feat: POSIX/P2P roadmap — multisig shape, socket bridge, bin index, docs

- Unify pear.multisig.json validation via bare-os-protocol + kernel boot fragment - Socket bridge: SCM_RIGHTS path, ancillary handling, TCP half-close/shutdown how, connect tcpRecvQueue + poll/recv EOF and EPIPE-shaped errors - Bin manifest / Hyperbee hints schema 2 + namesDigest; batch-write invalidation - Host booter structured logging; BOOT_PERF_DETAIL bare_stdlib_merge_ns timing - Wasm kernel optional syscall imports; security_posture rotation hints schema 2 - Shell errexit inside compound bodies; expand getconf/_SC_* and bareOsGetconfSysconf - Subprocess bridge snapshot timeoutPolicy; blind-relay protomux backpressure tests - Pear updater minimal delegate example + verify-pear scan; holepunch drift repos - Refresh handbook, kernel-image, syscall-socket-contract, posix matrix, PEAR-RUN Rebuild coreutils/bundles; bundle kernel; keep seeder/kernel parity.
2026-04-05 02:08:38 -04:00
parent ebee9576c8
commit 7f4279d315
52 changed files with 1580 additions and 633 deletions
@@ -37,6 +37,8 @@ Files in this directory are **read from disk by the seeder** (or copied into `pa
 3. Run `npm run build -w bare-os-bare-libs` when **`packages/bare-os-booter/lib/bare-module-manifest.json`** or bundle entries change.
 4. Run seeder again to re-stage the drive (or use a fresh Corestore for a clean image).

+**Host boot perf:** when **`BARE_OS_BOOT_PERF_DETAIL=1`**, the stock booter logs **`bare_stdlib_merge_ns`** after **`maybeMergeBareFromDrive`** (monotonic **`hrtime`** delta in nanoseconds) alongside guest **`boot-perf.json`** stages.
+
 Pear bundles use the **vendored** tree under `packages/bare-os-seeder/kernel/`; keep it in sync by running the same builds before `pear stage`. **`npm test`** runs **`scripts/verify-kernel-seeder-parity.mjs`**, **`scripts/verify-ctx-api-feature-bits.mjs`**, and **`scripts/validate-example-schemas.mjs`** (after **`bare-os-coreutils`** and **`bare-os-bare-libs`** builds) so the two trees match byte-for-byte, ctx semver / feature words stay wired, example JSON matches **[`docs/schemas/`](../docs/schemas/)**, and every **`kernel/bin/*`** file contains the **`BARE_OS_BIN_API`** pragma (coreutils **`runtime.js`** and hand-written stubs such as **`systemctl`** / **`journalctl`**).

 Optional **system** image examples: **`etc/bare-os/boot.allow.example`** (copy to **`boot.allow`** when using host **`BARE_OS_BOOT_ALLOWLIST=1`**), **`etc/bare-os/boot.policy.example.json`** (install as **`boot.policy.json`** when using **`BARE_OS_BOOT_POLICY=1`**; v2 fields **`maxExecLineDepth`**, **`denyEnvKeys`**, **`requireProcNodes`**; v3 **`requireKernelCapabilitiesExtendedSeedingPlatform`**, **`requireKernelCapabilitiesRlimitsDelegatesShell`**, **`allowedPearIpcChannels`**, **`denyVfsPrefixes`**, **`maxInitdRestartsPerUnit`**; v4 **`requireKernelCapabilitiesOfflineNetExtensions`**, **`denyExecLineBuiltins`**, **`allowedCtxMethods`**; v9 **`requireKernelCapabilitiesBareModuleCryptoStaging`**, **`requirePearRuntimeRange`**, **`denyBareModuleSpecifierPatterns`**, **`requireBareCryptoMin`**, **`denyKernelSyscalls`**, **`requirePearIpcMin`**, **`extensionSignerPinsV2`**, **`offlineLkgManifestMaxAgeSec`**, **`bootPhasesRequireProcIndexMinSchema`**; v10 **`requireKernelCapabilitiesPearInspectLoggerTls`**, **`requireBareBootMin`**, **`bootPhasesRequireLifecycleMinSchema`**, **`extensionSignerPinsV3`**, …; JSON Schema: [`docs/schemas/boot.policy.schema.json`](../docs/schemas/boot.policy.schema.json)), **`etc/bare-os/kernel.extensions.registry.example.json`** (shape for **`/proc/bare_os/extensions.json`** schema 7), **`etc/bare-os/boot-trace-line.example.json`** and **`etc/bare-os/telemetry-ndjson.example.json`** (shape checks for CI), **`etc/bare-os/rc.profile.full`** (sample full profile referenced from **`profile`**), **`etc/bare-os/crontab.example`** (system-wide cron lines merged ahead of user **`~/.crontab`**), **`etc/bare-os/timers/*.timer.example`** (copy to **`~/.config/bare-os/timers/*.timer`** for **`OnCalendar=`**, **`EveryMs=`**, or **`OnInactiveSec=`** jobs). **`kernel.ext.d`** scripts register into **`/proc/bare_os/extensions.json`** when the booter provides **`ctx.bareOsRegisterKernelExtensionRecord`**.
