@wenathlan/saddle 2.0.150 → 2.0.152

package/dist/modalityregistry.js

@@ -0,0 +1,1386 @@
+// # modalityregistry — the catalog of the sandbox modalities the saddle
+// engine opens (root layer, wave SV1). One record per modality: the
+// isolation family, the driver requirements it mounts, the boot cost class,
+// the hardening gates it carries, the mime contract it answers and the
+// honest state of its wiring. The registry is the spine of the ninety
+// modality plan (the owner's law: the ninety modalities of saddle act for
+// the system, nothing touches the visitor machine): the workload never
+// chooses by name — the join resolver reads the request (isolation, gpu,
+// network, boot budget) and answers the modality set that satisfies it, so
+// the person chooses none and the platform resolves the join of all (the
+// nuclear modality law). Every record declares its state — live, host or
+// planned — so the report never lies: a lane that does not wire a modality
+// says so instead of pretending. Pure data and pure functions: zero
+// storage, zero node-only imports, the browser-pure bundle keeps carrying
+// it.
+/** The boot budgets of the ladder, per class: the ceilings the records walk
+ * under (firecracker 125 ms and gvisor about 200 ms ride warm, the full
+ * machine images ride cold). */
+export const BOOTLADDER = Object.freeze({
+    hot: 25,
+    warm: 800,
+    cold: 1500,
+});
+/** The ninety modality plan: the count the owner charged (the ninety
+ * modalities of saddle acting for the system) and the registry answers —
+ * the catalog walked from twenty through forty to the ninety law, and
+ * this constant is the line the plan pins. */
+export const MODALITYPLANCOUNT = 90;
+/** The modality records: the catalog the join resolver reads. */
+export const MODALITIES = Object.freeze([
+    // the virtual family: the full machine with the virtual drivers
+    {
+        id: "virtual-full",
+        label: "complete virtual",
+        family: "virtual",
+        isolation: "hardware",
+        state: "live",
+        drivers: ["virtualcpu", "virtualgpu", "virtualmemory"],
+        hardening: ["profile-lock"],
+        boot: "cold",
+        bootms: BOOTLADDER.cold,
+        gpu: true,
+        network: true,
+        mime: "application/vnd.devthink.sandbox+json",
+    },
+    {
+        id: "virtual-vgpu",
+        label: "vgpu slice",
+        family: "virtual",
+        isolation: "hardware",
+        state: "live",
+        drivers: ["virtualgpu", "nvml-shim", "vfio"],
+        hardening: ["mig-profile"],
+        boot: "warm",
+        bootms: 600,
+        gpu: true,
+        network: true,
+        mime: "application/vnd.devthink.sandbox+json",
+    },
+    {
+        id: "virtual-screen",
+        label: "vm plus vnc",
+        family: "screen",
+        isolation: "vm",
+        state: "live",
+        drivers: ["virtualcpu", "virtualgpu", "xvfb", "looking-glass"],
+        hardening: ["session-otp"],
+        boot: "warm",
+        bootms: 700,
+        gpu: true,
+        network: true,
+        mime: "application/vnd.devthink.screen+json",
+    },
+    {
+        id: "virtual-drivers",
+        label: "virtual drivers",
+        family: "virtual",
+        isolation: "vm",
+        state: "live",
+        drivers: ["virtualcpu", "virtualgpu", "virtualmemory", "nvml-shim"],
+        hardening: ["driver-quota"],
+        boot: "warm",
+        bootms: 250,
+        gpu: true,
+        network: false,
+        mime: "application/vnd.devthink.sandbox+json",
+    },
+    {
+        id: "virtual-kvm",
+        label: "kvm machine",
+        family: "virtual",
+        isolation: "hardware",
+        state: "live",
+        drivers: ["kvm", "virtualcpu"],
+        hardening: ["clean-rootfs"],
+        boot: "warm",
+        bootms: 150,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.sandbox+json",
+    },
+    // the runner family: the universal binary runner
+    {
+        id: "runner-universal",
+        label: "universal runner",
+        family: "runner",
+        isolation: "namespace",
+        state: "live",
+        drivers: ["binfmt", "bash"],
+        hardening: ["read-only-root", "dropped-caps"],
+        boot: "warm",
+        bootms: BOOTLADDER.warm,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.run+json",
+    },
+    {
+        id: "runner-node",
+        label: "node packages",
+        family: "packages",
+        isolation: "process",
+        state: "live",
+        drivers: ["node", "babel", "swc"],
+        hardening: ["package-allowlist"],
+        boot: "hot",
+        bootms: BOOTLADDER.hot,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.run+json",
+    },
+    {
+        id: "runner-bun",
+        label: "bun runtime",
+        family: "packages",
