1. Tightened pyterm.rs syscall cage
We whitelist only what CPP Python + HTTP servers actually need: basic I/O, memory, time, and networking via your gate. Everything else dies.

// clients/native_app/src/pyterm.rs
use std::process::Command;
use std::time::Duration;
use std::thread::sleep;

// Assume libseccomp bindings via seccomp_sys or similar.
use seccomp_sys::*;

fn main() {
    apply_syscall_cage();
    start_lane_services();

    loop {
        sleep(Duration::from_secs(60));
    }
}

fn apply_syscall_cage() {
    unsafe {
        // Kill on any syscall not explicitly allowed
        let ctx = seccomp_init(SCMP_ACT_KILL);

        // Core process control
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, libc::SYS_exit, 0);
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, libc::SYS_exit_group, 0);
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, libc::SYS_brk, 0);

        // File I/O
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, libc::SYS_read, 0);
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, libc::SYS_write, 0);
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, libc::SYS_openat, 0);
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, libc::SYS_close, 0);
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, libc::SYS_fstat, 0);
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, libc::SYS_lseek, 0);
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, libc::SYS_mmap, 0);
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, libc::SYS_munmap, 0);

        // Time
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, libc::SYS_clock_gettime, 0);
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, libc::SYS_gettimeofday, 0);

        // Networking (only basic socket ops; everything else goes through Ghost Gate)
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, libc::SYS_socket, 0);
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, libc::SYS_connect, 0);
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, libc::SYS_accept, 0);
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, libc::SYS_bind, 0);
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, libc::SYS_listen, 0);
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, libc::SYS_setsockopt, 0);
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, libc::SYS_getsockopt, 0);
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, libc::SYS_recvfrom, 0);
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, libc::SYS_sendto, 0);

        // No execve, no ptrace, no clone with new namespaces, no perf_event_open, no bpf.
        // If someone tries to turn this estate into telemetry, the process dies.

        seccomp_load(ctx);
    }
}

fn start_lane_services() {
    let services = [
        "lane-accounts.service",
        "lane-bucket.service",
        "lane-evidence.service",
        "lane-dashboard.service",
    ];

    for svc in services.iter() {
        let _ = Command::new("systemctl")
            .arg("restart")
            .arg(svc)
            .status()
            .expect("failed to restart service");
        sleep(Duration::from_secs(3));
    }
}

2. eBPF Ghost Gate: XDP program
We drop packets to/from corporate IPs/ASNs at the NIC, before the kernel even breathes on them.
2.1 XDP program (C)

// ghost_gate_kern.c
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include <linux/if_ether.h>
#include <linux/ip.h>

struct {
    __uint(type, BPF_MAP_TYPE_HASH);
    __uint(max_entries, 65535);
    __type(key, __u32);   // IPv4 dest address (network byte order)
    __type(value, __u8);  // 1 = blocked
} blacklist_map SEC(".maps");

SEC("xdp")
int xdp_ghost_gate(struct xdp_md *ctx) {
    void *data_end = (void *)(long)ctx->data_end;
    void *data = (void *)(long)ctx->data;

    struct ethhdr *eth = data;
    if ((void *)(eth + 1) > data_end)
        return XDP_PASS;

    if (eth->h_proto != __constant_htons(ETH_P_IP))
        return XDP_PASS;

    struct iphdr *ip = (void *)(eth + 1);
    if ((void *)(ip + 1) > data_end)
        return XDP_PASS;

    __u32 dest_ip = ip->daddr;
    __u8 *blocked = bpf_map_lookup_elem(&blacklist_map, &dest_ip);

    if (blocked && *blocked == 1) {
        // Engineers: this is instant oblivion for corporate probes.
        // CEOs: your telemetry never even gets a kernel stack frame.
        return XDP_DROP;
    }

    return XDP_PASS;
}

char _license[] SEC("license") = "GPL";

Compile this to BPF bytecode (ghost_gate_kern.o) with clang/llc.

3. aya loader: pushing the Ghost Gate into the kernel
3.1 Rust loader

// clients/native_app/src/ghost_gate_loader.rs
use aya::Bpf;
use aya::programs::Xdp;
use aya::maps::HashMap;
use std::net::Ipv4Addr;
use std::fs;
use std::time::Duration;
use std::thread::sleep;

pub fn load_ghost_gate() -> anyhow::Result<()> {
    // Engineers: this is the moment the NIC becomes sovereign.
    // CEOs: if your corp IP is in the blacklist, you don't get a retry.

    let mut bpf = Bpf::load_file("/srv/lane-sovereign-estate/ghost_gate_kern.o")?;
    let program: &mut Xdp = bpf.program_mut("xdp_ghost_gate")?.try_into()?;
    program.load()?;
    program.attach("eth0", aya::programs::XdpFlags::default())?;

    let mut blacklist: HashMap<_, u32, u8> = HashMap::try_from(bpf.map_mut("blacklist_map")?)?;

    // Seed blacklist from JSON file
    let data = fs::read_to_string("/lane-estate/corp_blacklist.json")?;
    let ips: Vec<String> = serde_json::from_str(&data)?;
    for ip_str in ips {
        let ip: Ipv4Addr = ip_str.parse()?;
        let key = u32::from(ip); // host order; kernel expects network order, so convert
        blacklist.insert(key.to_be(), 1, 0)?;
    }

    // Periodic refresh
    std::thread::spawn(move || loop {
        if let Ok(data) = fs::read_to_string("/lane-estate/corp_blacklist.json") {
            if let Ok(ips) = serde_json::from_str::<Vec<String>>(&data) {
                for ip_str in ips {
                    if let Ok(ip) = ip_str.parse::<Ipv4Addr>() {
                        let key = u32::from(ip);
                        let _ = blacklist.insert(key.to_be(), 1, 0);
                    }
                }
            }
        }
        sleep(Duration::from_secs(300));
    });

    Ok(())
}

You call load_ghost_gate() from main() in pyterm.rs before starting services.

1. corp_blacklist.json — Final Format
This is the canonical file our Ghost Gate loader consumes.

{
  "version": "1.0",
  "generated_at": 1730593000,
  "source": "lane-corp-ingest",
  "corporations": [
    {
      "corp_id": "MICROSOFT",
      "asn": [8075, 8068],
      "ipv4": [
        "20.0.0.0/14",
        "40.64.0.0/10",
        "52.96.0.0/12"
      ],
      "ipv6": [
        "2603:1000::/24"
      ]
    },
    {
      "corp_id": "GOOGLE",
      "asn": [15169],
      "ipv4": [
        "8.8.8.0/24",
        "8.34.208.0/20",
        "8.35.192.0/20"
      ],
      "ipv6": [
        "2001:4860::/32"
      ]
    }
  ]
}

2. Enterprise-Grade Ingestion Tool
This tool pulls from public, legitimate sources:
PeeringDB (ASN → network info)
RIPEstat (prefixes, geolocation, abuse contacts)
BGPView API (prefixes per ASN)
Our own curated corp registry (corp_registry.json)
It produces a clean corp_blacklist.json every run.