@@ -142,6 +142,12 @@ const CONF = {
  _SC_NPROCESSORS_CONF: '4',
  _SC_HOST_NAME_MAX: '255',
  _POSIX_HOST_NAME_MAX: '255',
+  _SC_MONOTONIC_CLOCK: '1',
+  _SC_ATEXIT_MAX: '32',
+  _SC_LINE_MAX: '2048',
+  _SC_BC_BASE_MAX: '99',
+  _SC_BC_DIM_MAX: '2048',
+  _SC_BC_SCALE_MAX: '99',
  _SC_SYMLOOP_MAX: '32',
  _SC_IOV_MAX: '1024',
  _SC_UIO_MAXIOV: '1024',
@@ -1,3 +1,18 @@
+/**
+ * Keep algorithm in sync with `packages/bare-os-protocol/lib/bare-os-pear-multisig-shape.js`
+ * (`pearMultisigShapeOk`). Kernel bundle cannot import npm packages.
+ * @param {unknown} parsed
+ * @returns {boolean}
+ */
+function bareOsPearMultisigShapeOk(parsed) {
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return false
+  const signers = /** @type {{ signers?: unknown }} */ (parsed).signers
+  const quorum = /** @type {{ quorum?: unknown }} */ (parsed).quorum
+  if (!Array.isArray(signers) || typeof quorum !== 'number') return false
+  if (quorum < 1 || quorum > signers.length) return false
+  return true
+}
+
 /**
 * Boot preamble: cooperative lock FSM constants + `invokeCtxBootHooks`.
 * This file is the **only** source for these symbols; `kernel/init.js` is generated by
@@ -2522,14 +2537,7 @@ async function runKernelExtDropins(ctx, opts = {}) {
        }
      } else {
        const mj = JSON.parse(ctx.b4a.toString(mbuf))
-        const signers = mj && mj.signers
-        const quorum = mj && mj.quorum
-        const badShape =
-          !Array.isArray(signers) ||
-          typeof quorum !== 'number' ||
-          quorum < 1 ||
-          quorum > signers.length
-        if (badShape) {
+        if (!bareOsPearMultisigShapeOk(mj)) {
          bootStructuredLog(
            ctx,
            'error',
@@ -2,9 +2,9 @@
  "version": 1,
  "bundles": [
    {
-      "path": "/lib/bare/bundles/compactEncoding.js",
+      "path": "/lib/bare/bundles/safetyCatch.js",
      "keys": [
-        "compactEncoding"
+        "safetyCatch"
      ]
    },
    {
@@ -20,15 +20,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/safetyCatch.js",
+      "path": "/lib/bare/bundles/compactEncoding.js",
      "keys": [
-        "safetyCatch"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareUrl.js",
-      "keys": [
-        "bareUrl"
+        "compactEncoding"
      ]
    },
    {
@@ -38,9 +32,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/barePath.js",
+      "path": "/lib/bare/bundles/bareUrl.js",
      "keys": [
-        "barePath"
+        "bareUrl"
      ]
    },
    {
@@ -49,6 +43,12 @@
        "bareEncoding"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/barePath.js",
+      "keys": [
+        "barePath"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareEvents.js",
      "keys": [
@@ -67,36 +67,54 @@
        "bareAbortController"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
-      "keys": [
-        "bareAnsiEscapes"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareReadline.js",
      "keys": [
        "bareReadline"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareCrypto.js",
-      "keys": [
-        "bareCrypto"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareAddonResolve.js",
      "keys": [
        "bareAddonResolve"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareCrypto.js",
+      "keys": [
+        "bareCrypto"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
+      "keys": [
+        "bareAnsiEscapes"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareAsyncHooks.js",
      "keys": [
        "bareAsyncHooks"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareAppKit.js",
+      "keys": [
+        "bareAppKit"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/fetch.js",
+      "keys": [
+        "fetch"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareApk.js",
+      "keys": [
+        "bareApk"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareAssert.js",
      "keys": [
@@ -109,24 +127,6 @@
        "bareAtomics"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareAppKit.js",
-      "keys": [
-        "bareAppKit"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareApk.js",
-      "keys": [
-        "bareApk"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/fetch.js",
-      "keys": [
-        "fetch"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareBmp.js",
      "keys": [
@@ -163,36 +163,36 @@
        "bareBundleEvaluate"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareBoot.js",
