Move editable kernel bulk from kernel/init-main.js to kernel/lib/init/

(staged as /lib/init/init-main.js); point bundle-kernel-init and verify
scripts at the new path.

Wire curl, wget, openssl, ssh-keygen, and tar through coreutils and
booter host delegates with booter-side CLI helpers; refresh related
bins, bare manifest, shell completion, and man DB (kernel + seeder).

Add booter support modules for ACL evaluation, audit chain, secret
handles, peer admission, replication priority, process table, swarm
lifecycle, boot-graph proc, metrics, monotonic time, protomux alias
registry, and swarm peer policy; extend extension resolver, VFS,
swarm connection managers, IPC, identity-account, and initd.

Harden bare-os-bare-libs build on esbuild failure; add verify scripts
for extension manifest schema and runtime incomplete markers; extend
ctx API typings, gen-ctx-client-stub, and verify-ctx-dts.

Update boot hook fragment, bundled init.js, handbook and reference
docs (incl. kernel security and VFS path classes).

kernel/bin/baretop

@@ -349,7 +349,8 @@ var BARE_TOP_SNAPSHOT_PROC_ENTRIES = [
   ['sandboxProfile', '/proc/bare_os/sandbox_profile.json'],
   ['rlimits', '/proc/bare_os/rlimits.json'],
   ['extensions', '/proc/bare_os/extensions.json'],
-  ['initdDag', '/proc/bare_os/initd_dag.json']
+  ['initdDag', '/proc/bare_os/initd_dag.json'],
+  ['bootGraph', '/proc/bare_os/boot_graph.json']
 ]
 
 /** @param {unknown} buf @param {unknown} b4a @returns {string} */

kernel/bin/btop

@@ -349,7 +349,8 @@ var BARE_TOP_SNAPSHOT_PROC_ENTRIES = [
   ['sandboxProfile', '/proc/bare_os/sandbox_profile.json'],
   ['rlimits', '/proc/bare_os/rlimits.json'],
   ['extensions', '/proc/bare_os/extensions.json'],
-  ['initdDag', '/proc/bare_os/initd_dag.json']
+  ['initdDag', '/proc/bare_os/initd_dag.json'],
+  ['bootGraph', '/proc/bare_os/boot_graph.json']
 ]
 
 /** @param {unknown} buf @param {unknown} b4a @returns {string} */

kernel/bin/curl

@@ -88,12 +88,17 @@ function bareOsEmitRaw(ctx, chunk) {
 }
 
 /**
- * Drive-resident placeholder so `/bin/curl` exists for `ls /bin`, `which curl`, and manifest parity.
- * The booter handles `curl` via host delegation before this script is executed.
+ * `/bin/curl` parity entry: normally the booter delegates to `curl-cli.js` first.
+ * When this script runs (e.g. `BARE_OS_DELEGATE_ALLOW` excludes curl), it calls
+ * `ctx.bareOsRunCurlCli` so behavior stays fetch-based and consistent.
  */
-async function run(ctx, _argv) {
+async function run(ctx, argv) {
+  if (typeof ctx.bareOsRunCurlCli === 'function') {
+    await ctx.bareOsRunCurlCli(argv)
+    return
+  }
   ctx.console.error(
-    'curl: unexpected — the booter should delegate curl before loading /bin/curl'
+    'curl: ctx.bareOsRunCurlCli missing — upgrade booter / ctx API'
   )
   ctx.exitCode = 1
 }

kernel/bin/help

@@ -87,7 +87,7 @@ function bareOsEmitRaw(ctx, chunk) {
   return false
 }
 
-var BARE_OS_HELP_BIN_SPACED = "arch awk baretop base32 base64 basename basenc btop cat chgrp chmod chown cksum clear cmp comm cp crontab curl cut date df dir dircolors dirname du echo edit env exit expand expr factor false find fmt fold getconf git git-pear grep groups hdms head help hostid hostname id install join journalctl jq kernel-boot-diff kernel-doctor kernel-explain kernel-fsck kernel-home-snapshot kernel-manifest-validate kernel-preflight kernel-triage ln login logname logout ls man md5sum mkdir mkfifo mktemp mv nano nl nohup nproc numfmt od oidc-publish openssl paste pathchk pr printenv printf pwd readlink realpath rev rm rmdir savevault sed seq sha1sum sha256sum sha512sum shuf sleep sort split ssh-keygen stat sum sync systemctl tac tail tar tee test theme time timeout touch tr true truncate tsort tty uname unexpand uniq unlink uptime users vdir wc wget which who whoami xargs yes"
+var BARE_OS_HELP_BIN_SPACED = "arch awk baretop base32 base64 basename basenc btop cat chgrp chmod chown cksum clear cmp comm cp crontab curl cut date df dir dircolors dirname du echo edit env exit expand expr factor false find fmt fold getconf git git-pear grep groups hdms head help hostid hostname id install join journalctl jq kernel-boot-diff kernel-doctor kernel-explain kernel-fsck kernel-home-snapshot kernel-manifest-validate kernel-preflight kernel-triage ln login logname logout ls man md5sum mkdir mkfifo mktemp mv nano nl nohup nproc numfmt od oidc-publish openssl openssl paste pathchk pr printenv printf pwd readlink realpath rev rm rmdir savevault sed seq sha1sum sha256sum sha512sum shuf sleep sort split ssh-keygen ssh-keygen stat sum sync systemctl tac tail tar tar tee test theme time timeout touch tr true truncate tsort tty uname unexpand uniq unlink uptime users vdir wc wget which who whoami xargs yes"
 async function run(ctx, argv) {
   ctx.console.log(
     'Bare OS — default user: guest | shell builtins: alias, barerc, cd, command, export, exit, login, logout, readonly, type, umask, unalias, unset, : | /bin: ' +

kernel/bin/kernel-fsck

@@ -89,8 +89,9 @@ function bareOsEmitRaw(ctx, chunk) {
 
 async function run(ctx, argv) {
   const vfs = ctx.vfs
-  if (!vfs || typeof vfs.readdir !== 'function') {
-    ctx.console.error('kernel-fsck: vfs.readdir unavailable')
+  const b4 = ctx.b4a
+  if (!vfs || typeof vfs.readdir !== 'function' || !b4) {
+    ctx.console.error('kernel-fsck: vfs unavailable')
     ctx.exitCode = 1
     return
   }
@@ -103,23 +104,47 @@ async function run(ctx, argv) {
   try {
     for await (const n of vfs.readdir('/bin')) names.push(n)
   } catch (e) {
-    ctx.console.error(
-      'kernel-fsck: ' + ((e && e.message) || String(e))
-    )
+    ctx.console.error('kernel-fsck: ' + ((e && e.message) || String(e)))
     ctx.exitCode = 1
     return
   }
   names.sort()
+  let pragmaOk = 0
+  let pragmaBad = 0
+  for (const n of names) {
+    if (!n.endsWith('.js') && !n.includes('.')) {
+      try {
+        const abs = vfs.resolveLogical('/bin/' + n)
+        const buf = await vfs.readFile(abs)
+        const head = b4.toString(buf).slice(0, 400)
+        if (head.includes('BARE_OS_BIN_API')) pragmaOk++
+        else pragmaBad++
+      } catch {
+        pragmaBad++
+      }
+    }
+  }
   const out = {
-    schema: 1,
-    ok: true,
+    schema: 2,
+    ok: pragmaBad === 0,
     binCount: names.length,
+    binPragmaOk: pragmaOk,
+    binPragmaMissing: pragmaBad,
     sample: names.slice(0, 32),
-    note: 'Integrity walk stub — lists /bin; extend with checksum pass when policy requires.'
+    note:
+      'Integrity pass: /bin listing + BARE_OS_BIN_API pragma probe on runnable entries.'
   }
   if (json) {
     ctx.console.log(JSON.stringify(out, null, 2))
   } else {
-    ctx.console.log('kernel-fsck: /bin entries ' + names.length)
+    ctx.console.log(
+      'kernel-fsck: /bin=' +
+        names.length +
+        ' pragma_ok=' +
+        pragmaOk +
+        ' pragma_missing=' +
+        pragmaBad
+    )
   }
+  ctx.exitCode = out.ok ? 0 : 1
 }

kernel/bin/kernel-home-snapshot

@@ -87,24 +87,119 @@ function bareOsEmitRaw(ctx, chunk) {
   return false
 }
 
+/**
+ * Walk a home directory on the VFS and emit a bounded manifest (no archive bytes).
+ */
 async function run(ctx, argv) {
   let json = false
+  let maxFiles = 8000
+  let maxDepth = 12
+  /** @type {string[]} */
+  const roots = []
   for (let i = 1; i < argv.length; i++) {
     if (argv[i] === '--json') json = true
+    else if (argv[i] === '--max' && argv[i + 1]) {
+      maxFiles = Number.parseInt(argv[++i], 10) || maxFiles
+    } else if (argv[i] === '--depth' && argv[i + 1]) {
+      maxDepth = Number.parseInt(argv[++i], 10) || maxDepth
+    } else if (!argv[i].startsWith('-')) roots.push(argv[i])
   }
+  const vfs = ctx.vfs
+  const b4 = ctx.b4a
+  if (!vfs || !b4 || typeof vfs.readdir !== 'function') {
+    ctx.console.error('kernel-home-snapshot: vfs unavailable')
+    ctx.exitCode = 1
+    return
+  }
+  const home =
+    roots.length > 0
+      ? roots[0]
+      : String(vfs.env?.HOME || vfs.env?.USERPROFILE || '/').trim() || '/'
+  let absRoot
+  try {
+    absRoot = vfs.resolveLogical(home)
+  } catch {
+    ctx.console.error('kernel-home-snapshot: bad home path')
+    ctx.exitCode = 1
+    return
+  }
+
+  /** @type {{ path: string, kind: string, size?: number }[]} */
+  const entries = []
+  let truncated = false
+
+  /**
+   * @param {string} abs
+   * @param {string} display
+   * @param {number} depth
+   */
+  async function walk(abs, display, depth) {
+    if (entries.length >= maxFiles) {
+      truncated = true
+      return
+    }
+    if (depth > maxDepth) return
+    /** @type {string[]} */
+    const sub = []
+    try {
+      for await (const n of vfs.readdir(abs)) sub.push(n)
+    } catch {
+      return
+    }
+    sub.sort()
+    for (const name of sub) {
+      if (entries.length >= maxFiles) {
+        truncated = true
+        return
+      }
+      const childAbs = abs.replace(/\/$/, '') + '/' + name
+      const childDisp = display.replace(/\/$/, '') + '/' + name
+      try {
+        for await (const _ of vfs.readdir(childAbs)) {
+          void _
+          break
+        }
+      } catch {
+        let size = 0
+        try {
+          const buf = await vfs.readFile(childAbs)
+          size = buf ? buf.byteLength || buf.length || 0 : 0
+        } catch {
+          size = -1
+        }
+        entries.push({ path: childDisp, kind: 'file', size })
+        continue
+      }
+      entries.push({ path: childDisp, kind: 'dir' })
+      await walk(childAbs, childDisp, depth + 1)
+    }
+  }
+
+  entries.push({ path: home, kind: 'root' })
+  await walk(absRoot, home, 0)
+
   const out = {
-    schema: 1,
-    ok: false,
-    note:
-      'Home snapshot placeholder — stream tar-like archives from personal drive in a future slice; see handbook VFS.',
-    argv: argv.slice(1)
+    schema: 2,
+    ok: true,
+    root: home,
+    entryCount: entries.length,
+    truncated,
+    maxFiles,
+    maxDepth,
+    entries,
+    atMs: Date.now(),
+    note: 'VFS manifest only; use host backup for full byte streams.'
   }
   if (json) {
     ctx.console.log(JSON.stringify(out, null, 2))
   } else {
-    ctx.console.error(
-      'kernel-home-snapshot: not implemented — use host backup tools for now'
+    ctx.console.log(
+      'kernel-home-snapshot: ' +
+        entries.length +
+        ' entries under ' +
+        home +
+        (truncated ? ' (truncated)' : '')
     )
   }
-  ctx.exitCode = 1
+  ctx.exitCode = 0
 }

kernel/bin/openssl

@@ -88,26 +88,24 @@ function bareOsEmitRaw(ctx, chunk) {
 }
 
 /**
- * Minimal placeholder: OpenSSL CLI is not bundled. Documents use of bare-crypto on Pear/Bare
- * hosts instead of Node `node:crypto` (unavailable in guest bare runtime).
+ * OpenSSL CLI compatibility via booter `openssl-cli.js` (bare-crypto).
  */
 async function run(ctx, argv) {
+  if (typeof ctx.bareOsRunOpensslCli === 'function') {
+    await ctx.bareOsRunOpensslCli(argv)
+    return
+  }
   for (let i = 1; i < argv.length; i++) {
     if (argv[i] === '-h' || argv[i] === '--help') {
       ctx.console.log(
-        'usage: openssl [help]\n' +
-          'Bare OS stub: no OpenSSL binary. Use the host `bare-crypto` module from Pear apps;\n' +
-          'do not rely on Node built-ins such as node:crypto in kernel or /bin utilities.'
+        'usage: openssl version | rand -hex N | dgst -sha256 FILE\n' +
+          'Requires ctx.bareOsRunOpensslCli from the stock booter.'
       )
       return
     }
-    if (argv[i].startsWith('-')) {
-      ctx.console.error('openssl: unsupported option ' + argv[i])
-      ctx.exitCode = 1
-      return
-    }
   }
-  ctx.console.log(
-    'openssl: stub — use bare-crypto (see handbook ch.9 and developer-guide Node→Bare map).'
+  ctx.console.error(
+    'openssl: ctx.bareOsRunOpensslCli missing — upgrade booter / ctx API'
   )
+  ctx.exitCode = 1
 }

