feat(snif): initial paper + empirical demo — WASM crash isolation for BEAM NIFs

- Zig source (safe_nif.zig): fibonacci + 5 crash modes (oob, unreachable,
  panic, overflow, div-zero) compiled to wasm32-freestanding in both
  ReleaseSafe and ReleaseFast
- Elixir demo (wasmex 0.14 / OTP 28): Loader + 11-test ExUnit suite
- All 11 tests pass: every trap class returns {:error, reason}, BEAM survives
- ReleaseFast disassembly captured: UB -> silent wrong answers, not crashes
- LaTeX paper (snif.tex, ~380 lines) + compiled PDF
- Critical invariant established: -OReleaseSafe mandatory for SNIFs
- Typed-wasm L5 bounds proof connection documented

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: hyperpolymath

.devcontainer/Containerfile

@@ -0,0 +1,32 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} (hyperpolymath) <{{AUTHOR_EMAIL}}>
+#
+# Dev Container image for {{PROJECT_NAME}}
+# Base: Chainguard Wolfi (minimal, supply-chain-secure)
+# Build: podman build -t {{PROJECT_NAME}}-dev -f .devcontainer/Containerfile .
+
+FROM cgr.dev/chainguard/wolfi-base:latest
+
+# Install common development tools
+RUN apk update && apk add --no-cache \
+    bash \
+    curl \
+    git \
+    openssh-client \
+    ca-certificates \
+    build-base \
+    posix-libc-utils \
+    shadow \
+    && rm -rf /var/cache/apk/*
+
+# Create non-root dev user (matches devcontainer.json remoteUser)
+RUN groupadd -g 1000 nonroot || true \
+    && useradd -m -u 1000 -g 1000 -s /bin/bash nonroot || true
+
+# Set workspace directory
+WORKDIR /workspaces/{{PROJECT_NAME}}
+
+# Default shell
+ENV SHELL=/bin/bash
+
+USER nonroot

.devcontainer/README.adoc

@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: PMPL-1.0-or-later
+= Dev Container Usage
+:author: {{AUTHOR}} <{{AUTHOR_EMAIL}}>
+
+== Overview
+
+This dev container uses `cgr.dev/chainguard/wolfi-base` with git, curl, bash, and just pre-installed. Dev container features add git, just, and nickel automatically.
+
+== VS Code (Local)
+
+. Install the *Dev Containers* extension (`ms-vscode-remote.remote-containers`).
+. Set `dev.containers.dockerPath` to `podman` in VS Code settings.
+. Open the repo folder, then choose **Reopen in Container** from the command palette.
+
+== GitHub Codespaces
+
+. From the repository on GitHub, click **Code > Codespaces > New codespace**.
+. The container builds automatically from this configuration.
+
+== Gitpod
+
+. Prefix the repo URL with `https://gitpod.io/#` to launch a workspace.
+. Gitpod reads `devcontainer.json` and builds the environment.
+
+== Customization
+
+Replace `{{PROJECT_NAME}}` placeholders in both `devcontainer.json` and `Containerfile` with your actual project name. Run `just deps` to verify the environment after first launch.

.devcontainer/devcontainer.json

@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: PMPL-1.0-or-later
+// Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} (hyperpolymath) <{{AUTHOR_EMAIL}}>
+//
+// Dev Container configuration for {{PROJECT_NAME}}
+// Works with: VS Code Dev Containers, GitHub Codespaces, Gitpod
+// Container runtime: Podman (recommended) or any OCI-compliant runtime
+{
+  "name": "{{PROJECT_NAME}}",
+
+  "build": {
+    "dockerfile": "Containerfile",
+    "context": ".."
+  },
+
+  "features": {
+    "ghcr.io/devcontainers/features/git:1": {
+      "ppa": false,
+      "version": "latest"
+    },
+    "ghcr.io/jdx/devcontainer-features/just:1": {},
+    "ghcr.io/nickel-lang/devcontainer-feature:0": {}
+  },
+
+  "postCreateCommand": "just deps",
+
+  "remoteUser": "nonroot",
+
+  "containerEnv": {
+    "EDITOR": "code --wait",
+    "LANG": "C.UTF-8"
+  },
+
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "EditorConfig.EditorConfig",
+        "eamodio.gitlens",
+        "streetsidesoftware.code-spell-checker",
+        "timonwong.shellcheck",
+        "tamasfe.even-better-toml",
+        "skellock.just",
+        "redhat.vscode-yaml",
+        "DavidAnson.vscode-markdownlint",
+        "asciidoctor.asciidoctor-vscode",
+        "usernamehw.errorlens"
+      ],
+      "settings": {
+        "editor.formatOnSave": true,
+        "editor.insertSpaces": true,
+        "editor.tabSize": 2,
+        "files.trimTrailingWhitespace": true,
+        "files.insertFinalNewline": true,
+        "files.trimFinalNewlines": true,
+        "[makefile]": {
+          "editor.insertSpaces": false
+        }
+      }
+    },
+    "codespaces": {
+      "openFiles": [
+        "README.adoc"
+      ]
+    }
+  },
+
+  "forwardPorts": [],
+
+  "shutdownAction": "stopContainer"
+}