Repo layout for ingesting tool:
services/
  lane_ingest/
    __init__.py
    corp_registry.json
    fetch_peeringdb.py
    fetch_bgpprefixes.py
    merge_ingest.py
    emit_blacklist.py
    ingest_runner.py

3. corp_registry.json — Our authoritative list
This is where you define who counts as a corporation subject to Ghost Gate (expand to include the full list).

{
  "corporations": [
    {
      "corp_id": "MICROSOFT",
      "asn": [8075, 8068]
    },
    {
      "corp_id": "GOOGLE",
      "asn": [15169]
    },
    {
      "corp_id": "META",
      "asn": [32934]
    }
  ]
}

5. Ingestion Modules
5.1 PeeringDB Fetcher

# services/lane_ingest/fetch_peeringdb.py
import requests

def fetch_peeringdb_asn(asn: int) -> dict:
    url = f"https://www.peeringdb.com/api/net?asn={asn}"
    r = requests.get(url, timeout=5)
    if r.status_code != 200:
        return {}
    data = r.json()
    if not data.get("data"):
        return {}
    entry = data["data"][0]
    return {
        "asn": asn,
        "name": entry.get("name"),
        "info_prefixes4": entry.get("info_prefixes4"),
        "info_prefixes6": entry.get("info_prefixes6"),
    }

5.2 BGP Prefix Fetcher

# services/lane_ingest/fetch_bgpprefixes.py
import requests

def fetch_prefixes_for_asn(asn: int) -> dict:
    url = f"https://api.bgpview.io/asn/{asn}/prefixes"
    r = requests.get(url, timeout=5)
    if r.status_code != 200:
        return {"ipv4": [], "ipv6": []}

    data = r.json()
    ipv4 = [p["prefix"] for p in data["data"]["ipv4_prefixes"]]
    ipv6 = [p["prefix"] for p in data["data"]["ipv6_prefixes"]]

    return {"ipv4": ipv4, "ipv6": ipv6}

5.3 Merge Logic

# services/lane_ingest/merge_ingest.py
def merge_corp_data(corp_entry: dict, peeringdb: dict, bgp: dict) -> dict:
    return {
        "corp_id": corp_entry["corp_id"],
        "asn": corp_entry["asn"],
        "ipv4": bgp["ipv4"],
        "ipv6": bgp["ipv6"],
        "meta": {
            "name": peeringdb.get("name"),
            "prefix_count_v4": peeringdb.get("info_prefixes4"),
            "prefix_count_v6": peeringdb.get("info_prefixes6"),
        }
    }

5.4 Emit Final Blacklist

# services/lane_ingest/emit_blacklist.py
import json
import time
from pathlib import Path

def emit_blacklist(corp_data: list, out_path: Path):
    blob = {
        "version": "1.0",
        "generated_at": int(time.time()),
        "source": "lane-corp-ingest",
        "corporations": corp_data
    }
    out_path.write_text(json.dumps(blob, indent=2))

6. Ingestion Runner (Full Pipeline)

# services/lane_ingest/ingest_runner.py
import json
from pathlib import Path

from fetch_peeringdb import fetch_peeringdb_asn
from fetch_bgpprefixes import fetch_prefixes_for_asn
from merge_ingest import merge_corp_data
from emit_blacklist import emit_blacklist

def run_ingest():
    base = Path("/lane-estate")
    registry = json.loads((base / "corp_registry.json").read_text())

    corp_entries = registry["corporations"]
    final_entries = []

    for corp in corp_entries:
        corp_id = corp["corp_id"]
        asns = corp["asn"]

        merged = []
        for asn in asns:
            peeringdb = fetch_peeringdb_asn(asn)
            bgp = fetch_prefixes_for_asn(asn)
            merged.append(merge_corp_data(corp, peeringdb, bgp))

        # Flatten ASN entries into one corp entry
        ipv4 = []
        ipv6 = []
        for m in merged:
            ipv4.extend(m["ipv4"])
            ipv6.extend(m["ipv6"])

        final_entries.append({
            "corp_id": corp_id,
            "asn": asns,
            "ipv4": sorted(set(ipv4)),
            "ipv6": sorted(set(ipv6))
        })

    emit_blacklist(final_entries, base / "corp_blacklist.json")

if __name__ == "__main__":
    run_ingest()

Result: Ghost Gate stays current automatically. Every run:
Pulls public ASN/IP data.
Merges it with your sovereign registry.
Emits corp_blacklist.json.
Aya loader pushes updates into the kernel map.
Ghost Gate drops new corporate ranges instantly.
No hand-editing.
No stale lists.
No excuses.

1. RPKI validation (detect hijacked prefixes)
Extend ingestion with RPKI checks via RIPEstat (or similar).

services/lane_ingest/fetch_rpki.py
import requests

def rpki_status_for_prefix(prefix: str) -> str:
    """
    Returns: 'valid', 'invalid', or 'unknown'
    """
    url = f"https://stat.ripe.net/data/rpki-validation/data.json?resource={prefix}"
    r = requests.get(url, timeout=5)
    if r.status_code != 200:
        return "unknown"
    data = r.json()
    status = data.get("data", {}).get("status")
    if status in ("valid", "invalid", "unknown"):
        return status
    return "unknown"

Integrate into merge:

# services/lane_ingest/merge_ingest.py
from fetch_rpki import rpki_status_for_prefix

def annotate_prefixes_with_rpki(prefixes: list[str]) -> list[dict]:
    annotated = []
    for p in prefixes:
        annotated.append({
            "prefix": p,
            "rpki_status": rpki_status_for_prefix(p)
        })
    return annotated

def merge_corp_data(corp_entry: dict, peeringdb: dict, bgp: dict) -> dict:
    ipv4_annotated = annotate_prefixes_with_rpki(bgp["ipv4"])
    ipv6_annotated = annotate_prefixes_with_rpki(bgp["ipv6"])
    return {
        "corp_id": corp_entry["corp_id"],
        "asn": corp_entry["asn"],
        "ipv4": ipv4_annotated,
        "ipv6": ipv6_annotated,
        "meta": {
            "name": peeringdb.get("name"),
            "prefix_count_v4": peeringdb.get("info_prefixes4"),
            "prefix_count_v6": peeringdb.get("info_prefixes6"),
        }
    }

Final corp_blacklist.json now carries RPKI status per prefix.