+        isolation: "process",
+        state: "live",
+        drivers: ["bun"],
+        hardening: ["package-allowlist"],
+        boot: "hot",
+        bootms: 20,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.run+json",
+    },
+    {
+        id: "runner-deno",
+        label: "deno runtime",
+        family: "packages",
+        isolation: "process",
+        state: "live",
+        drivers: ["deno"],
+        hardening: ["permission-map"],
+        boot: "hot",
+        bootms: 20,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.run+json",
+    },
+    {
+        id: "runner-webpack",
+        label: "webpack bundle",
+        family: "packages",
+        isolation: "process",
+        state: "live",
+        drivers: ["webpack", "swc"],
+        hardening: ["bundle-allowlist"],
+        boot: "hot",
+        bootms: 18,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.run+json",
+    },
+    {
+        id: "runner-babel",
+        label: "babel transpile",
+        family: "packages",
+        isolation: "process",
+        state: "live",
+        drivers: ["babel"],
+        hardening: ["plugin-allowlist"],
+        boot: "hot",
+        bootms: 15,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.run+json",
+    },
+    {
+        id: "runner-wasm",
+        label: "wasm and wasi",
+        family: "wasm",
+        isolation: "process",
+        state: "live",
+        drivers: ["wasmer", "wasmedge"],
+        hardening: ["capability-imports"],
+        boot: "hot",
+        bootms: 15,
+        gpu: false,
+        network: false,
+        mime: "application/wasm",
+    },
+    {
+        id: "runner-serverless",
+        label: "v8 isolates",
+        family: "runner",
+        isolation: "process",
+        state: "live",
+        drivers: ["v8"],
+        hardening: ["no-fs", "cpu-quota"],
+        boot: "hot",
+        bootms: 8,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.run+json",
+    },
+    // the language family: the polyglot toolchains the engine mounts inside
+    // the sandbox (every runner documented by its driver set — the exec lane
+    // drives each through the host runtime, the honest probe answers per host)
+    {
+        id: "language-python",
+        label: "cpython runtime",
+        family: "language",
+        isolation: "process",
+        state: "live",
+        drivers: ["python3"],
+        hardening: ["package-allowlist"],
+        boot: "hot",
+        bootms: 12,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.run+json",
+    },
+    {
+        id: "language-go",
+        label: "golang toolchain",
+        family: "language",
+        isolation: "process",
+        state: "live",
+        drivers: ["go"],
+        hardening: ["gopath-jail"],
+        boot: "hot",
+        bootms: 15,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.run+json",
+    },
+    {
+        id: "language-rust",
+        label: "rustc toolchain",
+        family: "language",
+        isolation: "process",
+        state: "live",
+        drivers: ["rustc"],
+        hardening: ["crate-allowlist"],
+        boot: "hot",
+        bootms: 18,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.run+json",
+    },
+    {
+        id: "language-cargo",
+        label: "cargo builds",
+        family: "language",
+        isolation: "process",
+        state: "live",
+        drivers: ["cargo"],
+        hardening: ["crate-allowlist"],
+        boot: "hot",
+        bootms: 20,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.run+json",
+    },
+    {
+        id: "language-v",
+        label: "v compiler",
+        family: "language",
+        isolation: "process",
+        state: "live",
+        drivers: ["v"],
+        hardening: ["package-allowlist"],
+        boot: "hot",
+        bootms: 15,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.run+json",
+    },
+    {
+        id: "language-java",
+        label: "jdk runtime",
+        family: "language",
+        isolation: "process",
+        state: "live",
+        drivers: ["java", "javac"],
+        hardening: ["security-manager"],
+        boot: "warm",
+        bootms: 200,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.run+json",
+    },
+    {
+        id: "language-dotnet",
+        label: "dotnet runtime",
+        family: "language",
+        isolation: "process",
+        state: "live",
+        drivers: ["dotnet"],
+        hardening: ["assembly-allowlist"],
+        boot: "warm",
+        bootms: 150,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.run+json",
+    },
+    {
+        id: "language-ruby",
+        label: "ruby interpreter",
+        family: "language",
+        isolation: "process",
+        state: "live",
+        drivers: ["ruby"],
+        hardening: ["gem-allowlist"],
