Updates
This commit is contained in:
Raven Scott
@@ -24,7 +24,9 @@ This directory holds the split **file-by-file inventory** that used to live in t
|
||||
- **Kernel feature bits and handshake** — [Kernel extensions](kernel-extensions.md)
|
||||
- **Bits, env, `/proc`, and `ctx` map** — [Kernel capabilities index](kernel-capabilities-index.md)
|
||||
- **Version alignment** — [Compatibility matrix](compatibility-matrix.md)
|
||||
- **Roadmap status** — [Feature roadmap status](feature-roadmap.md)
|
||||
- **Kernel program status tables** — [Feature roadmap status](feature-roadmap.md)
|
||||
- **VFS path classes (policy sketch)** — [vfs-path-classes.md](vfs-path-classes.md)
|
||||
- **Observability contracts** — [observability-contracts.md](observability-contracts.md)
|
||||
- **Kernel program (governed expansion)** — [developer-guide/kernel-program.md](../../developer-guide/kernel-program.md)
|
||||
- **Out of scope and tooling** (former §§15–16) — [Out of scope and tooling](out-of-scope-and-tooling.md)
|
||||
- **curl and wget (delegation, fetch stack, policy)** — [curl and wget](http-curl-and-wget.md)
|
||||
|
||||
@@ -37,4 +37,4 @@ Single place to compare **protocol**, **booter `ctx` API**, **feature-bit docume
|
||||
|
||||
- [`kernel-extensions.md`](./kernel-extensions.md)
|
||||
- [`kernel-capabilities-index.md`](./kernel-capabilities-index.md)
|
||||
- [Handbook ch.11 — Roadmap](../../handbook/11-kernel-roadmap-and-research.md)
|
||||
- [Handbook ch.11 — Kernel program](../../handbook/11-kernel-program-and-research.md)
|
||||
|
||||
@@ -64,7 +64,7 @@ The list below is one **bullet per variable** in the form **name — component
|
||||
- `BARE_OS_SANDBOX_WORKER` — Booter — When **`1`**, defers **`bareOsSandboxRunScript`** on a **fresh microtask** (async boundary); **not** a separate thread or isolate.
|
||||
- `BARE_OS_INITD_MAX_PARALLEL` — bare-initd — Max concurrent unit **starts** per DAG level (integer ≥ **1**; default **1**).
|
||||
- `BARE_OS_INITD_JOURNAL_MAX_LINES` — bare-initd / unit journals — Cap lines retained per unit NDJSON journal under **`/run/bare-os/unit-journal/`**.
|
||||
- `BARE_OS_TELEMETRY_NDJSON` — Booter — Absolute or **`~/…`** path in the **guest VFS**: append capped NDJSON telemetry records (**`telemetrySchemaVersion` / `lifecycleSchemaVersion`**: **5** (stock Wave 6+), **`ts`**, …) mirroring structured boot/kernel events.
|
||||
- `BARE_OS_TELEMETRY_NDJSON` — Booter — Absolute or **`~/…`** path in the **guest VFS**: append capped NDJSON telemetry records (**`telemetrySchemaVersion` / `lifecycleSchemaVersion`**: **5** (stock Capability word 6+), **`ts`**, …) mirroring structured boot/kernel events.
|
||||
- `BARE_OS_TELEMETRY_OTEL_JSONL` — Booter / var-log — Guest VFS path for OTLP-inspired JSON lines (var-log mirrors).
|
||||
- `BARE_OS_PROC_POLL_MS` — VFS — Coalescing interval for **`/proc/bare_os/metrics_live.json`** (250–60000).
|
||||
- `BARE_OS_SHELL_PARAM_EXPANSION` — Shell — When **`1`**, enable **`${VAR:-word}`** and **`${VAR#prefix}`** in **`expandWord`**.
|
||||
@@ -104,7 +104,7 @@ The list below is one **bullet per variable** in the form **name — component
|
||||
- `BARE_OS_SED_NULL_MAX_RECORDS` — **`sed -z`** — Max NUL-separated records per run (default **100000**).
|
||||
- `BARE_OS_HYPER_MULTISIG_VERIFY` — Seeder — When set, runs **`hyper-multisig verify`** via **[`bare-subprocess`](https://github.com/holepunchto/bare-subprocess)** under Pear/Bare (dependency of **`bare-os-seeder`**), or **`child_process`** on Node. Requires **`hyper-multisig`** on **`PATH`**.
|
||||
|
||||
### Wave 6 (selected)
|
||||
### Capability word 6 (selected)
|
||||
|
||||
- `BARE_OS_DNS_MAP_JSON` — Booter / resolver — Bounded JSON static split-horizon map; summary in **`/proc/bare_os/dns_map_active.json`**.
|
||||
- `BARE_OS_RESUME_STAGGER_MS` — Stock kernel / initd — Optional delay between unit starts on resume.
|
||||
|
||||
+116
-116
@@ -1,10 +1,10 @@
|
||||
# Feature roadmap status (kernel super-features)
|
||||
# Kernel capability program status
|
||||
|
||||
This file tracks the twenty-item “kernel super-features” plan. Items are **done** when shipped in the stock booter/kernel unless noted.
|
||||
This file tracks the twenty-item “kernel super-features” baseline plus expanded capability-word integration checklists. Items are **done** when shipped in the stock booter/kernel unless noted.
|
||||
|
||||
## Checklist format and CI
|
||||
|
||||
**Wave 6** through **Wave 11** use **Markdown pipe tables** with numbered rows so `pretest` can verify checklist depth: [`scripts/verify-kernel-capabilities-word-6.mjs`](../../scripts/verify-kernel-capabilities-word-6.mjs) through [`verify-kernel-capabilities-word-11.mjs`](../../scripts/verify-kernel-capabilities-word-11.mjs) count lines matching `| N |` inside each wave block. Do not replace those tables with lists without updating the verifiers. Earlier blocks (the original twenty items and **Wave 5**) follow the same table style for readability and diff-friendly review.
|
||||
**Capability word 6** through **capability word 11** sections use **Markdown pipe tables** with numbered rows so `pretest` can verify checklist depth: [`scripts/verify-kernel-capabilities-word-6.mjs`](../../scripts/verify-kernel-capabilities-word-6.mjs) through [`verify-kernel-capabilities-word-11.mjs`](../../scripts/verify-kernel-capabilities-word-11.mjs) count lines matching `| N |` inside each capability-word block. Do not replace those tables with lists without updating the verifiers. Earlier blocks (the original twenty items and **capability word 5**) follow the same table style for readability and diff-friendly review.
|
||||
|
||||
---
|
||||
|
||||
@@ -22,7 +22,7 @@ This file tracks the twenty-item “kernel super-features” plan. Items are **d
|
||||
| 8 | IPC session namespace | done — `BARE_OS_IPC_NAMESPACE`, mkfifo + initd + VFS |
|
||||
| 9 | Unified `/proc/bare_os/` tree | done — directory + `index.json` + aliases |
|
||||
| 10 | Initd unit `Before=` edges | done — merged into after graph + parallel prereq |
|
||||
| 11 | Boot policy schema v2 | done — `denyBootPhases`, `minKernelCapabilitiesPrimary`, `requireSeedCaps`, `BARE_OS_BOOT_POLICY_STRICT` |
|
||||
| 11 | Boot policy schema v2 | done — `denyBootStages` (legacy `denyBootPhases`), `minKernelCapabilitiesPrimary`, `requireSeedCaps`, `BARE_OS_BOOT_POLICY_STRICT` |
|
||||
| 12 | DNS allowlist for fetch | done — `BARE_OS_DNS_ALLOWLIST` in curl/wget |
|
||||
| 13 | Telemetry schema versioning | done — `telemetrySchemaVersion: 2` on NDJSON sink |
|
||||
| 14 | Suspend/resume hooks | done — `ctx.bareOsRegisterSuspendHook` / `Resume` + `Invoke*` |
|
||||
@@ -33,9 +33,9 @@ This file tracks the twenty-item “kernel super-features” plan. Items are **d
|
||||
| 19 | Audit JSON v2 | done — `auditSchemaVersion: 2` on delegate/execLine/http audit lines |
|
||||
| 20 | Documentation consolidation | done — this file + linked handbook/developer-guide updates |
|
||||
|
||||
## Wave 5 (twenty-item super-feature plan)
|
||||
## Capability word 5 checklist (twenty-item super-feature plan)
|
||||
|
||||
Wave 5 introduces the **fifth capability word** (**`bits5` / host transport delegates**), a **seeder RPC registry** so method lists do not drift, replication queue hints, an **automated compatibility matrix** check in CI, host OS probing under **`/proc`**, subprocess bridge lifecycle v2, transport observability, stricter **boot policy**, scheduled replication windows, union **`readlink`**, kernel profile warm reload, HDMS hints v2, seed-channel error hygiene, **`man`** coverage CI, OTel schema v2, bare-worker allowlist patterns, A/B staging rollback hints, a dev **`/proc/bare_os/debug.json`**, **`ctx.bare`** risk metadata in manifests, and documentation coherence checks.
|
||||
Capability word **5** introduces the **fifth capability word** (**`bits5` / host transport delegates**), a **seeder RPC registry** so method lists do not drift, replication queue hints, an **automated compatibility matrix** check in CI, host OS probing under **`/proc`**, subprocess bridge lifecycle v2, transport observability, stricter **boot policy**, scheduled replication windows, union **`readlink`**, kernel profile warm reload, HDMS hints v2, seed-channel error hygiene, **`man`** coverage CI, OTel schema v2, bare-worker allowlist patterns, A/B staging rollback hints, a dev **`/proc/bare_os/debug.json`**, **`ctx.bare`** risk metadata in manifests, and documentation coherence checks.
|
||||
|
||||
| # | Item | Status |
|
||||
|---|------|--------|
|
||||
@@ -60,18 +60,18 @@ Wave 5 introduces the **fifth capability word** (**`bits5` / host transport dele
|
||||
| 19 | `ctx.bare` risk metadata | done — manifest `tier`/`risk` examples + catalog docs |
|
||||
| 20 | Documentation coherence CI | done — [`scripts/verify-doc-links.mjs`](../../scripts/verify-doc-links.mjs), pretest |
|
||||
|
||||
## Mega-kernel waves (6–11)
|
||||
## Mega-kernel capability words (6–11)
|
||||
|
||||
Waves **6** through **11** are **hundred-item** checklists that track the mega-kernel program: capability words, **`ctx`** API semver, boot policy revisions, seed RPC additions, **`/proc/bare_os/`** schema bumps, telemetry and audit schema versions, and Pear or Bare runtime gates. Rows stay **terse** by design; follow links in each row, [`kernel-extensions.md`](./kernel-extensions.md), and [`developer-guide/adr/001-kernel-feature-bits-governance.md`](../../developer-guide/adr/001-kernel-feature-bits-governance.md) for prose explanations.
|
||||
Capability words **6** through **11** use **hundred-item** checklists that track the mega-kernel program: capability words, **`ctx`** API semver, boot policy revisions, seed RPC additions, **`/proc/bare_os/`** schema bumps, telemetry and audit schema versions, and Pear or Bare runtime gates. Rows stay **terse** by design; follow links in each row, [`kernel-extensions.md`](./kernel-extensions.md), and [`developer-guide/adr/001-kernel-feature-bits-governance.md`](../../developer-guide/adr/001-kernel-feature-bits-governance.md) for prose explanations.
