kobako 0.13.0-aarch64-linux → 0.14.0-aarch64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c0a1b4ccd9f4e1debe32912b925847390d00fbf09e798b41eb54ac0756ef4ab3
-  data.tar.gz: 4819002a95e4407ebacb91d1ae77cd8a7c52d80a1eb0511dcc01ac405d6b7459
+  metadata.gz: f52be5d778b482a65c810fb530ac716fd2232d2b54cc98aea60f906aa6959fe9
+  data.tar.gz: f537ac1f62dad56b63bbed4456b548495310c6809983765005d54f54ed195e4d
 SHA512:
-  metadata.gz: 902954ca6a47611ab670ea52dbe5edc2268428128ffaac0dd9d55e309af6d5b4a70fc47d07eed4f31261bdcdc7158cbdd91fbfad32d56098c8a2c84077db2855
-  data.tar.gz: 53174e7d4e921b558bca17b3683c0865954ff73219a0c07d86d11e18e6e812506aece5d5dc0626ce021fe9342a63d8d3b5ab612f513d7349e939e0e6e08ed063
+  metadata.gz: b0e38dd483517aa63e12d90e1936ee7f27ea0a3c2c1f7a998f7e475b4351313f170284d56c6b9e33f30d7925659adf5ed509b2c3b3f6eeaa8a8ae75bd25d620d
+  data.tar.gz: 2269f4eac755583383a491a9441cd2b30f54e174c7b16187ae0ef9e9520bd69dffd8950061aa59a387e9e91360d9c8bfdc21232f1da746cb3385b831ad723adb

data/.release-please-manifest.json

@@ -1 +1 @@
-{".":"0.13.0","wasm/kobako-core":"0.7.0","wasm/kobako":"0.7.0","wasm/kobako-io":"0.7.0","wasm/kobako-json":"0.7.0","wasm/kobako-regexp":"0.7.0","wasm/kobako-baker":"0.7.0","crates/kobako-codec":"0.7.0","crates/kobako-runtime":"0.7.0","crates/kobako-wasmtime":"0.7.0"}
+{".":"0.14.0","wasm/kobako-core":"0.8.0","wasm/kobako-mruby":"0.8.0","wasm/kobako-io":"0.8.0","wasm/kobako-json":"0.8.0","wasm/kobako-regexp":"0.8.0","wasm/kobako-baker":"0.8.0","crates/kobako-codec":"0.8.0","crates/kobako-runtime":"0.8.0","crates/kobako-wasmtime":"0.8.0","crates/kobako":"0.8.0"}

data/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## [0.14.0](https://github.com/elct9620/kobako/compare/v0.13.0...v0.14.0) (2026-07-08)
+
+
+### Features
+
+* **codec:** add the Run invocation envelope to the wire tier ([dbdd760](https://github.com/elct9620/kobako/commit/dbdd760ddc258681669f7f620f63b75f36322687))
+* **crates:** add the kobako host SDK skeleton ([8a99d09](https://github.com/elct9620/kobako/commit/8a99d09ef7068a6738d44f1a735d39516b24156b))
+* **crates:** add the parity runner to the kobako SDK ([998f059](https://github.com/elct9620/kobako/commit/998f059abd308ef921c295658aaf8377febb44e2))
+* **crates:** grow the SDK capability-Handle table ([f93fe8f](https://github.com/elct9620/kobako/commit/f93fe8f3dce2509cfa527229f8f593f4d816b940))
+* **crates:** grow the SDK Member block-yield seam ([4404713](https://github.com/elct9620/kobako/commit/44047130f309a2c935198077fb4f7f86839355e7))
+* **crates:** grow the SDK preload and run invocation seams ([d8d5fe2](https://github.com/elct9620/kobako/commit/d8d5fe268a56d45dad4f8b35a25e942a559dcd5f))
+* **crates:** honor the respond_to_guest narrowing on the SDK Member seam ([0f5eff1](https://github.com/elct9620/kobako/commit/0f5eff16a1e9f2229ad9d9c9316bf94e92035301))
+* **crates:** let a resolved Handle recover its concrete member type ([abd5502](https://github.com/elct9620/kobako/commit/abd55029a44a7631d323c3aec3b625d9692f9c5b))
+* **crates:** mark the SDK Error taxonomy non_exhaustive ([001fc69](https://github.com/elct9620/kobako/commit/001fc69e637d2c046f55cb517f9d9cf931793715))
+* **examples:** add the guest→host dispatch half to the Rust host ([5cdde68](https://github.com/elct9620/kobako/commit/5cdde68824352c5685aaa94ae464e909705a4648))
+* **examples:** assemble a minimal Rust host on the published crates ([6b98680](https://github.com/elct9620/kobako/commit/6b98680bcb625f9790f44df839035427a576e266))
+* **tasks:** add a rails-stats-style rake stats size report ([c02d530](https://github.com/elct9620/kobako/commit/c02d530d43a85594323b7801fdbe75aa95ae7f8c))
+* **tasks:** gate parity coverage over the CORE anchor manifest ([d26972c](https://github.com/elct9620/kobako/commit/d26972c1ad51e05df951643e17d66a6c811ba862))
+
+
+### Bug Fixes
+
+* **crates:** give SetupError a Display so Error::Setup reads cleanly ([bc8b128](https://github.com/elct9620/kobako/commit/bc8b128c9e296319c7fef47441b412d2ce345dff))
+* **crates:** keep the no-timeout epoch deadline within range ([a3255df](https://github.com/elct9620/kobako/commit/a3255df98a77825bb39b571a60fe6ff83d269d19))
+* **crates:** reject trailing bytes on Request and Run decode ([8e4929b](https://github.com/elct9620/kobako/commit/8e4929b64f3ea690f38211888070c2511da84754))
+* **lib:** close the Data #with seam on Handle construction ([c0b50ae](https://github.com/elct9620/kobako/commit/c0b50aec659e32a72c905aaf94c939ac009ad621))
+* **release:** resume the gem push loop past already-live versions ([170ee9b](https://github.com/elct9620/kobako/commit/170ee9bae6da3a65b4016040259e31e4721dfcfb))
+* **release:** treat a yanked-only version as unpublished when publishing ([3111cc0](https://github.com/elct9620/kobako/commit/3111cc072a7c9d18b129fd2762f267d855b48d55))
+* **transport:** fold fault messages to UTF-8 before they ride the wire ([0be8d40](https://github.com/elct9620/kobako/commit/0be8d4068dc5647f86746e80b356b0b9d52051f7))
+
 ## [0.13.0](https://github.com/elct9620/kobako/compare/v0.12.2...v0.13.0) (2026-07-03)
 
 

data/README.md

@@ -302,10 +302,10 @@ sandbox.run(:Greeter, name: "world") # => "hello, world"
 
 | Form     | Signature                            | Snippet name source                   | Validation timing                                                          |
 |----------|--------------------------------------|---------------------------------------|----------------------------------------------------------------------------|
-| Source   | `preload(code: "...", name: :Const)` | The `name:` keyword                   | Trial-compiled at preload; compile errors raise immediately                |
-| Bytecode | `preload(binary: bytes)`             | Read from the bytecode's `debug_info` | Deferred to first invocation; failure raises `Kobako::BytecodeError`       |
+| Source   | `preload(code: "...", name: :Const)` | The `name:` keyword                   | First invocation's replay; compile errors raise `Kobako::SandboxError`     |
+| Bytecode | `preload(binary: bytes)`             | Read from the bytecode's `debug_info` | First invocation's replay; structural failure raises `Kobako::BytecodeError` |
 
-Use the source form for snippets authored in your repo (compile errors fail fast at `#preload`); use the bytecode form when snippets ship as build artifacts from a separate `mrbc` pipeline. Both replay through the same per-invocation path.
+Use the source form for snippets authored in your repo; use the bytecode form when snippets ship as build artifacts from a separate `mrbc` pipeline. Both replay through the same per-invocation path, so no snippet content failure surfaces at `#preload` — force the first replay with a no-op invocation (e.g. `sandbox.eval("nil")`) when you want validation before real traffic.
 
