feat: POSIX/P2P roadmap — proc surfaces, syscalls, boot perf, docs, CI

- Align posix-conformance-matrix bareOsSyscallOps with getconf BARE_OS_SYSCALL_OPS
- Add verify-boot-policy-extension-signer-pins.mjs to pretest; document in scripts/README
- Document extensionSignerPinsV2–V5 env wiring in OTA_AND_BUNDLES; vault multisig sketch
- Note telemetry NDJSON redaction limits in environment appendix
- Expand booter CHANGELOG 1.40.0 (boot-perf, shell POSIX mode, subprocess errors, etc.)
- Holepunch sync README: NDJSON summary path

Seeder/kernel parity and pretest already green for bundled changes.

packages/bare-os-coreutils/src/getconf.js

@@ -54,7 +54,7 @@ const CONF = {
   _PC_2_SYMLINKS: '1',
   /** Comma-separated `ctx.bareOsSyscall` op names implemented in stock booter. */
   BARE_OS_SYSCALL_OPS:
-    'accept,access,bind,chdir,chmod,connect,exists,fcntl,fdatasync,fsync,ftruncate,getcwd,kill,link,listen,lstat,mkdir,mount,pathconf,posixPoll,readFile,readdir,readlink,recv,rename,rmdir,select,send,shutdown,socket,stat,symlink,truncate,umask,umount,unlink,utimes,writeFile',
+    'accept,access,bind,chdir,chmod,connect,exists,fcntl,fdatasync,fsync,ftruncate,getcwd,getsockopt,kill,link,listen,lstat,mkdir,mount,pathconf,posixPoll,readFile,readdir,readlink,readv,recv,rename,rmdir,select,send,setsockopt,shutdown,socket,stat,symlink,truncate,umask,umount,unlink,utimes,writeFile,writev',
   /** POSIX.1 XSH-style names documented in `/proc/bare_os/syscalls.json` opsDetail (socket family are syscall probes returning ENOSYS-shaped results). */
   BARE_OS_POSIX_XSH_OPS:
     'open,close,read,write,lseek,pipe,dup,dup2,fcntl,poll,select,umask,socket,bind,listen,accept,connect,send,recv,shutdown',

packages/bare-os-coreutils/src/xargs.js

@@ -2,7 +2,7 @@
  * Bounded xargs for Bare OS: invokes ctx.runBinCommand only (no host spawn).
  * Limits: stdin 256KiB, 4096 whitespace/null tokens, 128 args per invocation,
  * 64 invocations per run. Exceeding limits is a fatal error (exit 125).
- * Supports -0/--null, -n, -I repl (replace repl in utility argv; implies -n 1 unless -n given).
+ * Supports -0/--null, -n, -L (lines per invocation; mutually exclusive with -n), -I repl (replace repl in utility argv; implies -n 1 unless -n given).
  * -P N runs up to N batches in parallel (each batch uses a shallow ctx clone so exitCode does not race).
  * Max -P is min(requested, BARE_OS_XARGS_MAX_PROCS env, 32); default cap 8 when env unset.
  */
@@ -39,6 +39,8 @@ async function run(ctx, argv) {
   /** @type {string | null} */
   let repl = null
   let nExplicit = false
+  /** @type {number | null} */
+  let linesPerInv = null
   const envPCap = maxParallelFromEnv(ctx)
   let pCap = 1
   let i = 0
@@ -111,6 +113,23 @@ async function run(ctx, argv) {
       i++
       continue
     }
+    if (a === '-L' || a === '--max-lines') {
+      const n = args[i + 1]
+      if (n == null || !/^\d+$/.test(n) || Number(n) < 1) {
+        ctx.console.error('xargs: -L requires a positive integer')
+        ctx.exitCode = 1
+        return
+      }
+      linesPerInv = Math.min(Number(n), MAX_PER_INVOCATION)
+      i += 2
+      continue
+    }
+    if (a.startsWith('-L') && a.length > 2 && /^\d+$/.test(a.slice(2))) {
+      const n = Number(a.slice(2))
+      linesPerInv = Math.min(n, MAX_PER_INVOCATION)
+      i++
+      continue
+    }
     if (a === '-I' || a === '-i') {
       repl = args[i + 1] != null ? String(args[i + 1]) : '{}'
       i += 2
@@ -131,7 +150,7 @@ async function run(ctx, argv) {
     ctx.console.error(
       'xargs: Bare OS supports: -0/--null, -n N (max ' +
         MAX_PER_INVOCATION +
-        ' per run), -I repl, -P N (parallel batches, cap ' +
+        ' per run), -L N (lines per invocation), -I repl, -P N (parallel batches, cap ' +
         envPCap +
         ')'
     )
@@ -139,6 +158,12 @@ async function run(ctx, argv) {
     return
   }
 
+  if (linesPerInv != null && nExplicit) {
+    ctx.console.error('xargs: -L cannot be combined with -n')
+    ctx.exitCode = 1
+    return
+  }
+
   /** @type {string[]} */
   let cmd = args.slice(i)
   if (cmd.length === 0) cmd = ['echo']
@@ -154,7 +179,19 @@ async function run(ctx, argv) {
 
   /** @type {string[]} */
   let pieces
-  if (nullSep) {
+  if (linesPerInv != null) {
+    if (nullSep) {
+      pieces = text.split('\0').filter((s) => s.length > 0)
+    } else {
+      const raw = text.replace(/\r\n/g, '\n')
+      pieces =
+        raw.length === 0
+          ? []
+          : raw.endsWith('\n')
+            ? raw.slice(0, -1).split('\n')
+            : raw.split('\n')
+    }
+  } else if (nullSep) {
     pieces = text.split('\0').filter((s) => s.length > 0)
   } else {
     pieces = text.trim() === '' ? [] : text.trim().split(/\s+/).filter(Boolean)
@@ -197,7 +234,8 @@ async function run(ctx, argv) {
 
   /** @type {string[][]} */
   const batches = []
-  for (let o = 0; o < pieces.length; o += maxBatch) {
+  const step = linesPerInv != null ? linesPerInv : maxBatch
+  for (let o = 0; o < pieces.length; o += step) {
     if (batches.length >= MAX_INVOCATIONS) {
       ctx.console.error(
         'xargs: exceeded ' + MAX_INVOCATIONS + ' invocations (Bare OS limit)'
@@ -205,7 +243,7 @@ async function run(ctx, argv) {
       ctx.exitCode = 125
       return
     }
-    batches.push(pieces.slice(o, o + maxBatch))
+    batches.push(pieces.slice(o, o + step))
   }
 
   if (pCap <= 1) {