+        boot: "hot",
+        bootms: 12,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.run+json",
+    },
+    {
+        id: "language-php",
+        label: "php interpreter",
+        family: "language",
+        isolation: "process",
+        state: "live",
+        drivers: ["php"],
+        hardening: ["ini-lockdown"],
+        boot: "hot",
+        bootms: 12,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.run+json",
+    },
+    {
+        id: "language-lua",
+        label: "lua interpreter",
+        family: "language",
+        isolation: "process",
+        state: "live",
+        drivers: ["lua"],
+        hardening: ["sandbox-env"],
+        boot: "hot",
+        bootms: 8,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.run+json",
+    },
+    {
+        id: "language-zig",
+        label: "zig toolchain",
+        family: "language",
+        isolation: "process",
+        state: "live",
+        drivers: ["zig"],
+        hardening: ["package-allowlist"],
+        boot: "hot",
+        bootms: 15,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.run+json",
+    },
+    {
+        id: "language-nim",
+        label: "nim compiler",
+        family: "language",
+        isolation: "process",
+        state: "live",
+        drivers: ["nim"],
+        hardening: ["package-allowlist"],
+        boot: "hot",
+        bootms: 15,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.run+json",
+    },
+    // the runtime extensions of the runner family: the heavyweight virtual
+    // machines and the edge runtimes the join resolves beside the v8 isolate
+    {
+        id: "runtime-jvm",
+        label: "jvm hotspot",
+        family: "runner",
+        isolation: "process",
+        state: "live",
+        drivers: ["jvm", "jlink"],
+        hardening: ["security-manager"],
+        boot: "warm",
+        bootms: 250,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.run+json",
+    },
+    {
+        id: "runtime-clr",
+        label: "clr runtime",
+        family: "runner",
+        isolation: "process",
+        state: "live",
+        drivers: ["clr"],
+        hardening: ["assembly-allowlist"],
+        boot: "warm",
+        bootms: 200,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.run+json",
+    },
+    {
+        id: "runtime-workerd",
+        label: "workerd runtime",
+        family: "runner",
+        isolation: "process",
+        state: "live",
+        drivers: ["workerd"],
+        hardening: ["no-fs", "cpu-quota"],
+        boot: "hot",
+        bootms: 10,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.run+json",
+    },
+    {
+        id: "runner-wasi",
+        label: "wasi preview",
+        family: "wasm",
+        isolation: "process",
+        state: "live",
+        drivers: ["wasmtime"],
+        hardening: ["capability-imports"],
+        boot: "hot",
+        bootms: 15,
+        gpu: false,
+        network: false,
+        mime: "application/wasm",
+    },
+    // the container family: docker hardened, the profile pair and ghcr immutable
+    {
+        id: "container-docker",
+        label: "docker hardened",
+        family: "container",
+        isolation: "namespace",
+        state: "live",
+        drivers: ["docker"],
+        hardening: ["no-network", "dropped-caps", "read-only-root", "pid-limit"],
+        boot: "warm",
+        bootms: 400,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.container+json",
+    },
+    {
+        id: "container-max",
+        label: "docker max profile",
+        family: "container",
+        isolation: "namespace",
+        state: "live",
+        drivers: ["docker"],
+        hardening: ["no-network", "dropped-caps", "read-only-root"],
+        boot: "warm",
+        bootms: 600,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.container+json",
+    },
+    {
+        id: "container-lite",
+        label: "docker lite profile",
+        family: "container",
+        isolation: "namespace",
+        state: "live",
+        drivers: ["docker"],
+        hardening: ["no-network", "dropped-caps", "read-only-root", "pid-limit", "memory-cap"],
+        boot: "warm",
+        bootms: 300,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.container+json",
+    },
+    {
+        id: "container-ghcr",
+        label: "ghcr immutable",
+        family: "container",
+        isolation: "namespace",
+        state: "live",
+        drivers: ["docker", "ghcr"],
+        hardening: ["immutable-root", "uuid-instance"],
+        boot: "warm",
+        bootms: 450,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.container+json",
+    },
+    {
+        id: "container-runsc",
+        label: "gvisor sandboxed",
+        family: "container",
+        isolation: "namespace",
+        state: "host",
