@wenathlan/saddle 2.0.6 → 2.0.151

package/modalityregistry.ts

@@ -0,0 +1,156 @@
+// # modalityregistry — the catalog of the sandbox modalities the saddle
+// engine opens (root layer, wave SV1). One record per modality: the
+// isolation family, the driver requirements it mounts, the boot cost class,
+// the hardening gates it carries and the mime contract it answers. The
+// registry is the spine of the "fifty modalities" promise: the workload
+// never chooses by name — the join resolver reads the request (isolation,
+// gpu, network, boot budget) and answers the modality set that satisfies
+// it, so the person chooses none and the platform resolves the join of all
+// (the nuclear modality law). Pure data and pure functions: zero storage,
+// zero node-only imports, the browser-pure bundle keeps carrying it.
+
+/** The boot cost classes the ladder measures. */
+export type BootClass = "hot" | "warm" | "cold";
+
+/** The isolation families the modalities group under. */
+export type ModalityFamily =
+  | "virtual"
+  | "runner"
+  | "packages"
+  | "container"
+  | "microvm"
+  | "browser"
+  | "mobile"
+  | "confidential"
+  | "emulator"
+  | "pod"
+  | "local"
+  | "screen"
+  | "wasm"
+  | "fs"
+  | "delivery";
+
+/** One sandbox modality of the registry. */
+export interface ModalityRecord {
+  /** The stable id the api and the config rows reference. */
+  id: string;
+  /** The display label (short, lowercase). */
+  label: string;
+  /** The isolation family the modality belongs to. */
+  family: ModalityFamily;
+  /** The isolation depth the family reaches (the capability contract). */
+  isolation: "process" | "namespace" | "vm" | "hardware";
+  /** The driver modules the modality mounts when it boots. */
+  drivers: readonly string[];
+  /** The hardening gates the modality enforces by default. */
+  hardening: readonly string[];
+  /** The boot cost class (the measured budget lives in the boot ladder). */
+  boot: BootClass;
+  /** The measured boot budget in milliseconds (the ladder answers). */
+  bootms: number;
+  /** Whether the modality presents a gpu through the virtual drivers. */
+  gpu: boolean;
+  /** Whether the modality opens a network path (the hardened default is off). */
+  network: boolean;
+  /** The mime type the modality's api surface answers. */
+  mime: string;
+}
+
+/** The boot budgets of the ladder, per class: the ceilings the records walk
+ * under (firecracker 125 ms and gvisor about 200 ms ride warm, the full
+ * machine images ride cold). */
+export const BOOTLADDER: Readonly<Record<BootClass, number>> = Object.freeze({
+  hot: 25,
+  warm: 800,
+  cold: 1500,
+});
+
+/** The modality records: the catalog the join resolver reads. */
+export const MODALITIES: readonly ModalityRecord[] = Object.freeze([
+  // the virtual family: the full machine with the virtual drivers
+  { id: "virtual-full", label: "complete virtual", family: "virtual", isolation: "hardware", drivers: ["virtualcpu", "virtualgpu", "virtualmemory"], hardening: ["profile-lock"], boot: "cold", bootms: BOOTLADDER.cold, gpu: true, network: true, mime: "application/vnd.devthink.sandbox+json" },
+  { id: "virtual-vgpu", label: "vgpu slice", family: "virtual", isolation: "hardware", drivers: ["virtualgpu", "nvml-shim", "vfio"], hardening: ["mig-profile"], boot: "warm", bootms: 600, gpu: true, network: true, mime: "application/vnd.devthink.sandbox+json" },
+  { id: "virtual-screen", label: "vm plus vnc", family: "screen", isolation: "vm", drivers: ["virtualcpu", "virtualgpu", "xvfb", "looking-glass"], hardening: ["session-otp"], boot: "warm", bootms: 700, gpu: true, network: true, mime: "application/vnd.devthink.screen+json" },
+  // the runner family: the universal binary runner
+  { id: "runner-universal", label: "universal runner", family: "runner", isolation: "namespace", drivers: ["binfmt"], hardening: ["read-only-root", "dropped-caps"], boot: "warm", bootms: BOOTLADDER.warm, gpu: false, network: true, mime: "application/vnd.devthink.run+json" },
