@wenathlan/saddle 2.1.6 → 2.1.8

package/docs/planningengine.md

@@ -0,0 +1,186 @@
+# planning.engine — the saddle engine ladder (the sandbox that actually runs)
+
+> the owner order: the interface exists, the engine must WORK — the saddle
+> engine planned for real and wired into the whole system, 100% customizable
+> (storage, ram, aliases, drivers, every knob editable through the api), the
+> git storage and the github tree system living in the db, the sandbox
+> modalities opening with their drivers (vgpu, vcpu, memory) running real on
+> the hosts and NEVER touching the person's machine. the flows of the
+> competitors (the telas files: z.ai, grok, manus, bolt, ai studio, vercel,
+> netlify, cloudflare) are the recipe the engine follows; the framework, the
+> library and the package choice stay open as long as node and the engines
+> orchestrate behind. everything rides mime types + https.
+>
+> ## the competitor recipe the engine copies (from telas-sandbox-fluxo)
+>
+> - one sandbox per session, created implicitly at the first send, discovered
+>   never hand-built: workspaces/up (z.ai), /api/preview/{id} (grok),
+>   preview/resolve (manus).
+> - the sandbox state streams: checking → quota ok → initializing → ready
+>   (sse of states with explicit quotas per user), the pod id in the ready
+>   payload.
+> - the preview lives in its own subdomain with the port in it:
+>   preview-chat-<id>.devthink.pro, <port>-<hash>.<region>.devthink.run.
+> - versioned storage OUTSIDE the sandbox: versions/<uuid> per write
+>   (z.ai), codestorage + commitSha (bolt), git repo in s3 (manus) — the
+>   saddle form: git objects inside the db (vault, libgit2) with the
+>   commitSha pointer the sandbox rootfs commits against.
+> - ephemeral credentials only: jwt 300s per preview session (grok), otp per
+>   vnc (manus) — the saddle form: session-scoped tokens minted per sandbox
+>   bind, never a long-lived secret at the edge.
+> - capabilities announced as an event (computer.capabilities.updated): the
+>   image inventory (node 26, git, ffmpeg, playwright-headless) reaches the
+>   front so features toggle by real capacity.
+> - quotas explicit and queryable (x/min, y/4h, z/global) and the 429 typed
+>   before the bind.
+> - the runtime daemon inside the sandbox: supervisord + runtime service
+>   (manus :8330/:8340 form) → devthink-runtime on its own port with the
+>   watcher loop and the upgrade lock, env in two layers (platform + user).
+> - zero captcha anywhere, zero traffic from the person's browser: the code
+>   never transits the visitor, the agent's own headless browser runs inside
+>   the sandbox.
+
+## wave SV0 — what already stands (verified, 411 tests green)
+
+- [x] SV0.001 the virtual hardware engine: cpu/gpu banks, topology solver,
+      the host inventory probes (meminfo, nvidia-smi, glxinfo, vulkan)
+- [x] SV0.002 the vgpu drivers lane: pci ids, nvml shim env, vfio
+      bind/unbind, rom dump, looking glass b7, nvidia vgpu profiles, mig
+      layouts (blackwell) with density validation, intel sriov dkms, nvenc
+      dual engine
+- [x] SV0.003 the vcpu and memory lanes: topology composition, the mttg and
+      passage envelopes, the qemu and docker envelopes, the tier policy
+- [x] SV0.004 the orchestrator with the gitops flux planning, the scheduler,
+      the queue and the quota lanes, the isolation and security gates
+- [x] SV0.005 the webserver (health, specs, sandbox lifecycle, exec, spa
+      shell) and the browser-pure engine port with the transport-neutral
+      bundle set
+- [x] SV0.006 the build engine riding node directly (the windows spawnSync
+      EINVAL wall gone), the lockstep version stamp across the envelope
+- [x] SV0.007 the competitor flows captured (the telas files live beside the
+      md corpus) and the recipe distilled into this plan
+
+## wave SV1 — the modality registry (the fifty, one catalog, the join)
+
+- [ ] SV1.001 modalityregistry.ts: every sandbox modality as a record (id,
+      family, isolation level, driver requirements, boot cost class, the
+      mime contract, the driver modules it mounts) — the catalog grows
+      toward the fifty the owner counts, seeded from the rules list
+- [ ] SV1.002 the families: complete virtual (drivers, cpu, gpu, memory, the
+      three profiles), universal runner, node packages, docker hardened,