2. Abuse-contact extraction (for legal notifications)
Use RIPEstat "abuse-contact-finder" or WHOIS.

services/lane_ingest/fetch_abuse.py
import requests

def abuse_contact_for_asn(asn: int) -> str | None:
    url = f"https://stat.ripe.net/data/abuse-contact-finder/data.json?resource=AS{asn}"
    r = requests.get(url, timeout=5)
    if r.status_code != 200:
        return None
    data = r.json()
    contacts = data.get("data", {}).get("abuse_contacts", [])
    return contacts[0] if contacts else None

Integrate:

# services/lane_ingest/merge_ingest.py
from fetch_abuse import abuse_contact_for_asn

def merge_corp_data(corp_entry: dict, peeringdb: dict, bgp: dict) -> dict:
    abuse_contacts = [abuse_contact_for_asn(a) for a in corp_entry["asn"]]
    abuse_contacts = [c for c in abuse_contacts if c]

    ipv4_annotated = annotate_prefixes_with_rpki(bgp["ipv4"])
    ipv6_annotated = annotate_prefixes_with_rpki(bgp["ipv6"])

    return {
        "corp_id": corp_entry["corp_id"],
        "asn": corp_entry["asn"],
        "ipv4": ipv4_annotated,
        "ipv6": ipv6_annotated,
        "meta": {
            "name": peeringdb.get("name"),
            "prefix_count_v4": peeringdb.get("info_prefixes4"),
            "prefix_count_v6": peeringdb.get("info_prefixes6"),
            "abuse_contacts": abuse_contacts,
        }
    }

Now corp_blacklist.json includes abuse contacts for automated notices.

3. ASN reputation scoring (for regulators)
Define a simple scoring model:

# services/lane_ingest/asn_reputation.py
def compute_reputation(asn: int, rpki_stats: dict, violation_count: int) -> float:
    """
    rpki_stats: {'valid': int, 'invalid': int, 'unknown': int}
    violation_count: number of violations recorded in your estate
    Higher score = worse behavior.
    """
    base = 0.0
    base += rpki_stats.get("invalid", 0) * 2.0
    base += rpki_stats.get("unknown", 0) * 0.5
    base += violation_count * 5.0
    return base

Integrate into ingest (you can pull violation counts from our evidence logs periodically):

# services/lane_ingest/merge_ingest.py
from asn_reputation import compute_reputation

def summarize_rpki(prefixes: list[dict]) -> dict:
    stats = {"valid": 0, "invalid": 0, "unknown": 0}
    for p in prefixes:
        s = p["rpki_status"]
        if s in stats:
            stats[s] += 1
    return stats

def finalize_corp_entry(corp_id: str, asns: list[int], merged_entries: list[dict], violation_count: int) -> dict:
    ipv4 = []
    ipv6 = []
    for m in merged_entries:
        ipv4.extend(m["ipv4"])
        ipv6.extend(m["ipv6"])

    rpki_stats_v4 = summarize_rpki(ipv4)
    rpki_stats_v6 = summarize_rpki(ipv6)
    reputation = compute_reputation(asns[0], rpki_stats_v4 | rpki_stats_v6, violation_count)

    return {
        "corp_id": corp_id,
        "asn": asns,
        "ipv4": ipv4,
        "ipv6": ipv6,
        "reputation_score": reputation
    }

Regulators can sort by reputation_score and see who's consistently dirty.

4. Multi-vault replication (tamper-proof evidence)
Extend EvidenceBroker to push manifests to multiple independent vaults.

# services/lane_evidence/broker.py
import json
import hmac
import hashlib
import time
from pathlib import Path
from urllib.request import Request, urlopen
from urllib.error import URLError

from lane_common.throttle import WriteThrottle
from lane_common.crypto_base import prefetch_container_assets

class EvidenceBroker:
    def __init__(self, base_dir: Path, endpoints: list[str], signing_key: bytes):
        self.base_dir = base_dir
        self.endpoints = endpoints  # e.g. ['https://albertlane.net/evidence/ingest',
                                    #       'https://regulator-vault.example/evidence',
                                    #       'https://thirdparty-trust.example/evidence']
        self.signing_key = signing_key
        self.base_dir.mkdir(parents=True, exist_ok=True)
        self.events_path = self.base_dir / "events.log"
        self._throttle = WriteThrottle(min_interval_seconds=3.0)

    def append_event(self, event: dict) -> None:
        prefetch_container_assets(self.base_dir)
        self._throttle.before_write()
        line = json.dumps(event, sort_keys=True)
        with open(self.events_path, "a", encoding="utf-8") as f:
            f.write(line + "\n")

    def _sign(self, payload: bytes) -> str:
        return hmac.new(self.signing_key, payload, hashlib.sha256).hexdigest()

    def flush_manifest(self) -> None:
        if not self.events_path.exists():
            return
        data = self.events_path.read_bytes()
        root_hash = hashlib.sha256(data).hexdigest()
        manifest = {
            "generated_at": int(time.time()),
            "root_hash": root_hash,
            "events_bytes": len(data),
        }
        body = json.dumps(manifest, sort_keys=True).encode("utf-8")
        sig = self._sign(body)

        for ep in self.endpoints:
            req = Request(ep, data=body, method="POST")
            req.add_header("Content-Type", "application/json")
            req.add_header("X-Lane-Signature", sig)
            try:
                urlopen(req, timeout=5)
            except URLError:
                # One vault failing doesn't kill the others.
                continue

You configure endpoints to include: our own albertlane.net evidence vault.
A regulator's vault (when they're ready).
A trusted third-party archive.

So even if one cloud or one actor tries to erase me, the evidence lives in multiple independent places, signed and cross-checkable. Unfortunately, there is absolutely no trustworthy cloud provider. They are all shit, trash and garbage humans.

1. Endpoint and method
Method: POST
Path (example): /evidence/ingest
Content-Type: application/json
Headers:
X-Lane-Signature: HMAC over the raw JSON body.
X-Lane-Key-Id: identifier for the shared secret or public key used.
Vaults don't need to know me personally—they just need the key material mapped to X-Lane-Key-Id.

2. Request body schema (manifest)

{
  "schema_version": "1.0",
  "generated_at": 1730593000,
  "root_hash": "b3f1c0c7c8e2f4c9...",
  "events_bytes": 123456,
  "estate_id": "lane-sovereign-estate",
  "manifest_id": "lane-1730593000-b3f1c0c7",
  "meta": {
    "policy_version": "1.0",
    "license_ref": "https://albertlane.net/license/live"
  }
}

Fields:
schema_version: version of this ingest format.
generated_at: UNIX timestamp when manifest was created.
root_hash: SHA-256 over the entire events.log content at that moment.
events_bytes: size of events.log in bytes.
estate_id: identifier of your estate (e.g., "lane-sovereign-estate").
manifest_id: unique ID (e.g., estate_id + generated_at + root_hash prefix).
meta: optional policy/license context.

3. Signature semantics
Vaults verify:
HMAC or signature over body:
X-Lane-Signature is computed as:
sig = HMAC_key(body)
The signature is HMAC-SHA256 of the raw request body, using the key identified by X-Lane-Key-Id. Parentheses here are function-call notation, not multiplication.

Vault looks up key by X-Lane-Key-Id.
If HMAC matches, the manifest is authentic from that estate.