-      "keys": [
-        "bareBoot"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareConsole.js",
      "keys": [
        "bareConsole"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareBoot.js",
+      "keys": [
+        "bareBoot"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareBundleId.js",
      "keys": [
        "bareBundleId"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareDebugLog.js",
-      "keys": [
-        "bareDebugLog"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareChannel.js",
      "keys": [
        "bareChannel"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareDebugLog.js",
+      "keys": [
+        "bareDebugLog"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareDelta.js",
      "keys": [
@@ -205,18 +205,18 @@
        "bareDaemon"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareDns.js",
-      "keys": [
-        "bareDns"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareDiagnosticsChannel.js",
      "keys": [
        "bareDiagnosticsChannel"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareDns.js",
+      "keys": [
+        "bareDns"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareEnv.js",
      "keys": [
@@ -229,12 +229,6 @@
        "bareExif"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareFfmpegEncodings.js",
-      "keys": [
-        "bareFfmpegEncodings"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareDgram.js",
      "keys": [
@@ -247,6 +241,12 @@
        "bareFfmpeg"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareFfmpegEncodings.js",
+      "keys": [
+        "bareFfmpegEncodings"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareCov.js",
      "keys": [
@@ -271,12 +271,6 @@
        "bareFormData"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareFileLogger.js",
-      "keys": [
-        "bareFileLogger"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareHeif.js",
      "keys": [
@@ -289,12 +283,6 @@
        "bareHrtime"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareGtk.js",
-      "keys": [
-        "bareGtk"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareFs.js",
      "keys": [
@@ -302,9 +290,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareIco.js",
+      "path": "/lib/bare/bundles/bareGtk.js",
      "keys": [
-        "bareIco"
+        "bareGtk"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareFileLogger.js",
+      "keys": [
+        "bareFileLogger"
      ]
    },
    {
@@ -313,24 +307,30 @@
        "bareHttpParser"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareIco.js",
+      "keys": [
+        "bareIco"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareImageResample.js",
      "keys": [
        "bareImageResample"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareInspect.js",
-      "keys": [
-        "bareInspect"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareHttp1.js",
      "keys": [
        "bareHttp1"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareInspect.js",
+      "keys": [
+        "bareInspect"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareHttps.js",
      "keys": [
@@ -349,30 +349,12 @@
        "bareIntl"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareLief.js",
-      "keys": [
-        "bareLief"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareIpc.js",
      "keys": [
        "bareIpc"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareInspector.js",
-      "keys": [
-        "bareInspector"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareLink.js",
-      "keys": [
-        "bareLink"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareLogger.js",
      "keys": [
@@ -380,15 +362,27 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareMake.js",
+      "path": "/lib/bare/bundles/bareLink.js",
      "keys": [
-        "bareMake"
+        "bareLink"
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareModule.js",
+      "path": "/lib/bare/bundles/bareInspector.js",
      "keys": [
-        "bareModule"
+        "bareInspector"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareLief.js",
+      "keys": [
+        "bareLief"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareMake.js",
+      "keys": [
+        "bareMake"
      ]
    },
    {
@@ -410,15 +404,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareNdk.js",