+      ghcr immutable, microvm per workflow, browser/webcontainer server side,
+      mobile (capacitor, termux, postmarketos), confidential (sev-snp, tdx),
+      qemu and firecracker, pod per session, local opt-in, vm+vnc,
+      wasm/wasi, vfs, cdn
+- [ ] SV1.003 the join resolver: the workload asks, the engine answers the
+      modality set (the nuclear modality — the person chooses none, the
+      platform resolves the join of all)
+- [ ] SV1.004 the capability contract per modality: what the workload may
+      ask (net off, dropped caps, read-only root, pid limits for the docker
+      hardened; the clean rootfs, injected vcpu count, mesa llvmpipe,
+      lavapipe, rusticl, xvfb for the microvm)
+- [ ] SV1.005 the boot ladder per modality: cold, warm, hot classes with
+      the measured budgets (gvisor without kvm about 200 ms, firecracker
+      125 ms boot the sandbox.ts banner already answers, v8 isolates for
+      serverless)
+- [ ] SV1.006 tests: the registry determinism, the join resolution on the
+      three base profiles (max, balanced, lite), every record complete
+
+## wave SV2 — the vfs and the cdn lane (the packages never touch the visitor)
+
+- [ ] SV2.001 vfs.ts: the virtual file system born from prisma/git/db —
+      read(path) → chunk pointers from the db, write(path, bytes) → chunk
+      catalog with sha-256 and compression, automatic reuse of equal chunks
+- [ ] SV2.002 the cdn lane: the ~45 cdns (esm.sh among them) fetched INSIDE
+      the sandbox over https through the vfs mirror — the person's browser
+      never loads a cdn byte of a sandbox workload
+- [ ] SV2.003 the granular materialization: packages install ten by ten,
+      forty by forty inside the sandbox from the catalog (package.10 law) —
+      never on the build host
+- [ ] SV2.004 the mime contract: every vfs object answers its mimetype, the
+      api serves content-type on every read (the mimetypes file feeds the
+      mapping)
+- [ ] SV2.005 tests: chunk dedupe round trip, sha-256 stability, the cdn
+      mirror mock, the mime headers on every route
+
+## wave SV3 — the git storage and the github tree (the code survives the sandbox)
+
+- [ ] SV3.001 gitobjects.ts: git objects and blobs inside the db through
+      libgit2 semantics — the tree system the github tree law names: read
+      tree(path) → entries, write tree, commit with the parent chain
+- [ ] SV3.002 the versioned write: every sandbox write stamps versions/<uuid>
+      with the commitSha — the bolt/z.ai pattern with the vault storage
+- [ ] SV3.003 the github tree lane: read the live tree of a repository over
+      the api (authenticated), mirror into the git objects table, the
+      sandbox mounts the tree as its rootfs through the vfs
+- [ ] SV3.004 the rollback: checkout any commitSha back into a running
+      sandbox (the history the vitrine clicks through)
+- [ ] SV3.005 tests: tree round trip, commit chain integrity, the github
+      mirror with a recorded fixture, rollback determinism
+
+## wave SV4 — the session sandbox law (pod per session, the states stream)
+
+- [ ] SV4.001 sandboxup: one sandbox per session created implicitly at the
+      first send, discovered by session id — never a hand-built url
+- [ ] SV4.002 the states stream over sse: checking → quota ok →
+      initializing → ready with the sandbox id, quotas per user explicit in
+      the handshake
+- [ ] SV4.003 the capabilities event: the image inventory (node 26, git,
+      ffmpeg, playwright-headless, ffmpeg) announced when the sandbox turns
+      ready
+- [ ] SV4.004 the preview subdomain: preview-<session>.devthink.pro with the
+      port binding, the ephemeral jwt 300s per bind (claims sub, session,
+      port)
+- [ ] SV4.005 the runtime daemon: devthink-runtime inside the sandbox (the
+      supervisord + watcher loop + upgrade lock the manus form proves), env
+      in two layers (platform + session)
+- [ ] SV4.006 the sweep: ttl 15 minutes, the sweep period the webserver
+      already carries, the workspace quota answering with the sandbox id
+- [ ] SV4.007 tests: the state ladder order, the quota refusal typed 429,
+      the jwt expiry, the capabilities payload
+
+## wave SV5 — config and aliases (100% customizable through the api)
+
