feat: complete Bare OS POSIX mega-plan (20-track)

Migrate booter and seeder host file/path access to bare-fs/bare-path via package imports while keeping Node defaults for dev/CI; extend CI to reject bare fs/path imports on Pear surfaces. Wire bareOsPearUpdaterDelegate through pear-runtime-updater-style dynamic import, expand process table and signal routing, add system RO alias mount and optional Hyperbee bin hint, protomux proc metrics, cron dom/dow OR rule, boot-perf detail with optional bare-hrtime, /lib/bare warm cache with metrics_live warmReadCache, vault threat-model and users-manual crypto pointers, Pear inspect emit, gated shell break/continue, kernel-ext-graph output and example schema, POSIX compliance matrix + verifier in pretest. Harden ACL sidecar evaluation toward POSIX-like mask semantics; tighten test/expr/ printf edge cases and man JSON; add blind-bootstrap/DHT registry protocol test and troubleshooting notes; refresh handbook, KERNEL_CONTRACT, environment appendix, and reference hub links.
2026-04-04 22:13:19 -04:00
parent 92384990c5
commit 433cb2176d
78 changed files with 1854 additions and 526 deletions
@@ -30,6 +30,8 @@ The repository’s default kernel ([`kernel/init.js`](../kernel/init.js)) is int

 Set **`BARE_OS_BOOT_TRACE=1`** (or **`true`**) in the environment to log boot phase timings on stderr as **`[boot] phase: Nms`**. Use **`BARE_OS_BOOT_TRACE=json`** for one JSON object per phase (**`{"phase":"…","ms":n}`**) on stderr. The same phases are also delivered to **`ctx.bareOsSubscribeBootEvent`** subscribers as NDJSON-shaped objects.

+**`BARE_OS_BOOT_PERF_DETAIL=1`** collects per-stage **`wallMs`** and optional **`bare-hrtime`** **`monotonicNs`** samples into **`/run/bare-os/boot-perf.json`** (**schema 2** when stages are present). **`BARE_OS_KERNEL_EXT_GRAPH=1`** writes **`/run/bare-os/kernel-ext-graph.json`** after **`kernel.ext.d`** ordering (and probes whether **`bare-module-traverse`** can be imported on the host).
+
 **Kernel program boot hooks** (see [kernel-program.md](./kernel-program.md)): **`BARE_OS_BOOT_SAFE_MODE`** skips **`rc.d`**, **`kernel.ext.d`**, and **`onboot`**; **`BARE_OS_BOOT_TRANSACTION_JOURNAL`** appends phase NDJSON to **`/run/bare-os/boot-transaction.ndjson`** (each line includes a **`bootStage`**); **`BARE_OS_BOOT_CHECKPOINT`** refreshes **`/run/bare-os/boot-checkpoint.json`** after each phase (**schema 2** adds **`bootStage`**). **`BARE_OS_BOOT_DRY_RUN`** skips trusted **`execLine`** and extension scripts; **`BARE_OS_BOOT_POLICY_PATH`** / **`policyFallbackPaths`** tier policy files; rollback marker + **`BARE_OS_BOOT_ROLLBACK_APPLY`**; **`kernel.d`** snippets may start with **`# ConditionEnvironment=KEY=VAL`** comment guards; **`bareOsPublishBootReady`** includes **`subsystems.kernel.bootPhases`** with **`bootStage`** labels. Extension drop-ins may use **`requires`**, **`after`**, and **`before`** for ordering alongside **`dependsOn`**. The booter emits additional **`booter:*`** phases (**`vfs`**, **`ctx`**, **`repl`**, **`initd`**, **`kernel_invoke`**) and records them under **`booterPhases`** in **`/run/bare-os/boot.json`**. **`BARE_OS_BOOT_ALLOWLIST=1`** with **`/etc/bare-os/boot.allow`** restricts the first token of lines in trusted rc/onboot snippets. Inspect **`ctx.bareOsRuntimeCaps`** for pipeline limits, quotas, pseudo paths, and **`features`** (including **`httpDelegate`**, **`gitDelegate`**, **`systemctlDelegate`**, **`vfsWatch`**, **`ipcFanout`**).

 **Boot policy v5** (optional **`/etc/bare-os/boot.policy.json`** fields when **`BARE_OS_BOOT_POLICY=1`**): **`requireKernelCapabilitiesHostTransportDelegates`** and **`requireInitJsSha256`** (64-char lowercase hex of raw **`/boot/init.js`** via **`ctx.bareOsBootFileSha256Hex`**). **`BARE_OS_KERNEL_PROFILE_WARM=1`** enables **`ctx.bareOsRequestKernelProfileReload()`** for a warm **`start(ctx)`** re-run without dropping the swarm session (same machinery as hot reload).
@@ -28,6 +28,7 @@ This chapter ties the Hyperdrive-resident kernel ([`kernel/init.js`](../kernel/i
 - **Mirror-drive hints** — `ctx.bareOsEmitMirrorDriveHint({ label?, key? })` emits `bare-os:mirror-drive-hint` on Node-style hosts for mirror-drive–style workflows (labels/keys only; trust boundaries unchanged).
 - **Release metadata** — Host can set `BARE_OS_PEAR_CHANNEL`, `BARE_OS_PEAR_RELEASE`, and `BARE_OS_IMAGE_DIGEST`; they appear in `/run/bare-os/boot.json`.
 - **`ctx.bareOsRequestPearReload()`** — Returns hints and env strings; the host **`pear-runtime` / `pear-runtime-updater`** must perform any real reload.
+- **`ctx.bareOsPearUpdaterDelegate()`** (async, **`bareOsCtxApiVersion` 1.32.0+**) — Surfaces non-secret updater state without bundling **`pear-runtime-updater`** in the stock booter. Host options: set **`BARE_OS_PEAR_UPDATER_SNAPSHOT_JSON`** to a JSON string for a fixed operator snapshot, or **`BARE_OS_PEAR_UPDATER_MODULE`** to an ESM URL/path whose default export (or **`getPearUpdaterState`** / **`bareOsPearUpdaterSnapshot`**) is an **`async function`** returning a plain object (for example **`{ version, updating, updated }`** mirroring your **`PearRuntimeUpdater`** instance). See [`bare-os-pear-updater-bridge.js`](../packages/bare-os-booter/lib/bare-os-pear-updater-bridge.js).

 ### System revision and initd (OTA-friendly ordering)

@@ -59,6 +59,8 @@ In addition to `scripts`, `id`, `dependsOn`, and `signaturePointer`, drop-ins ma
 - **`after`** — extension ids that must load before this drop-in (appended to `dependsOn`).
 - **`before`** — extension ids that must load **after** this drop-in (those ids gain a dependency on this drop-in’s `id`).

+With **`BARE_OS_KERNEL_EXT_GRAPH=1`**, the stock kernel writes **`/run/bare-os/kernel-ext-graph.json`** after ordering (shape in [`docs/schemas/kernel-ext-graph.example.json`](../docs/schemas/kernel-ext-graph.example.json)).
+
 ## batch A traceability (summary)

 Items **1–100** map to the first approved plan (boot graph, journal, safe mode, extension ordering, module policy, process/IPC, VFS, networking, security, telemetry, upgrades, dev UX, benchmarks). Implementation status: