Move editable kernel bulk from kernel/init-main.js to kernel/lib/init/

(staged as /lib/init/init-main.js); point bundle-kernel-init and verify
scripts at the new path.

Wire curl, wget, openssl, ssh-keygen, and tar through coreutils and
booter host delegates with booter-side CLI helpers; refresh related
bins, bare manifest, shell completion, and man DB (kernel + seeder).

Add booter support modules for ACL evaluation, audit chain, secret
handles, peer admission, replication priority, process table, swarm
lifecycle, boot-graph proc, metrics, monotonic time, protomux alias
registry, and swarm peer policy; extend extension resolver, VFS,
swarm connection managers, IPC, identity-account, and initd.

Harden bare-os-bare-libs build on esbuild failure; add verify scripts
for extension manifest schema and runtime incomplete markers; extend
ctx API typings, gen-ctx-client-stub, and verify-ctx-dts.

Update boot hook fragment, bundled init.js, handbook and reference
docs (incl. kernel security and VFS path classes).

docs/reference/README.md

@@ -39,6 +39,7 @@ This directory holds the split **file-by-file inventory** that used to live in t
 - **Legacy ↔ canonical names** — [Naming alias matrix](naming-alias-matrix.md)
 - **Kernel program status tables** — [Feature roadmap status](feature-roadmap.md)
 - **VFS path classes (policy sketch)** — [vfs-path-classes.md](vfs-path-classes.md)
+- **Kernel security subsystems** — [kernel-security-subsystems.md](kernel-security-subsystems.md)
 - **Observability contracts** — [observability-contracts.md](observability-contracts.md)
 - **Kernel extensions (short index)** — [kernel-extensions-capability-specs.md](kernel-extensions-capability-specs.md)
 - **Kernel extensions (generated TOC)** — [kernel-extensions-generated-toc.md](kernel-extensions-generated-toc.md)

docs/reference/kernel-security-subsystems.md

@@ -0,0 +1,15 @@
+# Kernel security subsystems (identity, handles, audit, ACL)
+
+Stock booter modules under `packages/bare-os-booter/lib/`:
+
+| Module | Role |
+| --- | --- |
+| `identity-account.js` | On-disk account v2 (Ed25519, PBKDF2, ChaCha20-Poly1305); **`BARE_OS_ACCOUNT_CRYPTO_PROFILE_V2`** and **`readAccountCryptoProfile(buf)`** expose algorithm metadata without decryption. |
+| `identity-session.js` | Login, vault unlock, session key application. |
+| `bare-os-secret-handle-registry.js` | Opaque handles with TTL, optional max uses, revocation; surfaced via **`ctx.bareOsAcquireKeyHandle`** / **`bareOsReleaseKeyHandle`** / **`bareOsTouchKeyHandle`**. |
+| `bare-os-audit-chain.js` | In-memory hash-linked audit rows; **`ctx.bareOsAuditLogAppend`**. |
+| `bare-os-acl-eval.js` | Advisory **`evaluateBareOsAcl`**; **`ctx.bareOsAclEvaluate`**. |
+
+`/proc/bare_os/security_posture.json` (**schema 3**) aggregates non-secret snapshots: account profile, active handle counts, audit chain head/length, vault rotation checkpoint path, and policy flags.
+
+**Documentation parity:** When changing any of the above APIs or proc schemas, update `handbook/04-the-booter-runtime.md`, `packages/bare-os-booter/lib/bare-os-ctx.d.ts`, `lib/bare-os-ctx-api.js`, and this file.

docs/reference/vfs-path-classes.md

@@ -11,8 +11,10 @@ Stock routing is implemented in `packages/bare-os-booter/lib/vfs.js` (`createVfs
 | `system` | `/boot`, `/bin`, `/lib`, `/etc`, `/usr`, `/var`, default | System image Hyperdrive |
 | `snapshot` | `/snapshots`, `/snapshots/system/…` | Read-only **system** checkout views when **`BARE_OS_VFS_SNAPSHOTS=1`** and `drive.checkout` exists |
 
-**Policy helper:** `evaluateBareOsVfsPathPolicy(path, rules)` returns **`verdict`**, **`matched`**, and **`metrics`** (`rulesEvaluated`, `matchCount`).
+**Policy helper:** `evaluateBareOsVfsPathPolicy(path, rules)` returns **`verdict`** (`allow` \| `deny` \| `neutral`), **`matched`** (including **`audit`** hits), **`auditHits`**, and **`metrics`** (`rulesEvaluated`, `matchCount`). Rules may use **`effect`**: **`allow`**, **`deny`**, or **`audit`** (audit records a match but does not override the verdict; later **`allow`/`deny`** rules still apply).
+
+**Env rules:** `parseBareOsVfsPolicyRulesFromEnv(env)` reads **`BARE_OS_VFS_POLICY_RULES_JSON`** as `{ "rules": [ { "id", "effect", "pathClass?", "prefix?" } ] }` for tooling that merges policy stacks.
 
 **Batch / diff helpers:** `bareOsVfsBatchPut(drive, puts)` and `bareOsHyperdriveDiffCollect(drive, a, b, opts)` in the same module (used from **`ctx.bareOsVfsBatchWrite`** / **`ctx.bareOsHyperdriveDiffCollect`** in the booter).
 
-This is **advisory** today: enforcement remains in the VFS implementation and boot policy (`denyVfsPrefixes`, …).
+Rule evaluation is **advisory** unless a caller enforces **`verdict`**; stock VFS routing still uses `createVfs` internals and boot policy (`denyVfsPrefixes`, …).

docs/schemas/kernel-extension-manifest.schema.json

@@ -0,0 +1,49 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://bare-os.local/schemas/kernel-extension-manifest.schema.json",
+  "title": "Bare OS kernel extension manifest (drop-in)",
+  "type": "object",
+  "required": ["id", "version"],
+  "properties": {
+    "id": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128
+    },
+    "version": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 64
+    },
+    "scripts": {
+      "type": "array",
+      "items": { "type": "string", "minLength": 1 },
+      "minItems": 1
+    },
+    "dependsOn": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "requires": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "capabilities": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "signer": { "type": "string", "maxLength": 128 },
+    "contentSha256": {
+      "type": "array",
+      "items": { "type": "string", "pattern": "^[a-f0-9]{64}$" }
+    },
+    "migration": {
+      "type": "object",
+      "properties": {
+        "fromVersion": { "type": "string" },
+        "hook": { "type": "string" }
+      }
+    }
+  },
+  "additionalProperties": true
+}