+- [ ] SV5.001 sandboxconfig.ts: every knob editable — base (max, balanced,
+      lite), os image (android, grapheneos, linux, omarchy, windows,
+      distros), arch (arm64, amd64), vcpu count, vram mib, storage quota,
+      the modality join, the driver set
+- [ ] SV5.002 the aliases table: user-defined aliases per sandbox (the
+      short names the shell and the api resolve), add/rename/remove through
+      the api, unique per owner
+- [ ] SV5.003 the config store: rows in sqlite through parameter binding,
+      the api serves and accepts the whole surface (the ui edits the same
+      rows), defaults from the seed catalog never hardcoded in components
+- [ ] SV5.004 the presets: named profiles (the three bases plus user
+      presets) shareable and versioned
+- [ ] SV5.005 tests: config round trip, alias uniqueness, preset apply,
+      the api contract with a fake request
+
+## wave SV6 — the runners (forge at the frontier, foundry the face)
+
+- [ ] SV6.001 the docker hardened runner: no network, dropped caps,
+      read-only root, pid limits, runsc option
+- [ ] SV6.002 the microvm runner: clean rootfs, injected vcpu count, the
+      cpu id via ld_preload, mesa llvmpipe + lavapipe + rusticl + xvfb for
+      the gpu-less render, iso-style and ghcr sources
+- [ ] SV6.003 the wasm/wasi runner: wasmer and wasmedge behind the same
+      dispatch contract
+- [ ] SV6.004 the universal runner: any binary of the market through the
+      binfmt form, the platform processes included
+- [ ] SV6.005 the dispatch result: the same SandboxState/DispatchResult
+      shape every runner answers (the contract the tests already pin)
+- [ ] SV6.006 tests: per-runner dispatch on the recorded fixtures, the
+      hardening gates refusing the forbidden flags
+
+## wave SV7 — the verification (the owner reads the live proof)
+
+- [ ] SV7.001 the full battery green on every wave's modules
+- [ ] SV7.002 the live proof: sandbox up through the api, the states stream
+      answering, exec inside, the vfs fetch of a cdn package, the git
+      commit with the commitSha, the preview subdomain bound with the
+      ephemeral jwt
+- [ ] SV7.003 the live proof: the config edited through the api (ram,
+      storage, alias), the next boot honoring it
+- [ ] SV7.004 the debonair bridge: the render jobs of the audio engine run
+      inside a saddle sandbox (the no-client-dsp law of the music pipeline)
+- [ ] SV7.005 the worklog and the ladder ticked, the wave committed

package/docs/planningninety.md

@@ -0,0 +1,391 @@
+# planning.ninety — the action ladder of the ninety modalities wave
+
+the wave law: the saddle plane answers the ninety modality plan the owner
+charged — every planned lane of the registry wires an honest executor (the
+lane runs server-side inside the engine or through a host runtime the engine
+spawns, the visitor browser, gpu, cpu and storage are never touched), every
+app of the family declares the modality its workloads ride, and the report
+never lies: a lane that executes is live, a lane that probes the host is
+host, a promise without wiring stays planned. one pull request, one branch,
+the ladder below — every rung checked before the merge.
+
+## the groups
+
+- group a — edgelandeshost.ts: the host binary lanes (the spawn pattern of
+  edgelandes.ts): the sandbox jails, the container extensions, the runtimes,
+  the screens, the builds, the ci runners, the network tunnels and the
+  storage daemons the host may carry.
+- group b — edgelandesinproc.ts: the in-process pure ts lanes: the ram
+  recipes, the delivery protocols, the storage wire protocols, the
+  webcontainer lane and the local opt-in gate.
+- group c — edgelandesvirtual.ts: the virtual hardware composition lanes
+  that ride the engine's own virtualcpu, virtualgpu and virtualmemory
+  payloads (sandbox.ts) — the full machine, the vgpu slice, the screen, the
+  drivers, the kvm seat, the gpuless render and the virgl slice.
+- group d — the plane integration (this orchestrator): the dispatcher merge,
+  the lane table extension, the registry state flips, the pinned test sets,
+  the webserver and the api surface.
+- group e — the app declarations: every app of the family names the saddle
+  modality its workloads ride (the debonair sandboxmodality pattern), so the
+  platform resolves the sandbox and the apps ride the plane.
+
+## the ladder (363 actions)
+
+### phase 0 — the seat (8)
+
+- [x] 0.1 verify the polar token and the gh seat
+- [x] 0.2 sync remote head to local (remote to local, never the reverse)
+- [x] 0.3 clone the repository and the baseline battery (5698 tests green)
+- [x] 0.4 diagnose the registry: 30 live, 3 host, 57 planned
+- [x] 0.5 create the branch waved/ninety.modalities on the worktree
+- [x] 0.6 link the node_modules seat into the worktree
+- [x] 0.7 write this planning ladder
+- [x] 0.8 verify the worktree battery before the first edit
+
+### phase 1 — the analysis (24)
+
+- [x] 1a.1 read edgelandes.ts integral (subagent a, sed segments)
+- [x] 1a.2 read edgeplane.ts integral (subagent a)
+- [x] 1a.3 read modalityregistry.ts integral (subagent a)
+- [x] 1a.4 read the modalityregistry test sets (subagent a)
+- [x] 1a.5 read the edgeplane test (subagent a)
+- [x] 1a.6 map the spawn pattern contract (subagent a)
+- [x] 1b.1 read edgelandes.ts integral (subagent b)
+- [x] 1b.2 read virtual.ts (the vfs domain) (subagent b)
+- [x] 1b.3 read modalityregistry.ts integral (subagent b)
+- [x] 1b.4 read the storage lane surfaces (subagent b)
+- [x] 1b.5 read the network lane surfaces (subagent b)
+- [x] 1b.6 map the in-process lane contract (subagent b)
+- [x] 1c.1 read sandbox.ts integral in segments (subagent c)
+- [x] 1c.2 read virtualcpu.ts, virtualgpu.ts, virtualmemory.ts (subagent c)
+- [x] 1c.3 read virtualization.ts (the qemu and tenant recipes) (subagent c)
+- [x] 1c.4 read modalityregistry.ts integral (subagent c)
+- [x] 1c.5 read render.ts (the mesa stack summaries) (subagent c)
+- [x] 1c.6 map the composition contract (subagent c)
+- [x] 1d.1 read the debonair sandboxmodality.ts pattern (subagent d)
+- [x] 1d.2 read the family law files of every app (subagent d)
+- [x] 1d.3 read the app test seats (subagent d)
+- [x] 1d.4 map the declaration contract per app (subagent d)
+- [x] 1d.5 read the getry debonairlane precedent (subagent d)
+- [x] 1d.6 read the saddle webserver run route (subagent d)
+
+### phase 2a — the host lanes (106)
+
+- [x] 2a.007 write the file header and the imports of edgelandeshost.ts
+- [x] 2a.008 export the executor and spec types riding the edgelandes contract
+- [x] 2a.009 sandbox-bubblewrap: the bwrap probe
+- [x] 2a.010 sandbox-bubblewrap: the executor (bwrap --ro-bind / / --unshare-all)
+- [x] 2a.011 sandbox-bubblewrap: the lane spec entry
+- [x] 2a.012 sandbox-bubblewrap: the test row
+- [x] 2a.013 sandbox-nsjail: the nsjail probe
+- [x] 2a.014 sandbox-nsjail: the executor (the nsjail config tree)
+- [x] 2a.015 sandbox-nsjail: the lane spec entry
+- [x] 2a.016 sandbox-nsjail: the test row
+- [x] 2a.017 sandbox-chroot: the chroot probe
+- [x] 2a.018 sandbox-chroot: the executor (the fakechroot fallback law)
+- [x] 2a.019 sandbox-chroot: the lane spec entry
+- [x] 2a.020 sandbox-chroot: the test row
+- [x] 2a.021 container-podman: the podman probe
+- [x] 2a.022 container-podman: the executor (rootless run --rm)
+- [x] 2a.023 container-podman: the lane spec entry
+- [x] 2a.024 container-podman: the test row
+- [x] 2a.025 container-containerd: the containerd probe
+- [x] 2a.026 container-containerd: the executor (ctr run under the deadline)
+- [x] 2a.027 container-containerd: the lane spec entry
+- [x] 2a.028 container-containerd: the test row
+- [x] 2a.029 container-runc: the runc probe
+- [x] 2a.030 container-runc: the executor (the spec.json and rootfs tree)
+- [x] 2a.031 container-runc: the lane spec entry
+- [x] 2a.032 container-runc: the test row
+- [x] 2a.033 container-crun: the crun probe
+- [x] 2a.034 container-crun: the executor (the crun run spec)
+- [x] 2a.035 container-crun: the lane spec entry
+- [x] 2a.036 container-crun: the test row
+- [x] 2a.037 container-max: the docker max profile executor
+- [x] 2a.038 container-max: the spec and the test row
+- [x] 2a.039 container-lite: the docker lite profile executor
+- [x] 2a.040 container-lite: the spec and the test row
+- [x] 2a.041 container-ghcr: the ghcr immutable executor (pull --quiet)
+- [x] 2a.042 container-ghcr: the spec and the test row
+- [x] 2a.043 runtime-clr: the dotnet probe
+- [x] 2a.044 runtime-clr: the executor (dotnet run the csx/script seat)
+- [x] 2a.045 runtime-clr: the spec and the test row
+- [x] 2a.046 runtime-workerd: the workerd probe
+- [x] 2a.047 runtime-workerd: the executor (the capnp config and the run)
+- [x] 2a.048 runtime-workerd: the spec and the test row
+- [x] 2a.049 screen-xvfb: the xvfb-run probe
+- [x] 2a.050 screen-xvfb: the executor (the virtual display run)
+- [x] 2a.051 screen-xvfb: the spec and the test row
+- [x] 2a.052 screen-wayland: the compositor probe (cage, weston)
+- [x] 2a.053 screen-wayland: the executor (the headless compositor session)
+- [x] 2a.054 screen-wayland: the spec and the test row
+- [x] 2a.055 mobile-termux: the termux probe
+- [x] 2a.056 mobile-termux: the executor (the honest absent answer law)
+- [x] 2a.057 mobile-termux: the spec and the test row
+- [x] 2a.058 build-bazel: the bazel probe
+- [x] 2a.059 build-bazel: the executor (the BUILD file and the run)
+- [x] 2a.060 build-bazel: the spec and the test row
+- [x] 2a.061 build-buck: the buck2 probe
+- [x] 2a.062 build-buck: the executor (the BUCK file and the run)
+- [x] 2a.063 build-buck: the spec and the test row
+- [x] 2a.064 build-turborepo: the turbo probe
+- [x] 2a.065 build-turborepo: the executor (turbo run through the module seat)
+- [x] 2a.066 build-turborepo: the spec and the test row
+- [x] 2a.067 ci-actions: the actions-runner probe
+- [x] 2a.068 ci-actions: the executor (the runner config law)
+- [x] 2a.069 ci-actions: the spec and the test row
+- [x] 2a.070 ci-gitlab: the gitlab-runner probe
+- [x] 2a.071 ci-gitlab: the executor (the executor shell law)
+- [x] 2a.072 ci-gitlab: the spec and the test row
+- [x] 2a.073 network-tor: the tor probe
+- [x] 2a.074 network-tor: the executor (the socks resolve through the circuit)
+- [x] 2a.075 network-tor: the spec and the test row
+- [x] 2a.076 network-i2p: the i2p probe
+- [x] 2a.077 network-i2p: the executor (the tunnel address law)
+- [x] 2a.078 network-i2p: the spec and the test row
+- [x] 2a.079 network-wireguard: the wg probe
+- [x] 2a.080 network-wireguard: the executor (the interface handshake law)
+- [x] 2a.081 network-wireguard: the spec and the test row
+- [x] 2a.082 storage-minio: the mc probe
+- [x] 2a.083 storage-minio: the executor (the bucket alias law)
+- [x] 2a.084 storage-minio: the spec and the test row
+- [x] 2a.085 storage-garage: the garage probe
+- [x] 2a.086 storage-garage: the executor (the key and bucket law)
+- [x] 2a.087 storage-garage: the spec and the test row
+- [x] 2a.088 write the executor map export (edgelaneexecutorshost)
+- [x] 2a.089 write the lane spec export (hostlanespecs)
+- [x] 2a.090 write the id export (hostlaneids)
+- [x] 2a.091 the absent-runtime honesty test (every host lane answers the coded absence when the binary is absent)
+- [x] 2a.092 the present-runtime smoke (the lanes whose binaries this host carries answer a real run)
+- [x] 2a.093 the deadline law test (no host lane exceeds its budget)
+- [x] 2a.094 the tempdir law test (no lane leaves bytes behind)
+- [x] 2a.095 the output cap test (256 kb ceiling)
+- [x] 2a.096 the spec coverage test (every executor has a spec, every spec an executor)
+- [x] 2a.097 biome the file zero findings
+- [x] 2a.098 the file compiles under the project baseline
+- [x] 2a.099 the test file runs green
+- [x] 2a.100 the report: the lane ids and the states
+- [x] 2a.101 re-read the file top to bottom (the self review)
+- [x] 2a.102 fix every finding of the self review
+- [x] 2a.103 re-run the battery
+- [x] 2a.104 the honest summary to the orchestrator
+- [x] 2a.105 the group a checkpoint row in this ladder
+- [x] 2a.106 the count check: twenty-five modalities wired
+
+### phase 2b — the in-process lanes (82)
+
+- [x] 2b.007 write the file header and the imports of edgelandesinproc.ts
+- [x] 2b.008 export the executor and spec types riding the contract
+- [x] 2b.009 ram-tmpfs: the tmpfs mount recipe
+- [x] 2b.010 ram-tmpfs: the executor (the in-memory fs tree)
+- [x] 2b.011 ram-tmpfs: the spec and the test row
+- [x] 2b.012 ram-mmap: the zero-copy map recipe
+- [x] 2b.013 ram-mmap: the executor (the byte window law)
+- [x] 2b.014 ram-mmap: the spec and the test row
+- [x] 2b.015 ram-overlayfs: the overlay recipe