 ## Security
 

data/ROADMAP.md

@@ -0,0 +1,26 @@
+# Roadmap
+
+kobako is a Ruby gem providing an in-process Wasm sandbox for untrusted mruby
+code: a wasmtime host runs a precompiled `kobako.wasm` guest, with host↔guest
+Transport over a MessagePack wire. Features cover one-shot `#eval`, preload +
+`#run` dispatch, Service injection through Namespaces / Members, opaque
+Capability Handles, block yield re-entry, three-class error attribution,
+output capture, and a warm Sandbox pool.
+
+| Feature | Entry Points | Notes |
+|---------|-------------|-------|
+| ✅ [F-01 Sandbox instantiation](docs/behavior/lifecycle.md) | [lib/kobako/sandbox.rb](lib/kobako/sandbox.rb) | B-22 (per-Thread isolation) is exercised only indirectly through the pool contention tests; no test cites it |
+| ✅ [F-02 Namespace declaration](docs/behavior/registration.md) | [lib/kobako/catalog/namespaces.rb](lib/kobako/catalog/namespaces.rb) | — |
+| ✅ [F-03 Member binding](docs/behavior/registration.md) | [lib/kobako/namespace.rb](lib/kobako/namespace.rb) | — |
+| ✅ [F-04 Synchronous mruby source execution (`#eval`)](docs/behavior/lifecycle.md) | [lib/kobako/sandbox.rb](lib/kobako/sandbox.rb) | — |
+| ✅ [F-05 Guest-initiated Transport dispatch](docs/behavior/dispatch.md) | [lib/kobako/transport/dispatcher.rb](lib/kobako/transport/dispatcher.rb) | — |
+| ✅ [F-06 Capability Handle encoding and referencing](docs/behavior/dispatch.md) | [lib/kobako/catalog/handles.rb](lib/kobako/catalog/handles.rb) | — |
+| ✅ [F-07 Three-class error attribution and raising](docs/behavior/errors.md) | [lib/kobako/outcome.rb](lib/kobako/outcome.rb) | E-26 (guest-entry envelope decode failure) has no exercising test — not reachable through the public API |
+| ✅ [F-08 Guest output capture](docs/behavior/lifecycle.md) | [lib/kobako/capture.rb](lib/kobako/capture.rb) | — |
+| ✅ [F-09 Host–guest message codec](docs/wire-codec.md) | [lib/kobako/codec/](lib/kobako/codec/) | — |
+| ✅ [F-10 Reproducible build pipeline](SPEC.md#code-organization) | [tasks/wasm/build.rake](tasks/wasm/build.rake) | Verified by build-time gates (`rake anchors`, double-bake byte-identity, gemspec whitelist), not `test/` |
+| ✅ [F-11 Multi-layer test and benchmark suite](SPEC.md#testing-style) | [test/](test/) | Benchmarks live in [benchmark/](benchmark/) with the gate in `tasks/bench/`; the anchor baseline advances only by deliberate re-bless |
+| ✅ [F-12 Guest block reception and yield re-entry](docs/behavior/yield.md) | [lib/kobako/transport/yielder.rb](lib/kobako/transport/yielder.rb) | — |
+| ✅ [F-13 Snippet preloading (`#preload`)](docs/behavior/invocation.md) | [lib/kobako/catalog/snippets.rb](lib/kobako/catalog/snippets.rb) | — |
+| ✅ [F-14 Synchronous entrypoint dispatch (`#run`)](docs/behavior/invocation.md) | [lib/kobako/sandbox.rb](lib/kobako/sandbox.rb) | — |
+| ✅ [F-15 Warm Sandbox pool checkout (`Kobako::Pool`)](docs/behavior/runtime.md) | [lib/kobako/pool.rb](lib/kobako/pool.rb) | — |

data/crates/kobako-runtime/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.8.0](https://github.com/elct9620/kobako/compare/kobako-runtime-v0.7.0...kobako-runtime-v0.8.0) (2026-07-08)
+
+
+### Bug Fixes
+
+* **crates:** give SetupError a Display so Error::Setup reads cleanly ([bc8b128](https://github.com/elct9620/kobako/commit/bc8b128c9e296319c7fef47441b412d2ce345dff))
+
 ## [0.7.0](https://github.com/elct9620/kobako/compare/kobako-runtime-v0.6.1...kobako-runtime-v0.7.0) (2026-07-03)
 
 

data/crates/kobako-runtime/README.md

@@ -26,7 +26,7 @@ map the neutral types onto their own language surface.
 
 ```toml
 [dependencies]
-kobako-runtime = "0.7.0" # x-release-please-version
+kobako-runtime = "0.8.0" # x-release-please-version
 ```
 
 ## License

data/crates/kobako-wasmtime/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.8.0](https://github.com/elct9620/kobako/compare/kobako-wasmtime-v0.7.0...kobako-wasmtime-v0.8.0) (2026-07-08)
+
+
+### Bug Fixes
+
+* **crates:** keep the no-timeout epoch deadline within range ([a3255df](https://github.com/elct9620/kobako/commit/a3255df98a77825bb39b571a60fe6ff83d269d19))
+
 ## [0.7.0](https://github.com/elct9620/kobako/compare/kobako-wasmtime-v0.6.1...kobako-wasmtime-v0.7.0) (2026-07-03)
 
 

data/crates/kobako-wasmtime/README.md

@@ -24,7 +24,7 @@ SDK consumes the same surface.
 
 ```toml
 [dependencies]
-kobako-wasmtime = "0.7.0" # x-release-please-version
+kobako-wasmtime = "0.8.0" # x-release-please-version
 ```
 
 ## License

data/lib/kobako/catalog/handles.rb

@@ -95,7 +95,7 @@ module Kobako
         end
       end
 
-      # Guard {#alloc} against issuing an ID past the cap. Returns +nil+
+      # Guard #alloc against issuing an ID past the cap. Returns +nil+
       # on success; raises +Kobako::HandleExhaustedError+ at exhaustion.
       def ensure_capacity!
         cap = Kobako::Handle::MAX_ID
@@ -107,7 +107,7 @@ module Kobako
       end
 
       # Single source of truth for the "unknown Handle id" raise used by
-      # {#fetch}. Returns +nil+ on success; raises +Kobako::SandboxError+
+      # #fetch. Returns +nil+ on success; raises +Kobako::SandboxError+
       # when +id+ is not currently bound.
       def require_bound!(id)
         return if @entries.key?(id)

data/lib/kobako/catalog/namespaces.rb

@@ -71,7 +71,7 @@ module Kobako
       end
 
       # Encode the preamble as msgpack bytes for stdin Frame 1 delivery.
-      # Routes through {Kobako::Codec::Encoder} like every other host-side
+      # Routes through Kobako::Codec::Encoder like every other host-side
       # wire encode so there is a single codec path; the preamble carries
       # only Strings and Arrays, so none of the kobako ext types actually
       # fire. Structure: +[["Namespace", ["MemberA", "MemberB"]], ...]+.
@@ -106,7 +106,7 @@ module Kobako
         self
       end
 