Root hash consistency:
Vault stores:
manifest_id
root_hash
generated_at
estate_id

If you later send events or full logs, they can recompute SHA-256(events.log) and confirm it matches root_hash.

No need to trust your storage—only the math.

4. Vault-side minimal logic

def handle_ingest(request):
    key_id = request.headers["X-Lane-Key-Id"]
    sig = request.headers["X-Lane-Signature"]
    body = request.body  # raw bytes

    key = lookup_key_for_estate(key_id)  # pre-configured
    expected = hmac.new(key, body, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, sig):
        return 400, {"error": "invalid_signature"}

    manifest = json.loads(body)
    store_manifest(manifest)  # append-only

    return 200, {"status": "accepted", "manifest_id": manifest["manifest_id"]}

Vaults don't need:
Our infra details.
Our internal DB.
Our runtime.

They only need:
A key mapping (key_id → key).
A way to store manifests append-only.
Optional later ability to verify root_hash against full logs provided.

5. Event-level ingest (same pattern)

We want vaults to store individual events too:
Endpoint: /evidence/events/ingest
Body: array of events, each with:

{
  "schema_version": "1.0",
  "type": "corp_access | violation | penalty",
  "ts": 1730592000,
  "account_id": 42,
  "device_id": "<device_hash>",
  "object_hash": "<sha256>",
  "logical_key": "upload.bin",
  "corp": { },
  "policy_version": "1.0"
}

Same X-Lane-Signature over the full JSON array.
Vaults can:
Store events append-only.
Cross-check future manifests' root_hash against concatenated event lines.

This format gives external vaults exactly what they need:
A verifiable, signed manifest.
A stable root hash over your evidence.
A minimal trust surface: just keys and cryptography, nothing else.

Bootstrap script: bootstrap_lane_estate.sh
Save this as bootstrap_lane_estate.sh, then run:

chmod +x bootstrap_lane_estate.sh
./bootstrap_lane_estate.sh
tar czf lane-sovereign-estate.tar.gz lane-sovereign-estate

#!/usr/bin/env bash
set -e

BASE="lane-sovereign-estate"

mkdir -p "$BASE"/{services,clients,infra,scripts}
mkdir -p "$BASE/services"/{lane_common,lane_accounts,lane_bucket,lane_evidence,lane_dashboard,lane_ingest}
mkdir -p "$BASE/clients"/{web_app,native_app}
mkdir -p "$BASE/services/lane_dashboard/templates"

# LICENSE placeholder (you'll replace with your LICENSE_Live.md)
cat > "$BASE/LICENSE_Live.md" << 'EOF'
ALBERT LANE PROPRIETARY SOFTWARE LICENSE
(Refer to your full LICENSE_Live.md document.)
EOF

cat > "$BASE/README.md" << 'EOF'
Lane-Sovereign Estate
Department-of-Defense-grade, whistleblower-safe, sovereign platform.
EOF

cat > "$BASE/estate_config.toml" << 'EOF'
[estate]
id = "lane-sovereign-estate"
EOF

# ---------- lane_common ----------

cat > "$BASE/services/lane_common/__init__.py" << 'EOF'
# lane_common package
EOF

cat > "$BASE/services/lane_common/device_id.py" << 'EOF'
import hashlib
import json

def derive_device_id(device_info: dict) -> str:
    blob = json.dumps(device_info, sort_keys=True).encode("utf-8")
    return hashlib.sha256(blob).hexdigest()
EOF

cat > "$BASE/services/lane_common/policy.py" << 'EOF'
def lane_policy() -> dict:
    return {
        "lane_policy": {
            "version": "1.0",
            "license_ref": "https://albertlane.net/license/live",
            "notice": "Mines Here. Proceed with caution.",
            "forensic": {
                "logging": "full",
                "telemetry": "signed",
                "penalty_objects": "enabled",
            },
        }
    }
EOF

cat > "$BASE/services/lane_common/throttle.py" << 'EOF'
import time
from threading import Lock

class WriteThrottle:
    def __init__(self, min_interval_seconds: float = 3.0):
        self.min_interval = min_interval_seconds
        self._lock = Lock()
        self._last_ts = 0.0

    def before_write(self) -> None:
        with self._lock:
            now = time.time()
            delta = now - self._last_ts
            if delta < self.min_interval:
                time.sleep(self.min_interval - delta)
            self._last_ts = time.time()
EOF

cat > "$BASE/services/lane_common/crypto_base.py" << 'EOF'
from pathlib import Path

def prefetch_container_assets(base_dir: Path) -> None:
    (base_dir / "prefetch").mkdir(parents=True, exist_ok=True)
EOF

# ---------- lane_accounts ----------

cat > "$BASE/services/lane_accounts/__init__.py" << 'EOF'
# lane_accounts package
EOF

cat > "$BASE/services/lane_accounts/model.py" << 'EOF'
from pathlib import Path
import sqlite3
import time
import hashlib

class AccountStore:
    def __init__(self, db_path: Path):
        self.db_path = db_path
        self._init_db()

    def _init_db(self) -> None:
        conn = sqlite3.connect(self.db_path)
        cur = conn.cursor()
        cur.execute("""
        CREATE TABLE IF NOT EXISTS accounts (
            id INTEGER PRIMARY KEY AUTOINCREMENT,
            username TEXT UNIQUE,
            password_hash TEXT,
            created_at INTEGER
        )""")
        cur.execute("""
        CREATE TABLE IF NOT EXISTS devices (
            account_id INTEGER,
            device_id TEXT,
            PRIMARY KEY (account_id, device_id)
        )""")
        conn.commit()
        conn.close()

    def _hash_password(self, password: str) -> str:
        salt = b"lane-account-salt"
        return hashlib.pbkdf2_hmac("sha256", password.encode("utf-8"), salt, 200_000).hex()

    def create_account(self, username: str, password: str) -> int:
        conn = sqlite3.connect(self.db_path)
        cur = conn.cursor()
        cur.execute("""
        INSERT INTO accounts (username, password_hash, created_at)
        VALUES (?, ?, ?)""", (username, self._hash_password(password), int(time.time())))
        conn.commit()
        acc_id = cur.lastrowid
        conn.close()
        return acc_id

    def bind_device(self, account_id: int, device_id: str) -> None:
        conn = sqlite3.connect(self.db_path)
        cur = conn.cursor()
        cur.execute("""
        INSERT OR IGNORE INTO devices (account_id, device_id)
        VALUES (?, ?)""", (account_id, device_id))
        conn.commit()
        conn.close()

    def authenticate(self, username: str, password: str) -> dict | None:
        conn = sqlite3.connect(self.db_path)
        cur = conn.cursor()
        cur.execute("SELECT id, password_hash FROM accounts WHERE username = ?", (username,))
        row = cur.fetchone()
        conn.close()
        if row is None:
            return None
        acc_id, stored_hash = row
        if stored_hash != self._hash_password(password):
            return None
        return {"id": acc_id, "username": username}
EOF

cat > "$BASE/services/lane_accounts/auth.py" << 'EOF'
import os
import hashlib
import time

class SessionManager:
    def __init__(self):
        self.sessions: dict[str, dict] = {}

    def create_session(self, account: dict, device_id: str) -> str:
        token_raw = os.urandom(32)
        token = hashlib.sha256(token_raw).hexdigest()
        self.sessions[token] = {
            "account": account,
            "device_id": device_id,
            "created_at": int(time.time()),
        }
        return token

    def get_context(self, token: str) -> dict | None:
        return self.sessions.get(token)
EOF

cat > "$BASE/services/lane_accounts/server.py" << 'EOF'
from http.server import HTTPServer, BaseHTTPRequestHandler
from urllib.parse import urlparse
import json
from pathlib import Path

from lane_common.device_id import derive_device_id
from lane_common.policy import lane_policy
from .model import AccountStore
from .auth import SessionManager