|
||||
|
||||
## Wave 6 (100-item mega kernel)
|
||||
## Capability word 6 checklist (100-item mega kernel)
|
||||
|
||||
| # | Item | Status |
|
||||
|---|------|--------|
|
||||
| 1 | bits6 + BARE_OS_KERNEL_FEATURES_STOCK_WORD_REPLICATION_OPERATOR_SURFACE + FEATURE6_* | done — kernel-feature-bits.js, seed caps, /proc, RPC |
|
||||
| 2 | ADR 001 Word 6 + deprecation policy | done — developer-guide/adr/001 |
|
||||
| 3 | Roadmap verifier + protocol tests bits6 | done — verify-kernel-capabilities-contract.mjs, protocol test.js |
|
||||
| 4 | ctx API semver + d.ts for Wave 6 fields | done — bare-os-ctx-api.js 1.15.0, bare-os-ctx.d.ts |
|
||||
| 3 | Program verifier + protocol tests bits6 | done — verify-kernel-capabilities-contract.mjs, protocol test.js |
|
||||
| 4 | ctx API semver + d.ts for word-6 fields | done — bare-os-ctx-api.js 1.15.0, bare-os-ctx.d.ts |
|
||||
| 5 | ctx.d.ts / capability index drift checks | done — verify-ctx-dts.mjs, verify-ctx-api-feature-bits.mjs |
|
||||
| 6 | Protocol semver coupling docs | done — package-bare-os-protocol.md, README |
|
||||
| 7 | RPC registry single-source (seed-rpc-methods.js) | done — new methods registered |
|
||||
@@ -169,7 +169,7 @@ Waves **6** through **11** are **hundred-item** checklists that track the mega-k
|
||||
| 99 | HDMS pairing backoff telemetry | done — NDJSON fields |
|
||||
| 100 | Mega-integration verify-kernel-capabilities-word-6 + pretest | done — scripts + release notes template |
|
||||
|
||||
## Wave 7 (100-item mega kernel)
|
||||
## Capability word 7 checklist (100-item mega kernel)
|
||||
|
||||
| # | Item | Status |
|
||||
|---|------|--------|
|
||||
@@ -180,7 +180,7 @@ Waves **6** through **11** are **hundred-item** checklists that track the mega-k
|
||||
| 5 | verify-ctx-api-feature-bits + verify-ctx-dts for bits7 | done — scripts |
|
||||
| 6 | verify-kernel-capabilities-word-7.mjs (100 rows) + pretest | done — scripts |
|
||||
| 7 | verify-kernel-capabilities-contract BARE_OS_KERNEL_FEATURES_STOCK_WORD_PEAR_CORESTORE_HRPC + RPC + boot v7 | done — verify-kernel-capabilities-contract.mjs |
|
||||
| 8 | Protocol README + package-bare-os-protocol.md wave 7 semver | done — docs |
|
||||
| 8 | Protocol README + package-bare-os-protocol.md word-7 semver | done — docs |
|
||||
| 9 | RPC bare_os.corestore_stats | done — seed-rpc-methods, channel, booter |
|
||||
| 10 | RPC bare_os.snapshot_manifest_slice | done — channel + handshake |
|
||||
| 11 | RPC bare_os.mirror_drive_hint_v2 | done — channel |
|
||||
@@ -195,21 +195,21 @@ Waves **6** through **11** are **hundred-item** checklists that track the mega-k
|
||||
| 20 | Seeder notReadyReason ready-guard enum | done — channel |
|
||||
| 21 | staging_slot schema 4 + quarantine JSON | done — channel |
|
||||
| 22 | peer_firewall_stats v3 transportBreakdown | done — channel |
|
||||
| 23 | /proc bare_diagnostics_channel.json | done — wave7 proc |
|
||||
| 24 | /proc bare_thread_pool.json | done — wave7 proc |
|
||||
| 25 | /proc async_hooks_lag.json | done — wave7 proc |
|
||||
| 26 | /proc compact_encoding_profile.json | done — wave7 proc |
|
||||
| 27 | /proc protomux_channels.json | done — wave7 proc |
|
||||
| 28 | /proc hrpc_bridge_health.json | done — wave7 proc |
|
||||
| 29 | /proc updater_download_state.json | done — wave7 proc |
|
||||
| 30 | /proc security_context.json | done — wave7 proc |
|
||||
| 31 | /proc git_lfs_pointer_stats.json | done — wave7 proc |
|
||||
| 32 | /proc corestore_gc_hint.json | done — wave7 proc |
|
||||
| 33 | /proc hyperdb_readonly_index.json | done — wave7 proc |
|
||||
| 34 | /proc blind_relay_router.json | done — wave7 proc |
|
||||
| 35 | /proc autopass_session_sketch.json | done — wave7 proc |
|
||||
| 36 | /proc bare_net_interfaces.json | done — wave7 proc |
|
||||
| 37 | /proc pear_build_fingerprint.json | done — wave7 proc |
|
||||
| 23 | /proc bare_diagnostics_channel.json | done — word7 proc |
|
||||
| 24 | /proc bare_thread_pool.json | done — word7 proc |
|
||||
| 25 | /proc async_hooks_lag.json | done — word7 proc |
|
||||
| 26 | /proc compact_encoding_profile.json | done — word7 proc |
|
||||
| 27 | /proc protomux_channels.json | done — word7 proc |
|
||||
| 28 | /proc hrpc_bridge_health.json | done — word7 proc |
|
||||
| 29 | /proc updater_download_state.json | done — word7 proc |
|
||||
| 30 | /proc security_context.json | done — word7 proc |
|
||||
| 31 | /proc git_lfs_pointer_stats.json | done — word7 proc |
|
||||
| 32 | /proc corestore_gc_hint.json | done — word7 proc |
|
||||
| 33 | /proc hyperdb_readonly_index.json | done — word7 proc |
|
||||
| 34 | /proc blind_relay_router.json | done — word7 proc |
|
||||
| 35 | /proc autopass_session_sketch.json | done — word7 proc |
|
||||
| 36 | /proc bare_net_interfaces.json | done — word7 proc |
|
||||
| 37 | /proc pear_build_fingerprint.json | done — word7 proc |
|
||||
| 38 | bare_os_proc_index schema 3 + sorted tests | done — vfs + booter test |
|
||||
| 39 | ctx.bareOsEmitBundlebeeHint | done — booter |
|
||||
| 40 | ctx.bareOsRegisterBareDiagnosticsTap | done — booter |
|
||||
@@ -270,11 +270,11 @@ Waves **6** through **11** are **hundred-item** checklists that track the mega-k
|
||||
| 95 | Audit JSON v4 HTTP redirect depth | done — schema |
|
||||
| 96 | GDPR retention hints developer-guide | done — privacy |
|
||||
| 97 | bare-diagnostics-channel mirror path env | done — kernel-extensions |
|
||||
| 98 | PII scrub Wave 7 fields | done — privacy doc |
|
||||
| 98 | PII scrub word-7 fields | done — privacy doc |
|
||||
| 99 | HDMS vault lock contention telemetry | done — NDJSON doc |
|
||||
| 100 | Mega-integration BARE_OS_KERNEL_FEATURES_STOCK_WORD_PEAR_CORESTORE_HRPC !== 0 + pretest chain | done — protocol test |
|
||||
|
||||
## Wave 8 (100-item mega kernel)
|
||||
## Capability word 8 checklist (100-item mega kernel)
|
||||
|
||||
| # | Item | Status |
|
||||
|---|------|--------|
|
||||
@@ -300,7 +300,7 @@ Waves **6** through **11** are **hundred-item** checklists that track the mega-k
|
||||
| 20 | staging_slot v5 drainDeadlineMs | done — channel schema 5 |
|
||||
| 21 | peer_firewall_stats saturationClass | done — peerFirewallSaturationJson |
|
||||
| 22 | kernel_info pear/bare fingerprint note | done — channel |
|
||||
| 23 | /proc structured_clone_profile.json | done — wave8 proc |
|
||||
| 23 | /proc structured_clone_profile.json | done — word8 proc |
|
||||
| 24 | /proc form_data_delegate_limits.json | done |
|
||||
| 25 | /proc hypercore_signing_status.json | done |
|
||||
| 26 | /proc brittle_snapshot_ci.json | done |
|
||||
@@ -325,7 +325,7 @@ Waves **6** through **11** are **hundred-item** checklists that track the mega-k
|
||||
| 45 | bare-url IDNA/IPv6 zone limits table | done — kernel-extensions |
|
||||
| 46 | bare-https ALPN hint env | done — kernel-extensions |
|
||||
| 47 | bare-http-parser upgrade/chunked limits | done — kernel-extensions |
|
||||
| 48 | /proc hyper_multisig_trust_pointer | done — wave8 proc |
|
||||
| 48 | /proc hyper_multisig_trust_pointer | done — word8 proc |
|
||||
| 49 | boot.policy v8 requireKernelCapabilitiesBareRuntimeProtoMux | done — kernel/init.js + schema |
|
||||
| 50 | boot.policy denySeedRpcMethods | done — env merge + booter skip RPC |
|
||||
| 51 | boot.policy maxProtomuxChannelNameLength | done — kernel env |
|
||||
@@ -362,31 +362,31 @@ Waves **6** through **11** are **hundred-item** checklists that track the mega-k
|
||||
| 82 | Delegate bundlebee kind stub | done — host-delegate-registry |
|
||||
| 83 | Delegate WARC/archive placeholders | done — host-delegate-registry |
|
||||
| 84 | Subprocess sched policy hint | done — kernel-extensions |
|
||||
| 85 | /proc sandbox_worker_queue.json | done — wave8 proc |
|
||||
| 85 | /proc sandbox_worker_queue.json | done — word8 proc |
|
||||
| 86 | bare-thread vs bare-worker exclusion doc | done — handbook |
|
||||
| 87 | BARE_OS_HTTP_PROXY_MAP_JSON doc | done — kernel-extensions |
|
||||
| 88 | bare-http1 keep-alive pool size env | done — kernel-extensions |
|
||||
| 89 | DNSSEC host handles disclaimer | done — developer-guide |
|
||||
| 90 | happy eyeballs IPv6-first toggle env | done — kernel-extensions |
|
||||
| 91 | /proc rocksdb_pointer.json | done — wave8 proc |
|
||||
| 91 | /proc rocksdb_pointer.json | done — word8 proc |
|
||||
| 92 | http_dht_proxy_routes RPC | done — seed RPC + channel |
|
||||
| 93 | NDJSON lifecycle v7 sessionForkGeneration | done — schema + example |
|
||||
| 94 | OTel v5 scopeMetrics sketch | done — schema + example |
|
||||
| 95 | Audit v5 requestSmugglingClass | done — booter audit lines |
|
||||
| 96 | GDPR subprocessor template | done — developer-guide privacy |
|
||||
| 97 | bare-diagnostics subscription allowlist mirror | done — kernel-extensions |
|
||||
| 98 | PII scrub Wave 8 field keys | done — 13-privacy-telemetry-pii.md |
|
||||
| 98 | PII scrub word-8 field keys | done — 13-privacy-telemetry-pii.md |
|
||||
| 99 | HDMS vaultRotateCount telemetry | done — hdms_hints schema 3 |
|
||||
| 100 | Mega-integration BARE_OS_KERNEL_FEATURES_STOCK_WORD_BARE_RUNTIME_PROTO_MUX + wave8 verifier | done — protocol test + pretest |
|
||||
| 100 | Mega-integration BARE_OS_KERNEL_FEATURES_STOCK_WORD_BARE_RUNTIME_PROTO_MUX + word8 verifier | done — protocol test + pretest |
|
||||
|
||||
## Wave 9 (100-item mega kernel)
|
||||
## Capability word 9 checklist (100-item mega kernel)
|
||||
|
||||
| # | Item | Status |
|
||||
|---|------|--------|
|
||||
| 1 | bits9 + BARE_OS_KERNEL_FEATURES_STOCK_WORD_BARE_MODULE_CRYPTO_STAGING + FEATURE9_* + BARE_OS_KERNEL_FEATURE_BITS_DOC=11 | done — kernel-feature-bits.js, protocol index |
|
||||
| 2 | ADR 001 §12 ninth capability word | done — developer-guide/adr/001 |
|
||||
| 3 | bits9 on seed capabilities + /proc + BARE_OS_SEED_CAP_STRICT | done — channel.js, booter index.js |
|
||||
| 4 | BARE_OS_CTX_API_VERSION 1.18.0 + bare-os-ctx.d.ts wave9 | done — bare-os-ctx-api.js |
|
||||
| 4 | BARE_OS_CTX_API_VERSION 1.18.0 + bare-os-ctx.d.ts word9 | done — bare-os-ctx-api.js |
|
||||
| 5 | verify-ctx-api-feature-bits + verify-ctx-dts bits9 | done — scripts |
|
||||
| 6 | verify-kernel-capabilities-word-9.mjs 100 rows + pretest | done — scripts |
|
||||
| 7 | verify-kernel-capabilities-contract BARE_OS_KERNEL_FEATURES_STOCK_WORD_BARE_MODULE_CRYPTO_STAGING + RPC + boot policy v9 | done — verify-kernel-capabilities-contract.mjs |
|
||||
@@ -415,33 +415,33 @@ Waves **6** through **11** are **hundred-item** checklists that track the mega-k
|
||||
| 30 | Seed RPC peer_handshake_latency_budget | done — channel + seeder |
|
||||
| 31 | replication_status pearRuntimeChannel | done — channel opts |
|
||||
| 32 | replication_status pearUpdaterDelegate | done — channel opts |
