http server updates and docs

kernel/share/agent-workspace/README-agent.md

@@ -22,7 +22,7 @@ This tree follows the **agent** Markdown workspace convention: “soul” files
 3. During a session, the model loads the full document with the **`read_skill`** tool (do not paste huge skills into the user channel unless asked).
 4. Shared skills can live under **`~/.agent/skills/`**; keep **`workspace/skills/`** for machine-local or repo-specific behavior.
 
-Seeded examples in this repo (under **`skills/`**): **`p2p-os-status`**, **`bare-os-kernel-proc`**, **`bare-os-super-developer`**, **`holesail`** (Holesail tunnels / initd), and **`hdms`** (Hyperdrive mounts and invite/pair).
+Seeded examples in this repo (under **`skills/`**): **`p2p-os-status`**, **`bare-os-kernel-proc`**, **`bare-os-super-developer`**, **`holesail`** (Holesail tunnels / initd; stock **`bare-www-*`** pairs with **`bare-os-www`** on **`~/.www`**), and **`hdms`** (Hyperdrive mounts and invite/pair).
 
 After **`agent --config`** / **`--setup`** (or changing **`owner_name`** / **`agent_label`** via **`edit_agent_config`**), **`IDENTITY.md`** and **`USER.md`** are regenerated from **`config.json`** so the workspace matches the operator and agent label.
 

kernel/share/agent-workspace/skills/bare-os-super-developer/SKILL.md

@@ -33,7 +33,7 @@ Think in layers the stock OS already uses:
 
 | Layer | Mechanism | Notes |
 | --- | --- | --- |
-| **Init** | **`bareOsRegisterBootStepHook`**, initd units | Boot-order DAG; pair **`registerKernelShutdownHook`** / initd disposers for teardown. |
+| **Init** | **`bareOsRegisterBootStepHook`**, initd units | Boot-order DAG (stock example: **`bare-os-www`** before **`bare-holesail`** for **`bare-www-*`** tunnels); pair **`registerKernelShutdownHook`** / initd disposers for teardown. |
 | **Virtual files** | **`bareOsRegisterVirtualFile(name, reader, opts?)`** | Serves **`/run/bare-os/virtual/<name>`**; gated by runtime caps. |
 | **IPC** | **`ctx.bareOsIpc`** when present | **`push`/`take`**, JSON helpers, fanout, duplex bridge — bounded; audit when **`BARE_OS_IPC_AUDIT=1`**. |
 | **Kernel extensions** | **`bareOsRegisterKernelExtensionRecord`**, **`bareOsRunImageScript`** under **`/lib/bare-os/extensions/`** | Trusted image paths only. |

kernel/share/agent-workspace/skills/hdms/SKILL.md

@@ -23,6 +23,7 @@ Use when the user asks about **HDMS** (Hyperdrive Management): **`hdms`** CLI, *
 - **Writable mounts:** **`hdms create <label>`** — new Corestore namespace + Hyperdrive, replicate to swarm.
 - **Read-only by key:** **`hdms add <label> <z32-key>`** — open an existing drive by key string.
 - **VFS:** paths **`/mnt/<label>/…`**; writable mounts allow **`put`** on those routes.
+- **`www` label:** A mount labeled **`www`** at **`/mnt/www`** also routes **`$HOME/.www`** and **`/home/<active>/.www`** in the VFS—the same docroot the stock **`bare-os-www`** initd serves by default. See **`handbook/05-identity-vault-and-hdms.md`** and **`handbook/04-the-booter-runtime.md`** § **bare-os-www**.
 
 ## Invite and pair (Autopass / BlindPairing)
 

kernel/share/agent-workspace/skills/holesail/SKILL.md

@@ -17,6 +17,7 @@ Use when the user asks about **Holesail** in this repo: exposing TCP/UDP through
 1. **Integration** lives in **`packages/bare-os-booter/lib/bare-holesail.js`** (initd + optional early “kernel-path” instance) and **`packages/bare-os-booter/lib/holesail-cli.js`** (**`ctx.bareOsRunHolesailCli`** for **`/bin/holesail`**).
 2. **Resolution order** under **`pear run`**: the booter prefers **`ctx.bare.holesail`** ( **`/lib/bare/bundles/holesail.js`** after drive merge), else host **`import.meta.resolve('holesail')`**, else eval of the drive IIFE bundle via **`ctx.vfs`** — **`/bin`** and **`/boot/init.js`** are **not** Node modules, so scripts must not **`require('holesail')`**.
 3. **Stock default**: initd unit **`bare-holesail`** is **on** when **`BARE_OS_HOLESAIL_INITD`** and **`BARE_OS_HOLESAIL_MANAGED`** are left at defaults (**`1`** in stock **`shellEnv`** unless the host clears them). Disable with **`BARE_OS_HOLESAIL_INITD=0`** or **`systemctl disable bare-holesail`** (**`~/.config/bare-os/initd/disabled.txt`**).
+4. **`bare-os-www`** (**`packages/bare-os-booter/lib/bare-os-www-initd.js`**) serves **`~/.www`** on **`127.0.0.1:8088`** by default. **`bare-holesail`** starts **after** it in the initd DAG so the stock managed entry **`bare-www-<port>`** (**`server: true`**, **`host: 127.0.0.1`**, **`port`** from **`BARE_OS_WWW_PORT`**) can reach the HTTP listener. Opt out of auto-merge with **`BARE_OS_WWW_HOLESAIL=0`**. Handbook: **`handbook/04-the-booter-runtime.md`** § **bare-os-www** and § **bare-holesail**.
 
 ## Managed vs single-tunnel mode
 
@@ -34,7 +35,7 @@ From **`holesail-cli.js`** help text:
 - **`holesail add ID --server|--client`** with optional **`--key`**, bare **`hs://…`** token (no **`--key`** prefix), **`--port`**, **`--host`**, **`--udp`**, **`--secure` / `--no-secure`**, **`--log`**.
 - **`holesail remove ID`**, **`start|stop|restart ID`**, **`enable|disable ID`**.
 
-Initd starts after **`kernel-logger`** by default. Logs: **`/var/log/bare-os/holesail.log`**. Example unit drop-in: **`/etc/bare-os/units/bare-holesail.unit.example`** on the system image.
+Managed **`bare-holesail`** starts after **`kernel-logger`** and **`bare-os-www`** by default. Logs: **`/var/log/bare-os/holesail.log`**. Example unit drop-in: **`/etc/bare-os/units/bare-holesail.unit.example`** on the system image.
 
 ## Debugging and safety
 

kernel/share/agent-workspace/skills/p2p-os-status/SKILL.md

@@ -18,7 +18,8 @@ Use this skill whenever the user asks for system status, peer count, drive healt
 2. Call **`get_swarm_peers`** (and **`get_system_info`** as needed) for swarm / session context when exposed by the booter.
 3. Use **`read_proc_file`** on **`/proc/bare_os/*`** mirrors when the user cares about kernel/session metrics (see the **bare-os-kernel-proc** skill for feature/capability JSON).
 4. Check SSH/kernel narrative only when **`read_proc_file`** or **`read_man_page`** confirms how this image exposes **`sshd`** (do not assume **`node`** exists).
-5. Summarize in clear bullet points:
+5. When a **personal static site** matters, after **`login`** check **`~/.www`** (and optional **`curl -I http://127.0.0.1:8088/`**, or the port from **`BARE_OS_WWW_PORT`** in env); initd logs append to **`/var/log/bare-os/www.log`**.
+6. Summarize in clear bullet points:
 
    - Drive sync status
    - Active peers