snxraven/bare-operating-system
1
1
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

feat(booter): harden guest vs user isolation and POSIX/P2P parity

Browse Source 
- Guest-safe legacy personal-root migration with state file and env gates
- VFS guest deny for sensitive /.bare paths; warm-cache clear on identity switch
- Optional acct/<hash>/ personal layout, guest scrub, vault exclude alignment
- Shell session reset + errexit; fish history reload hook; replication metric
- Audit NDJSON for migration/scrub; structured booter logging paths
- Bump POSIX profile; getconf keys; syscall/socket contract + handbook/docs pass
- Booter tests (Bare vs Node split for identity-session); release-checklist audit hook
This commit is contained in:
Raven Scott
2026-04-05 03:16:33 -04:00
parent 6a4790591d
commit 4af98ef97b
45 changed files with 1139 additions and 450 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/deployment/OTA_AND_BUNDLES.md
+2 -1
View File
@@ -19,7 +19,8 @@ Bare OS aligns with the **Holepunch** toolchain for shipping JavaScript as **Bar
- **System image**: `kernel/` is staged to the **system Hyperdrive** by **`bare-os-seeder`**; the booter never falls back to a git checkout for production boot.
- **Ctx / API semver**: bump **`BARE_OS_CTX_API_VERSION`** when guest-visible `ctx` behavior changes; record it in [compatibility-matrix.md](../reference/compatibility-matrix.md).
- **Offline / LKG**: document **`BARE_OS_OFFLINE_LKG_BOOT`** and related env in [environment appendix](../reference/environment-and-posix-appendix.md).
- **Warm cache + proc**: **`bareOsVfsBatchWrite`** clears **`/bin`** / **`/lib/bare`** warm read caches and increments **`vfs.warm_read_cache_invalidate_batch`**; the same path clears the **cached** **`/proc/bare_os/syscalls.json`** text so replication swaps cannot serve stale syscall metadata. **`ctx.bareOsCorestoreSnapshotHint()`** increments **`operator.corestore_snapshot_hint`** for operator dashboards.
- **Warm cache + proc**: **`bareOsVfsBatchWrite`** clears **`/bin`** / **`/lib/bare`** warm read caches and increments **`vfs.warm_read_cache_invalidate_batch`**; the same path clears the **cached** **`/proc/bare_os/syscalls.json`** text so replication swaps cannot serve stale syscall metadata. With **`BARE_OS_VFS_WARM_CACHE_INVALIDATE_ON_REPLICATION`**, core-length growth triggers **`ctx.bareOsInvalidateWarmReadCaches('replication:core-length')`** and increments **`vfs.replication_warm_full_invalidate`** in **`kernelCounters`**. **`ctx.bareOsCorestoreSnapshotHint()`** increments **`operator.corestore_snapshot_hint`** for operator dashboards.
- **Local Holepunch clones**: after patching **`bare-*`** sources from a local **`holepunchto_repos`** checkout, rebuild with **`npm run build -w bare-os-bare-libs`**, mirror **`kernel/`** → **`packages/bare-os-seeder/kernel/`**, refresh **`docs/audit/bundle-health.json`**, and re-run **`npm test`** (see **[`kernel/lib/bare/README.md`](../../kernel/lib/bare/README.md)**).
- **Extension signer pins**: when **`BARE_OS_BOOT_POLICY=1`**, the stock kernel copies **`extensionSignerPinsV2`**…**`V5`** from **`boot.policy`** into **`ctx.env`** as **`BARE_OS_BOOT_POLICY_EXTENSION_SIGNER_PINS_V2_JSON`** … **`_V5_JSON`** (stringified objects). Treat pin churn like ABI bumps — run **`npm run pretest`** (**`verify-boot-policy-extension-signer-pins.mjs`**, extension manifest schema, capability verifiers) after edits.
## Reproducibility checklist