Complete the internal “100 task” roadmap: coreutils and shell parity (xargs,

sh, diff/patch, sort, printf, find, test, getfacl/setfacl/xattr), expanded
/proc and metrics (process table, syscalls, replication, net, security
posture, worker budget, swarm/replication hints), initd DAG supervision
metadata and richer restart journal telemetry, synthetic process groups via
IPC (assignProcessGroup/signalProcessGroup) mirrored into process_table,
optional kernel.ext.d incremental hot reload (BARE_OS_KERNEL_EXT_D_HOT_RELOAD)
with reload audit NDJSON, features proc for hyperblobs dedup and systemd
subset documentation, vault threat model doc plus posture fields for AEAD,
Pear enclave pointer, account rotation continuity, and Ed25519 consistency
across boot manifest / extensions / replication. Adds or extends tests and
keeps kernel/ and packages/bare-os-seeder/kernel/ in parity; guest init is
bundled from kernel/lib/init/init-main.js via bundle-kernel-init.

kernel/etc/bare-os/audit-line.example.json

@@ -0,0 +1,9 @@
+{
+  "auditSchemaVersion": 1,
+  "type": "vfs_policy",
+  "ts": 1710000000000,
+  "sessionId": "example-session",
+  "path": "/etc/shadow",
+  "effect": "deny",
+  "detail": { "ruleId": "boot-policy-deny-vfs" }
+}

kernel/etc/bare-os/hyperbee-index-hint.example.json

@@ -0,0 +1,6 @@
+{
+  "schema": 1,
+  "proposedIndexes": ["paths", "packages", "aclSubjects"],
+  "isolation": "dedicated-corestore-namespace",
+  "note": "Designator for Hyperbee secondary indexes; not mounted in the stock guest VFS."
+}

kernel/etc/bare-os/ota-slots.example.json

@@ -0,0 +1,8 @@
+{
+  "schema": 1,
+  "slots": ["a", "b"],
+  "activeSlot": "a",
+  "previousSlot": "b",
+  "rollbackEnv": "BARE_OS_SEED_STAGING_PREVIOUS_SLOT",
+  "note": "OTA A/B slot hints for operators; stock kernel merges boot.policy + seeder handshake for enforcement."
+}

kernel/etc/bare-os/package-manager-lock-hint.example.json

@@ -0,0 +1,6 @@
+{
+  "schema": 1,
+  "lockfileLogicalPath": "/.bare/os/package-lock.json",
+  "hyperbeeMetadata": true,
+  "note": "Personal-drive package manager + lockfile story; tooling may mirror manifests under /.bare/os/."
+}

kernel/etc/bare-os/posix_utilities.json

@@ -0,0 +1,100 @@
+{
+  "schema": 1,
+  "note": "Sparse POSIX Issue 7 coverage hints for /bin utilities. Omitted command names are not yet profiled here.",
+  "utilities": {
+    "sh": {
+      "posixIssue7": "minimal",
+      "notes": [
+        "Line-oriented script runner; strips leading shebang; uses ctx.execLine"
+      ],
+      "source": "sh.js"
+    },
+    "xargs": {
+      "posixIssue7": "partial",
+      "notes": [
+        "-0 -n -I -P with bounded parallelism; ctx.runBinCommand only; see BARE_OS_XARGS_MAX_PROCS"
+      ],
+      "source": "xargs.js"
+    },
+    "test": {
+      "posixIssue7": "partial",
+      "notes": [
+        "Expanding [ and test; -r/-w/-x/-s vs UID/GID where supported"
+      ],
+      "source": "test.js"
+    },
+    "echo": {
+      "posixIssue7": "partial",
+      "source": "echo.js"
+    },
+    "printf": {
+      "posixIssue7": "partial",
+      "notes": [
+        "FORMAT supports \\n \\t \\r \\\\ and octal \\ddd; % conversions still partial vs Issue 7"
+      ],
+      "source": "printf.js"
+    },
+    "cmp": {
+      "posixIssue7": "partial",
+      "source": "cmp.js"
+    },
+    "diff": {
+      "posixIssue7": "partial",
+      "notes": ["-q -s -u; single unified hunk; text only"],
+      "source": "diff.js"
+    },
+    "patch": {
+      "posixIssue7": "partial",
+      "notes": ["stdin unified diff; -p --dry-run; whole-file hunk match"],
+      "source": "patch.js"
+    },
+    "find": {
+      "posixIssue7": "partial",
+      "source": "find.js"
+    },
+    "tar": {
+      "posixIssue7": "partial",
+      "notes": [
+        "Ustar; hard links; union limits; xattr via PATH.bare_xattr.json sidecar (see xattr)"
+      ]
+    },
+    "sed": {
+      "posixIssue7": "partial"
+    },
+    "awk": {
+      "posixIssue7": "partial"
+    },
+    "ls": {
+      "posixIssue7": "partial"
+    },
+    "sort": {
+      "posixIssue7": "partial",
+      "notes": ["LC_ALL / LC_COLLATE localeCompare for string keys when not C/POSIX"],
+      "source": "sort.js"
+    },
+    "getconf": {
+      "posixIssue7": "partial",
+      "notes": ["Static vs live pathconf bridge"],
+      "source": "getconf.js"
+    },
+    "getfacl": {
+      "posixIssue7": "partial",
+      "notes": [
+        "PATH.bare_acl sidecar or mode-derived user/group/other triples"
+      ],
+      "source": "getfacl.js"
+    },
+    "setfacl": {
+      "posixIssue7": "partial",
+      "notes": ["-b clears sidecar; else ACL lines from stdin"],
+      "source": "setfacl.js"
+    },
+    "xattr": {
+      "posixIssue7": "partial",
+      "notes": [
+        "PATH.bare_xattr.json map; values base64 UTF-8; -l -w -d"
+      ],
+      "source": "xattr.js"
+    }
+  }
+}