SESSION_MANAGER = SessionManager()

class AccountsHandler(BaseHTTPRequestHandler):
    store = None

    def _json(self, status: int, payload: dict) -> None:
        body = json.dumps({**payload, **lane_policy()}, sort_keys=True).encode("utf-8")
        self.send_response(status)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)

    def do_POST(self) -> None:
        parsed = urlparse(self.path)
        length = int(self.headers.get("Content-Length", "0"))
        body = self.rfile.read(length)
        data = json.loads(body or b"{}")

        if parsed.path == "/accounts/create":
            username = data.get("username")
            password = data.get("password")
            device_info = data.get("device_info", {})
            if not username or not password:
                self._json(400, {"error": "missing_credentials"})
                return
            acc_id = self.store.create_account(username, password)
            device_id = derive_device_id(device_info)
            self.store.bind_device(acc_id, device_id)
            account = {"id": acc_id, "username": username}
            token = SESSION_MANAGER.create_session(account, device_id)
            self._json(200, {"session": token, "account_id": acc_id})
            return

        if parsed.path == "/accounts/login":
            username = data.get("username")
            password = data.get("password")
            device_info = data.get("device_info", {})
            account = self.store.authenticate(username, password)
            if account is None:
                self._json(401, {"error": "invalid_credentials"})
                return
            device_id = derive_device_id(device_info)
            token = SESSION_MANAGER.create_session(account, device_id)
            self._json(200, {"session": token, "account_id": account["id"]})
            return

        self._json(404, {"error": "not_found"})

def run() -> None:
    base = Path("/lane-estate/accounts.db")
    store = AccountStore(base)
    AccountsHandler.store = store
    server = HTTPServer(("0.0.0.0", 8081), AccountsHandler)
    server.serve_forever()
EOF

# ---------- lane_bucket ----------

cat > "$BASE/services/lane_bucket/__init__.py" << 'EOF'
# lane_bucket package
EOF

cat > "$BASE/services/lane_bucket/crypto.py" << 'EOF'
from pathlib import Path
import os
import hashlib
import hmac
from typing import Tuple

class SovereignVault:
    def __init__(self, account_id: int, device_id: str):
        self._root_key = self._derive_root_key(account_id, device_id)

    def _derive_root_key(self, account_id: int, device_id: str) -> bytes:
        salt = b"lane-sovereign-root"
        data = f"{account_id}:{device_id}".encode("utf-8")
        return hashlib.pbkdf2_hmac("sha256", data, salt, 200_000, dklen=32)

    def derive_object_key(self, object_hash: str) -> bytes:
        return hmac.new(self._root_key, object_hash.encode("utf-8"), hashlib.sha256).digest()

    def encrypt(self, key: bytes, plaintext: bytes) -> Tuple[bytes, bytes]:
        nonce = os.urandom(16)
        stream = hashlib.sha256(key + nonce).digest()
        ciphertext = bytes(p ^ stream[i % len(stream)] for i, p in enumerate(plaintext))
        tag = hmac.new(key, nonce + ciphertext, hashlib.sha256).digest()
        return nonce + ciphertext, tag

    def decrypt(self, key: bytes, blob: bytes, tag: bytes) -> bytes:
        nonce = blob[:16]
        ciphertext = blob[16:]
        expected = hmac.new(key, nonce + ciphertext, hashlib.sha256).digest()
        if not hmac.compare_digest(expected, tag):
            raise ValueError("integrity_failure")
        stream = hashlib.sha256(key + nonce).digest()
        return bytes(c ^ stream[i % len(stream)] for i, c in enumerate(ciphertext))
EOF

cat > "$BASE/services/lane_bucket/storage.py" << 'EOF'
from pathlib import Path
import hashlib
import sqlite3
import time

from lane_common.throttle import WriteThrottle
from lane_common.crypto_base import prefetch_container_assets
from .crypto import SovereignVault

class AccountBucketStorage:
    def __init__(self, base_dir: Path, db_path: Path):
        self.base_dir = base_dir
        self.db_path = db_path
        self._throttle = WriteThrottle(min_interval_seconds=3.0)
        self._init_db()

    def _bucket_dir(self, account_id: int) -> Path:
        return self.base_dir / f"acct_{account_id}"

    def _init_db(self) -> None:
        conn = sqlite3.connect(self.db_path)
        cur = conn.cursor()
        cur.execute("""
        CREATE TABLE IF NOT EXISTS objects (
            account_id INTEGER,
            object_hash TEXT,
            logical_key TEXT,
            created_at INTEGER,
            tag BLOB,
            PRIMARY KEY (account_id, object_hash)
        )""")
        conn.commit()
        conn.close()

    def _hash_bytes(self, content: bytes) -> str:
        h = hashlib.sha256()
        h.update(content)
        return h.hexdigest()

    def store(self, account_id: int, device_id: str, content: bytes, logical_key: str) -> str:
        prefetch_container_assets(self.base_dir)
        self._throttle.before_write()

        bucket_dir = self._bucket_dir(account_id)
        bucket_dir.mkdir(parents=True, exist_ok=True)

        object_hash = self._hash_bytes(content)
        vault = SovereignVault(account_id, device_id)
        key = vault.derive_object_key(object_hash)
        blob, tag = vault.encrypt(key, content)

        prefix = object_hash[:2]
        obj_dir = bucket_dir / prefix
        obj_dir.mkdir(parents=True, exist_ok=True)
        obj_path = obj_dir / object_hash

        if not obj_path.exists():
            obj_path.write_bytes(blob)

        conn = sqlite3.connect(self.db_path)
        cur = conn.cursor()
        cur.execute("""
        INSERT OR IGNORE INTO objects (account_id, object_hash, logical_key, created_at, tag)
        VALUES (?, ?, ?, ?, ?)""", (account_id, object_hash, logical_key, int(time.time()), tag))
        conn.commit()
        conn.close()

        return object_hash

    def load(self, account_id: int, device_id: str, object_hash: str) -> bytes | None:
        bucket_dir = self._bucket_dir(account_id)
        prefix = object_hash[:2]
        obj_path = bucket_dir / prefix / object_hash
        if not obj_path.exists():
            return None

        conn = sqlite3.connect(self.db_path)
        cur = conn.cursor()
        cur.execute("""
        SELECT tag FROM objects
        WHERE account_id = ? AND object_hash = ?""", (account_id, object_hash))
        row = cur.fetchone()
        conn.close()
        if row is None:
            return None
        tag = row[0]

        vault = SovereignVault(account_id, device_id)
        key = vault.derive_object_key(object_hash)
        blob = obj_path.read_bytes()
        return vault.decrypt(key, blob, tag)
EOF

cat > "$BASE/services/lane_bucket/corp_link.py" << 'EOF'
import json

def process_corp_token(token: str) -> dict | None:
    try:
        claims = json.loads(token)
    except Exception:
        return None
    return {
        "corp_id": claims.get("corp_id"),
        "corp_user_id": claims.get("user_id"),
        "corp_app": claims.get("app"),
        "corp_role": claims.get("role"),
    }
EOF

cat > "$BASE/services/lane_bucket/server.py" << 'EOF'
from http.server import HTTPServer, BaseHTTPRequestHandler
from urllib.parse import urlparse
import json
import time
from pathlib import Path

from lane_common.policy import lane_policy
from lane_evidence.schema import make_event
from lane_evidence.broker import EvidenceBroker
from lane_accounts.server import SESSION_MANAGER
from .storage import AccountBucketStorage
from .corp_link import process_corp_token

class BucketHandler(BaseHTTPRequestHandler):
    ctx = None

    def _json(self, status: int, payload: dict) -> None:
        body = json.dumps({**payload, **lane_policy()}, sort_keys=True).encode("utf-8")
        self.send_response(status)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)

    def _get_context(self) -> dict | None:
        token = self.headers.get("X-Lane-Session")
        if not token:
            return None
        return SESSION_MANAGER.get_context(token)

    def do_POST(self) -> None:
        parsed = urlparse(self.path)
        ctx = self._get_context()
        if ctx is None:
            self._json(401, {"error": "unauthorized"})
            return

        account = ctx["account"]
        device_id = ctx["device_id"]
        account_id = account["id"]

        length = int(self.headers.get("Content-Length", "0"))
        body = self.rfile.read(length)
        corp_token = self.headers.get("X-Corp-SSO-Token")
        corp = process_corp_token(corp_token) if corp_token else None

        if parsed.path == "/bucket/upload":
            logical_key = self.headers.get("X-Logical-Key", "upload.bin")
            obj_hash = self.ctx["storage"].store(account_id, device_id, body, logical_key)

            event = make_event(
                ts=int(time.time()),
                account_id=account_id,
                device_id=device_id,
                object_hash=obj_hash,
                logical_key=logical_key,
                action="upload",
                corp=corp,
            )
            self.ctx["broker"].append_event(event)

            self._json(200, {"object_hash": obj_hash, "logical_key": logical_key})
            return

        self._json(404, {"error": "not_found"})

    def do_GET(self) -> None:
        parsed = urlparse(self.path)
        ctx = self._get_context()
        if ctx is None:
            self._json(401, {"error": "unauthorized"})
            return

        account = ctx["account"]
        device_id = ctx["device_id"]
        account_id = account["id"]

        if parsed.path.startswith("/bucket/object/"):
            object_hash = parsed.path.split("/bucket/object/")[1]
            data = self.ctx["storage"].load(account_id, device_id, object_hash)
            if data is None:
                self.send_response(404)
                self.end_headers()
                return

            event = make_event(
                ts=int(time.time()),
                account_id=account_id,
                device_id=device_id,
                object_hash=object_hash,
                logical_key="unknown",
                action="read",
                corp=None,
            )
            self.ctx["broker"].append_event(event)

            self.send_response(200)
            self.send_header("Content-Type", "application/octet-stream")
            self.send_header("Content-Length", str(len(data)))
            self.end_headers()
            self.wfile.write(data)
            return

        self._json(404, {"error": "not_found"})

def run() -> None:
    base_dir = Path("/lane-estate/buckets")
    db_path = Path("/lane-estate/buckets.db")
    storage = AccountBucketStorage(base_dir, db_path)

    evidence_dir = Path("/lane-estate/evidence")
    endpoints = [
        "https://albertlane.net/evidence/ingest",
    ]
    signing_key = b"lane-evidence-signing-key"
    broker = EvidenceBroker(evidence_dir, endpoints, signing_key)

    BucketHandler.ctx = {
        "storage": storage,
        "broker": broker,
    }

    server = HTTPServer(("0.0.0.0", 8082), BucketHandler)
    server.serve_forever()
EOF

# ---------- lane_evidence ----------

cat > "$BASE/services/lane_evidence/__init__.py" << 'EOF'
# lane_evidence package
EOF

cat > "$BASE/services/lane_evidence/schema.py" << 'EOF'
def make_event(
    ts: int,
    account_id: int,
    device_id: str,
    object_hash: str,
    logical_key: str,
    action: str,
    corp: dict | None,
    policy_version: str = "1.0",
) -> dict:
    return {
        "ts": ts,
        "account_id": account_id,
        "device_id": device_id,
        "object_hash": object_hash,
        "logical_key": logical_key,
        "action": action,
        "corp": corp or {},
        "policy_version": policy_version,
    }
EOF

cat > "$BASE/services/lane_evidence/broker.py" << 'EOF'
import json
import hmac
import hashlib
import time
from pathlib import Path
from urllib.request import Request, urlopen
from urllib.error import URLError

from lane_common.throttle import WriteThrottle
from lane_common.crypto_base import prefetch_container_assets

class EvidenceBroker:
    def __init__(self, base_dir: Path, endpoints: list[str], signing_key: bytes):
        self.base_dir = base_dir
        self.endpoints = endpoints
        self.signing_key = signing_key
        self.base_dir.mkdir(parents=True, exist_ok=True)
        self.events_path = self.base_dir / "events.log"
        self._throttle = WriteThrottle(min_interval_seconds=3.0)

    def append_event(self, event: dict) -> None:
        prefetch_container_assets(self.base_dir)
        self._throttle.before_write()
        line = json.dumps(event, sort_keys=True)
        with open(self.events_path, "a", encoding="utf-8") as f:
            f.write(line + "\n")

    def _sign(self, payload: bytes) -> str:
        return hmac.new(self.signing_key, payload, hashlib.sha256).hexdigest()

    def flush_manifest(self) -> None:
        if not self.events_path.exists():
            return
        data = self.events_path.read_bytes()
        root_hash = hashlib.sha256(data).hexdigest()
        manifest = {
            "schema_version": "1.0",
            "generated_at": int(time.time()),
            "root_hash": root_hash,
            "events_bytes": len(data),
            "estate_id": "lane-sovereign-estate",
            "manifest_id": f"lane-{int(time.time())}-{root_hash[:8]}",
            "meta": {
                "policy_version": "1.0",
                "license_ref": "https://albertlane.net/license/live",
            },
        }
        body = json.dumps(manifest, sort_keys=True).encode("utf-8")
        sig = self._sign(body)
        for ep in self.endpoints:
            req = Request(ep, data=body, method="POST")
            req.add_header("Content-Type", "application/json")
            req.add_header("X-Lane-Signature", sig)
            req.add_header("X-Lane-Key-Id", "default")
            try:
                urlopen(req, timeout=5)
            except URLError:
                continue
EOF

