feat: POSIX/Holepunch plan — proc contracts, shell, vault audit, docs, tests

- Docs: kernel-program truth, PLACEHOLDER_BASELINE, POSIX_DECLARED_PROFILE,
  env appendix (BARE_OS_SHELL_PIPEFAIL, BARE_OS_WASM_KERNEL), package-bare-os-booter
- Booter: syscalls.json fd model, process_table exitStatusModel, shell pipeline
  exit status + kernel-runner script-error path, mirror mounts test + handbook
- Seeder: corestore_snapshot proc alignment test; hyperswarm ^4.17.0; kernel mirror sync
- Vault: vault_save audit after saveVaultToDrive; split bare-os-vault-rotation-audit.js
- Contract: protomux/hyperswarm lock fixture + test; IPC stats ipcBackpressure test
- Coreutils: XCU tests, bare-cron man seed, ACL/xattr metadata path test
- Tooling: kernel-microbench + release-gate fixture doc; ADR 002 WASM compile hook
- Changelog/ctx d.ts and dependency/lockfile updates as needed

scripts/README.md

@@ -245,15 +245,21 @@ Host-side noise generator for **`JSON.parse`** resilience; does not load the sto
 
 Compares **`bootMs`** fields from two benchmark JSON files; exits **1** when regression exceeds the threshold.
 
+## `kernel-microbench.mjs`
+
+**Usage:** `node scripts/kernel-microbench.mjs [--list] [--suite boot|vfs|crypto] [--all]`
+
+Host-side microbench driver used as a **regression-shaped** workload (not a literal cold-boot timer). The **`boot`** suite prints JSON with **`bootMs`** suitable for **`kernel-program-release-gate.mjs`**. Example baseline fixture: [`fixtures/kernel-microbench-release-gate-baseline.example.json`](fixtures/kernel-microbench-release-gate-baseline.example.json).
+
 ## `kernel-vfs-microbench.mjs` / `kernel-net-mock-bench.mjs` / `kernel-bare-crypto-microbench.mjs`
 
-Small host stubs for VFS routing, DNS/egress policy merge, and crypto-shaped work.
+Small host stubs for VFS routing, DNS/egress policy merge, and crypto-shaped work (legacy single-purpose scripts).
 
 ## `kernel-program-benchmark-harness.mjs`
 
 **Usage:** `node scripts/kernel-program-benchmark-harness.mjs [--list|--help|--sample-boot-ms N]`
 
-Boot/VFS/IPC/network/crypto benchmark placeholder; **`--list`** prints planned suite names as JSON. **`--sample-boot-ms`** emits JSON for **`kernel-program-release-gate.mjs`** fixtures.
+Synthetic **`bootMs`** JSON for **`kernel-program-release-gate.mjs`** fixtures when you need a deterministic sample without running **`kernel-microbench.mjs`**.
 
 ## `validate-example-schemas.mjs`
 

scripts/fixtures/kernel-microbench-release-gate-baseline.example.json

@@ -0,0 +1,5 @@
+{
+  "schema": 1,
+  "note": "Example baseline for scripts/kernel-program-release-gate.mjs — replace bootMs after running: node scripts/kernel-microbench.mjs --suite boot",
+  "bootMs": 12
+}

scripts/kernel-microbench.mjs

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+/**
+ * Multi-suite microbench driver for kernel-program-release-gate fixtures.
+ * Usage: node scripts/kernel-microbench.mjs [--list] [--suite NAME] [--all]
+ */
+import crypto from 'node:crypto'
+import { performance } from 'node:perf_hooks'
+import process from 'node:process'
+
+const SUITES = ['boot', 'vfs', 'crypto']
+
+function bootSampleMs() {
+  const t0 = performance.now()
+  for (let i = 0; i < 5000; i++) JSON.stringify({ bootStage: 'noop', i })
+  return Math.round(performance.now() - t0)
+}
+
+function vfsSample() {
+  const t0 = performance.now()
+  let x = 0
+  for (let i = 0; i < 200000; i++) {
+    x += i % 7
+  }
+  return {
+    bench: 'kernel_vfs_micro',
+    ms: Math.round((performance.now() - t0) * 1000) / 1000,
+    checksum: x
+  }
+}
+
+function cryptoSample() {
+  const msg = crypto.randomBytes(1024)
+  const t0 = performance.now()
+  let h = msg
+  for (let i = 0; i < 5000; i++) {
+    h = crypto.createHash('sha256').update(h).digest()
+  }
+  return {
+    bench: 'kernel_bare_crypto_stub',
+    ms: Math.round((performance.now() - t0) * 1000) / 1000,
+    digestPrefix: h.subarray(0, 4).toString('hex')
+  }
+}
+
+async function runSuite(name) {
+  if (name === 'boot') {
+    return { suite: 'boot', bootMs: bootSampleMs(), atMs: Date.now() }
+  }
+  if (name === 'vfs') {
+    return { suite: 'vfs', schema: 1, ...vfsSample(), atMs: Date.now() }
+  }
+  if (name === 'crypto') {
+    return { suite: 'crypto', schema: 1, ...cryptoSample(), atMs: Date.now() }
+  }
+  throw new Error('unknown suite: ' + name)
+}
+
+async function main() {
+  const args = process.argv.slice(2)
+  if (args.includes('--list')) {
+    console.log(JSON.stringify({ suites: SUITES, schema: 1 }, null, 2))
+    return
+  }
+  const all = args.includes('--all')
+  let suite = ''
+  const si = args.indexOf('--suite')
+  if (si >= 0 && args[si + 1]) suite = args[si + 1]
+  if (all) {
+    const out = []
+    for (const s of SUITES) out.push(await runSuite(s))
+    console.log(JSON.stringify({ schema: 1, results: out, atMs: Date.now() }, null, 2))
+    return
+  }
+  if (!suite) suite = 'boot'
+  const one = await runSuite(suite)
+  console.log(JSON.stringify(one, null, 2))
+}
+
+main().catch((e) => {
+  console.error(e)
+  process.exit(1)
+})