-`BARE_OS_BOOT_TRACE` — Stock kernel (`init.js`) — If `1` or `true`, log each boot phase duration on stderr as `[boot] phase: Nms`; if `json`, log `{"phase":"…","ms":n}` per phase; **`ndjson`** adds **`sessionId`** / **`ts`** (same shape as `ctx.bareOsEmitBootEvent`)
-`BARE_OS_BOOT_TRACE` — Stock kernel (bundled **`/boot/init.js`** from [`kernel/lib/init/init-main.js`](../../kernel/lib/init/init-main.js) via [`scripts/bundle-kernel-init.mjs`](../../scripts/bundle-kernel-init.mjs)) — If `1` or `true`, log each boot phase duration on stderr as `[boot] phase: Nms`; if `json`, log `{"phase":"…","ms":n}` per phase; **`ndjson`** adds **`sessionId`** / **`ts`** (same shape as `ctx.bareOsEmitBootEvent`)
-`BARE_OS_BOOT_TRANSACTION_JOURNAL` — Stock kernel — **`1`**, **`true`**, or **`ndjson`** appends phase records to **`/run/bare-os/boot-transaction.ndjson`** when **`ctx.vfs`** supports it.
-`BARE_OS_BOOT_CHECKPOINT` — Stock kernel — **`1`** / **`true`** writes **`/run/bare-os/boot-checkpoint.json`** after each completed boot phase.
@@ -41,7 +41,7 @@ The list below is one **bullet per variable** in the form **name — component
-`MANWIDTH` — `/bin/man` — Wrap width for manual text (default `72`; minimum `40`)
-`NO_COLOR` — `/bin/man` — If set, disable ANSI bold for section headings on a TTY
-`BARE_OS_VFS_UNION_PREFIXES` — Booter / VFS — Comma-separated logical path prefixes where **`readFile`** may union system + overlay sources.
-`BARE_OS_VFS_UNION_WRITE_DENY` — Booter / VFS — When **`1`** / **`true`**, block **`writeFile`** / **`unlink`** on paths under union read prefixes (read-only union overlay).
@@ -59,12 +59,20 @@ The list below is one **bullet per variable** in the form **name — component
-`BARE_OS_DELEGATE_ALLOW` — Host delegates — Comma list **`git`**, **`curl`**, **`wget`**, **`systemctl`** — empty = all allowed.
-`BARE_OS_DNS_ALLOWLIST` — curl / wget — Optional host allowlist for http(s) URLs (`*.example.com` suffix form supported).
-`BARE_OS_KERNEL_HOT_RELOAD` — Booter — Dev: allow **`ctx.bareOsRequestKernelReload()`** to re-read **`/boot/init.js`**.
-`BARE_OS_KERNEL_EXT_D_HOT_RELOAD` — Stock kernel — When **`1`** / **`true`**, after boot the kernel exposes **`ctx.bareOsReloadKernelExtDropinsSafe()`**, which re-scans **`/etc/bare-os/kernel.ext.d`** and runs only extension scripts not yet recorded (**append-only**; does not unload). When **`ctx.vfs.writeFile`** exists, each reload appends **`kernelExtReloadSchemaVersion`** lines to **`/run/bare-os/kernel-ext-reload.ndjson`**.
-`BARE_OS_VFS_HYPERBLOBS_DEDUP` — Booter / features proc — When **`1`** / **`true`**, surfaces an operator hint under **`/proc/bare_os/features`** that host mirror / hyperblob pipelines may use content-defined chunking; the guest VFS does not enable hyperblobs by itself.
-`BARE_OS_XARGS_MAX_PROCS` — **`/bin/xargs`** — Raises the cap for **`-P`** parallelism (still bounded by a hard maximum of **32** and by delegate concurrency when **`runBinCommand`** uses workers); default effective cap **8** when unset.