-      # Returns +true+ when {#seal!} has been called, +false+ otherwise.
+      # Returns +true+ when #seal! has been called, +false+ otherwise.
       def sealed?
         @sealed
       end

data/lib/kobako/catalog/snippets.rb

@@ -43,7 +43,7 @@ module Kobako
       #
       # The bytes are memoized — the table is replayed verbatim on every
       # invocation after sealing, so Frame 3 never changes between
-      # encodes; {#register} drops the memo while the table is still open.
+      # encodes; #register drops the memo while the table is still open.
       # Unlike +Catalog::Namespaces#encode+, which gates its memo on the
       # seal, this one can fill eagerly and invalidate in +#register+
       # because every mutation funnels through that single method — there is

data/lib/kobako/codec/decoder.rb

@@ -12,23 +12,23 @@ module Kobako
     # ({docs/wire-codec.md}[link:../../../docs/wire-codec.md] § Type Mapping).
     #
     # Translates msgpack gem exceptions into the kobako error taxonomy
-    # ({Truncated}, {InvalidType}, {InvalidEncoding}, {UnsupportedType}) so
+    # (Truncated, InvalidType, InvalidEncoding, UnsupportedType) so
     # callers can pattern-match on the SPEC's wire-violation categories
     # without leaking the gem's internal exception classes.
     #
-    # Public API is a single function — {.decode}. The decoder is
+    # Public API is a single function — +.decode+. The decoder is
     # stateless; the +MessagePack::Unpacker+ instance is built per call
     # because callers always decode exactly one wire value at a time.
     module Decoder
       # Decode +bytes+ into one Ruby value and validate transitively
-      # against the SPEC type mapping. Raises {Truncated}, {InvalidType},
-      # or {InvalidEncoding} on wire violations.
+      # against the SPEC type mapping. Raises Truncated, InvalidType,
+      # or InvalidEncoding on wire violations.
       #
       # When a block is given, the decoded value is yielded and the block's
       # result is returned — wire Value Objects use this to build themselves
       # from the decoded payload. The block runs inside this method's
       # rescue, so a Value Object's +ArgumentError+ invariant failure
-      # surfaces as {InvalidType} without a separate {Utils.with_boundary}
+      # surfaces as InvalidType without a separate Utils.with_boundary
       # wrapper at the call site.
       def self.decode(bytes)
         value = Factory.load(bytes.b)
@@ -37,7 +37,7 @@ module Kobako
       # msgpack gem raises the format/type errors below; +ArgumentError+
       # comes from our ext-type validators (Handle id range, Exception type
       # whitelist) and from a yielded block's Value Object invariants — both
-      # are wire violations, so both map to {InvalidType}.
+      # are wire violations, so both map to InvalidType.
       rescue ::MessagePack::UnknownExtTypeError, ::MessagePack::MalformedFormatError,
              ::MessagePack::StackError, ::ArgumentError => e
         raise InvalidType, e.message
@@ -53,7 +53,7 @@ module Kobako
       # Encoding Rules). The msgpack gem returns UTF-8-tagged Strings for
       # str family but does not validate the bytes; +bin+ family decodes
       # to ASCII-8BIT. Walk the tree once and reject invalid UTF-8 in any
-      # str-typed leaf via {Utils.assert_utf8!}. {Kobako::Fault}
+      # str-typed leaf via Utils.assert_utf8!. Kobako::Fault
       # payloads are validated transitively: +Factory.unpack_fault+
       # feeds the inner ext-0x02 bytes back through this Decoder, so their
       # +str+ fields are already covered by the time control returns here.

data/lib/kobako/codec/encoder.rb

@@ -14,9 +14,9 @@ module Kobako
     # strings, arrays, and maps go through the gem's narrowest-encoding
     # logic; the three kobako-specific ext types (0x00 Symbol, 0x01
     # Capability Handle, 0x02 Exception envelope) are registered on
-    # the cached {Kobako::Codec::Factory} singleton.
+    # the cached Kobako::Codec::Factory singleton.
     #
-    # Public API is a single function — {.encode}. The codec is stateless;
+    # Public API is a single function — +.encode+. The codec is stateless;
     # there is no buffer accumulator and no streaming write API. Callers
     # that need to concatenate multiple encodings build the bytes
     # themselves.

data/lib/kobako/codec/error.rb

@@ -7,11 +7,11 @@ module Kobako
     # The wire codec implements the binary contract pinned in
     # {docs/wire-codec.md}[link:../../../docs/wire-codec.md] § Type Mapping.
     # Every wire violation surfaces as a
-    # subclass of {Error} so callers can pattern-match on the specific
+    # subclass of Error so callers can pattern-match on the specific
     # fault while still rescuing all codec faults via this base class.
     #
     # Higher layers (e.g. the Sandbox dispatch loop) translate these into
-    # the public {Kobako::SandboxError} / {Kobako::TrapError} taxonomy.
+    # the public Kobako::SandboxError / Kobako::TrapError taxonomy.
     class Error < StandardError; end
 
     # Input ended before the type prefix or payload was fully consumed.
@@ -21,7 +21,7 @@ module Kobako
     # type mapping (e.g. an unknown ext code, or a reserved msgpack tag).
     class InvalidType < Error; end
 
-    # A msgpack `str` payload was not valid UTF-8, or an ext 0x00 Symbol
+    # A msgpack +str+ payload was not valid UTF-8, or an ext 0x00 Symbol
     # payload was not valid UTF-8 — both are wire violations per SPEC.
     class InvalidEncoding < Error; end
 

data/lib/kobako/codec/factory.rb

@@ -16,7 +16,7 @@ module Kobako
     # § Ext Types).
     #
     # The factory is the single place in the host gem that touches the
-    # msgpack API — both {Encoder} and {Decoder} delegate through it, so
+    # msgpack API — both Encoder and Decoder delegate through it, so
     # the three kobako ext codes (0x00 Symbol, 0x01 Capability Handle,
     # 0x02 Exception envelope) are configured exactly once at first use.
     #
@@ -93,11 +93,11 @@ module Kobako
       end
 
       # Validate the ext-0x00 payload as UTF-8 and intern. Raises
-      # {InvalidEncoding} on invalid bytes — SPEC forbids the
+      # InvalidEncoding on invalid bytes — SPEC forbids the
       # binary-encoding fallback that msgpack-gem's default unpacker
       # would otherwise apply. The re-tag step lives here because the
       # msgpack ext-type unpacker hands us binary bytes; the assertion
-      # itself is shared with {Decoder} via {Utils.assert_utf8!}. The
+      # itself is shared with Decoder via Utils.assert_utf8!. The
       # +"Symbol"+ label keeps the error message in Ruby vocabulary
       # rather than wire-ext-code vocabulary.
       def unpack_symbol(payload)
@@ -125,7 +125,7 @@ module Kobako
       # Peel off the fixext-4 frame, hand the bytes to the
       # Host-Gem-internal +Kobako::Handle.restore+ factory, and
       # translate the +ArgumentError+ raised by Handle's invariants
-      # into a wire-layer +InvalidType+ via {Codec::Utils.with_boundary}.
+      # into a wire-layer +InvalidType+ via Codec::Utils.with_boundary.
       # The Value Object owns the id-range contract; this method only
       # owns the frame shape.
       def unpack_handle(payload)
@@ -136,11 +136,11 @@ module Kobako
         Codec::Utils.with_boundary { Kobako::Handle.restore(id) }
       end
 
-      # Encode the inner ext-0x02 map via {Encoder} (not +factory.dump+) so
+      # Encode the inner ext-0x02 map via Encoder (not +factory.dump+) so
       # the embedded payload flows through the same boundary as a top-level
       # encode — nested kobako values (Handle, nested Fault) reach the
       # registered ext-type packers via the cached singleton. A +details+
-      # chain nested past {MAX_EXT_DEPTH} has no wire representation and
+      # chain nested past MAX_EXT_DEPTH has no wire representation and
       # surfaces as +UnsupportedType+.
       def pack_fault(fault)
         within_ext_frame(UnsupportedType) do
@@ -149,12 +149,12 @@ module Kobako
       end
 
       # Peel the embedded msgpack map and hand it to +Kobako::Fault.new+
-      # inside {Decoder.decode}'s block form, so the value-object's
+      # inside Decoder.decode's block form, so the value-object's
       # +ArgumentError+ invariants surface as +InvalidType+ through the
-      # decoder boundary. Inner decode goes through {Decoder} (not
+      # decoder boundary. Inner decode goes through Decoder (not
       # +factory.load+) so the embedded +str+ payloads flow through the
       # same UTF-8 validation as a top-level decode. A nested ext 0x02 in
-      # +details+ re-enters this method, so {#within_ext_frame} bounds the
+      # +details+ re-enters this method, so #within_ext_frame bounds the
       # chain depth to keep it from exhausting the native stack.
       def unpack_fault(payload)
         within_ext_frame(InvalidType) do
@@ -167,7 +167,7 @@ module Kobako
       end
 
       # Track ext-envelope re-entry depth and refuse a chain past
-      # {MAX_EXT_DEPTH}, raising +over_limit+ so the failure lands in the
+      # MAX_EXT_DEPTH, raising +over_limit+ so the failure lands in the
       # caller's existing wire-error class. The counter is thread-scoped and
       # balanced by the +ensure+, so a raise mid-chain still unwinds it to
       # its entry value.