+        drivers: ["runsc"],
+        hardening: ["user-kernel"],
+        boot: "warm",
+        bootms: BOOTLADDER.warm,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.container+json",
+    },
+    // the sandbox family: the os jails short of a container daemon (the
+    // isolation ladder the engine walks below the microvm)
+    {
+        id: "sandbox-bubblewrap",
+        label: "bubblewrap jail",
+        family: "sandbox",
+        isolation: "namespace",
+        state: "live",
+        drivers: ["bwrap"],
+        hardening: ["user-namespace"],
+        boot: "warm",
+        bootms: 40,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.sandbox+json",
+    },
+    {
+        id: "sandbox-nsjail",
+        label: "nsjail cell",
+        family: "sandbox",
+        isolation: "namespace",
+        state: "live",
+        drivers: ["nsjail"],
+        hardening: ["cgroup-limit", "seccomp"],
+        boot: "warm",
+        bootms: 60,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.sandbox+json",
+    },
+    {
+        id: "sandbox-chroot",
+        label: "chroot root",
+        family: "sandbox",
+        isolation: "process",
+        state: "live",
+        drivers: ["chroot"],
+        hardening: ["read-only-root"],
+        boot: "hot",
+        bootms: 10,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.sandbox+json",
+    },
+    // the container extensions: the rootless and the oci runtimes the lane
+    // can drive beside the docker daemon
+    {
+        id: "container-podman",
+        label: "podman rootless",
+        family: "container",
+        isolation: "namespace",
+        state: "live",
+        drivers: ["podman"],
+        hardening: ["rootless", "no-network", "dropped-caps"],
+        boot: "warm",
+        bootms: 350,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.container+json",
+    },
+    {
+        id: "container-containerd",
+        label: "containerd supervisor",
+        family: "container",
+        isolation: "namespace",
+        state: "live",
+        drivers: ["containerd"],
+        hardening: ["no-network", "dropped-caps"],
+        boot: "warm",
+        bootms: 300,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.container+json",
+    },
+    {
+        id: "container-runc",
+        label: "runc process",
+        family: "container",
+        isolation: "namespace",
+        state: "live",
+        drivers: ["runc"],
+        hardening: ["no-network", "dropped-caps", "read-only-root"],
+        boot: "warm",
+        bootms: 100,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.container+json",
+    },
+    {
+        id: "container-crun",
+        label: "crun process",
+        family: "container",
+        isolation: "namespace",
+        state: "live",
+        drivers: ["crun"],
+        hardening: ["no-network", "dropped-caps", "read-only-root"],
+        boot: "warm",
+        bootms: 90,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.container+json",
+    },
+    // the microvm family: per workflow, the e2b form
+    {
+        id: "microvm-firecracker",
+        label: "firecracker microvm",
+        family: "microvm",
+        isolation: "vm",
+        state: "host",
+        drivers: ["firecracker", "virtualcpu"],
+        hardening: ["clean-rootfs", "injected-vcpu"],
+        boot: "warm",
+        bootms: 125,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.microvm+json",
+    },
+    {
+        id: "microvm-gpuless",
+        label: "gpuless render",
+        family: "microvm",
+        isolation: "vm",
+        state: "live",
+        drivers: ["mesa-llvmpipe", "lavapipe", "rusticl", "xvfb"],
+        hardening: ["clean-rootfs"],
+        boot: "warm",
+        bootms: 500,
+        gpu: true,
+        network: true,
+        mime: "application/vnd.devthink.microvm+json",
+    },
+    // the pod family: one pod per session (the competitor recipe)
+    {
+        id: "pod-session",
+        label: "pod per session",
+        family: "pod",
+        isolation: "namespace",
+        state: "host",
+        drivers: ["k8s"],
+        hardening: ["quota-check"],
+        boot: "warm",
+        bootms: 800,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.pod+json",
+    },
+    // the confidential family: attested compute
+    {
+        id: "confidential-sevsnp",
+        label: "sev snp",
+        family: "confidential",
+        isolation: "hardware",
+        state: "host",
+        drivers: ["sev-snp", "tpm"],
+        hardening: ["attestation"],
+        boot: "cold",
+        bootms: 1200,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.confidential+json",
+    },
+    {
+        id: "confidential-tdx",
+        label: "tdx",
+        family: "confidential",
+        isolation: "hardware",
+        state: "host",
+        drivers: ["tdx", "tpm"],
+        hardening: ["attestation"],
+        boot: "cold",
+        bootms: 1200,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.confidential+json",
+    },
+    // the emulator family: qemu full emulation
+    {
+        id: "emulator-qemu",
+        label: "qemu",
+        family: "emulator",
+        isolation: "vm",
+        state: "host",
+        drivers: ["qemu"],
+        hardening: ["tcg"],
+        boot: "cold",
+        bootms: 900,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.emulator+json",
+    },
+    // the browser family: the sandbox-side browser (never the person's)
+    {
+        id: "browser-server",
+        label: "virtual browser",
+        family: "browser",
+        isolation: "namespace",
+        state: "host",
+        drivers: ["chromium-headless", "playwright"],
+        hardening: ["sandboxed-tabs"],
+        boot: "warm",
+        bootms: 300,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.browser+json",
+    },
+    {
+        id: "browser-webcontainer",
+        label: "webcontainer server side",
+        family: "browser",
+        isolation: "namespace",
+        state: "live",
+        drivers: ["node", "wasm"],
+        hardening: ["opt-in"],
+        boot: "warm",
+        bootms: 350,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.browser+json",
+    },
+    // the screen family extensions: the virtual displays the sandboxed ui
+    // renders through (never the visitor display)
+    {
+        id: "screen-xvfb",
+        label: "xvfb display",
+        family: "screen",
+        isolation: "process",
+        state: "live",
+        drivers: ["xvfb"],
+        hardening: ["headless-only"],
+        boot: "hot",
+        bootms: 20,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.screen+json",
+    },
+    {
+        id: "screen-wayland",
+        label: "wayland compositor",
+        family: "screen",
+        isolation: "process",
+        state: "live",
+        drivers: ["wayland", "wlroots"],
+        hardening: ["headless-only"],
+        boot: "warm",
+        bootms: 150,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.screen+json",
+    },
+    // the mobile family: the os images of the mobile lane
+    {
+        id: "mobile-capacitor",
+        label: "capacitor",
+        family: "mobile",
+        isolation: "namespace",
+        state: "host",
+        drivers: ["capacitor"],
+        hardening: ["emulated-device"],
+        boot: "warm",
+        bootms: 600,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.mobile+json",
+    },
+    {
+        id: "mobile-termux",
+        label: "termux",
+        family: "mobile",
+        isolation: "namespace",
+        state: "live",
+        drivers: ["termux"],
+        hardening: ["emulated-device"],
+        boot: "warm",
+        bootms: 550,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.mobile+json",
+    },
+    {
+        id: "mobile-postmarketos",
+        label: "postmarketos",
+        family: "mobile",
+        isolation: "vm",
+        state: "host",
+        drivers: ["qemu"],
+        hardening: ["emulated-device"],
+        boot: "cold",
+        bootms: 1000,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.mobile+json",
+    },
+    // the fs and delivery families: the vfs, the git objects and the cdn lane
+    {
+        id: "fs-vfs",
+        label: "vfs",
+        family: "fs",
+        isolation: "process",
+        state: "live",
+        drivers: ["vfs"],
+        hardening: ["chunk-catalog"],
+        boot: "hot",
+        bootms: 5,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.vfs+json",
+    },
+    {
+        id: "fs-gitobjects",
+        label: "git objects vfs",
+        family: "fs",
+        isolation: "process",
+        state: "live",
+        drivers: ["git", "vfs"],
+        hardening: ["content-hash", "chunk-catalog"],
+        boot: "hot",
+        bootms: 10,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.vfs+json",
+    },
+    {
+        id: "delivery-cdn",
+        label: "cdn mirror",
+        family: "delivery",
+        isolation: "process",
+        state: "live",
+        drivers: ["vfs", "cdn"],
+        hardening: ["inside-sandbox-fetch"],
+        boot: "hot",
+        bootms: 5,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.cdn+json",
+    },
+    // the delivery protocol extensions: the wire lanes the streamed answer
+    // rides (the socket surface the self-hosted engine speaks)
+    {
+        id: "delivery-wss",
+        label: "websocket streams",
+        family: "delivery",
+        isolation: "process",
+        state: "live",
+        drivers: ["wss"],
+        hardening: ["origin-pin"],
+        boot: "hot",