-`BARE_OS_PEER_FIREWALL_E2E_JSON` — Booter / replication proc — Optional operator JSON merged into **`/proc/bare_os/replication`** for peer-firewall end-to-end checks (**invalid JSON yields an error object** in proc).
-`BARE_OS_PEAR_SECURE_ENCLAVE_JSON` — Booter / security posture — Non-secret JSON pointer for optional Pear secure-enclave key storage hints; treat as opaque unless host policy attests hardware backing (see [vault threat model](vault-threat-model.md)).
-`BARE_OS_ACCOUNT_KEY_ROTATION_STATE_JSON` — Booter / security posture — Non-secret JSON for signing continuity across overlapping trust windows during account key rotation (not private keys).
-`BARE_OS_TIMER_EVERY_MS_MONOTONIC` — bare-cron / timers — When **`1`** / **`true`**, **`EveryMs=`** timer units may use monotonic scheduling where supported.
-`BARE_OS_TRACE_ID` — Booter / telemetry — Optional correlation id mirrored into telemetry NDJSON lines when set.
-`BARE_OS_IPC_NAMESPACE` — VFS / mkfifo / initd — Prefix simulated FIFO keys as **`<ns>__<name>`** while logical paths stay **`/run/bare-os/ipc/<name>`**.
-`BARE_OS_SANDBOX_SCRIPT` — `ctx.bareOsSandboxRunScript` — Set **`0`** / **`false`** to disable sandbox script helper.
-`BARE_OS_SANDBOX_WORKER` — Booter — When **`1`**, defers **`bareOsSandboxRunScript`** on a **fresh microtask** (async boundary); **not** a separate thread or isolate.
-`BARE_OS_INITD_MAX_PARALLEL` — bare-initd — Max concurrent unit **starts** per DAG level (integer ≥ **1**; default **1**).
-`BARE_OS_INITD_JOURNAL_MAX_LINES` — bare-initd / unit journals — Cap lines retained per unit NDJSON journal under **`/run/bare-os/unit-journal/`**.
-`BARE_OS_TELEMETRY_NDJSON` — Booter — Absolute or **`~/…`** path in the **guest VFS**: append capped NDJSON telemetry records (**`telemetrySchemaVersion` / `lifecycleSchemaVersion`**:**5**(stock Capability word 6+),**`ts`**, …) mirroring structured boot/kernel events.
-`BARE_OS_TELEMETRY_NDJSON` — Booter — Absolute or **`~/…`** path in the **guest VFS**: append capped NDJSON telemetry records (**`telemetrySchemaVersion` / `lifecycleSchemaVersion`** follow stock **`BARE_OS_LIFECYCLE_SCHEMA_VERSION`**, currently**10**in the tree;**`ts`**, …) mirroring structured boot/kernel events.
-`BARE_OS_PROC_POLL_MS` — VFS — Coalescing interval for **`/proc/bare_os/metrics_live.json`** and poll cadence for related pseudo metrics reads (250–60000).
-`BARE_OS_SHELL_PARAM_EXPANSION` — Shell — When **`1`**, enable **`${VAR:-word}`** and **`${VAR#prefix}`** in **`expandWord`**.
@@ -76,7 +84,8 @@ The list below is one **bullet per variable** in the form **name — component
-`BARE_OS_SHELL_LOCAL_DECLARE` — Shell — When **`1`**, **`local`** and read-only **`declare -r`** apply per shell line (shallow **`vfs.env`** copy).
-`BARE_OS_AUTOPASS_INVITE_URL` — `/proc/bare_os/hdms_hints.json` — Optional operator invite URL hint (guest does not fetch it).
-`BARE_OS_BIN_WORKER_OFFLOAD` — **`runBinCommand`** (Bare) — When **`1`** on **Bare** (not Node), may run **`awk`** / **`sed`** / **`jq`** in a **`bare-worker`** thread; falls back in-process on failure. With **`BARE_OS_BIN_WORKER_ALLOW`** (comma list) for future expansion.
