id: profile.build
version: "1.0.0"
extension: ext.vm-packer
isolation:
  level: microvm
network:
  default: deny
  egress: []
workspace:
  mode: remote-canonical
  access: rw
scope_default: agent
ttl:
  default: 8h
  max: 24h
  idle_reap: null
resources:
  cpu: null
  memory_mb: null
setup:
  instructions: >
    Build sandbox for snuggle-inventor. Attach to pre-built VM via ops-bridge
    tunnel (e.g. haskell-build). Secret refs resolved at provision boundary only.
  secret_refs:
    - build-registry-token
placement:
  prefer: [localhost]
  fallback: [workstation]
reachability:
  tunnel: ops-bridge
  identity: ops-warden
metadata:
  cost_class: self-hosted
  latency_class: standard
  observability: none