy auto-generated code without static analysis. In my pipelines, bandit flagged real SQL injection from LLM output before review.

What about migrations when contracts change?

Alias/version your contracts (e.g., v1/v2 endpoints), then roll out changes gradually. Never break the contract in-place—edge and browser clients may update at different times.

Are you already running business logic identically across browser, edge, and cloud? Where do sync issues show up for you—CI, test, or after user bug reports? I run a free 30-min stack audit for DACH founders building AI in regulated markets. DM me on LinkedIn or write to @ger_dennis_ai.