+  { id: "runner-node", label: "node packages", family: "packages", isolation: "process", drivers: ["node", "babel", "swc"], hardening: ["package-allowlist"], boot: "hot", bootms: BOOTLADDER.hot, gpu: false, network: true, mime: "application/vnd.devthink.run+json" },
+  { id: "runner-wasm", label: "wasm and wasi", family: "wasm", isolation: "process", drivers: ["wasmer", "wasmedge"], hardening: ["capability-imports"], boot: "hot", bootms: 15, gpu: false, network: false, mime: "application/wasm" },
+  { id: "runner-serverless", label: "v8 isolates", family: "runner", isolation: "process", drivers: ["v8"], hardening: ["no-fs", "cpu-quota"], boot: "hot", bootms: 8, gpu: false, network: true, mime: "application/vnd.devthink.run+json" },
+  // the container family: docker hardened and ghcr immutable
+  { id: "container-docker", label: "docker hardened", family: "container", isolation: "namespace", drivers: ["docker"], hardening: ["no-network", "dropped-caps", "read-only-root", "pid-limit"], boot: "warm", bootms: 400, gpu: false, network: false, mime: "application/vnd.devthink.container+json" },
+  { id: "container-ghcr", label: "ghcr immutable", family: "container", isolation: "namespace", drivers: ["docker", "ghcr"], hardening: ["immutable-root", "uuid-instance"], boot: "warm", bootms: 450, gpu: false, network: true, mime: "application/vnd.devthink.container+json" },
+  { id: "container-runsc", label: "gvisor sandboxed", family: "container", isolation: "namespace", drivers: ["runsc"], hardening: ["user-kernel"], boot: "warm", bootms: BOOTLADDER.warm, gpu: false, network: true, mime: "application/vnd.devthink.container+json" },
+  // the microvm family: per workflow, the e2b form
+  { id: "microvm-firecracker", label: "firecracker microvm", family: "microvm", isolation: "vm", drivers: ["firecracker", "virtualcpu"], hardening: ["clean-rootfs", "injected-vcpu"], boot: "warm", bootms: 125, gpu: false, network: true, mime: "application/vnd.devthink.microvm+json" },
+  { id: "microvm-gpuless", label: "gpuless render", family: "microvm", isolation: "vm", drivers: ["mesa-llvmpipe", "lavapipe", "rusticl", "xvfb"], hardening: ["clean-rootfs"], boot: "warm", bootms: 500, gpu: true, network: true, mime: "application/vnd.devthink.microvm+json" },
+  // the pod family: one pod per session (the competitor recipe)
+  { id: "pod-session", label: "pod per session", family: "pod", isolation: "namespace", drivers: ["k8s"], hardening: ["quota-check"], boot: "warm", bootms: 800, gpu: false, network: true, mime: "application/vnd.devthink.pod+json" },
+  // the confidential family: attested compute
+  { id: "confidential-sevsnp", label: "sev snp", family: "confidential", isolation: "hardware", drivers: ["sev-snp", "tpm"], hardening: ["attestation"], boot: "cold", bootms: 1200, gpu: false, network: true, mime: "application/vnd.devthink.confidential+json" },
+  { id: "confidential-tdx", label: "tdx", family: "confidential", isolation: "hardware", drivers: ["tdx", "tpm"], hardening: ["attestation"], boot: "cold", bootms: 1200, gpu: false, network: true, mime: "application/vnd.devthink.confidential+json" },
+  // the emulator family: qemu full emulation
+  { id: "emulator-qemu", label: "qemu", family: "emulator", isolation: "vm", drivers: ["qemu"], hardening: ["tcg"], boot: "cold", bootms: 900, gpu: false, network: true, mime: "application/vnd.devthink.emulator+json" },
+  // the browser family: the sandbox-side browser (never the person's)
+  { id: "browser-server", label: "virtual browser", family: "browser", isolation: "namespace", drivers: ["chromium-headless", "playwright"], hardening: ["sandboxed-tabs"], boot: "warm", bootms: 300, gpu: false, network: true, mime: "application/vnd.devthink.browser+json" },