+      "path": "/lib/bare/bundles/bareModule.js",
      "keys": [
-        "bareNdk"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareNative.js",
-      "keys": [
-        "bareNative"
+        "bareModule"
      ]
    },
    {
@@ -427,6 +415,24 @@
        "bareNodeFetch"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareNative.js",
+      "keys": [
+        "bareNative"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareNdk.js",
+      "keys": [
+        "bareNdk"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareDev.js",
+      "keys": [
+        "bareDev"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareOpen.js",
      "keys": [
@@ -434,9 +440,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareMedia.js",
+      "path": "/lib/bare/bundles/bareOs.js",
      "keys": [
-        "bareMedia"
+        "bareOs"
      ]
    },
    {
@@ -446,9 +452,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareOs.js",
+      "path": "/lib/bare/bundles/bareMedia.js",
      "keys": [
-        "bareOs"
+        "bareMedia"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/barePng.js",
+      "keys": [
+        "barePng"
      ]
    },
    {
@@ -469,30 +481,24 @@
        "barePackDrive"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/barePng.js",
-      "keys": [
-        "barePng"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/barePipe.js",
      "keys": [
        "barePipe"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/barePunycode.js",
-      "keys": [
-        "barePunycode"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareNodeRuntime.js",
      "keys": [
        "bareNodeRuntime"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/barePunycode.js",
+      "keys": [
+        "barePunycode"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareQuerystring.js",
      "keys": [
@@ -505,18 +511,18 @@
        "bareQueueMicrotask"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/barePrebuild.js",
-      "keys": [
-        "barePrebuild"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareRealm.js",
      "keys": [
        "bareRealm"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/barePrebuild.js",
+      "keys": [
+        "barePrebuild"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareProcess.js",
      "keys": [
@@ -529,42 +535,36 @@
        "bareRuntime"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/barePromClient.js",
-      "keys": [
-        "barePromClient"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareDev.js",
-      "keys": [
-        "bareDev"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareRpc.js",
      "keys": [
        "bareRpc"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/barePromClient.js",
+      "keys": [
+        "barePromClient"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareSemver.js",
      "keys": [
        "bareSemver"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareSdl.js",
-      "keys": [
-        "bareSdl"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareRepl.js",
      "keys": [
        "bareRepl"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareSdl.js",
+      "keys": [
+        "bareSdl"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareRun.js",
      "keys": [
@@ -577,12 +577,6 @@
        "bareSignals"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareSidecar.js",
-      "keys": [
-        "bareSidecar"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareStringDecoder.js",
      "keys": [
@@ -595,12 +589,36 @@
        "bareStream"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareSidecar.js",
+      "keys": [
+        "bareSidecar"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareStorage.js",
      "keys": [
        "bareStorage"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareSvg.js",
+      "keys": [
+        "bareSvg"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareSystemLogger.js",
+      "keys": [
+        "bareSystemLogger"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareStructuredClone.js",
+      "keys": [
+        "bareStructuredClone"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareStdio.js",
      "keys": [
@@ -608,9 +626,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareSvg.js",
+      "path": "/lib/bare/bundles/bareTiff.js",
      "keys": [
-        "bareSvg"
+        "bareTiff"
      ]
    },
    {