|
||||
| 33 | staging_slot schema 6 + wave9 blob | done — channel.js |
|
||||
| 33 | staging_slot schema 6 + word9 blob | done — channel.js |
|
||||
| 34 | kernel_info pearApplingId | done — channel.js |
|
||||
| 35 | peer_firewall_stats v4 wave9 | done — channel.js |
|
||||
| 35 | peer_firewall_stats v4 word9 | done — channel.js |
|
||||
| 36 | compact_ping schema 3 encodingHint | done — channel.js |
|
||||
| 37 | handshakeTokenBucketV3Json on replication_status | done — channel.js |
|
||||
| 38 | Seed RPC ready_guard_v3 | done — seed-rpc-methods, channel |
|
||||
| 39 | Seed RPC mirror_drive_compaction_v4 | done — channel + seeder |
|
||||
| 40 | Seed RPC blind_relay_circuit_v2 | done — channel + seeder |
|
||||
| 41 | /proc pear_stage_pointer.json | done — bare-os-proc-bare-module-crypto-staging.js |
|
||||
| 42 | /proc pear_updater_state.json | done — wave9 proc |
|
||||
| 43 | /proc pear_appling_manifest.json | done — wave9 proc |
|
||||
| 44 | /proc drive_resolve_cache.json | done — wave9 proc |
|
||||
| 45 | /proc bare_module_resolution.json | done — wave9 proc |
|
||||
| 46 | /proc bare_crypto_policy.json | done — wave9 proc |
|
||||
| 47 | /proc bare_ipc_bridge.json | done — wave9 proc |
|
||||
| 48 | /proc bare_vm_sandbox_sketch.json | done — wave9 proc |
|
||||
| 49 | /proc bare_daemon_hooks.json | done — wave9 proc |
|
||||
| 50 | /proc bare_storage_quota.json | done — wave9 proc |
|
||||
| 51 | /proc bare_worker_pool.json | done — wave9 proc |
|
||||
| 52 | /proc pear_wakeups_schedule.json | done — wave9 proc |
|
||||
| 53 | /proc pear_drop_events.json | done — wave9 proc |
|
||||
| 54 | /proc pear_radio_state.json | done — wave9 proc |
|
||||
| 55 | /proc hypercore_repair_hint.json | done — wave9 proc |
|
||||
| 56 | /proc hyperdrive_sparse_index.json | done — wave9 proc |
|
||||
| 57 | /proc protomux_channel_alias_v2.json | done — wave9 proc |
|
||||
| 58 | /proc structured_clone_budget_v2.json | done — wave9 proc |
|
||||
| 59 | /proc form_data_delegate_limits_v2.json | done — wave9 proc |
|
||||
| 42 | /proc pear_updater_state.json | done — word9 proc |
|
||||
| 43 | /proc pear_appling_manifest.json | done — word9 proc |
|
||||
| 44 | /proc drive_resolve_cache.json | done — word9 proc |
|
||||
| 45 | /proc bare_module_resolution.json | done — word9 proc |
|
||||
| 46 | /proc bare_crypto_policy.json | done — word9 proc |
|
||||
| 47 | /proc bare_ipc_bridge.json | done — word9 proc |
|
||||
| 48 | /proc bare_vm_sandbox_sketch.json | done — word9 proc |
|
||||
| 49 | /proc bare_daemon_hooks.json | done — word9 proc |
|
||||
| 50 | /proc bare_storage_quota.json | done — word9 proc |
|
||||
| 51 | /proc bare_worker_pool.json | done — word9 proc |
|
||||
| 52 | /proc pear_wakeups_schedule.json | done — word9 proc |
|
||||
| 53 | /proc pear_drop_events.json | done — word9 proc |
|
||||
| 54 | /proc pear_radio_state.json | done — word9 proc |
|
||||
| 55 | /proc hypercore_repair_hint.json | done — word9 proc |
|
||||
| 56 | /proc hyperdrive_sparse_index.json | done — word9 proc |
|
||||
| 57 | /proc protomux_channel_alias_v2.json | done — word9 proc |
|
||||
| 58 | /proc structured_clone_budget_v2.json | done — word9 proc |
|
||||
| 59 | /proc form_data_delegate_limits_v2.json | done — word9 proc |
|
||||
| 60 | bare_os_proc_index schema 5 | done — vfs.js + aliases + readdir |
|
||||
| 61 | ctx.bareOsEmitPearStageHint | done — booter index.js |
|
||||
| 62 | ctx.bareOsBareModuleResolveProbe | done — booter stub |
|
||||
@@ -462,7 +462,7 @@ Waves **6** through **11** are **hundred-item** checklists that track the mega-k
|
||||
| 77 | boot.policy requirePearIpcMin | done — kernel/init.js |
|
||||
| 78 | boot.policy extensionSignerPinsV2 | done — kernel/init.js env |
|
||||
| 79 | boot.policy offlineLkgManifestMaxAgeSec | done — kernel/init.js env |
|
||||
| 80 | boot.policy bootPhasesRequireProcIndexMinSchema | done — kernel/init.js |
|
||||
| 80 | boot.policy bootStagesRequireProcIndexMinSchema (legacy bootPhasesRequireProcIndexMinSchema) | done — kernel/init.js |
|
||||
| 81 | /bin/openssl stub (bare-crypto doc) | done — bare-os-coreutils |
|
||||
| 82 | proc extensions.json schema 6 | done — vfs procBareOsExtensionsText |
|
||||
| 83 | BARE_OS_PROBE_ID_BARE_MODULE_CRYPTO_STAGING + bareModuleProbeClass telemetry | done — bare-os-var-log |
|
||||
@@ -474,24 +474,24 @@ Waves **6** through **11** are **hundred-item** checklists that track the mega-k
|
||||
| 89 | bareOsAdvertisedKernelCapabilitiesBareModuleCryptoStaging + seed bits9 ctx | done — index.js |
|
||||
| 90 | VFS BARE_OS_PROC_FILE_TO_ID_BARE_MODULE_CRYPTO_STAGING + routing | done — vfs.js |
|
||||
| 91 | Developer-guide Node→Bare module map | done — developer-guide/node-to-bare-modules.md |
|
||||
| 92 | Handbook ch.11 wave 9 pointer | done — handbook |
|
||||
| 92 | Handbook ch.11 word-9 pointer | done — handbook |
|
||||
| 93 | kernel-capabilities-index FEATURE9_* | done — docs reference |
|
||||
| 94 | kernel-extensions.md wave9 env/proc | done — docs reference |
|
||||
| 95 | compatibility-matrix wave 9 row | done — docs/reference |
|
||||
| 96 | scripts/README.md wave9 verifier | done — scripts index |
|
||||
| 97 | booter CHANGELOG wave 9 | done — packages/bare-os-booter |
|
||||
| 98 | privacy doc PII scrub wave9 keys | done — developer-guide |
|
||||
| 94 | kernel-extensions.md word9 env/proc | done — docs reference |
|
||||
| 95 | compatibility-matrix word-9 row | done — docs/reference |
|
||||
| 96 | scripts/README.md word9 verifier | done — scripts index |
|
||||
| 97 | booter CHANGELOG word-9 | done — packages/bare-os-booter |
|
||||
| 98 | privacy doc PII scrub word9 keys | done — developer-guide |
|
||||
| 99 | BARE_OS_SOCKS_PROXY_MAP_JSON helper | done — http-fetch-url.js |
|
||||
| 100 | Mega-integration wave9 + parity | done — pretest + seeder kernel sync |
|
||||
| 100 | Mega-integration word9 + parity | done — pretest + seeder kernel sync |
|
||||
|
||||
## Wave 10 (100-item mega kernel)
|
||||
## Capability word 10 checklist (100-item mega kernel)
|
||||
|
||||
| # | Item | Status |
|
||||
|---|------|--------|
|
||||
| 1 | bits10 + BARE_OS_KERNEL_FEATURES_STOCK_WORD_PEAR_INSPECT_LOGGER_TLS + FEATURE10_* + BARE_OS_KERNEL_FEATURE_BITS_DOC=12 | done — kernel-feature-bits.js, protocol index |
|
||||
| 2 | ADR 001 §13 tenth capability word | done — developer-guide/adr/001 |
|
||||
| 3 | bits10 on seed capabilities + /proc + BARE_OS_SEED_CAP_STRICT | done — channel.js, booter index.js |
|
||||
| 4 | BARE_OS_CTX_API_VERSION 1.19.0 + bare-os-ctx.d.ts wave10 | done — bare-os-ctx-api.js |
|
||||
| 4 | BARE_OS_CTX_API_VERSION 1.19.0 + bare-os-ctx.d.ts word10 | done — bare-os-ctx-api.js |
|
||||
| 5 | verify-ctx-api-feature-bits + verify-ctx-dts bits10 | done — scripts |
|
||||
| 6 | verify-kernel-capabilities-word-10.mjs 100 rows + pretest | done — scripts |
|
||||
| 7 | verify-kernel-capabilities-contract BARE_OS_KERNEL_FEATURES_STOCK_WORD_PEAR_INSPECT_LOGGER_TLS + RPC + boot policy v10 | done — verify-kernel-capabilities-contract.mjs |
|
||||
@@ -520,33 +520,33 @@ Waves **6** through **11** are **hundred-item** checklists that track the mega-k
|
||||
| 30 | Seed RPC pear_terminal_caps | done — channel |
|
||||
| 31 | replication_status.pearBundleTier | done — channel + seeder env |
|
||||
| 32 | replication_status.autobaseDiscoveryHint | done — channel + seeder env |
|
||||
| 33 | staging_slot schema 7 + wave10 blob | done — channel.js |
|
||||
| 33 | staging_slot schema 7 + word10 blob | done — channel.js |
|
||||
| 34 | kernel_info.pearRuntimeBareFingerprint | done — channel + seeder env |
|
||||
| 35 | peer_firewall_stats v5 + wave10 | done — channel.js |
|
||||
| 35 | peer_firewall_stats v5 + word10 | done — channel.js |
|
||||
| 36 | compact_ping v4 optional fields | done — channel + compact_ping_v4 RPC |
|
||||
| 37 | handshakeTokenBucketV4Json / seeder token bucket v4 | done — replication_status |
|
||||
| 38 | ready_guard_v4 RPC | done — seed-rpc-methods, channel |
|
||||
| 39 | mirror_drive_compaction_v5 RPC | done — seed-rpc-methods, channel + seeder |
|
||||
| 40 | blind_relay_circuit_v3 RPC | done — seed-rpc-methods, channel + seeder |
|
||||
| 41 | /proc pear_doctor_state.json | done — bare-os-proc-pear-inspect-logger-tls.js |
|
||||
| 42 | /proc pear_workshop_flags.json | done — wave10 proc |
|
||||
| 43 | /proc pear_user_dirs_map.json | done — wave10 proc |
|
||||
| 44 | /proc pear_api_allowlist_sketch.json | done — wave10 proc |
|
||||
| 45 | /proc pear_rti_pointer.json | done — wave10 proc |
|
||||
| 46 | /proc bare_boot_phase_map.json | done — wave10 proc |
|
||||
| 47 | /proc bare_rpc_registry_sketch.json | done — wave10 proc |
|
||||
| 48 | /proc bare_logger_policy.json | done — wave10 proc |
|
||||
| 49 | /proc bare_performance_counters.json | done — wave10 proc |
|
||||
| 50 | /proc bare_inspect_policy.json | done — wave10 proc |
|
||||
| 51 | /proc bare_signals_mask.json | done — wave10 proc |
|
||||
| 52 | /proc bare_timers_budget.json | done — wave10 proc |
|
||||
| 53 | /proc bare_stream_backpressure.json | done — wave10 proc |
|
||||
| 54 | /proc bare_ws_gateway_sketch.json | done — wave10 proc |
|
||||
| 55 | /proc bare_tls_session_hint.json | done — wave10 proc |
|
||||
| 56 | /proc autobase_writer_hint.json | done — wave10 proc |
|
||||
| 57 | /proc blind_pairing_sketch.json | done — wave10 proc |
|
||||
| 58 | /proc broadcast_encryption_hint.json | done — wave10 proc |
|
||||
| 59 | /proc activity_queue_depth.json | done — wave10 proc |
|
||||
| 42 | /proc pear_workshop_flags.json | done — word10 proc |
|
||||
| 43 | /proc pear_user_dirs_map.json | done — word10 proc |
|
||||
| 44 | /proc pear_api_allowlist_sketch.json | done — word10 proc |
|
||||
| 45 | /proc pear_rti_pointer.json | done — word10 proc |
|
||||
| 46 | /proc bare_boot_phase_map.json | done — word10 proc |
|
||||
| 47 | /proc bare_rpc_registry_sketch.json | done — word10 proc |
|
||||
| 48 | /proc bare_logger_policy.json | done — word10 proc |
|
||||
| 49 | /proc bare_performance_counters.json | done — word10 proc |
|
||||
| 50 | /proc bare_inspect_policy.json | done — word10 proc |
|
||||
| 51 | /proc bare_signals_mask.json | done — word10 proc |
|
||||
| 52 | /proc bare_timers_budget.json | done — word10 proc |
|
||||
| 53 | /proc bare_stream_backpressure.json | done — word10 proc |
|
||||
| 54 | /proc bare_ws_gateway_sketch.json | done — word10 proc |
|
||||
| 55 | /proc bare_tls_session_hint.json | done — word10 proc |
|
||||
| 56 | /proc autobase_writer_hint.json | done — word10 proc |
|
||||
| 57 | /proc blind_pairing_sketch.json | done — word10 proc |
|
||||
| 58 | /proc broadcast_encryption_hint.json | done — word10 proc |
|
||||