.editorconfig

@@ -0,0 +1,65 @@
+# RSR-template-repo - Editor Configuration
+# https://editorconfig.org
+
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 2
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.adoc]
+trim_trailing_whitespace = false
+
+[*.rs]
+indent_size = 4
+
+[*.ex]
+indent_size = 2
+
+[*.exs]
+indent_size = 2
+
+[*.zig]
+indent_size = 4
+
+[*.ada]
+indent_size = 3
+
+[*.adb]
+indent_size = 3
+
+[*.ads]
+indent_size = 3
+
+[*.hs]
+indent_size = 2
+
+[*.res]
+indent_size = 2
+
+[*.resi]
+indent_size = 2
+
+[*.ncl]
+indent_size = 2
+
+[*.rkt]
+indent_size = 2
+
+[*.scm]
+indent_size = 2
+
+[*.nix]
+indent_size = 2
+
+[Justfile]
+indent_style = space
+indent_size = 4
+

.envrc

@@ -0,0 +1,27 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Activate development environment
+# Install direnv: https://direnv.net/
+
+# Load .tool-versions if asdf is available
+if has asdf; then
+  use asdf
+fi
+
+# Load Guix shell if guix.scm exists
+if has guix && [ -f guix.scm ]; then
+  use guix
+fi
+
+# Load Nix flake if flake.nix exists
+if has nix && [ -f flake.nix ]; then
+  use flake
+fi
+
+# Project environment variables
+export PROJECT_NAME="{{PROJECT_NAME}}"
+export RSR_TIER="infrastructure"
+# export DATABASE_URL="..."
+# export API_KEY="..."
+
+# Source .env if it exists (gitignored)
+dotenv_if_exists

.gitattributes

@@ -0,0 +1,55 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# RSR-compliant .gitattributes
+
+* text=auto eol=lf
+
+# Source
+*.rs    text eol=lf diff=rust
+*.ex    text eol=lf diff=elixir
+*.exs   text eol=lf diff=elixir
+*.jl    text eol=lf
+*.res   text eol=lf
+*.resi  text eol=lf
+*.ada   text eol=lf diff=ada
+*.adb   text eol=lf diff=ada
+*.ads   text eol=lf diff=ada
+*.hs    text eol=lf
+*.chpl  text eol=lf
+*.scm   text eol=lf
+*.a2ml  text eol=lf linguist-language=TOML
+*.ncl   text eol=lf
+*.nix   text eol=lf
+
+# Docs
+*.md    text eol=lf diff=markdown
+*.adoc  text eol=lf
+*.txt   text eol=lf
+
+# Data
+*.json  text eol=lf
+*.yaml  text eol=lf
+*.yml   text eol=lf
+*.toml  text eol=lf
+
+# Config
+.gitignore     text eol=lf
+.gitattributes text eol=lf
+Justfile       text eol=lf
+Makefile       text eol=lf
+Containerfile  text eol=lf
+
+# Scripts
+*.sh   text eol=lf
+
+# Binary
+*.png   binary
+*.jpg   binary
+*.gif   binary
+*.pdf   binary
+*.woff2 binary
+*.zip   binary
+*.gz    binary
+
+# Lock files
+Cargo.lock  text eol=lf -diff
+flake.lock  text eol=lf -diff

.github/.mailmap

@@ -0,0 +1 @@
+{{AUTHOR}} <{{AUTHOR_EMAIL}}> <{{AUTHOR_EMAIL_ALT}}>

.github/.nojekyll

@@ -0,0 +1 @@
+# AI Manifest - Level 1: .github

.github/0.1-AI-MANIFEST.a2ml

@@ -0,0 +1,14 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# CODEOWNERS - Define code review assignments
+# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+#
+# Replace hyperpolymath with your GitHub username or team
+
+# Default owners for everything
+* @hyperpolymath
+
+# Security-sensitive files require explicit review
+SECURITY.md @hyperpolymath
+.github/workflows/ @hyperpolymath
+Trustfile.a2ml @hyperpolymath
+.machine_readable/ @hyperpolymath