kernel/etc/bare-os/subprocess-bridge-guest.example.json

@@ -0,0 +1,6 @@
+{
+  "schema": 1,
+  "bridgeMetaEnv": "BARE_OS_SUBPROCESS_BRIDGE_META_JSON",
+  "posixSpawnParity": "incremental",
+  "note": "Host pid map and cgroup hints surface through the subprocess bridge snapshot; guest POSIX spawn remains phased."
+}

kernel/etc/bare-os/syscalls.example.json

@@ -0,0 +1,21 @@
+{
+  "schemaVersion": 3,
+  "ctxApiVersion": "1.30.0",
+  "posixProfile": {
+    "id": "bare-os-posix-like",
+    "version": "1.0.0"
+  },
+  "ops": ["readFile", "writeFile"],
+  "opsDetail": [
+    { "name": "readFile", "category": "fs", "stability": "stable" },
+    { "name": "writeFile", "category": "fs", "stability": "stable" }
+  ],
+  "errnoHints": {
+    "ENOENT": 2,
+    "EACCES": 13
+  },
+  "caps": {
+    "note": "example"
+  },
+  "atMs": 0
+}

kernel/etc/bare-os/timers/README

@@ -5,3 +5,8 @@ Install files named `*.timer` under:
   $HOME/.config/bare-os/timers/
 
 (max 8 timer files). See `every-ms.timer.example` and `on-calendar.timer.example` in this directory — copy and rename to `something.timer`.
+
+Clock semantics: `OnCalendar=` / crontab fields use the host wall clock. `every-ms=` timers
+default to `setInterval` (drift vs wall is possible). Set `BARE_OS_TIMER_EVERY_MS_MONOTONIC=1`
+in the guest environment to chain `setTimeout` callbacks so each firing waits a full period
+after the previous job finishes (monotonic cadence, not wall-aligned).

kernel/etc/bare-os/vfs-sidecar-xattr-acl.example.json

@@ -0,0 +1,18 @@
+{
+  "schema": 1,
+  "description": "Illustrative VFS sidecar layout for synthetic ACL and extended attributes (not applied automatically).",
+  "paths": {
+    "aclTextSidecarSuffix": ".bare_acl",
+    "xattrJsonSidecarSuffix": ".bare_xattr.json"
+  },
+  "exampleAclSidecarLines": [
+    "# file: /home/user/doc.txt",
+    "user::rw-",
+    "group::r--",
+    "other::r--"
+  ],
+  "exampleXattrJson": {
+    "user.com.example.tag": "aGVsbG8="
+  },
+  "note": "Use /bin/getfacl, /bin/setfacl, and /bin/xattr; values in xattr JSON are base64-encoded UTF-8 strings."
+}