| 59 | /proc activity_queue_depth.json | done — word10 proc |
|
||||
| 60 | bare_os_proc_index schema 6 | done — vfs.js + aliases + readdir |
|
||||
| 61 | ctx.bareOsEmitPearDoctorHint | done — booter index.js |
|
||||
| 62 | ctx.bareOsPearInspectProbe | done — booter stub |
|
||||
@@ -567,7 +567,7 @@ Waves **6** through **11** are **hundred-item** checklists that track the mega-k
|
||||
| 77 | requireBareTlsMin | done — kernel/init.js |
|
||||
| 78 | extensionSignerPinsV3 | done — boot.policy.schema + kernel env |
|
||||
| 79 | offlineLkgRequirePearStamp | done — kernel/init.js env |
|
||||
| 80 | bootPhasesRequireLifecycleMinSchema | done — kernel/init.js vs lifecycle schema |
|
||||
| 80 | bootStagesRequireLifecycleMinSchema (legacy bootPhasesRequireLifecycleMinSchema) | done — kernel/init.js vs lifecycle schema |
|
||||
| 81 | bare-fs errno mapping v4 (handbook) | done — handbook ch.9 |
|
||||
| 82 | Union statfs v2 docs | done — handbook ch.9 |
|
||||
| 83 | /dev/shm quota v3 class hints | done — handbook ch.9 |
|
||||
@@ -587,23 +587,23 @@ Waves **6** through **11** are **hundred-item** checklists that track the mega-k
|
||||
| 97 | NDJSON lifecycle v9 pearInspectLoggerTlsProbeId | done — bare-os-var-log.js |
|
||||
| 98 | OTel JSONL otlSchemaVersion 7 | done — bare-os-var-log.js |
|
||||
| 99 | Audit JSON schema 7 | done — index.js + kernel-runner.js |
|
||||
| 100 | Mega-integration wave10 + parity | done — pretest + seeder kernel sync |
|
||||
| 100 | Mega-integration word10 + parity | done — pretest + seeder kernel sync |
|
||||
|
||||
## Wave 11 (100-item mega kernel)
|
||||
## Capability word 11 checklist (100-item mega kernel)
|
||||
|
||||
| # | Item | Status |
|
||||
|---|------|--------|
|
||||
| 1 | bits11 + BARE_OS_KERNEL_FEATURES_STOCK_WORD_HYPERCORE_PACK_HRPC_LIFECYCLE + FEATURE11_* + BARE_OS_KERNEL_FEATURE_BITS_DOC=14 | done — kernel-feature-bits.js, protocol |
|
||||
| 2 | ADR 001 §14 eleventh capability word | done — developer-guide/adr/001 |
|
||||
| 3 | Protocol 0.8.0 + protocol-meta + package semver | done — bare-os-protocol |
|
||||
| 4 | channel.js bits11 + seed RPC wave 11 handlers | done — channel.js |
|
||||
| 4 | channel.js bits11 + seed RPC word-11 handlers | done — channel.js |
|
||||
| 5 | BARE_OS_SEED_CAP_STRICT bits11 stock coverage | done — booter index.js |
|
||||
| 6 | Offline LKG seedCapabilityInfo bits11 | done — loadOsFromOfflineLkg |
|
||||
| 7 | verify-kernel-capabilities-word-11.mjs + pretest | done — scripts |
|
||||
| 8 | verify-kernel-capabilities-contract BARE_OS_KERNEL_FEATURES_STOCK_WORD_HYPERCORE_PACK_HRPC_LIFECYCLE + RPC + boot v11 | done — verify-kernel-capabilities-contract.mjs |
|
||||
| 9 | verify-ctx-api-feature-bits bits11 + doc 13 | done — scripts |
|
||||
| 10 | BARE_OS_CTX_API_VERSION 1.20.0 | done — bare-os-ctx-api.js |
|
||||
| 11 | bare-os-ctx.d.ts bits11 + wave11 ctx methods | done — typings |
|
||||
| 11 | bare-os-ctx.d.ts bits11 + word11 ctx methods | done — typings |
|
||||
| 12 | Seed RPC hypercore_replicate_budget_v2 | done — seed-rpc + channel |
|
||||
| 13 | Seed RPC drive_version_graph | done — seed-rpc + channel |
|
||||
| 14 | Seed RPC protomux_backpressure_v3 | done — seed-rpc + channel |
|
||||
@@ -624,11 +624,11 @@ Waves **6** through **11** are **hundred-item** checklists that track the mega-k
|
||||
| 29 | Seed RPC http_dht_proxy_routes_v3 | done — seed-rpc + channel |
|
||||
| 30 | Seed RPC ready_guard_v5 | done — seed-rpc + channel |
|
||||
| 31 | Seed RPC mirror_drive_compaction_v6 | done — seed-rpc + channel |
|
||||
| 32 | Seeder BARE_OS_SEED_* passthrough wave11 | done — bare-os-seeder index.js |
|
||||
| 32 | Seeder BARE_OS_SEED_* passthrough word11 | done — bare-os-seeder index.js |
|
||||
| 33 | bare-os-proc-hypercore-pack-hrpc-lifecycle.js 20 /proc JSON builders | done — booter lib |
|
||||
| 34 | VFS BARE_OS_PROC_FILE_TO_ID_HYPERCORE_PACK_HRPC_LIFECYCLE + routing | done — vfs.js |
|
||||
| 35 | bare_os_proc_index schema 7 + wave11 entries | done — vfs.js |
|
||||
| 36 | ctx wave11 emitters/probes (hypercore, drive graph, …) | done — index.js |
|
||||
| 35 | bare_os_proc_index schema 7 + word11 entries | done — vfs.js |
|
||||
| 36 | ctx word11 emitters/probes (hypercore, drive graph, …) | done — index.js |
|
||||
| 37 | BARE_OS_PROBE_ID_HYPERCORE_PACK_HRPC_LIFECYCLE env passthrough | done — index.js + var-log |
|
||||
| 38 | boot.policy v11 schema keys | done — boot.policy.schema.json |
|
||||
| 39 | requireKernelCapabilitiesHypercorePackHrpcLifecycle enforcement | done — kernel/init.js |
|
||||
@@ -637,7 +637,7 @@ Waves **6** through **11** are **hundred-item** checklists that track the mega-k
|
||||
| 42 | maxHrpcAllowlistDepth env | done — kernel/init.js |
|
||||
| 43 | offlineLkgRequireHypercorePackHrpcLifecycle env | done — kernel/init.js |
|
||||
| 44 | denySeedRpcMethods merge with prior env | done — kernel/init.js |
|
||||
| 45 | boot trace NDJSON wave11 probe fields | done — kernel/init.js bootTimed |
|
||||
| 45 | boot trace NDJSON word11 probe fields | done — kernel/init.js bootTimed |
|
||||
| 46 | /proc/extensions.json schema 8 payload | done — procBareOsExtensionsText |
|
||||
| 47 | BARE_OS_BARE_PACK_VERSION / ADDON_POLICY_VERSION passthrough | done — booter shell env |
|
||||
| 48 | cryptoproc:* + indexerproc:* worker patterns | done — kernel-runner.js |
|
||||
@@ -650,25 +650,25 @@ Waves **6** through **11** are **hundred-item** checklists that track the mega-k
|
||||
| 55 | otel-jsonl.example otlSchemaVersion 8 | done — kernel/etc |
|
||||
| 56 | kernel-extensions.registry.schema.json schema 8 branch | done — docs/schemas |
|
||||
| 57 | BARE_OS_KERNEL_FEATURES_STOCK_WORD_HYPERCORE_PACK_HRPC_LIFECYCLE !== 0 protocol test | done — packages/bare-os-protocol/test.js |
|
||||
| 58 | compatibility-matrix wave 11 row | done — docs/reference |
|
||||
| 58 | compatibility-matrix word-11 row | done — docs/reference |
|
||||
| 59 | verify-compat-matrix bits11 | done — scripts |
|
||||
| 60 | package-bare-os-protocol.md 0.8.0 pointer | done — docs/reference (sync) |
|
||||
| 61 | kernel-capabilities-index FEATURE11_* | done — docs/reference (sync) |
|
||||
| 62 | kernel-extensions.md wave11 env/proc | done — docs/reference (sync) |
|
||||
| 63 | developer-guide node-to-bare wave11 pointers | done — developer-guide (sync) |
|
||||
| 62 | kernel-extensions.md word11 env/proc | done — docs/reference (sync) |
|
||||
| 63 | developer-guide node-to-bare word11 pointers | done — developer-guide (sync) |
|
||||
| 64 | handbook ch.6 boot policy v11 | done — handbook (sync) |
|
||||
| 65 | handbook ch.3 protocol 0.7 / bits11 | done — handbook (sync) |
|
||||
| 66 | README + DOCUMENTATION wave11 headline | done — root docs (sync) |
|
||||
| 66 | README + DOCUMENTATION word11 headline | done — root docs (sync) |
|
||||
| 67 | PEAR-RUN + booter README ctx 1.20 | done — package READMEs (sync) |
|
||||
| 68 | scripts/README.md wave11 verifier | done — scripts/README.md (sync) |
|
||||
| 69 | privacy telemetry PII wave11 keys | done — developer-guide/13 (sync) |
|
||||
| 70 | release-checklist wave11 gates | done — scripts/release-checklist.mjs (sync) |
|
||||
| 71 | validate-example-schemas wave11 examples | done — validate-example-schemas |
|
||||
| 72 | VFS readdir ordering wave11 proc files | done — vfs.js tests / impl |
|
||||
| 68 | scripts/README.md word11 verifier | done — scripts/README.md (sync) |
|
||||
| 69 | privacy telemetry PII word11 keys | done — developer-guide/13 (sync) |
|
||||
| 70 | release-checklist word11 gates | done — scripts/release-checklist.mjs (sync) |
|
||||
| 71 | validate-example-schemas word11 examples | done — validate-example-schemas |
|
||||
| 72 | VFS readdir ordering word11 proc files | done — vfs.js tests / impl |
|
||||
| 73 | loadOsFromPeers strict bits11 | done — index.js |
|
||||
| 74 | kernel_info / capabilities bits11 adjunct | done — channel.js |
|
||||
| 75 | Wave11 proc bare_pack_cache + bare_addon_policy | done — wave11-proc |
|
||||
| 76 | Wave11 proc bare_signals_profile + bare_timers_histogram | done — wave11-proc |
|
||||
| 75 | Word-11 proc bare_pack_cache + bare_addon_policy | done — word11-proc |
|
||||
| 76 | Word-11 proc bare_signals_profile + bare_timers_histogram | done — word11-proc |
|
||||
| 77 | ctx bareOsBarePackCacheProbe + bareOsBareAddonPolicyProbe | done — index.js |
|
||||
| 78 | ctx bareOsBareSignalsProfile + bareOsBareTimersHistogram | done — index.js |
|
||||
| 79 | Stream F VFS env toggles BARE_OS_HIDE_PROC_HYPERCORE_PACK_HRPC_LIFECYCLE_* | done — vfs routing |
|
||||
@@ -685,27 +685,27 @@ Waves **6** through **11** are **hundred-item** checklists that track the mega-k
|
||||
| 90 | Stream Q handbook/devguide/reference sweep | tracked — mega doc pass |
|
||||
| 91 | Stream R HyperDB/Pear finishing slots | tracked — seed RPC tests |
|
||||
| 92 | Stream S release hygiene + compat CI | tracked — pretest matrix |
|
||||
| 93 | verify-doc-links wave11 anchors | done — CI |
|
||||
| 94 | verify-man-coverage wave11 | done — CI |
|
||||
| 93 | verify-doc-links word11 anchors | done — CI |
|
||||
| 94 | verify-man-coverage word11 | done — CI |
|
||||
| 95 | verify-pear-no-static-node-import | done — CI |
|
||||
| 96 | verify-kernel-seeder-parity after kernel merge | done — pretest |
|
||||
| 97 | smoke-bare-manifest imports | done — pretest |
|
||||
| 98 | booter CHANGELOG wave11 headline | done — packages/bare-os-booter |
|
||||
| 98 | booter CHANGELOG word11 headline | done — packages/bare-os-booter |
|
||||
| 99 | protocol CHANGELOG 0.8.0 | done — packages/bare-os-protocol |
|
||||
| 100 | Mega-integration wave11 + seeder kernel parity | done — pretest + rsync kernel |
|
||||
| 100 | Mega-integration word11 + seeder kernel parity | done — pretest + rsync kernel |
|
||||
|
||||
See also [kernel-extensions.md](kernel-extensions.md) and [package-bare-os-protocol.md](package-bare-os-protocol.md).
|
||||
|
||||
---
|
||||
|
||||
## Kernel program backlog — tranche A (100 items)
|
||||
## Kernel program backlog — batch A (100 items)
|
||||
|
||||
Governed kernel expansion: [developer-guide/kernel-program.md](../../developer-guide/kernel-program.md), stock kernel boot hooks (**`BARE_OS_BOOT_SAFE_MODE`**, **`BARE_OS_BOOT_TRANSACTION_JOURNAL`**, **`BARE_OS_BOOT_CHECKPOINT`**), **`kernel.ext.d`** ordering fields **`requires`** / **`after`** / **`before`**, **`/proc/bare_os/kernel_program.json`** (legacy **`giant_phase_program.json`**), **`/bin/kernel-doctor`**, **`/bin/kernel-explain`**, scripts **`verify-kernel-program-doc.mjs`** + **`kernel-program-benchmark-harness.mjs`**. **`bareOsCtxApiVersion` `1.25.0`**: optional **`subsystems.kernel.programProc`** on **`bareOsPublishBootReady`** payloads.
