snxraven/bare-operating-system
1
1
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

- disk.os: path manifest search, metrics schema bump, docs

Browse Source 
- HRPC: bare_os.search_local, route table/schema updates; ctx API 1.52.0
- VFS: optional path-capability enforcement; pathcap-verify coreutil
- Replication/boot: warm-cache adaptive metrics, boot budget NDJSON v2
- Identity: savevault pre-snapshot host hint
- POSIX: profile 1.0.16, socket connect timeout env, Wasm ctx API peek import
- Security/ops: peer admission test, personal-drive path policy verifier in pretest
- P2P UX: pkg-swarm-index; multisig rc.proposals/enabled gate + audit rows
- Docs/scripts: README, handbook, env appendix, developer-guide, ctx helper sync
- Examples: syscalls.example ctx version; seeder kernel rsync parity
This commit is contained in:
Raven Scott
2026-04-05 15:27:39 -04:00
parent 169df862f7
commit 41526508df
86 changed files with 3116 additions and 551 deletions
Download Patch File Download Diff File Expand all files Collapse all files
developer-guide/09-security-and-trust.md
+2
View File
@@ -72,6 +72,8 @@ Default **guest** sessions have predictable **`HOME=/home/guest`** and no Ed2551
**`pear.multisig.json`** metadata (signer list + quorum) is validated by the same shape predicate in **`bare-os-protocol`** (seeder hint) and the bundled guest helper **`bareOsPearMultisigShapeOk`** in **`kernel/lib/boot/00-pear-multisig-shape.js`**; keep those files aligned when changing rules.
**`BARE_OS_RC_PROPOSAL_MULTISIG_STRICT`** ties **`/etc/bare-os/rc.proposals/enabled/*.json`** to that policy before **`rc.d`**: each proposal lists approved signer public keys in **`signaturesFrom`**; the guest checks membership and quorum only (host tooling should verify signatures over proposal payloads before writing **`enabled/`**).
---
## Reporting issues
developer-guide/kernel-program.md
+1 -1
View File
@@ -70,7 +70,7 @@ Items **1–100** map to the first approved plan (boot graph, journal, safe mode
## Optional Wasm kernel bridge
**`ctx.bareOsWasmKernelCompile`** / **`ctx.bareOsWasmKernelInstantiate`** (see **`packages/bare-os-booter/lib/bare-os-wasm-kernel.js`**) compile or instantiate a **bounded** Wasm module when **`BARE_OS_WASM_KERNEL=1`**. The booter applies **`maxBytes`**, **memory page caps**, and a **wall-clock instantiate timeout**; syscall-shaped imports (**`bare_os_pathconf`**, **`bare_os_wall_time_ms32`**, **`bare_os_umask_get`**, optional **`bare_os_monotonic_ms`** when **`BARE_OS_WASM_KERNEL_MONOTONIC_MS`**, optional **`bare_os_hostname_peek`** when **`BARE_OS_WASM_KERNEL_HOSTNAME_IMPORT`**) are only constructed when **`BARE_OS_WASM_KERNEL_SYSCALL`** is enabled and the corresponding **`ctx`** hooks exist. **Parity note:** the full **`posixXsh.namesCsv`** surface ( **`clock_gettime`**, **`nanosleep`**, socket bridge ops, …) lives on **`ctx.bareOsSyscall`** in JS — it is **not** exported into the Wasm import object because those paths are async or bridge-heavy. Wasm guests should call back into JS/host shims when they need syscall parity beyond the **sync** clock / umask / pathconf imports. Treat Wasm as **untrusted**: keep modules small, gate on env, and never pass secrets into guest linear memory without a separate review.
**`ctx.bareOsWasmKernelCompile`** / **`ctx.bareOsWasmKernelInstantiate`** (see **`packages/bare-os-booter/lib/bare-os-wasm-kernel.js`**) compile or instantiate a **bounded** Wasm module when **`BARE_OS_WASM_KERNEL=1`**. The booter applies **`maxBytes`**, **memory page caps**, and a **wall-clock instantiate timeout**; syscall-shaped imports (**`bare_os_pathconf`**, **`bare_os_wall_time_ms32`**, **`bare_os_umask_get`**, optional **`bare_os_monotonic_ms`** when **`BARE_OS_WASM_KERNEL_MONOTONIC_MS`**, optional **`bare_os_hostname_peek`** when **`BARE_OS_WASM_KERNEL_HOSTNAME_IMPORT`**, optional **`bare_os_ctx_api_version_peek`** when **`BARE_OS_WASM_KERNEL_CTX_API_PEEK`**) are only constructed when **`BARE_OS_WASM_KERNEL_SYSCALL`** is enabled and the corresponding **`ctx`** hooks exist. **Parity note:** the full **`posixXsh.namesCsv`** surface ( **`clock_gettime`**, **`nanosleep`**, socket bridge ops, …) lives on **`ctx.bareOsSyscall`** in JS — it is **not** exported into the Wasm import object because those paths are async or bridge-heavy. Wasm guests should call back into JS/host shims when they need syscall parity beyond the **sync** clock / umask / pathconf imports. Treat Wasm as **untrusted**: keep modules small, gate on env, and never pass secrets into guest linear memory without a separate review.
## See also