-`BARE_OS_BIN_WORKER_OFFLOAD` — **`runBinCommand`** (Bare) — When **`1`** on **Bare** (not Node), may run **`awk`** / **`sed`** / **`jq`** in a **`bare-worker`** thread; falls back in-process on failure. With **`BARE_OS_BIN_WORKER_ALLOW`** (comma list) for future expansion (**`textproc:*`**, **`mathproc:*`**, **`mediaproc:*`**, **`sysproc:*`**, **`metaproc:*`**, … — see [kernel-extensions.md](kernel-extensions.md)).
-`BARE_OS_BIN_WORKER_CPU_MS_MAX` — Booter — Optional per-invocation CPU-time budget hint (ms) for **`bare-worker`** **`/bin`** offload; surfaced in operator metrics / worker budget snapshots.
-`BARE_OS_EXEC_LINE_BUDGET_MS` — Booter — Reject top-level **`execLine`** when cumulative wall time exceeds budget.
-`BARE_OS_DELEGATE_MAX_PER_MIN` — Host delegates — Global per-minute cap (sliding window) on delegate invocations.
- **Ownership** — Display and permission checks use **`UID`/`GID`** and mode bits; **`chown`/`chgrp`** update **`metadata.bareOs`** on the **personal** writable tree (not a multi-user host kernel).
- **Utilities** — Tier-1 JS **`/bin`** (**~113** commands; see [§12.10](package-bare-os-coreutils-and-ci.md#1210-package-bare-os-coreutils)): text tools include **`paste`**, **`split`**, **`tac`**, **`rev`**, **`expand`**, **`unexpand`**, **`fold`**, **`fmt`**, **`comm`**, **`cmp`**, **`join`**, **`pr`**, **`yes`** (line-capped via **`BARE_OS_YES_MAX_LINES`** / **`getconf`**), **`shuf`** (capped via **`BARE_OS_SHUF_MAX_LINES`**), **`tsort`**, **`factor`**, **`expr`** (integer-focused subset), **`numfmt`** (**`--to=iec`** / **`--to=si`**). Checksums: **`md5sum`** (bundled MD5), **`sha1sum`**, **`sha256sum`**, **`sha512sum`** (Web Crypto where available), **`sum`**, **`base32`**, **`basenc`** (**`--base16`**). Files: **`truncate`**, **`unlink`**, **`install`**, **`df`** (synthetic Hyperdrive row; **`-h`** human sizes), **`sync`** (no-op), **`timeout`** (wall-clock cap; exit **124** on timeout when **`BARE_OS_FEATURE_ABORT_TIMEOUT`** is advertised). Session stubs: **`arch`**, **`groups`**, **`hostid`**, **`nproc`**, **`uptime`**, **`users`**, **`who`**. Plus earlier parity: **`man`**, **`sed`** (including **`-z`**, **`BARE_OS_SED_NULL_MAX_RECORDS`**), **`awk`**, **`grep`** (**`-r`** with **`--include`/`--exclude`/`--exclude-dir`**, **`BARE_OS_GREP_FILTER_MAX`**), **`cp`** (**`-u`/`-v`/`-p`**), **`mv`**, **`find`** (**`-regex`**, **`-exec`/`-ok`**, **`BARE_OS_FIND_EXEC_MAX`**), **`mktemp`**, **`git-pear`**, **`cksum`**, **`getconf`** (includes pipeline / cap names + **`-a`**), **`xargs`**, **`dircolors`**, **`theme`**, **`ls`**, **`uniq`**, **`realpath`**, **`base64`**, **`rm`** **`-d`**, **`stat`** **`%F`**. **`dir`** / **`vdir`** call **`ls`**. Large **`sed`/`awk`** are not byte-identical to GNU on all inputs. **`mkfifo`** → **`/run/bare-os/ipc/`**. Online help: **`/share/man/man.json`** and **`man`**.
- **Utilities** — Tier-1 JS **`/bin`** (**~113** commands; see [§12.10](package-bare-os-coreutils-and-ci.md#1210-package-bare-os-coreutils)): text tools include **`paste`**, **`split`**, **`tac`**, **`rev`**, **`expand`**, **`unexpand`**, **`fold`**, **`fmt`**, **`comm`**, **`cmp`**, **`join`**, **`pr`**, **`yes`** (line-capped via **`BARE_OS_YES_MAX_LINES`** / **`getconf`**), **`shuf`** (capped via **`BARE_OS_SHUF_MAX_LINES`**), **`tsort`**, **`factor`**, **`expr`** (integer-focused subset), **`numfmt`** (**`--to=iec`** / **`--to=si`**). Checksums: **`md5sum`** (bundled MD5), **`sha1sum`**, **`sha256sum`**, **`sha512sum`** (Web Crypto where available), **`sum`**, **`base32`**, **`basenc`** (**`--base16`**). Files: **`truncate`**, **`unlink`**, **`install`**, **`df`** (synthetic Hyperdrive row; **`-h`** human sizes), **`sync`** (no-op), **`timeout`** (wall-clock cap; exit **124** on timeout when **`BARE_OS_FEATURE_ABORT_TIMEOUT`** is advertised). Session stubs: **`arch`**, **`groups`**, **`hostid`**, **`nproc`**, **`uptime`**, **`users`**, **`who`**. Plus earlier parity: **`man`**, **`sed`** (including **`-z`**, **`BARE_OS_SED_NULL_MAX_RECORDS`**), **`awk`**, **`grep`** (**`-r`** with **`--include`/`--exclude`/`--exclude-dir`**, **`BARE_OS_GREP_FILTER_MAX`**), **`cp`** (**`-u`/`-v`/`-p`**), **`mv`**, **`find`** (**`-regex`**, **`-exec`/`-ok`**, **`BARE_OS_FIND_EXEC_MAX`**), **`mktemp`**, **`git-pear`**, **`cksum`**, **`getconf`** (static name table plus live **`vfs.env`** overrides for caps; **`-a`**), **`xargs`** (**`-P`** cap raised via **`BARE_OS_XARGS_MAX_PROCS`**, hard max **32**), **`getfacl`** / **`setfacl`** (POSIX-style ACL **view/edit** against synthetic **`/.bare_acl.json`** sidecars; see handbook ch.9), **`dircolors`**, **`theme`**, **`ls`**, **`uniq`**, **`realpath`**, **`base64`**, **`rm`** **`-d`**, **`stat`** **`%F`**. **`dir`** / **`vdir`** call **`ls`**. Large **`sed`/`awk`** are not byte-identical to GNU on all inputs. **`mkfifo`** → **`/run/bare-os/ipc/`**; optional logical process groups via **`ctx.bareOsIpc.assignProcessGroup`** / **`signalProcessGroup`** (POSIX **`setpgid`** / **`killpg`** analog for IPC routing). Machine-readable per-command POSIX hints: stock **`/etc/bare-os/posix_utilities.json`** (path echoed in **`/proc/bare_os_features`** and **`metrics_live`**). Online help: **`/share/man/man.json`** and **`man`**.
- **Process tooling note** — **`ps`** and **`kill`** operate on Bare OS synthetic process rows (`pid` 1..3 for kernel/booter/shell); they do not target host OS processes.
- **Additional utility coverage** — **`dd`** (block-copy subset) and **`logger`** (structured append to **`/var/log/messages`**) are available as Tier-1 commands.
- **Mount tooling note** — **`mount`** / **`umount`** are Hyperdrive/HDMS-backed commands for `/mnt/<label>` and are not host-kernel mount syscalls.