data/lib/kobako/codec/handle_walk.rb

@@ -5,16 +5,16 @@ require_relative "../handle"
 module Kobako
   module Codec
     # Substitutes Capability Handles into and out of a Ruby value tree at
-    # the host↔guest boundary. {deep_wrap} allocates a +Kobako::Handle+ for
+    # the host↔guest boundary. #deep_wrap allocates a +Kobako::Handle+ for
     # each non-wire-representable leaf on the host→guest +#run+ argument
-    # path; {deep_restore} resolves each wire-decoded Handle back to its
-    # host object on every guest→host value path. {representable?} is the
-    # by-value codec-type predicate that decides which leaves {deep_wrap}
+    # path; #deep_restore resolves each wire-decoded Handle back to its
+    # host object on every guest→host value path. #representable? is the
+    # by-value codec-type predicate that decides which leaves #deep_wrap
     # must wrap: the closed 12-entry wire type set
     # ({docs/wire-codec.md}[link:../../../docs/wire-codec.md] § Type
     # Mapping).
     #
-    # All helpers are pure except {deep_wrap}, whose only side effect is
+    # All helpers are pure except #deep_wrap, whose only side effect is
     # allocating new Handle ids into the supplied table.
     module HandleWalk
       module_function
@@ -24,7 +24,7 @@ module Kobako
       # unsigned +uint 64+ maximum
       # ({docs/wire-codec.md}[link:../../../docs/wire-codec.md] § Type
       # Mapping #3, the +fixint+ / +int 8..64+ / +uint 8..64+ union).
-      # Anchored as a +Range+ so {primitive_type?} stays a single
+      # Anchored as a +Range+ so #primitive_type? stays a single
       # dispatch line. This is the codec's encode domain — not to
       # be confused with the Handle id range, which lives on
       # +Kobako::Handle+ as +MIN_ID+ / +MAX_ID+ (1..2^31 − 1) and
@@ -41,13 +41,13 @@ module Kobako
       # representable. Integers outside the codec's signed-64 /
       # unsigned-64 union are rejected so the predicate agrees with the
       # msgpack gem's encode-time +RangeError+ behaviour the codec
-      # already surfaces as {UnsupportedType}.
+      # already surfaces as UnsupportedType.
       def representable?(value)
         primitive_type?(value) || container_representable?(value)
       end
 
       # Deep-walk Array / Hash containers in +value+ and replace every
-      # leaf that fails {representable?} with a +Kobako::Handle+
+      # leaf that fails #representable? with a +Kobako::Handle+
       # allocated from +handler+. The
       # walk only descends through representable container shapes
       # (Array, Hash) one structural level at a time; a non-representable
@@ -61,13 +61,9 @@ module Kobako
       # whose leaves are either representable or +Kobako::Handle+
       # tokens.
       #
-      # The block bodies spell +HandleWalk.deep_wrap+ explicitly rather
-      # than the unqualified +deep_wrap+ because +module_function+ makes
-      # the instance copy of these helpers private; an implicit receiver
-      # inside a block would resolve against the enclosing +self+
-      # (still +HandleWalk+ at definition time, but the qualified form
-      # keeps the dispatch readable when the recursive call sits inside a
-      # Proc captured from elsewhere).
+      # Recursive calls spell the +HandleWalk.+ receiver so the dispatch
+      # stays valid even when a block is captured and run under a
+      # different +self+ (+module_function+ privatizes the instance copies).
       def deep_wrap(value, handler)
         case value
         when ::Array then value.map { |element| HandleWalk.deep_wrap(element, handler) }
@@ -79,7 +75,7 @@ module Kobako
 
       # Deep-walk Array / Hash containers in +value+ and replace every
       # +Kobako::Handle+ leaf with the host-side object +handler+ resolves
-      # it to. The symmetric inverse of {deep_wrap}: that walk allocates objects
+      # it to. The symmetric inverse of #deep_wrap: that walk allocates objects
       # into Handles on the host→guest argument path; this walk resolves
       # Handles back to their objects wherever a guest→host payload carries
       # one — an invocation result, a yield-block result, or a dispatch
@@ -107,9 +103,9 @@ module Kobako
         end
       end
 
-      # The non-container branch of {representable?}: returns +true+ for
+      # The non-container branch of #representable?: returns +true+ for
       # the scalar leaves and an existing Handle. Not part of the
-      # public surface; reach for {representable?} instead.
+      # public surface; reach for #representable? instead.
       def primitive_type?(value)
         case value
         when ::NilClass, ::TrueClass, ::FalseClass, ::Float, ::String, ::Symbol, Kobako::Handle then true
@@ -118,10 +114,10 @@ module Kobako
         end
       end
 
-      # The container branch of {representable?}: recurses into Array
+      # The container branch of #representable?: recurses into Array
       # elements and Hash key+value pairs through the public
-      # {representable?}. Not part of the public surface; reach for
-      # {representable?} instead.
+      # #representable?. Not part of the public surface; reach for
+      # #representable? instead.
       def container_representable?(value)
         case value
         when ::Array then value.all? { |element| HandleWalk.representable?(element) }

data/lib/kobako/codec/utils.rb

@@ -10,18 +10,18 @@ module Kobako
     #   - UTF-8 assertion at the codec boundary
     #     ({docs/wire-codec.md}[link:../../../docs/wire-codec.md]
     #     § str/bin Encoding Rules and § Ext Types → ext 0x00). Used by
-    #     {Decoder} when walking +str+ family payloads and by {Factory}
+    #     Decoder when walking +str+ family payloads and by Factory
     #     when validating the +ext 0x00+ Symbol payload.
     #   - +ArgumentError+ translation at the codec boundary
-    #     ({with_boundary}) so the public taxonomy stays
-    #     {Kobako::Codec::Error}.
+    #     (#with_boundary) so the public taxonomy stays
+    #     Kobako::Codec::Error.
     #
     # Both helpers are pure — they only inspect inputs, never mutate them.
-    # The host↔guest Handle substitution walk lives in {HandleWalk}.
+    # The host↔guest Handle substitution walk lives in HandleWalk.
     module Utils
       module_function
 
-      # Raise {InvalidEncoding} unless +string+'s bytes are valid under
+      # Raise InvalidEncoding unless +string+'s bytes are valid under
       # its current encoding tag. +label+ is the caller-supplied prefix
       # for the error message (e.g. +"str payload"+, +"Symbol payload"+).
       def assert_utf8!(string, label)
@@ -32,13 +32,13 @@ module Kobako
 
       # Run +block+ at the codec boundary: a value object raises
       # +ArgumentError+ when an invariant is violated at construction, and
-      # this helper surfaces that as {InvalidType} so the public taxonomy
-      # stays {Kobako::Codec::Error} and never leaks +ArgumentError+ from
+      # this helper surfaces that as InvalidType so the public taxonomy
+      # stays Kobako::Codec::Error and never leaks +ArgumentError+ from
       # the Ruby standard library.
       #
       # Reach for this only where a value object is constructed outside a
-      # {Decoder.decode} block, whose rescue already performs the same
-      # mapping (worked example: {Factory#unpack_handle} building
+      # Decoder.decode block, whose rescue already performs the same
+      # mapping (worked example: Factory#unpack_handle building
       # +Handle.restore+ from a raw fixext payload). Do not use it for
       # general-purpose validation outside the codec boundary —
       # host-layer +ArgumentError+ values should propagate unchanged.