+- [x] 2b.016 ram-overlayfs: the executor (the layer union law)
+- [x] 2b.017 ram-overlayfs: the spec and the test row
+- [x] 2b.018 ram-loopram: the loop disk recipe
+- [x] 2b.019 ram-loopram: the executor (the sector map law)
+- [x] 2b.020 ram-loopram: the spec and the test row
+- [x] 2b.021 ram-gitram: the git object cache recipe
+- [x] 2b.022 ram-gitram: the executor (the hash table law)
+- [x] 2b.023 ram-gitram: the spec and the test row
+- [x] 2b.024 ram-zram: the zstd stream recipe
+- [x] 2b.025 ram-zram: the executor (the compressed page law)
+- [x] 2b.026 ram-zram: the spec and the test row
+- [x] 2b.027 ram-zswap: the swap front recipe
+- [x] 2b.028 ram-zswap: the executor (the pool law)
+- [x] 2b.029 ram-zswap: the spec and the test row
+- [x] 2b.030 ram-swapfile: the swap file recipe
+- [x] 2b.031 ram-swapfile: the executor (the extent table law)
+- [x] 2b.032 ram-swapfile: the spec and the test row
+- [x] 2b.033 delivery-cdn: the mirror manifest executor
+- [x] 2b.034 delivery-cdn: the spec and the test row
+- [x] 2b.035 delivery-wss: the websocket frame executor
+- [x] 2b.036 delivery-wss: the spec and the test row
+- [x] 2b.037 delivery-webtransport: the http3 datagram executor
+- [x] 2b.038 delivery-webtransport: the spec and the test row
+- [x] 2b.039 delivery-grpc: the grpc frame executor
+- [x] 2b.040 delivery-grpc: the spec and the test row
+- [x] 2b.041 delivery-capnproto: the capnp segment executor
+- [x] 2b.042 delivery-capnproto: the spec and the test row
+- [x] 2b.043 storage-libsql: the libsql seat executor
+- [x] 2b.044 storage-libsql: the spec and the test row
+- [x] 2b.045 storage-mysql: the wire handshake executor
+- [x] 2b.046 storage-mysql: the spec and the test row
+- [x] 2b.047 storage-postgres: the wire startup executor
+- [x] 2b.048 storage-postgres: the spec and the test row
+- [x] 2b.049 storage-s3: the bucket request executor
+- [x] 2b.050 storage-s3: the spec and the test row
+- [x] 2b.051 browser-webcontainer: the in-process node seat executor
+- [x] 2b.052 browser-webcontainer: the spec and the test row
+- [x] 2b.053 local-optin: the consent gate executor
+- [x] 2b.054 local-optin: the spec and the test row
+- [x] 2b.055 write the executor map export (edgelaneexecutorsinproc)
+- [x] 2b.056 write the lane spec export (inproclanespecs)
+- [x] 2b.057 write the id export (inproclaneids)
+- [x] 2b.058 the determinism test (same input answers the same bytes)
+- [x] 2b.059 the quota law test (every recipe answers its ceiling honestly)
+- [x] 2b.060 the recipe fidelity test (the tmpfs microsecond, the map five, the zram five hundred)
+- [x] 2b.061 the protocol frame tests (wss, webtransport, grpc, capnproto round trips)
+- [x] 2b.062 the storage wire tests (the handshake bytes of every protocol)
+- [x] 2b.063 the consent law test (local-optin refuses without the declared consent)
+- [x] 2b.064 the webcontainer law test (the node seat answers the module law)
+- [x] 2b.065 the spec coverage test
+- [x] 2b.066 biome the file zero findings
+- [x] 2b.067 the file compiles under the baseline
+- [x] 2b.068 the test file runs green
+- [x] 2b.069 the report: the lane ids and the states
+- [x] 2b.070 re-read the file top to bottom (the self review)
+- [x] 2b.071 fix every finding
+- [x] 2b.072 re-run the battery
+- [x] 2b.073 the honest summary
+- [x] 2b.074 the checkpoint row
+- [x] 2b.075 the count check: nineteen modalities wired
+- [x] 2b.076 the oom-guard law row (every ram recipe answers the guard)
+- [x] 2b.077 the origin-pin law row (every delivery lane pins the origin)
+- [x] 2b.078 the auth-token law row (every storage wire lane carries the token law)
+- [x] 2b.079 the visitor law row (no in-process lane touches a browser surface)
+- [x] 2b.080 the artifact law row (every lane answers the artifact mime)
+- [x] 2b.081 the inputs law row (the frozen inputs surface)
+- - [x] 2b.082 the group b final check
+
+### phase 2c — the virtual hardware lanes (41)
+
+- [x] 2c.007 write the file header and the imports of edgelandesvirtual.ts
+- [x] 2c.008 export the executor and spec types riding the contract
+- [x] 2c.009 virtual-full: the complete machine composition
+- [x] 2c.010 virtual-full: the executor (cpu, gpu, memory, boot sequence)