|
||||
|
||||
|
||||
## Kernel program backlog — tranche B (100 items)
|
||||
## Kernel program backlog — batch B (100 items)
|
||||
|
||||
Second tranche of the same governed program. Traceability: [developer-guide/kernel-program.md](../../developer-guide/kernel-program.md), **`/proc/bare_os/kernel_program.json`** schema **2**, `bareOsCtxApiVersion` **1.25.0**.
|
||||
Second batch of the same governed program. Traceability: [developer-guide/kernel-program.md](../../developer-guide/kernel-program.md), **`/proc/bare_os/kernel_program.json`** schema **2**, `bareOsCtxApiVersion` **1.25.0**.
|
||||
|
||||
| # | Item | Status |
|
||||
| ---: | --- | --- |
|
||||
@@ -808,4 +808,4 @@ Second tranche of the same governed program. Traceability: [developer-guide/kern
|
||||
| 97 | Fuzz boot policy JSON harness | done |
|
||||
| 98 | Chaos safe-mode rollback integration test doc | done |
|
||||
| 99 | Release gate benchmark regression script | done |
|
||||
| 100 | Roadmap tranche B table + verify-kernel-program-roadmap-table.mjs CI | done |
|
||||
| 100 | Program batch B table + verify-kernel-program-roadmap-table.mjs CI | done |
|
||||
|
||||
@@ -58,7 +58,7 @@ The booter may also call **`primeGlobalFetchFromBareLibrary(bareLibrary)`** duri
|
||||
|
||||
**TLS and CA behavior** for delegated **`curl`** can use optional **`init.bareOsCurlTls`** ( **`insecure`**, **`caPem`**, **`pinnedSha256`**) alongside **`BARE_OS_TLS_PIN_SHA256`**; see the security guide and kernel **`init`** documentation.
|
||||
|
||||
**Wave 6 (rotation and HTTP hints)** — For operators running **bare-fetch** (or host **`fetch`**) behind the delegate, document **multi-pin** rotation as a comma- or JSON-list of hex digests (same semantics as single-pin, evaluated by the host). **HSTS preload** lists and **alt-svc** hints are **host-layer** concerns: reserved env names **`BARE_OS_TLS_PINS_JSON`**, **`BARE_OS_HSTS_PRELOAD_PINS_JSON`**, **`BARE_OS_CURL_ALT_SVC_JSON`** are listed in [kernel-extensions.md](./kernel-extensions.md) for Pear-side wiring; the stock in-guest booter does not parse them.
|
||||
**Capability word 6 (rotation and HTTP hints)** — For operators running **bare-fetch** (or host **`fetch`**) behind the delegate, document **multi-pin** rotation as a comma- or JSON-list of hex digests (same semantics as single-pin, evaluated by the host). **HSTS preload** lists and **alt-svc** hints are **host-layer** concerns: reserved env names **`BARE_OS_TLS_PINS_JSON`**, **`BARE_OS_HSTS_PRELOAD_PINS_JSON`**, **`BARE_OS_CURL_ALT_SVC_JSON`** are listed in [kernel-extensions.md](./kernel-extensions.md) for Pear-side wiring; the stock in-guest booter does not parse them.
|
||||
|
||||
---
|
||||
|
||||
|
||||
@@ -165,7 +165,7 @@ Each row is one **bit index** in the first capability word. Columns list **env o
|
||||
| 14 `FEATURE6_HANDSHAKE_TOKEN_BUCKET` | `BARE_OS_SEED_TOKEN_BUCKET_JSON` | seed handshake | client backoff metadata |
|
||||
| 15 `FEATURE6_COMPACT_SEED_PING` | — | `compact_ping` / `compact_pong` | optional bandwidth probe |
|
||||
|
||||
**Related `ctx` (1.22.0+):** eleven words are only in frozen **`bareOsAdvertisedKernelCapabilityWords`** / **`bareOsSeedKernelCapabilityWords`** (semantic keys per [capability-words.md](./capability-words.md)). Hooks and helpers from waves 6–11 still apply — e.g. **`bareOsReadProcMetricsLive()`**, **`bareOsReadDelegateFairnessSnapshot`**, **`bareOsReadSubprocessBridgeJobs`**, **`bareOsReadSubprocessBridgeSnapshot`**, **`bareOsRequestKernelProfileReload`**, **`bareOsIsCtxMethodAllowed`**, **`bareOsEmitIpcAudit`**, **`bareOsEmitBlindPeerHint`**, **`bareOsHostCapability`**, **`bareOsPearUpdaterDelegate`**, **`bareOsEmitHyperdhtBootstrapRefresh`**, **`bareOsBooterPackageVersion`**; Pear IPC channel names in [`bare-os-pear-ipc-registry.js`](../../packages/bare-os-booter/lib/bare-os-pear-ipc-registry.js).
|
||||
**Related `ctx` (1.22.0+):** eleven words are only in frozen **`bareOsAdvertisedKernelCapabilityWords`** / **`bareOsSeedKernelCapabilityWords`** (semantic keys per [capability-words.md](./capability-words.md)). Hooks and helpers from words 6–11 still apply — e.g. **`bareOsReadProcMetricsLive()`**, **`bareOsReadDelegateFairnessSnapshot`**, **`bareOsReadSubprocessBridgeJobs`**, **`bareOsReadSubprocessBridgeSnapshot`**, **`bareOsRequestKernelProfileReload`**, **`bareOsIsCtxMethodAllowed`**, **`bareOsEmitIpcAudit`**, **`bareOsEmitBlindPeerHint`**, **`bareOsHostCapability`**, **`bareOsPearUpdaterDelegate`**, **`bareOsEmitHyperdhtBootstrapRefresh`**, **`bareOsBooterPackageVersion`**; Pear IPC channel names in [`bare-os-pear-ipc-registry.js`](../../packages/bare-os-booter/lib/bare-os-pear-ipc-registry.js).
|
||||
|
||||
### Word 7 (seventh capability word, `pearCorestoreHrpc`)
|
||||
|
||||
|
||||
@@ -12,15 +12,15 @@ New capability bits are governed by [ADR 001 — Kernel feature bit governance](
|
||||
|
||||
Runtime bits are defined in `bare-os-protocol` (`kernel-feature-bits.js`) and surfaced under `/proc/bare_os_features` and the **`/proc/bare_os/`** tree. The stock booter advertises **`BARE_OS_KERNEL_FEATURES_STOCK_WORD_PRIMARY`** through **`BARE_OS_KERNEL_FEATURES_STOCK_WORD_HYPERCORE_PACK_HRPC_LIFECYCLE`** (eleven words on the wire when non-zero; see [capability-words.md](./capability-words.md)).
|
||||
|
||||
Seed RPC **`bare_os.capabilities`** includes **`protocolPackageVersion`**, optional **`booterPackageVersion`**, **`featureBitsDoc`**, **`doc`**, **`bits`**, **`bits2`**, **`bits3`**, **`bits4`**, **`bits5`**, **`bits6`**, **`bits7`**, **`bits8`**, **`bits9`**, **`bits10`**, **`role`**, **`protocol`**. RPC method names are listed from a single registry ([`seed-rpc-methods.js`](../../packages/bare-os-protocol/lib/seed-rpc-methods.js)); unknown methods return **`bare_os.rpc_unknown_method`**. **`bare_os.replication_status`** returns seeder-side replication hints (manifest path count, local RAM block count). **`bare_os.replication_queue`** includes bounded **`queueDepthEstimate`** and snapshot workflow notes; **`bare_os.capability_attestation`**, and **`bare_os.mbr_layout`** remain optional wave-2 RPCs. Wave 6 adds **`replication_plan`**, **`dht_bootstrap_hint`**, **`snapshot_chain`**, **`mirror_compaction_hint`**, **`updater_state`**, **`blind_peer_topology_v2`**, **`compact_ping`**. Wave 7 adds **`corestore_stats`**, **`snapshot_manifest_slice`**, **`mirror_drive_hint_v2`**, **`hrpc_registry_summary`**, **`protomux_capability_ad`**, **`dht_address_book`**, **`replication_throttle_hint`**, **`bundlebee_stage`**, **`http_dht_proxy_hint`**. Wave 8 adds **`protomux_rpc_pool_hint`**, **`hyperblob_store_hint`**, **`signing_request_queue_hint`**, **`core_storage_layout_hint`**, **`mirror_drive_compaction_v3`**, **`bundlebee_cli_stage`**, **`ready_guard_v2`**, **`blind_relay_circuit_hint`**, **`http_dht_proxy_routes`**. **Wave 9** adds Holepunch-aligned short names such as **`pear_stage_hint`**, **`updater_channel_matrix`**, **`appling_bundle_pointer`**, **`drive_resolve_policy`**, **`bundle_id_fingerprint`**, **`hyperdb_migration_hint`**, **`sidecar_bundle_index_v2`**, **`pear_message_queue_sketch`**, **`runtime_bootstrap_etag`**, **`force_update_guard`**, **`gracedown_window`**, **`tryboot_slot`**, **`hotmods_allowlist`**, **`prefetcher_budget`**, **`opstream_backpressure`**, **`multisig_link_pointer`**, **`md_render_caps`**, **`bundlebee_cli_stage_v2`**, **`seed_manifest_diff_v2`**, **`peer_handshake_latency_budget`**, plus replication adjuncts (**`ready_guard_v3`**, **`mirror_drive_compaction_v4`**, **`blind_relay_circuit_v2`**, **`http_dht_proxy_routes_v2`**, token-bucket metadata, **`compact_ping` v3**, **`peer_firewall_stats` v4**, **`staging_slot` schema 6**, **`kernel_info.pearApplingId`**). **`bare_os.manifest_hints`** returns a sample of manifest paths; **`bare_os.peer_health`** returns seeder health counters; **`bare_os.staging_slot`** returns optional A/B slot hints (seeder env `BARE_OS_SEED_STAGING_SLOT`, `BARE_OS_SEED_STAGING_PENDING`). Booter mirrors hints under **`/proc/bare_os/manifest_hints`**, **`peer_health`**, **`staging_slot`**, **`net_summary.json`**, **`extensions.json`** (schema **7** in wave 10), **`hdms_hints.json`** (schema **3**: optional **`vaultRotateCount`**) and embeds them in **`/proc/bare_os_replication`** JSON. **`/proc/bare_os/index.json`** lists stable aliases (**`bare_os_proc_index` schema 6**). **Wave 10** adds Pear/Bare sketch RPCs (**`pear_doctor_hint`** … **`pear_terminal_caps`**, **`ready_guard_v4`**, **`compact_ping_v4`**, compaction/blind-relay v5/v3), replication adjuncts (**`pearBundleTier`**, **`autobaseDiscoveryHint`**, **`handshakeTokenBucketV4`**, **`staging_slot` schema 7**, **`peer_firewall_stats` v5**), and 19× Wave 10 **`/proc/bare_os/*.json`** files via **`bare-os-proc-pear-inspect-logger-tls.js`**.
|
||||
Seed RPC **`bare_os.capabilities`** includes **`protocolPackageVersion`**, optional **`booterPackageVersion`**, **`featureBitsDoc`**, **`doc`**, **`bits`**, **`bits2`**, **`bits3`**, **`bits4`**, **`bits5`**, **`bits6`**, **`bits7`**, **`bits8`**, **`bits9`**, **`bits10`**, **`role`**, **`protocol`**. RPC method names are listed from a single registry ([`seed-rpc-methods.js`](../../packages/bare-os-protocol/lib/seed-rpc-methods.js)); unknown methods return **`bare_os.rpc_unknown_method`**. **`bare_os.replication_status`** returns seeder-side replication hints (manifest path count, local RAM block count). **`bare_os.replication_queue`** includes bounded **`queueDepthEstimate`** and snapshot workflow notes; **`bare_os.capability_attestation`**, and **`bare_os.mbr_layout`** remain optional word-2 RPCs. Capability word 6 adds **`replication_plan`**, **`dht_bootstrap_hint`**, **`snapshot_chain`**, **`mirror_compaction_hint`**, **`updater_state`**, **`blind_peer_topology_v2`**, **`compact_ping`**. Capability word 7 adds **`corestore_stats`**, **`snapshot_manifest_slice`**, **`mirror_drive_hint_v2`**, **`hrpc_registry_summary`**, **`protomux_capability_ad`**, **`dht_address_book`**, **`replication_throttle_hint`**, **`bundlebee_stage`**, **`http_dht_proxy_hint`**. Capability word 8 adds **`protomux_rpc_pool_hint`**, **`hyperblob_store_hint`**, **`signing_request_queue_hint`**, **`core_storage_layout_hint`**, **`mirror_drive_compaction_v3`**, **`bundlebee_cli_stage`**, **`ready_guard_v2`**, **`blind_relay_circuit_hint`**, **`http_dht_proxy_routes`**. **Capability word 9** adds Holepunch-aligned short names such as **`pear_stage_hint`**, **`updater_channel_matrix`**, **`appling_bundle_pointer`**, **`drive_resolve_policy`**, **`bundle_id_fingerprint`**, **`hyperdb_migration_hint`**, **`sidecar_bundle_index_v2`**, **`pear_message_queue_sketch`**, **`runtime_bootstrap_etag`**, **`force_update_guard`**, **`gracedown_window`**, **`tryboot_slot`**, **`hotmods_allowlist`**, **`prefetcher_budget`**, **`opstream_backpressure`**, **`multisig_link_pointer`**, **`md_render_caps`**, **`bundlebee_cli_stage_v2`**, **`seed_manifest_diff_v2`**, **`peer_handshake_latency_budget`**, plus replication adjuncts (**`ready_guard_v3`**, **`mirror_drive_compaction_v4`**, **`blind_relay_circuit_v2`**, **`http_dht_proxy_routes_v2`**, token-bucket metadata, **`compact_ping` v3**, **`peer_firewall_stats` v4**, **`staging_slot` schema 6**, **`kernel_info.pearApplingId`**). **`bare_os.manifest_hints`** returns a sample of manifest paths; **`bare_os.peer_health`** returns seeder health counters; **`bare_os.staging_slot`** returns optional A/B slot hints (seeder env `BARE_OS_SEED_STAGING_SLOT`, `BARE_OS_SEED_STAGING_PENDING`). Booter mirrors hints under **`/proc/bare_os/manifest_hints`**, **`peer_health`**, **`staging_slot`**, **`net_summary.json`**, **`extensions.json`** (schema **7** in Capability word 10), **`hdms_hints.json`** (schema **3**: optional **`vaultRotateCount`**) and embeds them in **`/proc/bare_os_replication`** JSON. **`/proc/bare_os/index.json`** lists stable aliases (**`bare_os_proc_index` schema 6**). **Capability word 10** adds Pear/Bare sketch RPCs (**`pear_doctor_hint`** … **`pear_terminal_caps`**, **`ready_guard_v4`**, **`compact_ping_v4`**, compaction/blind-relay v5/v3), replication adjuncts (**`pearBundleTier`**, **`autobaseDiscoveryHint`**, **`handshakeTokenBucketV4`**, **`staging_slot` schema 7**, **`peer_firewall_stats` v5**), and 19× Capability word 10 **`/proc/bare_os/*.json`** files via **`bare-os-proc-pear-inspect-logger-tls.js`**.