+  { id: "browser-webcontainer", label: "webcontainer server side", family: "browser", isolation: "namespace", drivers: ["node", "wasm"], hardening: ["opt-in"], boot: "warm", bootms: 350, gpu: false, network: true, mime: "application/vnd.devthink.browser+json" },
+  // the mobile family: the os images of the mobile lane
+  { id: "mobile-capacitor", label: "capacitor", family: "mobile", isolation: "namespace", drivers: ["capacitor"], hardening: ["emulated-device"], boot: "warm", bootms: 600, gpu: false, network: true, mime: "application/vnd.devthink.mobile+json" },
+  { id: "mobile-termux", label: "termux", family: "mobile", isolation: "namespace", drivers: ["termux"], hardening: ["emulated-device"], boot: "warm", bootms: 550, gpu: false, network: true, mime: "application/vnd.devthink.mobile+json" },
+  { id: "mobile-postmarketos", label: "postmarketos", family: "mobile", isolation: "vm", drivers: ["qemu"], hardening: ["emulated-device"], boot: "cold", bootms: 1000, gpu: false, network: true, mime: "application/vnd.devthink.mobile+json" },
+  // the fs and delivery families: the vfs and the cdn lane
+  { id: "fs-vfs", label: "vfs", family: "fs", isolation: "process", drivers: ["vfs"], hardening: ["chunk-catalog"], boot: "hot", bootms: 5, gpu: false, network: false, mime: "application/vnd.devthink.vfs+json" },
+  { id: "delivery-cdn", label: "cdn mirror", family: "delivery", isolation: "process", drivers: ["vfs", "cdn"], hardening: ["inside-sandbox-fetch"], boot: "hot", bootms: 5, gpu: false, network: true, mime: "application/vnd.devthink.cdn+json" },
+  { id: "local-optin", label: "local opt in", family: "local", isolation: "process", drivers: [], hardening: ["explicit-consent"], boot: "hot", bootms: 10, gpu: false, network: false, mime: "application/vnd.devthink.local+json" },
+]);
+
+/** The base profiles the owner names (the config wave makes them editable). */
+export type BaseProfile = "max" | "balanced" | "lite";
+
+/** The join request: what the workload asks, never a modality name. */
+export interface JoinRequest {
+  /** The base profile the sandbox boots under. */
+  base: BaseProfile;
+  /** Whether the workload needs a gpu path through the virtual drivers. */
+  gpu: boolean;
+  /** Whether the workload needs a network path. */
+  network: boolean;
+  /** The isolation depth the workload demands at minimum. */
+  isolation?: ModalityRecord["isolation"];
+  /** The boot budget the workload tolerates, in milliseconds. */
+  bootbudget?: number;
+  /** The family the workload prefers (the first filter when given). */
+  family?: ModalityFamily;
+}
+
+/**
+ * Resolves the modality join for a request: the records that satisfy every
+ * demand, ordered by boot cost then isolation depth — the platform answers
+ * the join, the person never names a modality (the nuclear law).
+ *
+ * @param request the workload demands.
+ * @returns the modality records that satisfy the join, best candidate first.
+ */
+export function resolvejoin(request: JoinRequest): readonly ModalityRecord[] {
+  const budget = request.bootbudget ?? BOOTLADDER.cold;
+  const order: Record<ModalityRecord["isolation"], number> = { process: 0, namespace: 1, vm: 2, hardware: 3 };
+  return MODALITIES.filter((modality) => {
+    if (request.family && modality.family !== request.family) return false;
+    if (request.gpu && !modality.gpu) return false;
+    if (request.network && !modality.network) return false;
+    if (request.isolation && order[modality.isolation] < order[request.isolation]) return false;
+    if (modality.bootms > budget) return false;
+    // the lite base keeps the heavy machine images out of the answer
+    if (request.base === "lite" && modality.isolation === "hardware") return false;
+    return true;
+  }).sort((a, b) => a.bootms - b.bootms || order[a.isolation] - order[b.isolation]);
+}
+
+/**
+ * Answers one modality by id (the config rows and the api carry ids).
+ *
+ * @param id the modality id.
+ * @returns the record, or undefined when the id is unknown.
