id: profile.saas-stub
version: "1.0.0"
extension: ext.saas-stub
isolation:
  level: microvm
network:
  default: deny
  egress: []
workspace:
  mode: remote-canonical
  access: rw
scope_default: session
ttl:
  default: 1h
  max: 4h
  idle_reap: null
resources:
  cpu: null
  memory_mb: null
setup:
  instructions: "Metered SaaS stub — no external provider API."
  secret_refs: []
placement:
  prefer: []
  fallback: []
reachability:
  tunnel: ops-bridge
  identity: ops-warden
metadata:
  cost_class: saas-metered
  latency_class: standard
  observability: none