The type system is the seccomp profile

Every Kern binary now seals itself, before user code runs, to a seccomp-BPF filter that permits only the syscalls its capability set grants, and that set is derived by the compiler from the program's own types. A program that never mints Cap<Net> gets a kernel that denies socket(); one that never mints Cap<Process> cannot execve. E0404 already made ambient authority a compile error; the sandbox makes the same guarantee kernel-enforced at runtime, so a later RCE cannot exceed what the type system permitted.

Nothing to configure, installed with NO_NEW_PRIVS so a spawned process inherits the filter. Self-hosting survives the seal: the compiler seals itself to FS|PROCESS and still bootstraps the next generation, running clang under the inherited filter. Landlock completes the filesystem story: the seccomp gate decides whether a program may open files, KERN_SANDBOX_FS_RO/RW decide which paths, layered on the seal and a clean no-op on kernels without Landlock.