+ */
+export function getmodality(id: string): ModalityRecord | undefined {
+  return MODALITIES.find((modality) => modality.id === id);
+}

package/mttg.config

@@ -2,7 +2,7 @@
   "meta": {
     "name": "mttg.config",
     "title": "saddle - MTTG Multi-Tenant Task Groups (cgroups v2 + tenants + transcode) with MTTCG (QEMU TCG) section",
-    "version": "2.0.0",
+    "version": "2.0.127",
     "date": "2026-08-22",
     "language": "en",
     "conceptSeparation": "MTTG = Multi-Tenant Task Groups (cgroup v2 cpu.weight/cpuset/memory/io/pids/hugetlb/rdma + tenants + transcode pipelines). MTTCG = QEMU Multi-Threaded TCG (one host thread per vCPU under TCG). Both live here as DISTINCT sections; MTTCG accel flags also in qemu.config#mttcg.",

package/orchestrator.ts

@@ -91,7 +91,10 @@ const runtimecatalog = {
 
 /** toolchain stack reported by dumpstate and the version probe. */
 const stackcatalog = {
-  nodecurrent: '26.7.0',
+  /* walks with the .nvmrc pin the maintenance rung stamps — the 2.0.133
+     publish regression answered the engine advertising a node the repository
+     retired, so the anchor rides the pin lane now (never ahead of it) */
+  nodecurrent: '26.12.1',
   nodelts: '24.19.0',
   typescript: '7.0.2',
   qemu: runtimecatalog.qemu,
@@ -4389,7 +4392,7 @@ class orchestrator {
   /**
    * default contents of the flat config files written by start(); the
    * version strings carry the v2 anchors (qemu 11.1.0, docker 29.7.2,
-   * node 26.7.0), replacing the stale Meta banners.
+   * node 26.12.0), replacing the stale Meta banners.
    */
   #defaultconfigcontents(): Record<configfilename, string> {
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wenathlan/saddle",
-  "version": "2.0.6",
+  "version": "2.0.151",
   "description": "binary computing engine that turns distributed storage into a publishable working set carrying the merged virtual-hardware engine (the saddle + e2ugh grand merge)",
   "type": "module",
   "private": false,
@@ -19,11 +19,23 @@
     "xcode": {
       "uuid": "11.1.1"
     },
-    "uuid": "^11.1.1"
+    "uuid": "^11.1.1",
+    "@grpc/grpc-js": "1.14.5",
+    "deepmerge-ts": "^8.0.0",
+    "esbuild": "^0.28.2",
+    "follow-redirects": "^1.16.1",
+    "mysql2": "^3.24.6",
+    "postcss-selector-parser": "^7.1.6",
+    "source-map-js": "1.2.2",
+    "proxy-addr": "2.0.8",
+    "body-parser": "^2.4.0",
+    "fast-uri": "^3.1.9",
+    "zod": "^4.6.7",
+    "undici": "^7.30.1"
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/wenathlan/saddle.git"
+    "url": "https://github.com/wenathlan/devthink"
   },
   "bugs": {
     "url": "https://github.com/wenathlan/saddle/issues"
@@ -32,16 +44,40 @@
   "keywords": [
     "distributed computing",
     "virtual memory",
+    "virtual machine",
+    "virtual cpu",
+    "virtual gpu",
     "runner",
     "storage",
-    "automation"
+    "automation",
+    "llvmpipe",
+    "lavapipe",
+    "rusticl",
+    "qemu",
+    "firecracker",
+    "mesa",
+    "ghcr"
   ],
   "engines": {
-    "node": ">=26.7.0",
-    "npm": ">=10.9.2"
+    "bare": "^1.18.0",
+    "bun": "^1.4.2",
+    "chrome": "^16.0.912",
+    "cnpm": "^9.4.0",
+    "corepack": "^0.35.0",
+    "deno": "^2.9.5",
+    "ecmascript": "^5.0.0",
+    "firefox": ">=0.8.0",
+    "iojs": "^1.0.0",
+    "node": ">=26.12.1 <27",
+    "npm": "^12.1.0",
+    "pnpm": "^12.6.0",
+    "teleport": ">=0.2.0",
+    "typescript": "^5.8.0",
+    "vscode": "^1.118.0",
+    "yarn": "^4.17.1"
   },
   "peerDependencies": {
-    "playwright": "^1.62.1"
+    "playwright": "^1.63.0"
   },
   "peerDependenciesMeta": {