Second batch of the same governed program. Traceability: [developer-guide/kernel-program.md](../../developer-guide/kernel-program.md), **`/proc/bare_os/kernel_program.json`** schema **2**, `bareOsCtxApiVersion`**1.25.0**.
Second batch of the same governed program. Traceability: [developer-guide/kernel-program.md](../../developer-guide/kernel-program.md), **`/proc/bare_os/kernel_program.json`** schema **2**, `bareOsCtxApiVersion`**1.30.0**.
| # | Item | Status |
| ---: | --- | --- |
@@ -770,7 +770,7 @@ Second batch of the same governed program. Traceability: [developer-guide/kernel
- Kernel **`.ext.d` incremental reload** — `BARE_OS_KERNEL_EXT_D_HOT_RELOAD=1` — After boot, `ctx.bareOsReloadKernelExtDropinsSafe()` scans `/etc/bare-os/kernel.ext.d` and runs only **new** extension scripts (append-only; no unload); optional **`/run/bare-os/kernel-ext-reload.ndjson`**
- Hyperblobs dedup hint — `BARE_OS_VFS_HYPERBLOBS_DEDUP=1` — Surfaces under `/proc/bare_os/features` for operator pipelines (guest VFS does not auto-enable chunking)
- Kernel profile warm — `BARE_OS_KERNEL_PROFILE_WARM=1` — Dev: `ctx.bareOsRequestKernelProfileReload()` re-reads `/boot/init.js` (same loop as hot reload)
@@ -9,6 +9,7 @@ These files are **read from disk by the seeder** and written into the system dri
### 9.1 [kernel/init.js](../../kernel/init.js)
- **Staged as**: `/boot/init.js`
- **Source of truth**: Hand-authored logic lives in [`kernel/lib/init/init-main.js`](../../kernel/lib/init/init-main.js) (plus [`kernel/lib/boot/`](../../kernel/lib/boot/)); the staged file is produced by [`scripts/bundle-kernel-init.mjs`](../../scripts/bundle-kernel-init.mjs). Keep [`packages/bare-os-seeder/kernel/`](../../packages/bare-os-seeder/kernel/) in byte parity after changes.
- **Contract**: Must define a top-level `async function start(ctx)` (see [kernel-runner.js](../../packages/bare-os-booter/lib/kernel-runner.js)).
- **Behavior** (see [handbook/06-kernel-and-binaries.md](../../handbook/06-kernel-and-binaries.md)):
- Prints `/etc/os-release`, optional `/etc/motd`, optional profile `rc`, `/etc/bare-os/rc`, sorted digit-prefixed `/etc/bare-os/rc.d/*`, optional `/etc/bare-os/rc.local`, then banner / issue.
`/proc/bare_os/security_posture.json` (**schema 3**) aggregates non-secret snapshots: account profile, active handle counts, audit chain head/length, vault rotation checkpoint path, and policy flags. Host env may supply **`BARE_OS_PEAR_SECURE_ENCLAVE_JSON`** (opaque Pear enclave pointer) and **`BARE_OS_ACCOUNT_KEY_ROTATION_STATE_JSON`** (rotation continuity metadata — not secret keys); both are merged only when non-empty.
**Threat model and encryption posture:** [vault-threat-model.md](vault-threat-model.md) (encryption at rest, AEAD, operator assumptions).
**Documentation parity:** When changing any of the above APIs or proc schemas, update `handbook/04-the-booter-runtime.md`, `packages/bare-os-booter/lib/bare-os-ctx.d.ts`, `lib/bare-os-ctx-api.js`, and this file.
Bare OS mirrors structured **boot** and **kernel** events to optional sinks:
- **Boot trace** — `BARE_OS_BOOT_TRACE` (`json` / `ndjson`) from the stock kernel (`kernel/init.js`), including canonical **`stage`** plus legacy **`phase`** fields on each line.