|
||||
|
||||
**Wave 8 Pear/Bare bridge (doc-first):** **`ctx.bareOsEmitStructuredCloneCap`** / **`ctx.bareOsProtomuxChannelAlias`**; **`BARE_OS_CURL_RESOLVE_MAP_JSON`** (curl/wget); **`BARE_OS_HTTP_PROXY_MAP_JSON`** (operator proxy map, host-interpreted); **`BARE_OS_BARE_HTTP1_KEEPALIVE_POOL`**, **`BARE_OS_HAPPY_EYEBALLS_IPV6_FIRST`**, **`BARE_OS_RESUME_STAGGER_LEVEL_MS_JSON`**, **`BARE_OS_INITD_COLLECT_MODE_HINT`**, **`BARE_OS_INITD_START_LIMIT_INTERVAL_MS`**, **`BARE_OS_INITD_START_LIMIT_BURST`**, **`BARE_OS_WORKER_RSS_HIGH_WATER_JSON`**, **`BARE_OS_SANDBOX_FS_CLASS`**, **`BARE_OS_SUBPROCESS_SCHED_POLICY_HINT`**, **`BARE_OS_DIAGNOSTICS_SUBSCRIBE_ALLOWLIST_JSON`**; **`BARE_OS_BOOT_POLICY_DENY_SEED_RPC_METHODS`** (comma-separated short names, also merged from **`denySeedRpcMethods`** in **`boot.policy.json`** v8).
|
||||
**Capability word 8 Pear/Bare bridge (doc-first):** **`ctx.bareOsEmitStructuredCloneCap`** / **`ctx.bareOsProtomuxChannelAlias`**; **`BARE_OS_CURL_RESOLVE_MAP_JSON`** (curl/wget); **`BARE_OS_HTTP_PROXY_MAP_JSON`** (operator proxy map, host-interpreted); **`BARE_OS_BARE_HTTP1_KEEPALIVE_POOL`**, **`BARE_OS_HAPPY_EYEBALLS_IPV6_FIRST`**, **`BARE_OS_RESUME_STAGGER_LEVEL_MS_JSON`**, **`BARE_OS_INITD_COLLECT_MODE_HINT`**, **`BARE_OS_INITD_START_LIMIT_INTERVAL_MS`**, **`BARE_OS_INITD_START_LIMIT_BURST`**, **`BARE_OS_WORKER_RSS_HIGH_WATER_JSON`**, **`BARE_OS_SANDBOX_FS_CLASS`**, **`BARE_OS_SUBPROCESS_SCHED_POLICY_HINT`**, **`BARE_OS_DIAGNOSTICS_SUBSCRIBE_ALLOWLIST_JSON`**; **`BARE_OS_BOOT_POLICY_DENY_SEED_RPC_METHODS`** (comma-separated short names, also merged from **`denySeedRpcMethods`** in **`boot.policy.json`** v8).
|
||||
|
||||
**Wave 9 Pear/Bare bridge:** **`ctx.bareOsEmitPearStageHint`**, **`ctx.bareOsBareModuleResolveProbe`**, **`ctx.bareOsBareCryptoCapProbe`**, **`ctx.bareOsPearUpdaterChannel`**, **`ctx.bareOsEmitDriveResolveHint`**, **`ctx.bareOsRegisterBareDiagnosticsTapV2`**, **`ctx.bareOsEmitPearMessageSketch`**, **`ctx.bareOsEmitTrybootSlot`**, **`ctx.bareOsEmitMultisigPointer`**, **`ctx.bareOsBareStorageHint`**; host env **`BARE_OS_SOCKS_PROXY_MAP_JSON`** (delegated fetch); **`BARE_OS_BARE_CRYPTO_VERSION`**, **`BARE_OS_PEAR_IPC_PACKAGE_VERSION`**, **`BARE_OS_PEAR_UPDATER_CHANNEL`**, **`BARE_OS_HAPPY_EYEBALLS_V3_MODE`**, **`BARE_OS_BIN_WORKER_WASM_MS_MAX`**, **`BARE_OS_PROBE_ID_BARE_MODULE_CRYPTO_STAGING`**, **`BARE_OS_BARE_MODULE_PROBE_CLASS`**; optional **`BARE_OS_*_JSON`** blobs for Wave 9 **`/proc/bare_os/*.json`** files (see **`bare-os-proc-bare-module-crypto-staging.js`**); boot policy **v9** adds **`requireKernelCapabilitiesBareModuleCryptoStaging`**, **`requirePearRuntimeRange`**, **`denyBareModuleSpecifierPatterns`**, **`requireBareCryptoMin`**, **`denyKernelSyscalls`**, **`requirePearIpcMin`**, **`extensionSignerPinsV2`**, **`offlineLkgManifestMaxAgeSec`**, **`bootPhasesRequireProcIndexMinSchema`**, **`maxKernelExtensionDepth` v2 semantics**, … — see [`boot.policy.schema.json`](../schemas/boot.policy.schema.json).
|
||||
**Capability word 9 Pear/Bare bridge:** **`ctx.bareOsEmitPearStageHint`**, **`ctx.bareOsBareModuleResolveProbe`**, **`ctx.bareOsBareCryptoCapProbe`**, **`ctx.bareOsPearUpdaterChannel`**, **`ctx.bareOsEmitDriveResolveHint`**, **`ctx.bareOsRegisterBareDiagnosticsTapV2`**, **`ctx.bareOsEmitPearMessageSketch`**, **`ctx.bareOsEmitTrybootSlot`**, **`ctx.bareOsEmitMultisigPointer`**, **`ctx.bareOsBareStorageHint`**; host env **`BARE_OS_SOCKS_PROXY_MAP_JSON`** (delegated fetch); **`BARE_OS_BARE_CRYPTO_VERSION`**, **`BARE_OS_PEAR_IPC_PACKAGE_VERSION`**, **`BARE_OS_PEAR_UPDATER_CHANNEL`**, **`BARE_OS_HAPPY_EYEBALLS_V3_MODE`**, **`BARE_OS_BIN_WORKER_WASM_MS_MAX`**, **`BARE_OS_PROBE_ID_BARE_MODULE_CRYPTO_STAGING`**, **`BARE_OS_BARE_MODULE_PROBE_CLASS`**; optional **`BARE_OS_*_JSON`** blobs for Capability word 9 **`/proc/bare_os/*.json`** files (see **`bare-os-proc-bare-module-crypto-staging.js`**); boot policy **v9** adds **`requireKernelCapabilitiesBareModuleCryptoStaging`**, **`requirePearRuntimeRange`**, **`denyBareModuleSpecifierPatterns`**, **`requireBareCryptoMin`**, **`denyKernelSyscalls`**, **`requirePearIpcMin`**, **`extensionSignerPinsV2`**, **`offlineLkgManifestMaxAgeSec`**, **`bootStagesRequireProcIndexMinSchema`** (legacy **`bootPhasesRequireProcIndexMinSchema`**), **`maxKernelExtensionDepth` v2 semantics**, … — see [`boot.policy.schema.json`](../schemas/boot.policy.schema.json).
|
||||
|
||||
**Wave 10 Pear/Bare bridge:** **`ctx.bareOsEmitPearDoctorHint`**, **`ctx.bareOsPearInspectProbe`**, **`ctx.bareOsEmitBareBootPhaseHint`**, **`ctx.bareOsBareRpcCapProbe`**, **`ctx.bareOsEmitPearStampPointer`**, **`ctx.bareOsRegisterBareLoggerTap`**, **`ctx.bareOsEmitAutobaseDiscoveryHint`**, **`ctx.bareOsEmitBlindPairingSketch`**, **`ctx.bareOsBareStreamBackpressureHint`**, **`ctx.bareOsPearTerminalCapsProbe`**; host env **`BARE_OS_PROBE_ID_PEAR_INSPECT_LOGGER_TLS`**, **`BARE_OS_BARE_RPC_PROBE_CLASS`**, **`BARE_OS_MTLS_PROXY_MAP_JSON`**, **`BARE_OS_THREAD_POOL_TELEMETRY_JSON`**, **`BARE_OS_HAPPY_EYEBALLS_V4_MODE`**, **`BARE_OS_BARE_BOOT_VERSION`**, **`BARE_OS_BARE_LOGGER_VERSION`**, **`BARE_OS_BARE_TLS_VERSION`**, **`BARE_OS_LIFECYCLE_SCHEMA_VERSION`** (injected); boot policy **v10** adds **`requireKernelCapabilitiesPearInspectLoggerTls`**, **`requireBareBootMin`**, **`denyBareRpcMethodPatterns`**, **`maxPearInspectDepth`**, **`requireBareLoggerMin`**, **`denyAutobaseDiscoveryChannels`**, **`requireBareTlsMin`**, **`extensionSignerPinsV3`**, **`offlineLkgRequirePearStamp`**, **`bootPhasesRequireLifecycleMinSchema`**, …
|
||||
**Capability word 10 Pear/Bare bridge:** **`ctx.bareOsEmitPearDoctorHint`**, **`ctx.bareOsPearInspectProbe`**, **`ctx.bareOsEmitBareBootPhaseHint`**, **`ctx.bareOsBareRpcCapProbe`**, **`ctx.bareOsEmitPearStampPointer`**, **`ctx.bareOsRegisterBareLoggerTap`**, **`ctx.bareOsEmitAutobaseDiscoveryHint`**, **`ctx.bareOsEmitBlindPairingSketch`**, **`ctx.bareOsBareStreamBackpressureHint`**, **`ctx.bareOsPearTerminalCapsProbe`**; host env **`BARE_OS_PROBE_ID_PEAR_INSPECT_LOGGER_TLS`**, **`BARE_OS_BARE_RPC_PROBE_CLASS`**, **`BARE_OS_MTLS_PROXY_MAP_JSON`**, **`BARE_OS_THREAD_POOL_TELEMETRY_JSON`**, **`BARE_OS_HAPPY_EYEBALLS_V4_MODE`**, **`BARE_OS_BARE_BOOT_VERSION`**, **`BARE_OS_BARE_LOGGER_VERSION`**, **`BARE_OS_BARE_TLS_VERSION`**, **`BARE_OS_LIFECYCLE_SCHEMA_VERSION`** (injected); boot policy **v10** adds **`requireKernelCapabilitiesPearInspectLoggerTls`**, **`requireBareBootMin`**, **`denyBareRpcMethodPatterns`**, **`maxPearInspectDepth`**, **`requireBareLoggerMin`**, **`denyAutobaseDiscoveryChannels`**, **`requireBareTlsMin`**, **`extensionSignerPinsV3`**, **`offlineLkgRequirePearStamp`**, **`bootStagesRequireLifecycleMinSchema`** (legacy **`bootPhasesRequireLifecycleMinSchema`**), …
|
||||
|
||||
**Kernel program proc:** governance [developer-guide/kernel-program.md](../../developer-guide/kernel-program.md); roadmap tables [feature-roadmap.md](./feature-roadmap.md) (tranches A and B). **`BARE_OS_BOOT_SAFE_MODE`** (skip **`rc.d`**, **`kernel.ext.d`**, **`onboot`**); **`BARE_OS_BOOT_TRANSACTION_JOURNAL`** → **`/run/bare-os/boot-transaction.ndjson`** (lines include **`bootStage`**); **`BARE_OS_BOOT_CHECKPOINT`** → **`/run/bare-os/boot-checkpoint.json`** (schema **2**, **`bootStage`**); **`BARE_OS_BOOT_DRY_RUN`**, **`BARE_OS_BOOT_POLICY_PATH`**, **`policyFallbackPaths`**, rollback marker, bundle digest, ABI min; **`kernel.d`** **`# ConditionEnvironment=`** guards; **`kernel.ext.d`** **`requires`** / **`after`** / **`before`**; **`/proc/bare_os/kernel_program.json`** **schema 2** + **`operatorSketches`** (**`BARE_OS_KERNEL_PROGRAM_PROC_JSON`** override, legacy **`BARE_OS_GIANT_PHASE_PROGRAM_JSON`**); **`bareOsEmitKernelEvent`** / **`Subscribe`**, **`bareOsAcquireKeyHandle`**; **`/run/bare-os/services.json`**, **`loader-audit.ndjson`**; **`/bin/kernel-doctor`**, **`kernel-explain`**, **`kernel-boot-diff`**, **`kernel-preflight`**, **`kernel-triage`**, **`kernel-manifest-validate`**, **`kernel-fsck`**.