+        bootms: 5,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.cdn+json",
+    },
+    {
+        id: "delivery-webtransport",
+        label: "webtransport lane",
+        family: "delivery",
+        isolation: "process",
+        state: "live",
+        drivers: ["webtransport", "http3"],
+        hardening: ["origin-pin"],
+        boot: "hot",
+        bootms: 8,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.cdn+json",
+    },
+    {
+        id: "delivery-grpc",
+        label: "grpc lane",
+        family: "delivery",
+        isolation: "process",
+        state: "live",
+        drivers: ["grpc"],
+        hardening: ["auth-token"],
+        boot: "hot",
+        bootms: 8,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.cdn+json",
+    },
+    {
+        id: "delivery-capnproto",
+        label: "capnproto lane",
+        family: "delivery",
+        isolation: "process",
+        state: "live",
+        drivers: ["capnproto"],
+        hardening: ["auth-token"],
+        boot: "hot",
+        bootms: 6,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.cdn+json",
+    },
+    // the storage family: the self-hosted vault backends (the competitor
+    // recipe of the hosted buckets — sqlite and the wire protocols and the
+    // s3-compatible daemons, every one a lane may mount behind the vault)
+    {
+        id: "storage-sqlite",
+        label: "sqlite vault",
+        family: "storage",
+        isolation: "process",
+        state: "live",
+        drivers: ["sqlite"],
+        hardening: ["file-quota"],
+        boot: "hot",
+        bootms: 8,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.storage+json",
+    },
+    {
+        id: "storage-libsql",
+        label: "libsql vault",
+        family: "storage",
+        isolation: "process",
+        state: "live",
+        drivers: ["libsql"],
+        hardening: ["file-quota"],
+        boot: "hot",
+        bootms: 10,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.storage+json",
+    },
+    {
+        id: "storage-mysql",
+        label: "mysql wire vault",
+        family: "storage",
+        isolation: "process",
+        state: "live",
+        drivers: ["mysql-wire"],
+        hardening: ["auth-token", "row-quota"],
+        boot: "warm",
+        bootms: 200,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.storage+json",
+    },
+    {
+        id: "storage-postgres",
+        label: "postgres wire vault",
+        family: "storage",
+        isolation: "process",
+        state: "live",
+        drivers: ["postgres-wire"],
+        hardening: ["auth-token", "row-quota"],
+        boot: "warm",
+        bootms: 200,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.storage+json",
+    },
+    {
+        id: "storage-s3",
+        label: "s3 compatible vault",
+        family: "storage",
+        isolation: "process",
+        state: "live",
+        drivers: ["s3-api"],
+        hardening: ["bucket-quota"],
+        boot: "warm",
+        bootms: 100,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.storage+json",
+    },
+    {
+        id: "storage-minio",
+        label: "minio vault",
+        family: "storage",
+        isolation: "process",
+        state: "live",
+        drivers: ["minio"],
+        hardening: ["bucket-quota"],
+        boot: "warm",
+        bootms: 300,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.storage+json",
+    },
+    {
+        id: "storage-garage",
+        label: "garage vault",
+        family: "storage",
+        isolation: "process",
+        state: "live",
+        drivers: ["garage"],
+        hardening: ["bucket-quota"],
+        boot: "warm",
+        bootms: 300,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.storage+json",
+    },
+    // the network family: the resolution and the private tunnels the engine
+    // opens for the sandbox (the hardened default stays off until a lane
+    // asks)
+    {
+        id: "network-dns",
+        label: "dns resolver",
+        family: "network",
+        isolation: "process",
+        state: "live",
+        drivers: ["dns"],
+        hardening: ["resolver-allowlist"],
+        boot: "hot",
+        bootms: 5,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.net+json",
+    },
+    {
+        id: "network-doh",
+        label: "dns over https",
+        family: "network",
+        isolation: "process",
+        state: "live",
+        drivers: ["doh"],
+        hardening: ["resolver-allowlist"],
+        boot: "hot",
+        bootms: 8,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.net+json",
+    },
+    {
+        id: "network-tor",
+        label: "tor onion lane",
+        family: "network",
+        isolation: "process",
+        state: "live",
+        drivers: ["tor"],
+        hardening: ["circuit-limit"],