data/lib/kobako/codec.rb

@@ -18,12 +18,12 @@ module Kobako
   # the kobako root so the codec can register them without depending
   # upward on Transport.
   #
-  # Backed by the official +msgpack+ gem via {Factory}; {Encoder} and
-  # {Decoder} are thin wrappers that register the three kobako-specific
+  # Backed by the official +msgpack+ gem via Factory; Encoder and
+  # Decoder are thin wrappers that register the three kobako-specific
   # ext types (0x00 Symbol, 0x01 Capability Handle, 0x02 Exception
   # envelope) on a single +MessagePack::Factory+ instance. The Rust side
   # mirrors this layer as the +codec+ module in the +kobako-codec+ crate;
-  # the ext-code constants live as module-private values on {Factory}
+  # the ext-code constants live as module-private values on Factory
   # alongside +codec::EXT_SYMBOL+ / +codec::EXT_HANDLE+ /
   # +codec::EXT_ERRENV+ on that side.
   module Codec

data/lib/kobako/errors.rb

@@ -4,38 +4,13 @@
 module Kobako
   # Error taxonomy.
   #
-  # Every `Kobako::Sandbox` invocation (`#eval` or `#run`) either returns a value or raises
-  # exactly one of three invocation-outcome classes. Attribution is decided after the
-  # guest binary returns control to the host: first the Wasm-trap layer, then
-  # the outcome-envelope tag.
-  #
-  # Three invocation-outcome branches:
-  #
-  #   * {TrapError}     — Wasm engine layer (trap, OOM, unreachable, or a
-  #                       wire-violation fallback signalling a corrupted
-  #                       guest runtime).
-  #   * {SandboxError}  — sandbox / wire layer (mruby script error,
-  #                       wire-decode failure on an otherwise valid tag,
-  #                       Catalog::Handles exhaustion, output buffer overrun).
-  #   * {ServiceError}  — service / capability layer (a Service capability
-  #                       call that failed and was not rescued inside the
-  #                       script).
-  #
-  # Two further branches sit outside the invocation taxonomy:
-  #
-  #   * {SetupError}    — construction layer. Raised by `Kobako::Sandbox.new`
-  #                       when the wasm runtime cannot be built from the
-  #                       configured +wasm_path+ before any invocation runs.
-  #                       Not an invocation outcome, so it never passes
-  #                       through the two-step attribution decision.
-  #   * {PoolTimeoutError} — pool checkout layer. Raised by `Kobako::Pool#with`
-  #                       when the checkout wait exceeds +checkout_timeout+.
-  #
-  # Named subclasses:
-  #
-  #   * {ModuleNotBuiltError} < {SetupError} — Guest Binary artifact absent
-  #                       at +wasm_path+.
-  #   * {HandleExhaustedError} < {SandboxError} — Handle id cap hit.
+  # Every +Kobako::Sandbox+ invocation (+#eval+ or +#run+) either returns a
+  # value or raises exactly one of TrapError, SandboxError, or ServiceError.
+  # Attribution is decided after the guest binary returns control to the
+  # host: first the Wasm-trap layer, then the outcome-envelope tag.
+  # SetupError and PoolTimeoutError sit outside the invocation taxonomy and
+  # never pass through that attribution decision. Each class below
+  # documents its own layer.
 
   # Base for all kobako-raised errors so callers that want to ignore the
   # taxonomy can rescue a single class.
@@ -48,8 +23,8 @@ module Kobako
   #
   # Two named subclasses cover the configured per-invocation caps:
   #
-  #   * {TimeoutError}     — wall-clock +timeout+ exceeded.
-  #   * {MemoryLimitError} — guest +memory.grow+ would exceed
+  #   * TimeoutError     — wall-clock +timeout+ exceeded.
+  #   * MemoryLimitError — guest +memory.grow+ would exceed
   #                          +memory_limit+.
   #
   # Host Apps that only care about "guest is unrecoverable, discard the
@@ -128,14 +103,14 @@ module Kobako
   class HandleExhaustedError < SandboxError; end
 
   # BytecodeError is the SandboxError subclass raised when a
-  # `#preload(binary:)` snippet fails structural validation during the
-  # first invocation's snippet replay against a fresh `mrb_state` (RITE
+  # +#preload(binary:)+ snippet fails structural validation during the
+  # first invocation's snippet replay against a fresh +mrb_state+ (RITE
   # version mismatch or corrupt body). Bytecode that loads cleanly and
-  # then raises at top level surfaces as plain `SandboxError` with the
+  # then raises at top level surfaces as plain +SandboxError+ with the
   # natural mruby class preserved. Inherits from SandboxError so a single
-  # `rescue Kobako::SandboxError` covers both source and bytecode
+  # +rescue Kobako::SandboxError+ covers both source and bytecode
   # snippet failures while callers wanting bytecode-specific handling
-  # can `rescue Kobako::BytecodeError` directly.
+  # can +rescue Kobako::BytecodeError+ directly.
   class BytecodeError < SandboxError; end
 
   # Pool checkout layer. Raised by +Kobako::Pool#with+ when the checkout

data/lib/kobako/handle.rb

@@ -14,8 +14,10 @@ module Kobako
   # The constructor is internal to the Host Gem. +Kobako::Handle.new+ is
   # privatised so Host App code cannot fabricate a Handle from a bare
   # integer; legitimate Handle instances enter Host App code only as
-  # fields on raised error objects. The Host Gem itself constructs
-  # Handles through {.restore}, which exists at exactly two call
+  # fields on raised error objects. +#with+ — Data's copy-with-changes
+  # constructor — is removed for the same reason: a legitimate Handle
+  # must not derive a sibling with a caller-chosen id. The Host Gem itself constructs
+  # Handles through +.restore+, which exists at exactly two call
   # sites: +Kobako::Codec::Factory#unpack_handle+ (wire decode) and
   # +Kobako::Codec::HandleWalk.deep_wrap+ / +Kobako::Transport::Dispatcher#wrap_as_handle+
   # (allocator paths). Both live inside +lib/kobako/+ and are not part
@@ -41,6 +43,7 @@ module Kobako
     end
 
     private_class_method :new
+    undef_method :with
 
     # Host Gem–internal factory. Allocates the Data instance through
     # +Class#allocate+ and dispatches +#initialize+ explicitly so the

data/lib/kobako/namespace.rb

@@ -3,7 +3,7 @@
 module Kobako
   # A named grouping of Members for one Sandbox.
   # Returned by +Sandbox#define+. Each instance owns a flat name→object
-  # table of Members; member binding is validated against {NAME_PATTERN}.
+  # table of Members; member binding is validated against NAME_PATTERN.
   class Namespace
     # Ruby constant-name pattern shared by Namespace and Member names.
     NAME_PATTERN = /\A[A-Z]\w*\z/
@@ -11,7 +11,7 @@ module Kobako
     attr_reader :name
 
     # Build a new Namespace. +name+ is an already-validated Namespace
-    # name (must satisfy {NAME_PATTERN}; validation is the caller's
+    # name (must satisfy NAME_PATTERN; validation is the caller's
     # responsibility).
     def initialize(name)
       @name = name
@@ -38,7 +38,7 @@ module Kobako
 
     # Mark this Namespace as sealed. Called by
     # +Kobako::Catalog::Namespaces#seal!+ on the owning Sandbox's first
-    # invocation; afterwards {#bind} raises +ArgumentError+. Idempotent;
+    # invocation; afterwards #bind raises +ArgumentError+. Idempotent;
     # returns +self+.
     def seal!
       @sealed = true

data/lib/kobako/outcome.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require_relative "codec"
 require_relative "outcome/panic"
 require_relative "transport/error"
 

data/lib/kobako/sandbox.rb

@@ -120,7 +120,9 @@ module Kobako
     # Register a snippet on this Sandbox in one of two forms:
     #
     #   * +preload(code: source, name: Name)+ — +source+ is mruby source
-    #     as a +String+ and +Name+ matches +/\A[A-Z]\w*\z/+. The +name+
+    #     as a +String+ and +Name+ matches +/\A[A-Z]\w*\z/+. Compile
+    #     failures surface as +Kobako::SandboxError+ on the first
+    #     invocation's replay. The +name+
     #     becomes the snippet's +(snippet:Name)+ backtrace filename and
     #     is the dedupe key that rejects a duplicate +code:+ snippet.
     #   * +preload(binary: bytes)+ — +bytes+ is precompiled RITE
@@ -216,7 +218,7 @@ module Kobako
     # runtime that cannot honor the request never runs guest code.
     def build_runtime!
       runtime = Kobako::Runtime.from_path(@wasm_path, @options.timeout, @options.memory_limit,
-                                          @options.stdout_limit, @options.stderr_limit, profile)
+                                          @options.stdout_limit, @options.stderr_limit, @options.profile)
       @options.enforce_floor!(runtime.profile)
       runtime
     end
@@ -257,10 +259,8 @@ module Kobako
     # the readout here also covers the trap path, where +Runtime#eval+ /
     # +#run+ raise instead of returning outcome bytes.
     #
-    # The ext returns a positional 2-tuple +[wall_time, memory_peak]+
-    # whose order matches the +Kobako::Usage+ field order; the
-    # destructure-then-kwargs handoff below is the explicit
-    # positional→keyword conversion point.
+    # The ext-side contract is positional: +Runtime#usage+ yields
+    # +[wall_time, memory_peak]+ in +Kobako::Usage+ field order.
     def read_usage!
       wall_time, memory_peak = @runtime.usage
       @usage = Usage.new(wall_time: wall_time, memory_peak: memory_peak)
@@ -283,16 +283,14 @@ module Kobako
 