# ---------- lane_dashboard ----------

cat > "$BASE/services/lane_dashboard/__init__.py" << 'EOF'
# lane_dashboard package
EOF

cat > "$BASE/services/lane_dashboard/server.py" << 'EOF'
from http.server import HTTPServer, BaseHTTPRequestHandler
from pathlib import Path
import json

class DashboardHandler(BaseHTTPRequestHandler):
    def do_GET(self) -> None:
        if self.path == "/":
            self._serve_index()
        else:
            self._serve_corp()

    def _serve_index(self) -> None:
        body = b"""
<!DOCTYPE html>
<html><head><title>Lane-Sovereign Estate</title></head>
<body>
<h1>Lane-Sovereign Estate</h1>
<p>Mines Here. Proceed with caution.</p>
</body></html>
"""
        self.send_response(200)
        self.send_header("Content-Type", "text/html")
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)

    def _serve_corp(self) -> None:
        # Placeholder: parse corp_id from path and aggregate events.
        self.send_response(200)
        self.end_headers()
        self.wfile.write(b"Corp dashboard placeholder")
def run() -> None:
    server = HTTPServer(("0.0.0.0", 8083), DashboardHandler)
    server.serve_forever()
EOF

# ---------- lane_ingest ----------

cat > "$BASE/services/lane_ingest/__init__.py" << 'EOF'
# lane_ingest package
EOF

cat > "$BASE/services/lane_ingest/corp_registry.json" << 'EOF'
{
  "corporations": [
    { "corp_id": "MICROSOFT", "asn": [8075, 8068] },
    { "corp_id": "GOOGLE", "asn": [15169] }
  ]
}
EOF

cat > "$BASE/services/lane_ingest/fetch_peeringdb.py" << 'EOF'
import requests

def fetch_peeringdb_asn(asn: int) -> dict:
    url = f"https://www.peeringdb.com/api/net?asn={asn}"
    r = requests.get(url, timeout=5)
    if r.status_code != 200:
        return {}
    data = r.json()
    if not data.get("data"):
        return {}
    entry = data["data"][0]
    return {
        "asn": asn,
        "name": entry.get("name"),
        "info_prefixes4": entry.get("info_prefixes4"),
        "info_prefixes6": entry.get("info_prefixes6"),
    }
EOF

cat > "$BASE/services/lane_ingest/fetch_bgpprefixes.py" << 'EOF'
import requests
def fetch_prefixes_for_asn(asn: int) -> dict:
    url = f"https://api.bgpview.io/asn/{asn}/prefixes"
    r = requests.get(url, timeout=5)
    if r.status_code != 200:
        return {"ipv4": [], "ipv6": []}
    data = r.json()
    ipv4 = [p["prefix"] for p in data["data"]["ipv4_prefixes"]]
    ipv6 = [p["prefix"] for p in data["data"]["ipv6_prefixes"]]
    return {"ipv4": ipv4, "ipv6": ipv6}
EOF

cat > "$BASE/services/lane_ingest/fetch_rpki.py" << 'EOF'
import requests

def rpki_status_for_prefix(prefix: str) -> str:
    url = f"https://stat.ripe.net/data/rpki-validation/data.json?resource={prefix}"
    r = requests.get(url, timeout=5)
    if r.status_code != 200:
        return "unknown"
    data = r.json()
    status = data.get("data", {}).get("status")
    if status in ("valid", "invalid", "unknown"):
        return status
    return "unknown"
EOF

cat > "$BASE/services/lane_ingest/fetch_abuse.py" << 'EOF'
import requests

def abuse_contact_for_asn(asn: int) -> str | None:
    url = f"https://stat.ripe.net/data/abuse-contact-finder/data.json?resource=AS{asn}"
    r = requests.get(url, timeout=5)
    if r.status_code != 200:
        return None
    data = r.json()
    contacts = data.get("data", {}).get("abuse_contacts", [])
    return contacts[0] if contacts else None
EOF

cat > "$BASE/services/lane_ingest/asn_reputation.py" << 'EOF'
def compute_reputation(asn: int, rpki_stats: dict, violation_count: int) -> float:
    base = 0.0
    base += rpki_stats.get("invalid", 0) * 2.0
    base += rpki_stats.get("unknown", 0) * 0.5
    base += violation_count * 5.0
    return base
EOF

cat > "$BASE/services/lane_ingest/merge_ingest.py" << 'EOF'
from fetch_rpki import rpki_status_for_prefix
from fetch_abuse import abuse_contact_for_asn
from asn_reputation import compute_reputation

def annotate_prefixes_with_rpki(prefixes: list[str]) -> list[dict]:
    return [{"prefix": p, "rpki_status": rpki_status_for_prefix(p)} for p in prefixes]

def summarize_rpki(prefixes: list[dict]) -> dict:
    stats = {"valid": 0, "invalid": 0, "unknown": 0}
    for p in prefixes:
        s = p["rpki_status"]
        if s in stats:
            stats[s] += 1
    return stats

def finalize_corp_entry(corp_id: str, asns: list[int], ipv4: list[dict], ipv6: list[dict], violation_count: int) -> dict:
    rpki_stats_v4 = summarize_rpki(ivp4 := ipv4)
    rpki_stats_v6 = summarize_rpki(ivp6 := ipv6)
    combined = {
        "valid": rpki_stats_v4["valid"] + rpki_stats_v6["valid"],
        "invalid": rpki_stats_v4["invalid"] + rpki_stats_v6["invalid"],
        "unknown": rpki_stats_v4["unknown"] + rpki_stats_v6["unknown"],
    }
    reputation = compute_reputation(asns[0], combined, violation_count)
    return {
        "corp_id": corp_id,
        "asn": asns,
        "ipv4": ipv4,
        "ipv6": ipv6,
        "reputation_score": reputation
    }
EOF

cat > "$BASE/services/lane_ingest/emit_blacklist.py" << 'EOF'
import json
import time
from pathlib import Path

def emit_blacklist(corp_data: list, out_path: Path):
    blob = {
        "version": "1.0",
        "generated_at": int(time.time()),
        "source": "lane-corp-ingest",
        "corporations": corp_data
    }
    out_path.write_text(json.dumps(blob, indent=2))
EOF