     "playwright": {
@@ -65,17 +101,17 @@
     "./sessions": "./dist/foundation.js",
     "./modes": "./dist/modes.js",
     "./mode": "./dist/modes.js",
+    "./sandbox": "./dist/sandbox.js",
+    "./modalities": "./dist/modalityregistry.js",
     "./browser": "./dist/browser.js",
     "./browser-playwright": "./dist/browser.js",
     "./bot": "./dist/automation.js",
-    "./captcha": "./dist/acquisition.js",
     "./deploy": "./dist/modes.js",
     "./extension": "./dist/browser.js",
     "./server-node": "./dist/server.js",
     "./sessions-file": "./dist/execution.js",
     "./sessions-store": "./dist/execution.js",
     "./queue-persistent": "./dist/execution.js",
-    "./captcha-evidence": "./dist/acquisition.js",
     "./hash": "./dist/foundation.js",
     "./release-assets": "./dist/distribution.js",
     "./release-verify": "./dist/distribution.js",
@@ -114,7 +150,7 @@
   },
   "files": [
     "dist",
-    "web/extension/manifest.json",
+    "manifest.json",
     "docs",
     "README.md",
     "LICENSE",
@@ -147,16 +183,16 @@
     "docker.config",
     "Dockerfile",
     "tsconfig.json",
-    "biome.json",
+    "biome.jsonc",
+    "modalityregistry.ts",
     "tiers.ts",
     "quantum.ts"
   ],
   "scripts": {
-    "build:engine": "node tests/scripts/buildengine.mjs",
+    "build:engine": "node tests/scripts/buildengine.ts",
     "check": "npm run build:engine && node --check dist/index.js && node --check dist/execution.js && node --check dist/cli.js && node --check dist/browser.js && node --check dist/distribution.js",
     "formatcheck": "node --import tsx format.ts",
-    "test": "npm run build:engine && node --import tsx --test tests/engine.test.ts tests/extension.test.ts tests/package.test.ts tests/release.test.ts tests/virtualengine.test.ts tests/features.test.ts tests/media.test.ts tests/render.test.ts tests/simulation.test.ts tests/specs.test.ts tests/virtualcpu.test.ts tests/virtualgpu.test.ts tests/virtualmemory.test.ts tests/web.test.ts tests/workflow.test.ts",
-    "test:legacy": "vitest run tests/agent-utils.test.ts tests/cache.test.ts tests/chunking.test.ts tests/core.test.ts tests/errors.test.ts tests/llms-txt.test.ts tests/middleware.test.ts tests/proxy.test.ts tests/tokens.test.ts",
+    "test": "vitest run",
     "run": "npm run build:engine && node dist/cli.js",
     "extension:build": "npm run build:engine && node dist/browser.js",
     "release:assets": "npm run build:engine && node dist/distribution.js",
@@ -166,18 +202,18 @@
     "prepublishOnly": "npm run pack:check",
     "tauri": "npx --yes @tauri-apps/cli@2.11.4",
     "capacitor:sync:android": "npm run web:build:pages && cap sync android",
-    "capacitor:flatten:android": "node tests/scripts/flattenandroid.mjs",
     "capacitor:sync:ios": "npm run web:build:pages && cap sync ios",
-    "native:check:flat": "node tests/scripts/validateflatnative.mjs",
-    "web:dev": "vite --config web/vite.config.ts --host",
-    "web:check": "npm run build:engine && tsc --project web/tsconfig.json --noEmit",
-    "web:build": "vite build --config web/vite.config.ts",
-    "web:build:pages": "vite build --config web/vite.config.ts",
+    "native:check:flat": "node tests/scripts/validateflatnative.ts",
+    "web:dev": "vite --host",
+    "web:check": "npm run build:engine && tsc --project tsconfig.json --noEmit",
+    "web:build": "vite build",
+    "web:build:pages": "vite build",
+    "web:preview": "vite preview --host",
     "build": "npm run build:engine",
     "build:tsc": "tsc -p tsconfig.json --noEmitOnError false",
     "start": "node --import tsx ./cli.ts plan",