@@ -626,9 +644,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareSystemLogger.js",
+      "path": "/lib/bare/bundles/bareTcp.js",
      "keys": [
-        "bareSystemLogger"
+        "bareTcp"
      ]
    },
    {
@@ -637,24 +655,6 @@
        "bareThread"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareStructuredClone.js",
-      "keys": [
-        "bareStructuredClone"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareTiff.js",
-      "keys": [
-        "bareTiff"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareTcp.js",
-      "keys": [
-        "bareTcp"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareTimers.js",
      "keys": [
@@ -691,6 +691,12 @@
        "bareTty"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareUnionBundle.js",
+      "keys": [
+        "bareUnionBundle"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareV8.js",
      "keys": [
@@ -703,12 +709,6 @@
        "bareUnpack"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareUnionBundle.js",
-      "keys": [
-        "bareUnionBundle"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareWalkHandles.js",
      "keys": [
@@ -722,9 +722,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareWebKit.js",
+      "path": "/lib/bare/bundles/bareWebp.js",
      "keys": [
-        "bareWebKit"
+        "bareWebp"
      ]
    },
    {
@@ -733,24 +733,18 @@
        "bareWhich"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareWebKit.js",
+      "keys": [
+        "bareWebKit"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareWebKitGtk.js",
      "keys": [
        "bareWebKitGtk"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareWebp.js",
-      "keys": [
-        "bareWebp"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareXdiff.js",
-      "keys": [
-        "bareXdiff"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareUtils.js",
      "keys": [
@@ -763,12 +757,6 @@
        "bareV8ToIstanbul"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareWorker.js",
-      "keys": [
-        "bareWorker"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareWinUi.js",
      "keys": [
@@ -776,9 +764,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareWs.js",
+      "path": "/lib/bare/bundles/bareXdiff.js",
      "keys": [
-        "bareWs"
+        "bareXdiff"
      ]
    },
    {
@@ -792,6 +780,18 @@
      "keys": [
        "bareZmq"
      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareWs.js",
+      "keys": [
+        "bareWs"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareWorker.js",
+      "keys": [
+        "bareWorker"
+      ]
    }
  ],
  "bundleStats": {
@@ -1595,8 +1595,8 @@
  ],
  "bundleProvenance": {
    "schemaVersion": 1,
-    "generatedAt": "2026-04-05T05:45:19.496Z",
-    "gitCommit": "15209b4837c1c23e2b6102c180d8adf609f4c381",
+    "generatedAt": "2026-04-05T06:07:30.836Z",
+    "gitCommit": "ebee9576c8e7ad247c71fbe2a0478dcf644edfa8",
    "nodeVersion": "v22.22.0",
    "bundleTier": "all",
    "normativeManifest": "packages/bare-os-booter/lib/bare-module-manifest.json",
@@ -1,6 +1,6 @@
 {
  "schema": 1,
-  "atMs": 1775367918774,
+  "atMs": 1775369250127,
  "commands": [
    "arch",
    "awk",
@@ -0,0 +1,14 @@
+/**
+ * Keep algorithm in sync with `packages/bare-os-protocol/lib/bare-os-pear-multisig-shape.js`
+ * (`pearMultisigShapeOk`). Kernel bundle cannot import npm packages.
+ * @param {unknown} parsed
+ * @returns {boolean}
+ */
+function bareOsPearMultisigShapeOk(parsed) {
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return false
+  const signers = /** @type {{ signers?: unknown }} */ (parsed).signers
+  const quorum = /** @type {{ quorum?: unknown }} */ (parsed).quorum
+  if (!Array.isArray(signers) || typeof quorum !== 'number') return false
+  if (quorum < 1 || quorum > signers.length) return false
+  return true
+}
@@ -2486,14 +2486,7 @@ async function runKernelExtDropins(ctx, opts = {}) {
        }
      } else {
        const mj = JSON.parse(ctx.b4a.toString(mbuf))
-        const signers = mj && mj.signers
-        const quorum = mj && mj.quorum
-        const badShape =
-          !Array.isArray(signers) ||
-          typeof quorum !== 'number' ||
-          quorum < 1 ||
-          quorum > signers.length
-        if (badShape) {
+        if (!bareOsPearMultisigShapeOk(mj)) {
          bootStructuredLog(
            ctx,
            'error',