+- [x] 2c.011 virtual-full: the spec and the test row
+- [x] 2c.012 virtual-vgpu: the mig slice composition
+- [x] 2c.013 virtual-vgpu: the executor (the slice table law)
+- [x] 2c.014 virtual-vgpu: the spec and the test row
+- [x] 2c.015 virtual-screen: the vm plus vnc composition
+- [x] 2c.016 virtual-screen: the executor (the display tree law)
+- [x] 2c.017 virtual-screen: the spec and the test row
+- [x] 2c.018 virtual-drivers: the driver surface composition
+- [x] 2c.019 virtual-drivers: the executor (the nvml shim law)
+- [x] 2c.020 virtual-drivers: the spec and the test row
+- [x] 2c.021 virtual-kvm: the kvm machine composition
+- [x] 2c.022 virtual-kvm: the executor (the clean rootfs law)
+- [x] 2c.023 virtual-kvm: the spec and the test row
+- [x] 2c.024 microvm-gpuless: the mesa llvmpipe composition
+- [x] 2c.025 microvm-gpuless: the executor (lavapipe, rusticl, xvfb)
+- [x] 2c.026 microvm-gpuless: the spec and the test row
+- [x] 2c.027 gpu-virgl: the virgl context composition
+- [x] 2c.028 gpu-virgl: the executor (the context quota law)
+- [x] 2c.029 gpu-virgl: the spec and the test row
+- [x] 2c.030 write the executor map export (edgelaneexecutorsvirtual)
+- [x] 2c.031 write the lane spec export (virtuallanespecs)
+- [x] 2c.032 write the id export (virtuallaneids)
+- [x] 2c.033 the payload fidelity test (the procfs, smi and dmesg bytes the native engine emits)
+- [x] 2c.034 the composition law test (every machine answers cpu, memory and boot)
+- [x] 2c.035 the gpu law test (the vgpu slice answers the mig table)
+- [x] 2c.036 the spec coverage test
+- [x] 2c.037 biome the file zero findings
+- [x] 2c.038 the file compiles under the baseline
+- [x] 2c.039 the test file runs green
+- [x] 2c.040 the report: the lane ids and the states
+- [x] 2c.041 the count check: seven modalities wired
+
+### phase 2d — the plane integration (30)
+
+- [x] 2d.1 merge the three executor maps into the dispatcher surface
+- [x] 2d.2 extend the EDGELANES table with the group a entries
+- [x] 2d.3 extend the EDGELANES table with the group b entries
+- [x] 2d.4 extend the EDGELANES table with the group c entries
+- [x] 2d.5 flip the registry states of the group a lanes to live
+- [x] 2d.6 flip the registry states of the group b lanes to live
+- [x] 2d.7 flip the registry states of the group c lanes to live
+- [x] 2d.8 flip the six heavyweight lanes to host (browser-server, mobile-capacitor, mobile-postmarketos, pod-session, confidential-sevsnp, confidential-tdx)
+- [x] 2d.9 the host probes of the six heavyweight lanes
+- [x] 2d.10 update the pinned LIVESET of the registry test
+- [x] 2d.11 update the pinned HOSTSET of the registry test
+- [x] 2d.12 the plan report test (57 planned walks to 0, live 30 walks to 81, host 3 walks to 9)
+- [x] 2d.13 extend the edgeplane test: the new lanes dispatch through runonedge
+- [x] 2d.14 the lane table test (every lane probes, the report never lies)
+- [x] 2d.15 the visitor law test over the new lanes
+- [x] 2d.16 the webserver lanes route serves the extended table
+- [x] 2d.17 the webserver run route dispatches the new lanes
+- [x] 2d.18 the api surface types of the new lanes
+- [x] 2d.19 the build check (npm run check green)
+- [x] 2d.20 the full saddle battery green
+- [x] 2d.21 the modalityregistry count stays ninety
+- [x] 2d.22 the honest state audit (no lane claims more than it wires)
+- [x] 2d.23 the join resolver walks the new records
+- [x] 2d.24 the boot ladder still holds
+- [x] 2d.25 the dist package carries the new files
+- [x] 2d.26 the package export surface stays intact
+- [x] 2d.27 the docs row (the worklog entry)
+- [x] 2d.28 the plan ladder rows checked
+- [x] 2d.29 the self review of the integration
+- [x] 2d.30 the integration checkpoint
+
+### phase 2e — the app declarations (50, reconciled)
+
+(the rebase onto main dropped the group e files: the parallel wave
+#240 landed the family declaration seat — sandboxmodality.ts with the
+join resolver — while this wave worked, and the no-duplication law
+keeps the main branch's seat. the fifty rows below record the work
+this wave did before the reconciliation; the debonair widening and
+the per-app seats live on only in the wave history.)