|
||||
**Kernel program proc:** governance [developer-guide/kernel-program.md](../../developer-guide/kernel-program.md); program tables [feature-roadmap.md](./feature-roadmap.md) (batches A and B). **`BARE_OS_BOOT_SAFE_MODE`** (skip **`rc.d`**, **`kernel.ext.d`**, **`onboot`**); **`BARE_OS_BOOT_TRANSACTION_JOURNAL`** → **`/run/bare-os/boot-transaction.ndjson`** (lines include **`bootStage`**); **`BARE_OS_BOOT_CHECKPOINT`** → **`/run/bare-os/boot-checkpoint.json`** (schema **2**, **`bootStage`**); **`BARE_OS_BOOT_DRY_RUN`**, **`BARE_OS_BOOT_POLICY_PATH`**, **`policyFallbackPaths`**, rollback marker, bundle digest, ABI min; **`kernel.d`** **`# ConditionEnvironment=`** guards; **`kernel.ext.d`** **`requires`** / **`after`** / **`before`**; **`/proc/bare_os/kernel_program.json`** **schema 2** + **`operatorSketches`** (**`BARE_OS_KERNEL_PROGRAM_PROC_JSON`** override, legacy **`BARE_OS_GIANT_PHASE_PROGRAM_JSON`**); **`bareOsEmitKernelEvent`** / **`Subscribe`**, **`bareOsAcquireKeyHandle`**; **`/run/bare-os/services.json`**, **`loader-audit.ndjson`**; **`/bin/kernel-doctor`**, **`kernel-explain`**, **`kernel-boot-diff`**, **`kernel-preflight`**, **`kernel-triage`**, **`kernel-manifest-validate`**, **`kernel-fsck`**.
|
||||
|
||||
**Word 11** (`bare-os-protocol` **0.8.x**, **`bits11`**): twenty new seed RPC short names (through **`mirror_drive_compaction_v6`**, **`compact_ping_v5`**, **`http_dht_proxy_routes_v3`**, …), boot policy **v11** (**`requireKernelCapabilitiesHypercorePackHrpcLifecycle`**, **`extensionSignerPinsV4`**, pack/addon semver floors, **`maxHrpcAllowlistDepth`**, **`offlineLkgRequireHypercorePackHrpcLifecycle`**, merged **`denySeedRpcMethods`**), **`/proc/bare_os/index.json`** schema **7** with 20 word-11 JSON aliases, NDJSON lifecycle **10** / OTel **8** / audit **8**, **`kernel-extensions.registry.schema.json`** branch **8**. Host env **`BARE_OS_PROBE_ID_HYPERCORE_PACK_HRPC_LIFECYCLE`**; optional **`BARE_OS_HIDE_PROC_HYPERCORE_PACK_HRPC_LIFECYCLE=0`** (or **`false`** / **`off`**) hides those word-11 proc nodes from **`readdir`**, path resolution, and the proc index (see **`vfs.js`**).
|
||||
|
||||
@@ -56,7 +56,7 @@ Seed RPC **`bare_os.capabilities`** includes **`protocolPackageVersion`**, optio
|
||||
- Exec budget — `BARE_OS_EXEC_LINE_BUDGET_MS` — Reject top-level `execLine` when session wall time exceeds budget
|
||||
- Delegates — `BARE_OS_DELEGATE_MAX_PER_MIN`, `BARE_OS_DELEGATE_CURL_MAX_PER_MIN`, … — Per-minute caps on host delegates (sliding minute window)
|
||||
- Delegates — `BARE_OS_DELEGATE_AUDIT_ONLY=1` — With `BARE_OS_AUDIT=1`, log delegate invocations and skip host run (exit 0)
|
||||
- Boot policy — `BARE_OS_BOOT_POLICY=1` — Merge `skipPhases` / `denyBootPhases` from `/etc/bare-os/boot.policy.json`; optional `minKernelCapabilitiesPrimary` / `requireSeedCaps`; v2 `maxExecLineDepth`, `denyEnvKeys`, `requireProcNodes`; **v3** `requireKernelCapabilitiesExtendedSeedingPlatform`, `requireKernelCapabilitiesRlimitsDelegatesShell`, `allowedPearIpcChannels` → session env, `denyVfsPrefixes` (VFS deny), `maxInitdRestartsPerUnit` → `BARE_OS_INITD_RESTART_MAX_DEFAULT`; **v4** `requireKernelCapabilitiesOfflineNetExtensions`, `denyExecLineBuiltins` → `BARE_OS_BOOT_POLICY_DENY_EXEC_LINE_BUILTINS`, `allowedCtxMethods` → `BARE_OS_BOOT_POLICY_ALLOWED_CTX_METHODS`; **v5** `requireKernelCapabilitiesHostTransportDelegates`, `requireInitJsSha256`; **v6** `requireKernelCapabilitiesReplicationOperatorSurface`, `requireBooterSemver`, `requireCtxApiMin`, `denyKernelExtensionIds`, `kernelExtensionHashPins`, `offlineLkgIntegrityStrict`; **v7–v8** (see schema); **v9** `requireKernelCapabilitiesBareModuleCryptoStaging`, `requirePearRuntimeRange`, `denyBareModuleSpecifierPatterns`, `requireBareCryptoMin`, `denyKernelSyscalls`, `requirePearIpcMin`, `extensionSignerPinsV2`, `offlineLkgManifestMaxAgeSec`, `bootPhasesRequireProcIndexMinSchema`, stricter extension depth / cycle diagnostics; **v10** `requireKernelCapabilitiesPearInspectLoggerTls`, `requireBareBootMin`, `denyBareRpcMethodPatterns`, `maxPearInspectDepth`, `requireBareLoggerMin`, `denyAutobaseDiscoveryChannels`, `requireBareTlsMin`, `extensionSignerPinsV3`, `offlineLkgRequirePearStamp`, `bootPhasesRequireLifecycleMinSchema`
|
||||
- Boot policy — `BARE_OS_BOOT_POLICY=1` — Merge `skipBootStages` / `denyBootStages` (legacy `skipPhases` / `denyBootPhases`) from `/etc/bare-os/boot.policy.json`; optional `minKernelCapabilitiesPrimary` / `requireSeedCaps`; v2 `maxExecLineDepth`, `denyEnvKeys`, `requireProcNodes`; **v3** `requireKernelCapabilitiesExtendedSeedingPlatform`, `requireKernelCapabilitiesRlimitsDelegatesShell`, `allowedPearIpcChannels` → session env, `denyVfsPrefixes` (VFS deny), `maxInitdRestartsPerUnit` → `BARE_OS_INITD_RESTART_MAX_DEFAULT`; **v4** `requireKernelCapabilitiesOfflineNetExtensions`, `denyExecLineBuiltins` → `BARE_OS_BOOT_POLICY_DENY_EXEC_LINE_BUILTINS`, `allowedCtxMethods` → `BARE_OS_BOOT_POLICY_ALLOWED_CTX_METHODS`; **v5** `requireKernelCapabilitiesHostTransportDelegates`, `requireInitJsSha256`; **v6** `requireKernelCapabilitiesReplicationOperatorSurface`, `requireBooterSemver`, `requireCtxApiMin`, `denyKernelExtensionIds`, `kernelExtensionHashPins`, `offlineLkgIntegrityStrict`; **v7–v8** (see schema); **v9** `requireKernelCapabilitiesBareModuleCryptoStaging`, `requirePearRuntimeRange`, `denyBareModuleSpecifierPatterns`, `requireBareCryptoMin`, `denyKernelSyscalls`, `requirePearIpcMin`, `extensionSignerPinsV2`, `offlineLkgManifestMaxAgeSec`, `bootStagesRequireProcIndexMinSchema` (legacy `bootPhasesRequireProcIndexMinSchema`), stricter extension depth / cycle diagnostics; **v10** `requireKernelCapabilitiesPearInspectLoggerTls`, `requireBareBootMin`, `denyBareRpcMethodPatterns`, `maxPearInspectDepth`, `requireBareLoggerMin`, `denyAutobaseDiscoveryChannels`, `requireBareTlsMin`, `extensionSignerPinsV3`, `offlineLkgRequirePearStamp`, `bootStagesRequireLifecycleMinSchema` (legacy `bootPhasesRequireLifecycleMinSchema`)
|
||||
- Boot policy strict — `BARE_OS_BOOT_POLICY_STRICT=1` — Abort boot when policy checks fail
|
||||
- Lazy personal drive — `BARE_OS_LAZY_PERSONAL_DRIVE=1` — Mount personal Hyperdrive at session setup instead of immediately after kernel fetch
|
||||
- System revision — `BARE_OS_SYSTEM_REVISION_ID`, `BARE_OS_SYSTEM_REVISION_PENDING`, `BARE_OS_SYSTEM_SLOT` — Exposed as `ctx.bareOsSystemRevision` (Pear OTA–style hints)
|
||||
@@ -76,21 +76,21 @@ Seed RPC **`bare_os.capabilities`** includes **`protocolPackageVersion`**, optio
|
||||
- Bundle tier — `BARE_OS_BUNDLE_TIER=core` — `bare-os-bare-libs` build: only manifest rows with matching `tier` (`all` = default); optional per-row `risk` in manifest
|
||||
- Word-11 proc — `BARE_OS_HIDE_PROC_HYPERCORE_PACK_HRPC_LIFECYCLE=0` (or `false` / `off`) — Hides the 20 word-11 **`/proc/bare_os_*.json`** entries, matching **`/proc/bare_os/*.json`** aliases, and their rows in **`/proc/bare_os/index.json`**; reads resolve as absent (**`null`** / ENOENT semantics)
|
||||
|
||||
## Wave 6 summary
|
||||
## Capability word 6 summary
|
||||
|
||||
Shipped as **`bits6`** + **`BARE_OS_KERNEL_FEATURES_STOCK_WORD_REPLICATION_OPERATOR_SURFACE`**. Full bit map: [kernel-capabilities-index.md](./kernel-capabilities-index.md) (Word 6). One-row checklist: [feature-roadmap.md](./feature-roadmap.md) (Wave 6 table). CI: **`verify-kernel-capabilities-word-6.mjs`**, **`verify-pear-no-static-node-import.mjs`**.
|
||||
Shipped as **`bits6`** + **`BARE_OS_KERNEL_FEATURES_STOCK_WORD_REPLICATION_OPERATOR_SURFACE`**. Full bit map: [kernel-capabilities-index.md](./kernel-capabilities-index.md) (Word 6). One-row checklist: [feature-roadmap.md](./feature-roadmap.md) (Capability word 6 table). CI: **`verify-kernel-capabilities-word-6.mjs`**, **`verify-pear-no-static-node-import.mjs`**.
|
||||
|
||||
## Wave 9 summary
|
||||
## Capability word 9 summary
|
||||
|
||||
Shipped as **`bits9`** + **`BARE_OS_KERNEL_FEATURES_STOCK_WORD_BARE_MODULE_CRYPTO_STAGING`**. Word 9 map: [kernel-capabilities-index.md](./kernel-capabilities-index.md). Checklist: [feature-roadmap.md](./feature-roadmap.md) (Wave 9 table). Node→Bare map: [node-to-bare-modules.md](../../developer-guide/node-to-bare-modules.md). CI: **`verify-kernel-capabilities-word-9.mjs`**, **`verify-kernel-capabilities-contract.mjs`**, **`verify-ctx-api-feature-bits.mjs`**, **`verify-ctx-dts.mjs`**, **`verify-compat-matrix.mjs`**.