     # Read the per-last-invocation output captures from the ext and wrap
     # them as +Kobako::Capture+ value objects. Runs in the +invoke!+
-    # +ensure+ block next to {#read_usage!} for the same reason: the ext
+    # +ensure+ block next to #read_usage! for the same reason: the ext
     # stashes the captures on every outcome, so the readout also covers
     # the trap path, where +Runtime#eval+ / +#run+ raise instead of
     # returning outcome bytes — +#stdout+ / +#stderr+ keep the guest's
     # partial output readable after a rescue.
     #
-    # The ext returns a positional 4-tuple
-    # +[stdout_bytes, stdout_truncated, stderr_bytes, stderr_truncated]+;
-    # the destructure-then-kwargs handoff below is the explicit
-    # positional→keyword conversion point.
+    # The ext-side contract is positional: +Runtime#captures+ yields
+    # +[stdout_bytes, stdout_truncated, stderr_bytes, stderr_truncated]+.
     def read_captures!
       stdout_bytes, stdout_truncated, stderr_bytes, stderr_truncated = @runtime.captures
       @stdout_capture = Capture.new(bytes: stdout_bytes, truncated: stdout_truncated)
@@ -306,7 +304,7 @@ module Kobako
     # The yielded block must return the invocation's raw outcome bytes —
     # i.e. the value of +Runtime#eval+ / +#run+ — which the success path
     # feeds to +Outcome.decode+. Captures and usage are populated by the
-    # +ensure+ readouts ({#read_usage!} / {#read_captures!}) on every
+    # +ensure+ readouts (#read_usage! / #read_captures!) on every
     # outcome, so +#stdout+ / +#stderr+ / +#usage+ stay readable after a
     # rescued trap.
     # The rescue chain is the single trap-translation boundary —

data/lib/kobako/transport/dispatcher.rb

@@ -27,7 +27,7 @@ module Kobako
     #   Kobako::Transport::Dispatcher.dispatch(request_bytes, namespaces, handler, yield_to_guest)
     #   # => msgpack-encoded Response bytes (never raises)
     module Dispatcher
-      # Throw tag for the {Yielder}'s break unwind back to the
+      # Throw tag for the Yielder's break unwind back to the
       # dispatcher's +catch+ frame. +private_constant+ is a
       # convention boundary — not a defence.
       BREAK_THROW = :__kobako_break__
@@ -54,12 +54,12 @@ module Kobako
       # Callable gadget types whose own public methods are reflection surface
       # (+Proc#binding+ reaches +Binding#eval+, +Method#receiver+ / +#unbind+
       # hand back the underlying object) rather than Service behaviour. Only
-      # {CALLABLE_ALLOW} is reachable on a target of these types; a bound
+      # CALLABLE_ALLOW is reachable on a target of these types; a bound
       # lambda stays invocable, its reflective surface does not.
       GADGET_OWNERS = [Proc, Method, UnboundMethod, Binding].freeze
       private_constant :GADGET_OWNERS
 
-      # The sole methods reachable on a {GADGET_OWNERS} target: invoking it
+      # The sole methods reachable on a GADGET_OWNERS target: invoking it
       # (+call+ / +[]+ / +yield+) and the harmless +arity+ / +lambda?+
       # describers that aid guest-side debugging.
       CALLABLE_ALLOW = %i[call [] yield arity lambda?].freeze
@@ -91,7 +91,7 @@ module Kobako
       end
 
       # Resolve positional and keyword arguments off +request+ in one
-      # step. Both pass through {#resolve_arg} so Capability Handles
+      # step. Both pass through #resolve_arg so Capability Handles
       # round-trip back to the host-side Ruby object before the call
       # reaches +public_send+.
       def resolve_call_args(request, handler)
@@ -101,7 +101,7 @@ module Kobako
 
       # Map an error caught at the dispatch boundary to a +Response.error+
       # envelope (binary msgpack). +error+ is the +StandardError+ caught by
-      # {#dispatch}'s rescue; the +type+ field tells the guest which kind
+      # #dispatch's rescue; the +type+ field tells the guest which kind
       # of failure it was so it can raise the matching proxy-side error.
       def encode_caught_error(error)
         case error
@@ -119,8 +119,8 @@ module Kobako
       # reject calls to no-kwarg methods when the wire carries the
       # uniform empty-map shape.
       #
-      # +yielder+ is the host-side {Yielder} materialised when the guest
-      # call site supplied a block; its {Yielder#to_proc}
+      # +yielder+ is the host-side Yielder materialised when the guest
+      # call site supplied a block; its Yielder#to_proc
       # rides the +&block+ slot. +&nil+ is a no-op block argument in Ruby,
       # so the same call site handles both cases without an explicit
       # conditional.
@@ -137,8 +137,8 @@ module Kobako
       end
 
       # Guard the +public_send+ below against ambient reflection methods.
-      # A public method whose owner is a {META_OWNERS} or {GADGET_OWNERS} module is
-      # rejected, except {CALLABLE_ALLOW} on a gadget target (a bound lambda
+      # A public method whose owner is a META_OWNERS or GADGET_OWNERS module is
+      # rejected, except CALLABLE_ALLOW on a gadget target (a bound lambda
       # stays invocable). A name with no concrete public method is allowed
       # only when the target opts into it via +respond_to?+ (dynamic
       # +method_missing+ Services), since the dangerous methods are all
@@ -159,7 +159,7 @@ module Kobako
       # Consult the target's opt-in narrowing predicate. A bound object
       # may define a private +respond_to_guest?(name)+ to restrict which of its
       # methods the guest reaches; a falsy answer rejects the dispatch.
-      # The predicate composes beneath {#reject_meta_method!} — it only narrows,
+      # The predicate composes beneath #reject_meta_method! — it only narrows,
       # never re-opening the reflection surface the floor rejects — and is
       # consulted with the private surface included so the guest's +public_send+
       # dispatch can never reach +respond_to_guest?+ itself.
@@ -213,7 +213,7 @@ module Kobako
       # Encode +value+ as a +Response.ok+ envelope. When the value is not
       # wire-representable per the codec's type mapping, the
       # +UnsupportedType+ rescue routes it through the
-      # Catalog::Handles via {#wrap_as_handle} and re-encodes with the Capability
+      # Catalog::Handles via #wrap_as_handle and re-encodes with the Capability
       # Handle in place. The happy path encodes exactly once.
       def encode_ok(value, handler)
         response = Kobako::Transport::Response.ok(value)
@@ -224,15 +224,18 @@ module Kobako
 
       # Allocate +value+ in the Sandbox's Catalog::Handles and return a +Handle+
       # that the wire codec can carry. Used as the fallback path of
-      # {#encode_ok} when +value+ has no wire representation.
+      # #encode_ok when +value+ has no wire representation.
       def wrap_as_handle(value, handler)
         handler.alloc(value)
       end
 