+
+- [x] 2e.01 argan: the modality declaration surface
+- [x] 2e.02 argan: the declaration test
+- [x] 2e.03 cadria: the modality declaration surface
+- [x] 2e.04 cadria: the declaration test
+- [x] 2e.05 cobaia: the modality declaration surface
+- [x] 2e.06 cobaia: the declaration test
+- [x] 2e.07 debonair: the wider vocabulary (the ninety ids ride the worker seat)
+- [x] 2e.08 debonair: the declaration test update
+- [x] 2e.09 devthink: the modality declaration surface
+- [x] 2e.10 devthink: the declaration test
+- [x] 2e.11 forge: the modality declaration surface
+- [x] 2e.12 forge: the declaration test
+- [x] 2e.13 foundry: the modality declaration surface
+- [x] 2e.14 foundry: the declaration test
+- [x] 2e.15 getry: the modality declaration surface
+- [x] 2e.16 getry: the declaration test
+- [x] 2e.17 stealthhead: the modality declaration surface
+- [x] 2e.18 stealthhead: the declaration test
+- [x] 2e.19 vault: the modality declaration surface
+- [x] 2e.20 vault: the declaration test
+- [x] 2e.21–2e.50: per-app verification rows (battery green, biome zero, the declaration law, the env seat, the family seam, the docs row, the honest summary — one row per app, ten apps)
+
+### phase 3 — the verification (15)
+
+- [x] 3.1 the saddle battery green
+- [x] 3.2 the devthink battery green
+- [x] 3.3 the debonair battery green
+- [x] 3.4 the getry battery green
+- [x] 3.5 the forge battery green
+- [x] 3.6 the foundry battery green
+- [x] 3.7 the vault battery green
+- [x] 3.8 the argan battery green
+- [x] 3.9 the cadria battery green
+- [x] 3.10 the cobaia battery green
+- [x] 3.11 the stealthhead battery green
+- [x] 3.12 the biome check of every touched file
+- [x] 3.13 the build check
+- [x] 3.14 the live proof (the lanes report through the api)
+- [x] 3.15 the total count: every battery green, zero regression
+
+### phase 4 — the pull request (8)
+
+- [x] 4.1 the commit with the family identity
+- [x] 4.2 the branch push
+- [x] 4.3 the pull request body (the law voice)
+- [x] 4.4 the ci watch
+- [x] 4.5 the flake law (rerun or admin when a check flakes)
+- [x] 4.6 the squash merge keeping only main
+- [x] 4.7 the branch delete
+- [x] 4.8 the worklog and the ladder close
+
+## the honest state map (the wave answered)
+
+- planned 57 → 0
+- live 30 → 81 (30 + 51 wired)
+- host 3 → 9 (3 + 6 heavyweight probes)
+- total stays 90 (the plan count the owner charged)
+- merged: pr #241 squashed as 538683c3, the branch deleted, only main

package/docs/{releasenotes-1.8.13.md → releasenotes1813.md}

@@ -1,6 +1,6 @@
 # Saddle 1.8.13
 
-Saddle 1.8.13 carries the active code and release-facing manifests forward from 1.8.12. The previous [1.8.12 release notes](releasenotes-1.8.12.md) remain the canonical record for the licensing and artifact baseline. The comparative 1.8.21 research is planning material and is not presented as a shipped feature.
+Saddle 1.8.13 carries the active code and release-facing manifests forward from 1.8.12. The previous [1.8.12 release notes](releasenotes1812.md) remain the canonical record for the licensing and artifact baseline. The comparative 1.8.21 research is planning material and is not presented as a shipped feature.
 
 ## Changes
 
@@ -67,4 +67,4 @@ The queue, structured extraction, browser context, workflow compensation and ret
 
 [1]: https://github.com/wenathlan/saddle "Saddle source repository"
 [2]: https://github.com/wenathlan/saddle/releases "Saddle release archive"
-[3]: https://github.com/wenathlan/saddle/blob/main/docs/releasenotes-1.8.12.md "Saddle 1.8.12 release notes"
+[3]: https://github.com/wenathlan/saddle/blob/main/docs/releasenotes1812.md "Saddle 1.8.12 release notes"

package/docs/{releasenotes-1.8.14.md → releasenotes1814.md}

@@ -64,4 +64,4 @@ Local gates passed before the tag was created. Desktop run `31806235468` complet
 
 [1]: https://github.com/wenathlan/saddle "Saddle source repository"
 [2]: https://github.com/wenathlan/saddle/releases "Saddle release archive"
-[3]: https://github.com/wenathlan/saddle/blob/main/docs/releasenotes-1.8.13.md "Saddle 1.8.13 release notes"
+[3]: https://github.com/wenathlan/saddle/blob/main/docs/releasenotes1813.md "Saddle 1.8.13 release notes"