Campaign: SNIF (Sandboxed-NIF) for all estate languages — wrap raw NIFs, add a Rust/SPARK SNIF

[hyperpolymath]

Standard

Native FFI into a managed runtime (BEAM, and equivalents) must route through a SNIF — Sandboxed NIF (WASM-runtime, crash-isolated), never a raw NIF. A native crash must degrade to {:error, _} and leave the host alive, with a fallback chain SNIF → WASM → native → pure.

Exemplar (the only SNIF that exists today — Elixir): burble/server/lib/burble/coprocessor/snif_backend.ex + burble/docs/SNIF-INTEGRATION.md.

Raw NIFs to wrap (from audit)

• verisimdb/elixir-orchestration/lib/verisim/nif_bridge.ex — raw Rustler NIF (load_nif → priv/native/libverisim_nif.so). HTTP transport is the safe default, but the NIF path is unsandboxed → wrap in a SNIF.
• burble/server/lib/burble/coprocessor/zig_backend.ex — Zig NIFs with a documented SNIF fallback but not fully wrapped → complete the wrapper.

Build SNIF support for every estate language that uses native FFI

• Elixir ✓ (burble) — generalise it into the reusable pattern.
• Rust/SPARK SNIF (explicitly requested): sandbox Rust/SPARK native calls behind the same WASM-isolated boundary.
• Enumerate + add for the other estate host languages where native FFI is used.

Conformance to the immutable FFI rules

Every SNIF's boundary must be: pure-Zig FFI (no C source, no .h), ABI specified in Idris2, C-ABI as wire format only. Ties into the unified-zig-api + Idris2-ABI standards.

Scope

Master campaign; reachable repos = the 6. Per-repo sub-issues to follow.

---

Filed via Claude Code — https://claude.ai/code/session_01JNCDaWMB8NV6nAPrvmTg4w