     "dev": "node --import tsx --watch ./cli.ts",
-    "web": "node web/server.js",
+    "web": "node webserver.ts",
     "qemu:bridge": "node ./orchestrator.ts --qemu-bridge",
     "toolchain:verify": "node --version && npx tsc --version && python3 --version && qemu-system-x86_64 --version || true && docker --version",
     "dev:tsx": "node --import tsx --watch ./cli.ts",
@@ -194,100 +230,114 @@
     "test:unit": "node --test tests/*.test.ts",
     "test:e2e": "node --test tests/*.test.ts",
     "qemu:version": "qemu-system-x86_64 --version || echo 'qemu 11.1.0 expected 2026-08-22'",
-    "vm:create": "node ./index.ts --create-vm",
-    "vm:validate": "node ./index.ts --validate-vm",
-    "gpu:list": "node ./index.ts --list-gpus",
-    "docker:build": "docker build -f Dockerfile -t saddle:2.0.6 .",
-    "docker:run": "docker run --rm --memory-swap=-1 --shm-size=2g saddle:2.0.6",
-    "docker:health": "docker run --rm saddle:2.0.6 qemu-system-x86_64 --version && curl -fsS http://localhost:8080/health || true",
+    "vm:create": "node --import tsx ./cli.ts vm",
+    "vm:validate": "node --import tsx ./cli.ts vmlint",
+    "gpu:list": "node --import tsx ./cli.ts gpus",
+    "docker:build": "docker build -f Dockerfile -t saddle:2.0.151 .",
+    "docker:run": "docker run --rm --memory-swap=-1 --shm-size=2g saddle:2.0.151",
+    "docker:health": "docker run --rm saddle:2.0.151 qemu-system-x86_64 --version && curl -fsS http://localhost:8080/health || true",
     "firecracker:boot": "firecracker --api-sock /tmp/fc-saddle.sock --config-file vmconfig.json 2>/dev/null || echo 'firecracker 1.16.1 warm-pool boot 125ms target'",
     "py:bridge": "python3 qemubridge.py",
     "py:test": "python3 -m pytest -q || python3 qemubridge.py",
     "clean": "rm -rf dist coverage .biome __pycache__",
-    "prepare": "echo 'saddle grand-merge toolchain 2026-08-23: Node 26.7.0 Current / 24.19.0 LTS, npm 12.0.2, TS 7.0.2, Python 3.14.7, Docker 29.7.2, QEMU 11.1.0, Mesa 26.2.1, LLVM 22.1.8, Firecracker 1.16.1'",
+    "prepare": "echo 'saddle grand-merge toolchain 2026-08-23: Node 26.12.0 Current / 24.19.0 LTS, npm 12.0.2, TS 7.0.2, Python 3.14.7, Docker 29.7.2, QEMU 11.1.0, Mesa 26.2.1, LLVM 22.1.8, Firecracker 1.16.1'",
     "start:engine": "node --import tsx ./cli.ts plan"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.5.11",
-    "@capacitor/android": "^8.5.0",
-    "@capacitor/cli": "^8.5.1",
-    "@capacitor/core": "^8.5.0",
-    "@capacitor/ios": "^8.5.0",
-    "@hookform/resolvers": "^5.2.2",
-    "@radix-ui/react-accordion": "^1.2.12",
-    "@radix-ui/react-alert-dialog": "^1.1.15",
-    "@radix-ui/react-aspect-ratio": "^1.1.7",
-    "@radix-ui/react-avatar": "^1.1.10",
-    "@radix-ui/react-checkbox": "^1.3.3",
-    "@radix-ui/react-collapsible": "^1.1.12",
-    "@radix-ui/react-context-menu": "^2.2.16",
-    "@radix-ui/react-dialog": "^1.1.15",
-    "@radix-ui/react-dropdown-menu": "^2.1.16",
-    "@radix-ui/react-hover-card": "^1.1.15",
-    "@radix-ui/react-label": "^2.1.7",
-    "@radix-ui/react-menubar": "^1.1.16",
-    "@radix-ui/react-navigation-menu": "^1.2.14",
-    "@radix-ui/react-popover": "^1.1.15",
-    "@radix-ui/react-progress": "^1.1.7",
-    "@radix-ui/react-radio-group": "^1.3.8",
-    "@radix-ui/react-scroll-area": "^1.2.10",
-    "@radix-ui/react-select": "^2.2.6",
-    "@radix-ui/react-separator": "^1.1.7",
-    "@radix-ui/react-slider": "^1.3.6",
-    "@radix-ui/react-slot": "^1.2.3",
-    "@radix-ui/react-switch": "^1.2.6",
-    "@radix-ui/react-tabs": "^1.1.13",
-    "@radix-ui/react-toggle": "^1.1.10",