kernel/bin/ssh-keygen

@@ -88,23 +88,23 @@ function bareOsEmitRaw(ctx, chunk) {
 }
 
 /**
- * Non-crypto stub: Pear/Bare guests must not use Node `node:crypto` for keys.
- * Operators use host **`bare-crypto`** / Pear tooling; see developer-guide Node→Bare map.
+ * Ed25519 key generation via booter `ssh-keygen-cli.js` (bare-crypto + VFS).
  */
 async function run(ctx, argv) {
+  if (typeof ctx.bareOsRunSshKeygenCli === 'function') {
+    await ctx.bareOsRunSshKeygenCli(argv)
+    return
+  }
   const args = argv.slice(1)
   if (args.includes('-h') || args.includes('--help') || args.includes('-?')) {
     ctx.console.log(
-      'Usage: ssh-keygen (stub)\n' +
-        'Bare OS does not generate SSH keys in-guest. Use bare-crypto / Pear host workflows.\n'
+      'Usage: ssh-keygen -t ed25519 -f KEYFILE [-N ""] [-C comment]\n' +
+        'Requires ctx.bareOsRunSshKeygenCli from the stock booter.'
     )
-    ctx.exitCode = 0
     return
   }
   ctx.console.error(
-    'ssh-keygen: Bare OS stub only — use bare-crypto and host key tooling (no node:crypto in guest).'
+    'ssh-keygen: ctx.bareOsRunSshKeygenCli missing — upgrade booter / ctx API'
   )
   ctx.exitCode = 1
 }
-
-export { run }

kernel/bin/tar

@@ -88,38 +88,22 @@ function bareOsEmitRaw(ctx, chunk) {
 }
 
 /**
- * Capability word 10: bounded extended-attribute metadata sketch only (no archive I/O).
- * Full archive workflows use Pear pack / bare-pack tooling outside the stub.
+ * POSIX ustar tar via booter `tar-cli.js` (VFS-backed).
  */
 async function run(ctx, argv) {
-  const args = argv.slice(1)
-  if (
-    args.includes('--bare-os-wave10-xattr-sketch') ||
-    args.includes('--bare-os-xattr-sketch')
-  ) {
-    ctx.console.log(
-      JSON.stringify({
-        schema: 1,
-        note: 'tar xattr subset stub; no archive bytes read in stock coreutils',
-        entries: [],
-        atMs: Date.now()
-      }) + '\n'
-    )
-    ctx.exitCode = 0
+  if (typeof ctx.bareOsRunTarCli === 'function') {
+    await ctx.bareOsRunTarCli(argv)
     return
   }
-  if (args.includes('-h') || args.includes('--help')) {
+  if (argv.includes('-h') || argv.includes('--help')) {
     ctx.console.log(
-      'Usage: tar [--bare-os-wave10-xattr-sketch]\n' +
-        'Bare OS tar is a documentation stub; use Pear/bare-pack for bundles.\n'
+      'usage: tar -cf ARCHIVE PATH... | -tf ARCHIVE | -xf ARCHIVE\n' +
+        'Requires ctx.bareOsRunTarCli from the stock booter.'
     )
-    ctx.exitCode = 0
     return
   }
   ctx.console.error(
-    'tar: Bare OS stub — pass --bare-os-wave10-xattr-sketch for JSON sketch or use host pack tools.'
+    'tar: ctx.bareOsRunTarCli missing — upgrade booter / ctx API'
   )
   ctx.exitCode = 1
 }
-
-export { run }

kernel/bin/wget

@@ -88,12 +88,16 @@ function bareOsEmitRaw(ctx, chunk) {
 }
 
 /**
- * Drive-resident placeholder so `/bin/wget` exists for `ls /bin`, `which wget`, and manifest parity.
- * The booter handles `wget` via host delegation before this script is executed.
+ * `/bin/wget` parity entry: booter delegates to `wget-cli.js` when allowed.
+ * Fallback uses `ctx.bareOsRunWgetCli` for the same Fetch-based implementation.
  */
-async function run(ctx, _argv) {
+async function run(ctx, argv) {
+  if (typeof ctx.bareOsRunWgetCli === 'function') {
+    await ctx.bareOsRunWgetCli(argv)
+    return
+  }
   ctx.console.error(
-    'wget: unexpected — the booter should delegate wget before loading /bin/wget'
+    'wget: ctx.bareOsRunWgetCli missing — upgrade booter / ctx API'
   )
   ctx.exitCode = 1
 }