+      # +message+ folds to UTF-8 first: Ruby core builds some exception
+      # messages as ASCII-8BIT (the arity ArgumentError, for one), and
+      # the codec would ride those as bin — a shape the guest refuses.
       def encode_error(type, message)
+        message = message.encode(Encoding::UTF_8, invalid: :replace, undef: :replace)
         fault = Kobako::Fault.new(type: type, message: message)
-        response = Kobako::Transport::Response.error(fault)
-        response.encode
+        Kobako::Transport::Response.error(fault).encode
       end
     end
   end

data/lib/kobako/transport/request.rb

@@ -13,7 +13,7 @@ module Kobako
     # 5-element msgpack array:
     # +[target, method_name, args, kwargs, block_given]+. +target+ is
     # either a +String+ (+"<Namespace>::<Member>"+, e.g. +"MyService::KV"+)
-    # or a {Handle}. SPEC pins +kwargs+ map keys to ext 0x00 Symbol;
+    # or a Handle. SPEC pins +kwargs+ map keys to ext 0x00 Symbol;
     # enforced at construction so the Value Object is the single source of
     # truth. +block_given+ is a Boolean signalling whether the guest call
     # site supplied a block; the block body itself never crosses the
@@ -43,7 +43,7 @@ module Kobako
         Codec::Encoder.encode([target, method_name, args, kwargs, block_given])
       end
 
-      # Decode +bytes+ into a {Request}. Raises +Codec::InvalidType+ when the
+      # Decode +bytes+ into a Request. Raises +Codec::InvalidType+ when the
       # envelope is not the expected 5-element msgpack array, or when the
       # Value Object's construction invariants reject the decoded fields.
       def self.decode(bytes)

data/lib/kobako/transport/response.rb

@@ -20,7 +20,7 @@ module Kobako
     #
     # 2-element msgpack array: +[status, value-or-fault]+. +status+ is 0
     # (success) or 1 (fault). For success the second element is the return
-    # value; for fault it is a {Fault} (ext 0x02 envelope).
+    # value; for fault it is a Fault (ext 0x02 envelope).
     #
     # Built on the +class X < Data.define(...)+ subclass form so the
     # class body is fully Steep-visible; see +lib/kobako/outcome/panic.rb+
@@ -58,7 +58,7 @@ module Kobako
         Codec::Encoder.encode([status, payload])
       end
 
-      # Decode +bytes+ into a {Response}. Raises +Codec::InvalidType+ when the
+      # Decode +bytes+ into a Response. Raises +Codec::InvalidType+ when the
       # envelope is not the expected 2-element msgpack array, or when the
       # Value Object's construction invariants reject the decoded fields.
       def self.decode(bytes)

data/lib/kobako/transport/run.rb

@@ -51,7 +51,7 @@ module Kobako
       # Encode this Run to the msgpack bytes the guest's +__kobako_run+
       # entry point consumes as its command-buffer payload
       # ({docs/wire-codec.md Invocation channels}[link:../../../docs/wire-codec.md]).
-      # Walks +args+ / +kwargs+ through {Codec::HandleWalk.deep_wrap} so
+      # Walks +args+ / +kwargs+ through Codec::HandleWalk.deep_wrap so
       # any non-wire-representable leaf is allocated into +handler+ and
       # replaced with a +Kobako::Handle+; the
       # +handler+ argument is the Sandbox's table, sharing the same

data/lib/kobako/transport/yield.rb

@@ -10,9 +10,9 @@ module Kobako
     # First byte of the YieldResponse for the success branch — body is
     # the block's return value encoded as a single msgpack value.
     TAG_OK = 0x01
-    # First byte for `break val` — body is the break value.
+    # First byte for +break val+ — body is the break value.
     TAG_BREAK = 0x02
-    # Reserved for future `return val` support; both sides reject this
+    # Reserved for future +return val+ support; both sides reject this
     # tag as a wire violation (YieldResponse envelope contract).
     TAG_RESERVED = 0x03
     # First byte for an error / fault outcome — body is a
@@ -58,7 +58,7 @@ module Kobako
         [tag].pack("C") + Codec::Encoder.encode(value)
       end
 
-      # Decode +bytes+ into a {Yield}. Rejects empty input, the reserved
+      # Decode +bytes+ into a Yield. Rejects empty input, the reserved
       # tag 0x03, and any tag outside +LIVE_TAGS+ by raising
       # +Kobako::Codec::InvalidType+ — these are wire violations per the
       # SPEC's YieldResponse envelope contract.

data/lib/kobako/transport/yielder.rb

@@ -13,7 +13,7 @@ module Kobako
     # Each guest call that carries +block_given: true+ gets a Yielder
     # that the Dispatcher hands to the Service method as +&block+. The
     # Service method observes it as an ordinary Ruby Proc through
-    # {#to_proc}; +yield val+ / +block.call(val)+ invokes {#yield}, which
+    # #to_proc; +yield val+ / +block.call(val)+ invokes #yield, which
     # serialises the positional args, re-enters the guest via the injected
     # +yield_to_guest+ lambda, and reifies the +YieldResponse+ into Ruby
     # control flow:
@@ -24,13 +24,13 @@ module Kobako
     #   * +tag 0x04+ error — raise the +{class, message}+ payload at the
     #     Service's yield site
     #
-    # The Dispatcher calls {#invalidate!} from its +ensure+ block once
+    # The Dispatcher calls #invalidate! from its +ensure+ block once
     # dispatch completes; any later call to a stashed Yielder then raises
     # +LocalJumpError+ — the observable shape of an escaped Yielder.
     class Yielder
       # +yield_to_guest+ is a +String → String+ callable (the ext's
       # per-dispatch +Kobako::Runtime::GuestYielder+) that
-      # {#yield} invokes to re-enter the guest; +break_tag+ is the +catch+
+      # #yield invokes to re-enter the guest; +break_tag+ is the +catch+
       # throw tag the Dispatcher matches against to unwind the Service on
       # +tag 0x02+. +handler+ is the Sandbox's +Kobako::Catalog::Handles+,
       # used to restore a Capability Handle in the block's ok value back to
@@ -44,7 +44,7 @@ module Kobako
 
       # Re-enter the guest with +args+ and reify the YieldResponse into
       # Ruby control flow. Raises +LocalJumpError+ if called after
-      # {#invalidate!}. The ok value is consumed by the host Service
+      # #invalidate!. The ok value is consumed by the host Service
       # method, so a Capability Handle in it is restored to its host object.
       # The break value unwinds past the Service back to the guest
       # Member call, so it passes through verbatim — a Handle stays a
@@ -60,14 +60,14 @@ module Kobako
         raise yield_failure(response.value, default: "yield error")
       end
 
-      # The Proc the Dispatcher passes as +&block+, binding {#yield} so a
+      # The Proc the Dispatcher passes as +&block+, binding #yield so a
       # Service method's +yield+ / +block.call+ drives the round-trip.
       def to_proc
         method(:yield).to_proc
       end
 
       # Mark this Yielder dead. Called by the Dispatcher's +ensure+ block
-      # when the originating dispatch frame returns; any later {#yield}
+      # when the originating dispatch frame returns; any later #yield
       # call then raises +LocalJumpError+.
       def invalidate!
         @active = false

data/lib/kobako/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Kobako
-  VERSION = "0.13.0"
+  VERSION = "0.14.0"
 end