-    "@radix-ui/react-toggle-group": "^1.1.11",
-    "@radix-ui/react-tooltip": "^1.2.8",
-    "@tailwindcss/typography": "^0.5.15",
-    "@tailwindcss/vite": "^4.1.3",
-    "@types/google.maps": "^3.58.1",
-    "@types/node": "^26.4.0",
-    "@types/react": "^19.2.1",
-    "@types/react-dom": "^19.2.1",
-    "@vitejs/plugin-react": "^6.1.1",
-    "add": "^2.0.6",
-    "autoprefixer": "^10.4.20",
-    "axios": "^1.12.0",
+    "@biomejs/biome": "^2.6.2",
+    "@capacitor/android": "^8.5.3",
+    "@capacitor/cli": "^8.5.3",
+    "@capacitor/core": "^8.5.3",
+    "@capacitor/ios": "^8.5.3",
+    "@fluentui/react-icons": "^2.0.344",
+    "@hookform/resolvers": "^5.9.2",
+    "@libsql/client": "^0.18.0",
+    "@prisma/client": "^7.10.1",
+    "@radix-ui/react-accordion": "^1.3.1",
+    "@radix-ui/react-alert-dialog": "^1.2.1",
+    "@radix-ui/react-aspect-ratio": "^1.2.0",
+    "@radix-ui/react-avatar": "^1.3.1",
+    "@radix-ui/react-checkbox": "^1.4.1",
+    "@radix-ui/react-collapsible": "^1.2.1",
+    "@radix-ui/react-context-menu": "^2.4.1",
+    "@radix-ui/react-dialog": "^1.3.1",
+    "@radix-ui/react-dropdown-menu": "^2.2.1",
+    "@radix-ui/react-hover-card": "^1.2.1",
+    "@radix-ui/react-label": "^2.1.17",
+    "@radix-ui/react-menubar": "^1.2.1",
+    "@radix-ui/react-navigation-menu": "^1.4.1",
+    "@radix-ui/react-popover": "^1.3.1",
+    "@radix-ui/react-progress": "^1.2.1",
+    "@radix-ui/react-radio-group": "^1.5.1",
+    "@radix-ui/react-scroll-area": "^1.4.0",
+    "@radix-ui/react-select": "^2.4.1",
+    "@radix-ui/react-separator": "^1.2.0",
+    "@radix-ui/react-slider": "^1.6.1",
+    "@radix-ui/react-slot": "^1.5.0",
+    "@radix-ui/react-switch": "^1.4.1",
+    "@radix-ui/react-tabs": "^1.2.1",
+    "@radix-ui/react-toggle": "^1.2.1",
+    "@radix-ui/react-toggle-group": "^1.2.1",
+    "@radix-ui/react-tooltip": "^1.4.1",
+    "@tailwindcss/typography": "^0.5.20",
+    "@tailwindcss/vite": "^4.3.3",
+    "@types/google.maps": "^3.66.7",
+    "@types/node": "^26.6.5",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
+    "@vitejs/plugin-react": "^6.1.2",
+    "add": "^2.0.9",
+    "autoprefixer": "^10.6.1",
+    "axios": "^1.20.0",
+    "better-sqlite3": "^13.0.3",
+    "cheerio": "^1.2.0",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
+    "drizzle-kit": "^0.31.11",
+    "drizzle-orm": "^0.45.4",
     "embla-carousel-react": "^8.6.0",
-    "esbuild": "^0.25.0",
-    "framer-motion": "^13.1.1",
-    "input-otp": "^1.4.2",
+    "emittery": "^2.2.0",
+    "esbuild": "^0.28.2",
+    "framer-motion": "^13.5.1",
+    "hono": "^4.13.13",
+    "input-otp": "^1.5.0",
     "jsdom": "26.1.0",
-    "lucide-react": "^0.453.0",
-    "nanoid": "^5.1.5",
+    "lucide-react": "^1.61.0",
+    "mysql2": "^3.24.6",
+    "nanoid": "^6.0.2",
     "next-themes": "^0.4.6",
-    "postcss": "^8.4.47",
-    "prettier": "^3.6.2",
-    "react": "^19.2.1",
-    "react-day-picker": "^9.11.1",
-    "react-dom": "^19.2.1",
-    "react-hook-form": "^7.64.0",
-    "react-resizable-panels": "^3.0.6",
-    "recharts": "^2.15.2",
-    "sonner": "^2.0.7",
-    "streamdown": "^2.6.0",
-    "tailwind-merge": "^3.3.1",
-    "tailwindcss": "^4.1.14",
+    "p-limit": "^7.3.3",
+    "playwright": "^1.64.1",
+    "p-retry": "^8.0.1",
+    "postcss": "^8.5.31",
+    "prettier": "^3.9.10",
+    "prisma": "^7.10.1",
+    "react": "^19.3.1",
+    "react-day-picker": "^10.0.2",
+    "react-dom": "^19.3.1",
+    "react-hook-form": "^7.91.0",
+    "react-resizable-panels": "^4.14.8",
+    "recharts": "^3.10.1",
+    "sonner": "^2.0.8",