- **Boot trace** — `BARE_OS_BOOT_TRACE` (`json` / `ndjson`) from the stock bundled kernel ([`kernel/lib/init/init-main.js`](../../kernel/lib/init/init-main.js) → `/boot/init.js`), including canonical **`stage`** plus legacy **`phase`** fields on each line.
- **Kernel extension reload audit** — When `BARE_OS_KERNEL_EXT_D_HOT_RELOAD` is enabled and `ctx.bareOsReloadKernelExtDropinsSafe()` runs, append-only lines (**`kernelExtReloadSchemaVersion`**) may be written to **`/run/bare-os/kernel-ext-reload.ndjson`** (guest VFS), alongside existing **`loader-audit.ndjson`** when `BARE_OS_LOADER_AUDIT` is on.
@@ -7,6 +7,7 @@ Former **DOCUMENTATION.md** §§12.10–12.12. [Reference index →](README.md)
- **[packages/bare-os-coreutils/lib/commands.mjs](../../packages/bare-os-coreutils/lib/commands.mjs)** — **`COREUTILS_COMMANDS`**: authoritative sorted `/bin` names for **`build.mjs`** and the manual database builder (keeps the image and **`man`** coverage in sync).
- **[packages/bare-os-coreutils/build.mjs](../../packages/bare-os-coreutils/build.mjs)** — `export async function build()`: runs **`scripts/build-man-db.mjs`** (validates **`man/pages/*.json`**, writes **`kernel/share/man/man.json`** and the same path under **`packages/bare-os-seeder/kernel/share/man/`**); then for each command concatenates `lib/runtime.js`, optional **`preamble`** libs (**`md5sum`** → **`lib/md5.js`**, **`sed`** → **`lib/sed-engine.js`**, **`awk`** → **`lib/awk-engine.js`**, **`jq`** → **`lib/jq-engine.js`**, **`man`** → **`lib/man-render.js`**, **`ls`** / **`dircolors`** → lscolors helpers, **`edit`** / **`nano`** → **`lib/edit-*.js`** + shared TUI), then **`src/<name>.js`** (**`nano`** reuses **`src/edit.js`**); writes to **`kernel/bin/<name>`** and **`packages/bare-os-seeder/kernel/bin/<name>`**. CLI: **`node build.mjs`** when executed as main.
- **Manual pages** — Authoring: **`packages/bare-os-coreutils/man/pages/<name>.json`**; schema: **`man/schema.json`**. Optional **`examples`** (cheat.sh-style) and **`descriptionMode`**: **`preserve`** for preformatted text. **`scripts/ingest-handbook-for-man.mjs`** merges every **`handbook/*.md`** as **`man(7)`** at build time (**`man handbook`**, **`man handbook-01-introduction`**, …). Regenerate JSON stubs with **`node packages/bare-os-coreutils/scripts/seed-man-pages.mjs`**. Runtime: **`/bin/man`** reads **`/share/man/man.json`**. **Handbook:** [handbook/10-manpages-and-online-help.md](../../handbook/10-manpages-and-online-help.md).
- **POSIX utility index (optional image file)** — **`kernel/etc/bare-os/posix_utilities.json`** carries machine-readable per-command notes when staged; the booter echoes **`utilitiesIndexPath`** in **`/proc/bare_os_features`** and coalesced **`metrics_live`** (see handbook ch.9).