+        boot: "warm",
+        bootms: 800,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.net+json",
+    },
+    {
+        id: "network-i2p",
+        label: "i2p tunnel",
+        family: "network",
+        isolation: "process",
+        state: "live",
+        drivers: ["i2p"],
+        hardening: ["tunnel-limit"],
+        boot: "warm",
+        bootms: 700,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.net+json",
+    },
+    {
+        id: "network-wireguard",
+        label: "wireguard tunnel",
+        family: "network",
+        isolation: "process",
+        state: "live",
+        drivers: ["wireguard"],
+        hardening: ["peer-allowlist"],
+        boot: "warm",
+        bootms: 100,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.net+json",
+    },
+    // the ram family: the storage-to-ram bridge, the kernel recipes that swap,
+    // map and overlay the same bytes between use flags (the memory ladder the
+    // corpus records: the tmpfs at the microsecond, the memory map at five,
+    // the compressed ram at five hundred)
+    {
+        id: "ram-tmpfs",
+        label: "tmpfs",
+        family: "ram",
+        isolation: "process",
+        state: "live",
+        drivers: ["tmpfs"],
+        hardening: ["oom-guard"],
+        boot: "hot",
+        bootms: 5,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.ram+json",
+    },
+    {
+        id: "ram-mmap",
+        label: "zero copy map",
+        family: "ram",
+        isolation: "process",
+        state: "live",
+        drivers: ["mmap"],
+        hardening: ["oom-guard"],
+        boot: "hot",
+        bootms: 5,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.ram+json",
+    },
+    {
+        id: "ram-overlayfs",
+        label: "overlayfs",
+        family: "ram",
+        isolation: "process",
+        state: "live",
+        drivers: ["overlayfs"],
+        hardening: ["oom-guard"],
+        boot: "hot",
+        bootms: 10,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.ram+json",
+    },
+    {
+        id: "ram-loopram",
+        label: "loop ram disk",
+        family: "ram",
+        isolation: "process",
+        state: "live",
+        drivers: ["loop", "tmpfs"],
+        hardening: ["oom-guard"],
+        boot: "hot",
+        bootms: 15,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.ram+json",
+    },
+    {
+        id: "ram-gitram",
+        label: "git in ram",
+        family: "ram",
+        isolation: "process",
+        state: "live",
+        drivers: ["git", "mmap"],
+        hardening: ["oom-guard"],
+        boot: "hot",
+        bootms: 20,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.ram+json",
+    },
+    {
+        id: "ram-zram",
+        label: "zram zstd",
+        family: "ram",
+        isolation: "process",
+        state: "live",
+        drivers: ["zram", "zstd"],
+        hardening: ["oom-guard"],
+        boot: "hot",
+        bootms: 25,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.ram+json",
+    },
+    {
+        id: "ram-zswap",
+        label: "zswap",
+        family: "ram",
+        isolation: "process",
+        state: "live",
+        drivers: ["zswap"],
+        hardening: ["oom-guard"],
+        boot: "hot",
+        bootms: 25,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.ram+json",
+    },
+    {
+        id: "ram-swapfile",
+        label: "swapfile",
+        family: "ram",
+        isolation: "process",
+        state: "live",
+        drivers: ["swapfile"],
+        hardening: ["oom-guard"],
+        boot: "hot",
+        bootms: 25,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.ram+json",
+    },
+    // the build family: the build graphs the engine runs inside the sandbox
+    // (the artifact lane the repositories compile through)
+    {
+        id: "build-make",
+        label: "make builds",
+        family: "build",
+        isolation: "process",
+        state: "live",
+        drivers: ["make"],
+        hardening: ["recipe-allowlist"],
+        boot: "hot",
+        bootms: 10,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.build+json",
+    },
+    {
+        id: "build-bazel",
+        label: "bazel builds",
+        family: "build",
+        isolation: "process",
+        state: "live",
+        drivers: ["bazel"],
+        hardening: ["remote-cache-pin"],
+        boot: "warm",
+        bootms: 500,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.build+json",
+    },
+    {
+        id: "build-buck",
+        label: "buck builds",
+        family: "build",
+        isolation: "process",
+        state: "live",
+        drivers: ["buck"],
+        hardening: ["remote-cache-pin"],
+        boot: "warm",
+        bootms: 400,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.build+json",
+    },