+    "streamdown": "^2.7.1",
+    "tailwind-merge": "^3.7.0",
+    "tailwindcss": "^4.3.3",
     "tailwindcss-animate": "^1.0.7",
-    "tsx": "^4.19.1",
+    "tsx": "^4.23.15",
     "tw-animate-css": "^1.4.0",
     "typescript": "7.0.2",
     "vaul": "^1.1.2",
-    "vite": "^8.2.2",
-    "vite-plugin-manus-runtime": "^0.0.58",
-    "vitest": "^4.1.10",
-    "wouter": "^3.3.5",
-    "zod": "^4.1.12"
+    "vite": "^8.3.5",
+    "vite-plugin-manus-runtime": "^0.0.59",
+    "vitest": "^5.0.5",
+    "wouter": "^3.13.0",
+    "zod": "^4.6.7"
   },
   "optionalDependencies": {
-    "commander": "^13.1.0",
+    "commander": "^15.0.0",
     "dockerode": "^5.0.1",
-    "express": "^5.1.0"
+    "express": "^5.3.0"
   },
   "systemLibraries": {
     "note": "system libraries, not npm packages (declared by nested_package.json v3 as dependencies; kept here as build-time system requirements only)",
@@ -301,9 +351,9 @@
   "saddle": {
     "date": "2026-08-23",
     "toolchain": {
-      "node": "26.7.0",
+      "node": "26.12.0",
       "nodeLts": "24.19.0",
-      "nodeCurrent": "26.7.0",
+      "nodeCurrent": "26.12.0",
       "npm": "12.0.2",
       "typescript": "7.0.2",
       "python": "3.14.7",

package/passage.config

@@ -2,7 +2,7 @@
   "meta": {
     "name": "passage.config",
     "title": "saddle - Passage Configuration (3 homonym domains kept separate + host playbook)",
-    "version": "2.0.0",
+    "version": "2.1.6",
     "date": "2026-08-22",
     "language": "en",
     "conceptSeparation": "'passage' has 3 distinct domains in the pool: (1) gateway - L7 Pingora reverse proxy (routes/upstreams/TLS 1.3); (2) passthrough - PCI device passthrough modes (VFIO/MDEV/MIG/vGPU/SR-IOV/vfio-user/hotplug/KVM/none); (3) network_binding - VM network bridge modes + host port binding (never localhost). A 4th section carries the AetherForge host-side VFIO playbook. Sections are NEVER merged.",
@@ -56,7 +56,7 @@
   "gateway": {
     "meta": {
       "project": "saddle (grand merge)",
-      "version": "2.0.0",
+      "version": "2.1.6",
       "schema": "passage.config",
       "schemaversion": "2026.08.22",
       "engine": "passage gateway v6",

package/processors.json

@@ -3,7 +3,7 @@
   "meta": {
     "name": "processors.json",
     "title": "saddle - Unified Virtual Processor Database",
-    "version": "2.0.0",
+    "version": "2.0.127",
     "date": "2026-08-22",
     "language": "en",
     "description": "Union of the v5 canonical CPU database (6 x86_64 identities), the e2ugh processor catalog (55 SKUs incl. ARM/Apple/Xeon; lineage kept), Zen5/X3D microarchitecture specs and pool minis. Field conflicts resolved V5-first (model_name/max_boost_ghz/tdp_watts canonical); OMNI complementary fields (arch, core_type, topology, memory_support, release_date) merged in place. Versions re-pinned date-first 2026-08-22.",

package/qemu.config

@@ -2,7 +2,7 @@
   "meta": {
     "name": "qemu.config",
     "title": "saddle - QEMU Configuration (canonical JSON; sources: S6 TOML + v5 spec 11.1.0 + libvirt overlay)",
-    "version": "2.0.0",
+    "version": "2.0.127",
     "date": "2026-08-22",
     "language": "en",
     "format": "JSON (canonical v2 schema; sources were S6 TOML + V5 JSON schema + libvirt conf overlay)",
@@ -90,7 +90,7 @@
         "githubSetupPython": "actions/setup-python@v5.4.0",
         "platformKernel": "6.11.0+"
       },
-      "version": "2.0.0",
+      "version": "2.0.127",
       "title": "saddle - QEMU Configuration (canonical JSON; sources: S6 TOML + v5 spec 11.1.0 + libvirt overlay)",
       "project": "e2ugh v6",
       "toolchainV5": {