- **Commands** (sources under **`src/`**, same order as **`COREUTILS_COMMANDS`** in [`commands.mjs`](../../packages/bare-os-coreutils/lib/commands.mjs)): `arch`, `awk`, `base32`, `base64`, `basename`, `basenc`, `cat`, `chgrp`, `chmod`, `chown`, `cksum`, `clear`, `cmp`, `comm`, `cp`, `crontab`, `cut`, `date`, `df`, `dir`, `dirname`, `dircolors`, `du`, `edit`, `echo`, `env`, `exit`, `expand`, `expr`, `factor`, `false`, `find`, `fmt`, `fold`, `getconf`, `git-pear`, `grep`, `groups`, `head`, `hdms`, `help`, `hostid`, `hostname`, `id`, `install`, `join`, `jq`, `ln`, `login`, `logout`, `logname`, `ls`, `man`, `md5sum`, `mkdir`, `mkfifo`, `mktemp`, `mv`, `nano`, `nl`, `nproc`, `numfmt`, `od`, `paste`, `pathchk`, `pr`, `printenv`, `printf`, `pwd`, `readlink`, `realpath`, `rev`, `rm`, `rmdir`, `savevault`, `sed`, `seq`, `sha1sum`, `sha256sum`, `sha512sum`, `shuf`, `sleep`, `sort`, `split`, `stat`, `sum`, `sync`, `tac`, `tail`, `tee`, `test`, `theme`, `time`, `touch`, `tr`, `truncate`, `true`, `tsort`, `tty`, `uname`, `uniq`, `unlink`, `unexpand`, `uptime`, `users`, `vdir`, `wc`, `which`, `who`, `whoami`, `xargs`, `yes` (**112** built names). The interactive TTY editor is **`edit`**; **`nano`** is the same built script under **`/bin/nano`**, and the default shell maps **`nano` → `edit`** (see **`defaultShellAliases`** in [`shell.js`](../../packages/bare-os-booter/lib/shell.js)). Each built script begins with **`BARE_OS_BIN_API`** in the concatenated prelude; root **`pretest`** runs **[`scripts/verify-kernel-seeder-parity.mjs`](../../scripts/verify-kernel-seeder-parity.mjs)** to keep **`kernel/bin/*`** and **`packages/bare-os-seeder/kernel/bin/*`** in sync and to require that pragma on every staged binary. Scripts are plain **`async function run(ctx, argv)`** using **`ctx.vfs`**, **`ctx.drive`**, **`ctx.b4a`**, **`ctx.console`**, optional **`bareStdin(ctx)`**, optional **`ctx.runBinCommand`** — no ESM **`import`** in **`src/`** (Bare-safe **`AsyncFunction`** load). **`dir`** / **`vdir`** delegate to **`ls -C`** / **`ls -l`**. **Booter-delegated** (stubs under **`kernel/bin/`**, logic in **`packages/bare-os-booter/lib/`**): **`systemctl`**, **`journalctl`** (bare-initd control; **`bare-initctl`** alias; see [handbook/04-the-booter-runtime.md](../../handbook/04-the-booter-runtime.md)). **Narrative reference:** [handbook/09-posix-utilities-shell-and-vfs.md](../../handbook/09-posix-utilities-shell-and-vfs.md).
### 12.11 [packages/bare-os-booter/test.js](../../packages/bare-os-booter/test.js) and [test.identity.js](../../packages/bare-os-booter/test.identity.js)
@@ -18,3 +18,5 @@ Stock routing is implemented in `packages/bare-os-booter/lib/vfs.js` (`createVfs
**Batch / diff helpers:** `bareOsVfsBatchPut(drive, puts)` and `bareOsHyperdriveDiffCollect(drive, a, b, opts)` in the same module (used from **`ctx.bareOsVfsBatchWrite`** / **`ctx.bareOsHyperdriveDiffCollect`** in the booter).
Rule evaluation is **advisory** unless a caller enforces **`verdict`**; stock VFS routing still uses `createVfs` internals and boot policy (`denyVfsPrefixes`, …).
**ACL / xattr sidecars (utilities, not a separate path class):** advisory ACL and extended-attribute views may use synthetic JSON files such as **`/.bare_acl.json`** and **`/.bare_xattr.json`** next to the affected directory (see [handbook ch.9](../../handbook/09-posix-utilities-shell-and-vfs.md) and [`kernel/etc/bare-os/vfs-sidecar-xattr-acl.example.json`](../../kernel/etc/bare-os/vfs-sidecar-xattr-acl.example.json)).
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Raven Scott