|
||||
Shipped as **`bits9`** + **`BARE_OS_KERNEL_FEATURES_STOCK_WORD_BARE_MODULE_CRYPTO_STAGING`**. Word 9 map: [kernel-capabilities-index.md](./kernel-capabilities-index.md). Checklist: [feature-roadmap.md](./feature-roadmap.md) (Capability word 9 table). Node→Bare map: [node-to-bare-modules.md](../../developer-guide/node-to-bare-modules.md). CI: **`verify-kernel-capabilities-word-9.mjs`**, **`verify-kernel-capabilities-contract.mjs`**, **`verify-ctx-api-feature-bits.mjs`**, **`verify-ctx-dts.mjs`**, **`verify-compat-matrix.mjs`**.
|
||||
|
||||
## Wave 10 summary
|
||||
## Capability word 10 summary
|
||||
|
||||
Shipped as **`bits10`** + **`BARE_OS_KERNEL_FEATURES_STOCK_WORD_PEAR_INSPECT_LOGGER_TLS`**. Word 10 map: [kernel-capabilities-index.md](./kernel-capabilities-index.md). Checklist: [feature-roadmap.md](./feature-roadmap.md) (Wave 10 table). CI: **`verify-kernel-capabilities-word-10.mjs`** plus the capabilities-contract / ctx / compat scripts above.
|
||||
Shipped as **`bits10`** + **`BARE_OS_KERNEL_FEATURES_STOCK_WORD_PEAR_INSPECT_LOGGER_TLS`**. Word 10 map: [kernel-capabilities-index.md](./kernel-capabilities-index.md). Checklist: [feature-roadmap.md](./feature-roadmap.md) (Capability word 10 table). CI: **`verify-kernel-capabilities-word-10.mjs`** plus the capabilities-contract / ctx / compat scripts above.
|
||||
|
||||
## Wave 11 summary
|
||||
## Capability word 11 summary
|
||||
|
||||
Shipped as **`bits11`** + **`BARE_OS_KERNEL_FEATURES_STOCK_WORD_HYPERCORE_PACK_HRPC_LIFECYCLE`**. Word 11 map: [kernel-capabilities-index.md](./kernel-capabilities-index.md). Checklist: [feature-roadmap.md](./feature-roadmap.md) (Wave 11 table). Node→Bare map: [node-to-bare-modules.md](../../developer-guide/node-to-bare-modules.md). CI: **`verify-kernel-capabilities-word-11.mjs`** plus **`verify-kernel-capabilities-contract.mjs`**, **`verify-ctx-api-feature-bits.mjs`**, **`verify-ctx-dts.mjs`**, **`verify-compat-matrix.mjs`**.
|
||||
Shipped as **`bits11`** + **`BARE_OS_KERNEL_FEATURES_STOCK_WORD_HYPERCORE_PACK_HRPC_LIFECYCLE`**. Word 11 map: [kernel-capabilities-index.md](./kernel-capabilities-index.md). Checklist: [feature-roadmap.md](./feature-roadmap.md) (Capability word 11 table). Node→Bare map: [node-to-bare-modules.md](../../developer-guide/node-to-bare-modules.md). CI: **`verify-kernel-capabilities-word-11.mjs`** plus **`verify-kernel-capabilities-contract.mjs`**, **`verify-ctx-api-feature-bits.mjs`**, **`verify-ctx-dts.mjs`**, **`verify-compat-matrix.mjs`**.
|
||||
|
||||
## POSIX utility notes
|
||||
|
||||
|
||||
@@ -0,0 +1,10 @@
|
||||
# Observability contracts (NDJSON / OTel / audit)
|
||||
|
||||
Bare OS mirrors structured **boot** and **kernel** events to optional sinks:
|
||||
|
||||
- **Boot trace** — `BARE_OS_BOOT_TRACE` (`json` / `ndjson`) from the stock kernel (`kernel/init.js`), including canonical **`stage`** plus legacy **`phase`** fields on each line.
|
||||
- **Telemetry NDJSON** — `BARE_OS_TELEMETRY_NDJSON` (guest path); schema **`telemetry-ndjson-record.schema.json`** (`telemetrySchemaVersion` / `lifecycleSchemaVersion`).
|
||||
- **OTel-style JSONL** — `BARE_OS_TELEMETRY_OTEL_JSONL`; schema **`otel-bare-os-jsonl.schema.json`**.
|
||||
- **Audit stream** — host/session policy; see kernel extensions reference for env keys.
|
||||
|
||||
**Contract tests** in root `pretest`: `validate-example-schemas.mjs`, `verify-kernel-capabilities-contract.mjs`, `verify-compat-matrix.mjs`, and **`verify-banned-terminology.mjs`** (governance wording). When adding fields, bump schema versions and extend the example JSON under `kernel/etc/bare-os/`.
|
||||
@@ -0,0 +1,13 @@
|
||||
# VFS path classes (policy sketch)
|
||||
|
||||
Stock routing is implemented in `packages/bare-os-booter/lib/vfs.js` (`createVfs`). For **documentation and future policy hooks**, paths are classified with **`classifyBareOsVfsPathClass(path)`** (same module):
|
||||
|
||||
| Class | Typical prefixes | Notes |
|
||||
| --- | --- | --- |
|
||||
| `pseudo` | `/proc`, `/sys`, `/dev` | Synthetic trees; not Hyperdrive bytes |
|
||||
| `volatile` | `/run`, `/tmp` | Session / ephemeral; often personal-backed |
|
||||
| `mount` | `/mnt`, `/media`, `/mount` | Optional union / HDMS mounts |
|
||||
| `personal` | `/home/…`, `/root…` | Personal Hyperdrive view |
|
||||
| `system` | `/boot`, `/bin`, `/lib`, `/etc`, `/usr`, `/var`, default | System image Hyperdrive |
|
||||
|
||||
This is **advisory** today: enforcement remains in the VFS implementation and boot policy (`denyVfsPrefixes`, …).
|
||||
@@ -5,8 +5,26 @@
|
||||
"type": "object",
|
||||
"additionalProperties": true,
|
||||
"properties": {
|
||||
"skipPhases": { "type": "array", "items": { "type": "string" } },
|
||||
"denyBootPhases": { "type": "array", "items": { "type": "string" } },
|
||||
"skipBootStages": {
|
||||
"type": "array",
|
||||
"items": { "type": "string" },
|
||||
"description": "Boot stages to skip (canonical); merged with legacy skipPhases"
|
||||
},
|
||||
"denyBootStages": {
|
||||
"type": "array",
|
||||
"items": { "type": "string" },
|
||||
"description": "Boot stages denied like skip list (canonical); merged with legacy denyBootPhases"
|
||||
},
|
||||
"skipPhases": {
|
||||
"type": "array",
|
||||
"items": { "type": "string" },
|
||||
"description": "Deprecated alias of skipBootStages (still honored; prefer skipBootStages)"
|
||||
},
|
||||
"denyBootPhases": {
|
||||
"type": "array",
|
||||
"items": { "type": "string" },
|
||||
"description": "Deprecated alias of denyBootStages (still honored; prefer denyBootStages)"
|
||||
},
|
||||
"minKernelCapabilitiesPrimary": { "type": "integer", "minimum": 0 },
|
||||
"requireSeedCaps": { "type": "integer", "minimum": 0 },
|
||||
"requireKernelCapabilitiesExtendedSeedingPlatform": { "type": "integer", "minimum": 0 },
|
||||
@@ -21,7 +39,7 @@
|
||||
"requireKernelCapabilitiesHypercorePackHrpcLifecycle": {
|
||||
"type": "integer",
|
||||
"minimum": 0,
|
||||
"description": "Mask checked against ctx.bareOsAdvertisedKernelCapabilityWords.hypercorePackHrpcLifecycle (wave 11)"
|
||||
"description": "Mask checked against ctx.bareOsAdvertisedKernelCapabilityWords.hypercorePackHrpcLifecycle (capability word 11)"
|
||||
},
|
||||
"requireBareBootMin": {
|
||||
"type": "string",
|
||||
@@ -70,7 +88,7 @@
|
||||
"extensionSignerPinsV4": {
|
||||
"type": "object",
|
||||
"additionalProperties": { "type": "string" },
|
||||
"description": "Optional fourth extension signer pin map (wave 11); merged to BARE_OS_BOOT_POLICY_EXTENSION_SIGNER_PINS_V4_JSON"
|
||||
"description": "Optional fourth extension signer pin map (capability word 11); merged to BARE_OS_BOOT_POLICY_EXTENSION_SIGNER_PINS_V4_JSON"
|
||||
},
|
||||
"offlineLkgRequirePearStamp": {
|
||||
"type": "boolean",
|
||||
@@ -80,10 +98,15 @@
|
||||
"type": "boolean",
|
||||
"description": "When true, sets BARE_OS_OFFLINE_LKG_REQUIRE_HYPERCORE_PACK_HRPC_LIFECYCLE=1 for strict offline bits11 class hints"
|
||||
},
|
||||
"bootStagesRequireLifecycleMinSchema": {
|
||||
"type": "integer",
|
||||
"minimum": 0,
|
||||
"description": "When > 0, fail strict boot when BARE_OS_LIFECYCLE_SCHEMA_VERSION < this value; **0** disables. Canonical; merged with bootPhasesRequireLifecycleMinSchema (max wins)"
|
||||
},
|
||||
"bootPhasesRequireLifecycleMinSchema": {
|
||||
"type": "integer",
|
||||
"minimum": 0,
|
||||
"description": "When > 0, fail strict boot when BARE_OS_LIFECYCLE_SCHEMA_VERSION < this value; **0** disables the check"
|
||||
"description": "Deprecated alias of bootStagesRequireLifecycleMinSchema"
|
||||
},
|
||||
"requirePearRuntimeRange": {
|
||||
"type": "object",
|
||||
@@ -117,10 +140,15 @@
|
||||
"type": "integer",
|
||||
"minimum": 0
|
||||
},
|
||||
"bootStagesRequireProcIndexMinSchema": {
|
||||
"type": "integer",
|
||||
"minimum": 1,
|
||||
"description": "Fail strict boot when /proc/bare_os/index.json schema < this value (canonical; max with bootPhasesRequireProcIndexMinSchema)"
|
||||
},
|
||||
"bootPhasesRequireProcIndexMinSchema": {
|
||||
"type": "integer",
|
||||
"minimum": 1,
|
||||
"description": "Fail strict boot when /proc/bare_os/index.json schema < this value"
|
||||
"description": "Deprecated alias of bootStagesRequireProcIndexMinSchema"
|
||||
},
|
||||
"requireBareRuntimeMin": {
|
||||
"type": "string",
|
||||
@@ -207,7 +235,7 @@
|
||||
"policyFallbackPaths": {
|
||||
"type": "array",
|
||||
"items": { "type": "string" },
|
||||
"description": "Additional /etc/bare-os/*.json files whose skipPhases/denyBootPhases merge after the primary policy"
|
||||
"description": "Additional /etc/bare-os/*.json files whose skipBootStages/denyBootStages (and legacy skipPhases/denyBootPhases) merge after the primary policy"
|
||||
},
|
||||
"requireBootBundleSha256Hex": {
|
||||
"type": "string",
|
||||
|
||||
@@ -76,7 +76,7 @@
|
||||
"extensionSignerPinsV4Note": {
|
||||
"type": "string",
|
||||
"maxLength": 256,
|
||||
"description": "Optional operator note correlating boot.policy extensionSignerPinsV4 (wave 11)"
|
||||
"description": "Optional operator note correlating boot.policy extensionSignerPinsV4 (word 11)"
|
||||
},
|
||||
"entries": {
|
||||
"type": "array",
|
||||
@@ -97,6 +97,20 @@
|
||||
"type": "string",
|
||||
"maxLength": 256
|
||||
},
|
||||
"trustPolicy": {
|
||||
"type": "string",
|
||||
"enum": ["default", "pinned", "quorum-sketch"],
|
||||
"description": "Optional operator trust class for extension resolution (schema 8)"
|
||||
},
|
||||
"abiRange": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"min": { "type": "string", "maxLength": 32 },
|
||||
"max": { "type": "string", "maxLength": 32 }
|
||||
},
|
||||
"description": "Optional ctx / bundle ABI semver window for this entry"
|
||||
},
|
||||
"atMs": { "type": "integer", "minimum": 0 }
|
||||
}
|
||||
}
|
||||
|
||||
@@ -21,12 +21,12 @@
|
||||
"sessionForkGeneration": {
|
||||
"type": "integer",
|
||||
"minimum": 0,
|
||||
"description": "Optional fork generation counter for nested sessions (wave 8)"
|
||||
"description": "Optional fork generation counter for nested sessions (word 8)"
|
||||
},
|
||||
"hypercorePackHrpcLifecycleProbeId": {
|
||||
"type": "string",
|
||||
"maxLength": 128,
|
||||
"description": "Optional operator probe id when BARE_OS_PROBE_ID_HYPERCORE_PACK_HRPC_LIFECYCLE is set (wave 11)"
|
||||
"description": "Optional operator probe id when BARE_OS_PROBE_ID_HYPERCORE_PACK_HRPC_LIFECYCLE is set (word 11)"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user