data/release-please-config.json

@@ -29,28 +29,28 @@
         }
       ]
     },
-    "wasm/kobako": {
-      "component": "kobako-rs",
+    "wasm/kobako-mruby": {
+      "component": "kobako-mruby",
       "release-type": "rust",
       "extra-files": [
         {
           "type": "toml",
           "path": "/wasm/Cargo.lock",
-          "jsonpath": "$.package[?(@.name=='kobako')].version"
+          "jsonpath": "$.package[?(@.name=='kobako-mruby')].version"
         },
         {
           "type": "toml",
-          "path": "/wasm/kobako/Cargo.toml",
+          "path": "/wasm/kobako-mruby/Cargo.toml",
           "jsonpath": "$.dependencies['kobako-core'].version"
         },
         {
           "type": "toml",
-          "path": "/wasm/kobako/Cargo.toml",
+          "path": "/wasm/kobako-mruby/Cargo.toml",
           "jsonpath": "$.dependencies['kobako-codec'].version"
         },
         {
           "type": "generic",
-          "path": "/wasm/kobako/README.md"
+          "path": "/wasm/kobako-mruby/README.md"
         }
       ]
     },
@@ -178,13 +178,43 @@
           "path": "/crates/kobako-wasmtime/README.md"
         }
       ]
+    },
+    "crates/kobako": {
+      "component": "kobako-sdk",
+      "release-type": "rust",
+      "extra-files": [
+        {
+          "type": "toml",
+          "path": "/crates/Cargo.lock",
+          "jsonpath": "$.package[?(@.name=='kobako')].version"
+        },
+        {
+          "type": "toml",
+          "path": "/crates/kobako/Cargo.toml",
+          "jsonpath": "$.dependencies['kobako-codec'].version"
+        },
+        {
+          "type": "toml",
+          "path": "/crates/kobako/Cargo.toml",
+          "jsonpath": "$.dependencies['kobako-runtime'].version"
+        },
+        {
+          "type": "toml",
+          "path": "/crates/kobako/Cargo.toml",
+          "jsonpath": "$.dependencies['kobako-wasmtime'].version"
+        },
+        {
+          "type": "generic",
+          "path": "/crates/kobako/README.md"
+        }
+      ]
     }
   },
   "plugins": [
     {
       "type": "linked-versions",
       "groupName": "kobako crates",
-      "components": ["kobako-codec", "kobako-core", "kobako-rs", "kobako-io", "kobako-json", "kobako-regexp", "kobako-baker", "kobako-runtime", "kobako-wasmtime"]
+      "components": ["kobako-codec", "kobako-core", "kobako-mruby", "kobako-io", "kobako-json", "kobako-regexp", "kobako-baker", "kobako-runtime", "kobako-wasmtime", "kobako-sdk"]
     }
   ],
   "extra-files": [

data/sig/kobako/codec/handle_walk.rbs

@@ -5,9 +5,9 @@ module Kobako
 
       def self?.representable?: (untyped value) -> bool
 
-      def self?.deep_wrap: (untyped value, Kobako::Catalog::Handles handler) -> untyped
+      def self?.deep_wrap: (untyped value, Kobako::Codec::_HandleTable handler) -> untyped
 
-      def self?.deep_restore: (untyped value, Kobako::Catalog::Handles handler) -> untyped
+      def self?.deep_restore: (untyped value, Kobako::Codec::_HandleTable handler) -> untyped
 
       def self?.primitive_type?: (untyped value) -> bool
 

data/sig/kobako/codec.rbs

@@ -1,4 +1,15 @@
 module Kobako
   module Codec
+    # The Handle allocator/resolver a wire walk works against: alloc
+    # registers a non-wire-representable object and returns its Handle,
+    # fetch resolves a wire Handle id back to the live object. The
+    # Sandbox's Kobako::Catalog::Handles is the production conformer;
+    # modelled structurally so the Codec and Transport tiers need no
+    # upward dependency on Catalog.
+    interface _HandleTable
+      def alloc: (untyped object) -> Kobako::Handle
+
+      def fetch: (Integer id) -> untyped
+    end
   end
 end

data/sig/kobako/handle.rbs

@@ -9,8 +9,6 @@ module Kobako
 
     def self.restore: (Integer id) -> Handle
 
-    def with: (?id: Integer) -> Handle
-
     def ==: (untyped other) -> bool
 
     def hash: () -> Integer

data/sig/kobako/transport/dispatcher.rbs

@@ -12,9 +12,9 @@ module Kobako
 
       CALLABLE_ALLOW: Array[Symbol]
 
-      def self?.dispatch: (String request_bytes, Kobako::Catalog::Namespaces namespaces, Kobako::Catalog::Handles handler, Kobako::Transport::_GuestYielder yield_to_guest) -> String
+      def self?.dispatch: (String request_bytes, Kobako::Transport::_NamespaceRegistry namespaces, Kobako::Codec::_HandleTable handler, Kobako::Transport::_GuestYielder yield_to_guest) -> String
 
-      def self?.resolve_call_args: (Kobako::Transport::Request request, Kobako::Catalog::Handles handler) -> [Array[untyped], Hash[Symbol, untyped]]
+      def self?.resolve_call_args: (Kobako::Transport::Request request, Kobako::Codec::_HandleTable handler) -> [Array[untyped], Hash[Symbol, untyped]]
 
       def self?.encode_caught_error: (StandardError error) -> String
 
@@ -24,17 +24,17 @@ module Kobako
 
       def self?.reject_unexposed!: (untyped target, Symbol name) -> void
 
-      def self?.resolve_arg: (untyped value, Kobako::Catalog::Handles handler) -> untyped
+      def self?.resolve_arg: (untyped value, Kobako::Codec::_HandleTable handler) -> untyped
 
-      def self?.resolve_target: (String | Kobako::Handle target, Kobako::Catalog::Namespaces namespaces, Kobako::Catalog::Handles handler) -> untyped
+      def self?.resolve_target: (String | Kobako::Handle target, Kobako::Transport::_NamespaceRegistry namespaces, Kobako::Codec::_HandleTable handler) -> untyped
 
-      def self?.resolve_path: (String path, Kobako::Catalog::Namespaces namespaces) -> untyped
+      def self?.resolve_path: (String path, Kobako::Transport::_NamespaceRegistry namespaces) -> untyped
 
-      def self?.require_live_object!: (Integer id, Kobako::Catalog::Handles handler) -> untyped
+      def self?.require_live_object!: (Integer id, Kobako::Codec::_HandleTable handler) -> untyped
 
-      def self?.encode_ok: (untyped value, Kobako::Catalog::Handles handler) -> String
+      def self?.encode_ok: (untyped value, Kobako::Codec::_HandleTable handler) -> String
 
-      def self?.wrap_as_handle: (untyped value, Kobako::Catalog::Handles handler) -> Kobako::Handle
+      def self?.wrap_as_handle: (untyped value, Kobako::Codec::_HandleTable handler) -> Kobako::Handle
 
       def self?.encode_error: (String type, String message) -> String
     end

data/sig/kobako/transport/run.rbs

@@ -11,7 +11,7 @@ module Kobako
 
       def initialize: (entrypoint: Symbol | String, ?args: Array[untyped], ?kwargs: Hash[untyped, untyped]) -> void
 
-      def encode: (Kobako::Catalog::Handles handler) -> String
+      def encode: (Kobako::Codec::_HandleTable handler) -> String
 
       private
 

data/sig/kobako/transport/yielder.rbs

@@ -3,10 +3,10 @@ module Kobako
     class Yielder
       @yield_to_guest: Kobako::Transport::_GuestYielder
       @break_tag: Symbol
-      @handler: Kobako::Catalog::Handles
+      @handler: Kobako::Codec::_HandleTable
       @active: bool
 
-      def initialize: (Kobako::Transport::_GuestYielder yield_to_guest, Symbol break_tag, Kobako::Catalog::Handles handler) -> void
+      def initialize: (Kobako::Transport::_GuestYielder yield_to_guest, Symbol break_tag, Kobako::Codec::_HandleTable handler) -> void
 
       def yield: (*untyped args) -> untyped
 

data/sig/kobako/transport.rbs

@@ -8,5 +8,13 @@ module Kobako
     interface _GuestYielder
       def call: (String) -> String
     end
+
+    # The Service registry a dispatch resolves constant-path targets
+    # against. The Sandbox's Kobako::Catalog::Namespaces is the
+    # production conformer; modelled structurally so the Transport
+    # layer needs no upward dependency on Catalog.
+    interface _NamespaceRegistry
+      def lookup: (String target) -> untyped
+    end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kobako
 version: !ruby/object:Gem::Version
-  version: 0.13.0
+  version: 0.14.0
 platform: aarch64-linux
 authors:
 - Aotokitsuruya
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2026-07-03 00:00:00.000000000 Z
+date: 2026-07-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: msgpack
@@ -37,6 +37,7 @@ files:
 - CHANGELOG.md
 - LICENSE
 - README.md
+- ROADMAP.md
 - SECURITY.md
 - crates/kobako-runtime/CHANGELOG.md
 - crates/kobako-runtime/README.md