+    {
+        id: "build-ninja",
+        label: "ninja builds",
+        family: "build",
+        isolation: "process",
+        state: "live",
+        drivers: ["ninja"],
+        hardening: ["recipe-allowlist"],
+        boot: "hot",
+        bootms: 15,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.build+json",
+    },
+    {
+        id: "build-turborepo",
+        label: "turborepo builds",
+        family: "build",
+        isolation: "process",
+        state: "live",
+        drivers: ["turbo"],
+        hardening: ["remote-cache-pin"],
+        boot: "warm",
+        bootms: 300,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.build+json",
+    },
+    // the ci family: the self-hosted runners the engine drives for the
+    // repository pipelines (no hosted ci dependency — the runner rides the
+    // same self-hosted law)
+    {
+        id: "ci-actions",
+        label: "actions runner",
+        family: "ci",
+        isolation: "process",
+        state: "live",
+        drivers: ["actions-runner"],
+        hardening: ["workflow-allowlist"],
+        boot: "warm",
+        bootms: 400,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.ci+json",
+    },
+    {
+        id: "ci-gitlab",
+        label: "gitlab runner",
+        family: "ci",
+        isolation: "process",
+        state: "live",
+        drivers: ["gitlab-runner"],
+        hardening: ["workflow-allowlist"],
+        boot: "warm",
+        bootms: 400,
+        gpu: false,
+        network: true,
+        mime: "application/vnd.devthink.ci+json",
+    },
+    // the gpu family: the virtual graphics the machine may present (the
+    // declared slice — the record never claims a host gpu it does not mount)
+    {
+        id: "gpu-virgl",
+        label: "virgl render",
+        family: "gpu",
+        isolation: "vm",
+        state: "live",
+        drivers: ["virgl", "virtio-gpu"],
+        hardening: ["context-quota"],
+        boot: "warm",
+        bootms: 400,
+        gpu: true,
+        network: true,
+        mime: "application/vnd.devthink.gpu+json",
+    },
+    // the local family: the explicit opt-in (the only lane that may touch the
+    // visitor machine, and only under declared consent)
+    {
+        id: "local-optin",
+        label: "local opt in",
+        family: "local",
+        isolation: "process",
+        state: "live",
+        drivers: [],
+        hardening: ["explicit-consent"],
+        boot: "hot",
+        bootms: 10,
+        gpu: false,
+        network: false,
+        mime: "application/vnd.devthink.local+json",
+    },
+]);
+/** planreport — the honest census of the registry against the ninety plan:
+ * the counts per state and the plan verdict, computed from the records
+ * (never hardcoded, so the report cannot drift from the catalog). */
+export function planreport() {
+    const counts = { live: 0, host: 0, planned: 0 };
+    for (const modality of MODALITIES)
+        counts[modality.state] += 1;
+    return {
+        plancount: MODALITYPLANCOUNT,
+        catalogcount: MODALITIES.length,
+        live: counts.live,
+        host: counts.host,
+        planned: counts.planned,
+        plananswered: MODALITIES.length >= MODALITYPLANCOUNT,
+    };
+}
+/**
+ * Resolves the modality join for a request: the records that satisfy every
+ * demand, ordered by boot cost then isolation depth — the platform answers
+ * the join, the person never names a modality (the nuclear law).
+ *
+ * @param request the workload demands.
+ * @returns the modality records that satisfy the join, best candidate first.
+ */
+export function resolvejoin(request) {
+    const budget = request.bootbudget ?? BOOTLADDER.cold;
+    const order = { process: 0, namespace: 1, vm: 2, hardware: 3 };
+    return MODALITIES.filter((modality) => {
+        if (request.family && modality.family !== request.family)
+            return false;
+        if (request.gpu && !modality.gpu)
+            return false;
+        if (request.network && !modality.network)
+            return false;
+        if (request.isolation && order[modality.isolation] < order[request.isolation])
+            return false;
+        if (modality.bootms > budget)
+            return false;
+        // the lite base keeps the heavy machine images out of the answer
+        if (request.base === "lite" && modality.isolation === "hardware")
+            return false;
+        return true;
+    }).sort((a, b) => a.bootms - b.bootms || order[a.isolation] - order[b.isolation]);
+}
+/**
+ * Answers one modality by id (the config rows and the api carry ids).
+ *
+ * @param id the modality id.
+ * @returns the record, or undefined when the id is unknown.
+ */
+export function getmodality(id) {
+    return MODALITIES.find((modality) => modality.id === id);
+}