Standard
Native FFI into a managed runtime (BEAM, and equivalents) must route through a SNIF — Sandboxed NIF (WASM-runtime, crash-isolated), never a raw NIF. A native crash must degrade to {:error, _} and leave the host alive, with a fallback chain SNIF → WASM → native → pure.
Exemplar (the only SNIF that exists today — Elixir): burble/server/lib/burble/coprocessor/snif_backend.ex + burble/docs/SNIF-INTEGRATION.md.
Raw NIFs to wrap (from audit)
verisimdb/elixir-orchestration/lib/verisim/nif_bridge.ex — raw Rustler NIF (load_nif → priv/native/libverisim_nif.so). HTTP transport is the safe default, but the NIF path is unsandboxed → wrap in a SNIF.burble/server/lib/burble/coprocessor/zig_backend.ex — Zig NIFs with a documented SNIF fallback but not fully wrapped → complete the wrapper.
Build SNIF support for every estate language that uses native FFI
- Elixir ✓ (burble) — generalise it into the reusable pattern.
- Rust/SPARK SNIF (explicitly requested): sandbox Rust/SPARK native calls behind the same WASM-isolated boundary.
- Enumerate + add for the other estate host languages where native FFI is used.
Conformance to the immutable FFI rules
Every SNIF's boundary must be: pure-Zig FFI (no C source, no .h), ABI specified in Idris2, C-ABI as wire format only. Ties into the unified-zig-api + Idris2-ABI standards.
Scope
Master campaign; reachable repos = the 6. Per-repo sub-issues to follow.
Filed via Claude Code — https://claude.ai/code/session_01JNCDaWMB8NV6nAPrvmTg4w
Standard
Native FFI into a managed runtime (BEAM, and equivalents) must route through a SNIF — Sandboxed NIF (WASM-runtime, crash-isolated), never a raw NIF. A native crash must degrade to
{:error, _}and leave the host alive, with a fallback chainSNIF → WASM → native → pure.Exemplar (the only SNIF that exists today — Elixir):
burble/server/lib/burble/coprocessor/snif_backend.ex+burble/docs/SNIF-INTEGRATION.md.Raw NIFs to wrap (from audit)
verisimdb/elixir-orchestration/lib/verisim/nif_bridge.ex— raw Rustler NIF (load_nif→priv/native/libverisim_nif.so). HTTP transport is the safe default, but the NIF path is unsandboxed → wrap in a SNIF.burble/server/lib/burble/coprocessor/zig_backend.ex— Zig NIFs with a documented SNIF fallback but not fully wrapped → complete the wrapper.Build SNIF support for every estate language that uses native FFI
Conformance to the immutable FFI rules
Every SNIF's boundary must be: pure-Zig FFI (no C source, no
.h), ABI specified in Idris2, C-ABI as wire format only. Ties into the unified-zig-api + Idris2-ABI standards.Scope
Master campaign; reachable repos = the 6. Per-repo sub-issues to follow.
Filed via Claude Code — https://claude.ai/code/session_01JNCDaWMB8NV6nAPrvmTg4w