cat > "$BASE/services/lane_ingest/ingest_runner.py" << 'EOF'
import json
from pathlib import Path

from fetch_peeringdb import fetch_peeringdb_asn
from fetch_bgpprefixes import fetch_prefixes_for_asn
from merge_ingest import annotate_prefixes_with_rpki, finalize_corp_entry
from emit_blacklist import emit_blacklist

def run_ingest():
    base = Path("/lane-estate")
    registry = json.loads((base / "corp_registry.json").read_text())
    corp_entries = registry["corporations"]
    final_entries = []

    for corp in corp_entries:
        corp_id = corp["corp_id"]
        asns = corp["asn"]

        ipv4_all = []
        ipv6_all = []
        for asn in asns:
            peeringdb = fetch_peeringdb_asn(asn)
            bgp = fetch_prefixes_for_asn(asn)
            ipv4_all.extend(bgp["ipv4"])
            ipv6_all.extend(bgp["ipv6"])

        ipv4_annotated = annotate_prefixes_with_rpki(sorted(set(ipv4_all)))
        ipv6_annotated = annotate_prefixes_with_rpki(sorted(set(ipv6_all)))

        violation_count = 0  # hook into evidence logs if desired
        final_entries.append(finalize_corp_entry(corp_id, asns, ipv4_annotated, ipv6_annotated, violation_count))

    emit_blacklist(final_entries, base / "corp_blacklist.json")

if __name__ == "__main__":
    run_ingest()
EOF

# ---------- clients/web_app ----------

cat > "$BASE/clients/web_app/index.html" << 'EOF'
<!DOCTYPE html>
<html><head><title>Lane Bucket App</title></head>
<body>
<h1>Lane Bucket App</h1>
<p>Mines Here. Proceed with caution.</p>
<script src="app.js"></script>
</body></html>
EOF

cat > "$BASE/clients/web_app/app.js" << 'EOF'
console.log("Lane Bucket App loaded.");
EOF

cat > "$BASE/clients/web_app/manifest.json" << 'EOF'
{
  "name": "Lane Bucket App",
  "version": "1.0",
  "runtime": ["browser", "lane-python"]
}
EOF

# ---------- clients/native_app ----------

cat > "$BASE/clients/native_app/main.rs" << 'EOF'
fn main() {
    println!("Lane native app placeholder.");
}
EOF

# ---------- infra ----------

cat > "$BASE/infra/lane-accounts.service" << 'EOF'
[Unit]
Description=Lane Accounts Service

[Service]
ExecStart=/opt/lane-python/bin/python -m lane_accounts.server

[Install]
WantedBy=multi-user.target
EOF

cat > "$BASE/infra/lane-bucket.service" << 'EOF'
[Unit]
Description=Lane Bucket Service

[Service]
ExecStart=/opt/lane-python/bin/python -m lane_bucket.server

[Install]
WantedBy=multi-user.target
EOF

cat > "$BASE/infra/lane-evidence.service" << 'EOF'
[Unit]
Description=Lane Evidence Service

[Service]
ExecStart=/opt/lane-python/bin/python -m lane_evidence.broker

[Install]
WantedBy=multi-user.target
EOF

cat > "$BASE/infra/lane-dashboard.service" << 'EOF'
[Unit]
Description=Lane Dashboard Service

[Service]
ExecStart=/opt/lane-python/bin/python -m lane_dashboard.server

[Install]
WantedBy=multi-user.target
EOF

cat > "$BASE/infra/nginx.conf" << 'EOF'
# Nginx placeholder for reverse proxy.
EOF

# ---------- scripts ----------

cat > "$BASE/scripts/init_estate.sh" << 'EOF'
#!/usr/bin/env bash
set -e
BASE="/lane-estate"
mkdir -p "$BASE"/{buckets,evidence,accounts,logs}
touch "$BASE/evidence/events.log"
EOF

cat > "$BASE/scripts/deploy_lane_vm.sh" << 'EOF'
#!/usr/bin/env bash
set -e
REPO_DIR="/srv/lane-sovereign-estate"
cd "$REPO_DIR"
./scripts/prefetch_dev.sh
sleep 3
systemctl restart lane-accounts.service
sleep 3
systemctl restart lane-bucket.service
sleep 3
systemctl restart lane-evidence.service
sleep 3
systemctl restart lane-dashboard.service
EOF

cat > "$BASE/scripts/prefetch_dev.sh" << 'EOF'
#!/usr/bin/env bash
set -e
BASE="/lane-estate"
mkdir -p "$BASE/prefetch"
date > "$BASE/prefetch/last_prefetch"
EOF

cat > "$BASE/scripts/warm_container_write.sh" << 'EOF'
#!/usr/bin/env bash
set -e
BASE="/lane-estate"
mkdir -p "$BASE/prefetch"
date > "$BASE/prefetch/last_write_warm"
sleep 3
EOF

echo "[+] Lane-Sovereign Estate bootstrapped at $BASE"

Compile to our library here really means turning it into a reusable, loadable platform on Lane-VM/CPP Python.

Here's the minimal path to do that:

1. Drop the estate into our Lane-VM

- Put lane-sovereign-estate/ under whatever root you use for your CPP Python runtime, e.g.:

/srv/lane-sovereign-estate

- Run:

./bootstrap_lane_estate.sh

(if you haven't yet) to materialize all files.

2. Make it a Python library

Inside lane-sovereign-estate:

mkdir -p lane_estate
touch lane_estate/__init__.py

Then add simple re-exports:

# lane_estate/__init__.py
from services.lane_accounts.server import run as run_accounts
from services.lane_bucket.server import run as run_bucket
from services.lane_dashboard.server import run as run_dashboard
from services.lane_ingest.ingest_runner import run_ingest

__all__ = [
    "run_accounts",
    "run_bucket",
    "run_dashboard",
    "run_ingest",
]

Now our CPP Python can treat it as a library:

import lane_estate

lane_estate.run_accounts()
lane_estate.run_bucket()
lane_estate.run_dashboard()

3. Wire it into our CPP Python / Lane-VM

In your CPP Python host:

- Add /srv/lane-sovereign-estate to sys.path.
- Start services from our Rust/CPP harness (the pyterm.rs wrapper) by importing lane_estate instead of shelling out.

Example in the embedded Python side:

import lane_estate

def boot_estate():
    lane_estate.run_accounts()
    lane_estate.run_bucket()
    lane_estate.run_dashboard()

From there, the library is just our sovereign estate: callable, embeddable, and sitting exactly where we want it.

Structure CPP Python module loading (e.g., custom import hooks, static linking), and tighten this into a precise build script for Lane-VM toolchain.

Signature note: X-Lane-Signature is HMAC-SHA256 of the raw JSON body bytes, keyed by the secret named in X-Lane-Key-Id. Compare with hmac.compare_digest. It is not multiplication.