Move editable kernel bulk from kernel/init-main.js to kernel/lib/init/

(staged as /lib/init/init-main.js); point bundle-kernel-init and verify
scripts at the new path.

Wire curl, wget, openssl, ssh-keygen, and tar through coreutils and
booter host delegates with booter-side CLI helpers; refresh related
bins, bare manifest, shell completion, and man DB (kernel + seeder).

Add booter support modules for ACL evaluation, audit chain, secret
handles, peer admission, replication priority, process table, swarm
lifecycle, boot-graph proc, metrics, monotonic time, protomux alias
registry, and swarm peer policy; extend extension resolver, VFS,
swarm connection managers, IPC, identity-account, and initd.

Harden bare-os-bare-libs build on esbuild failure; add verify scripts
for extension manifest schema and runtime incomplete markers; extend
ctx API typings, gen-ctx-client-stub, and verify-ctx-dts.

Update boot hook fragment, bundled init.js, handbook and reference
docs (incl. kernel security and VFS path classes).

scripts/README.md

@@ -39,7 +39,7 @@ Fails when banned governance tokens (**`Wave N`**, **`wave N`**, **`tranche`**,
 
 **Usage:** `node scripts/bundle-kernel-init.mjs` (also **`npm run bundle:kernel`**)
 
-Concatenates sorted `kernel/lib/boot/*.js` + `kernel/init-main.js` → **`kernel/init.js`**. Run after editing boot fragments; root **`pretest`** invokes it automatically.
+Concatenates sorted `kernel/lib/boot/*.js` + `kernel/lib/init/init-main.js` → **`kernel/init.js`**. Run after editing boot fragments; root **`pretest`** invokes it automatically.
 
 ## `verify-feature-roadmap-canonical.mjs`
 
@@ -77,6 +77,24 @@ Appends one NDJSON trend row (`schema: 1`) to **`BARE_OS_BENCHMARK_TREND_NDJSON`
 
 Ensures [docs/reference/naming-alias-matrix.md](../docs/reference/naming-alias-matrix.md) lists canonical **`ctx`** boot-hook names and boot-policy key aliases. Root **`pretest`**.
 
+## `verify-runtime-no-incomplete-markers.mjs`
+
+**Usage:** `node scripts/verify-runtime-no-incomplete-markers.mjs`
+
+Fails on **`TODO` / `FIXME`** in hand-authored **`kernel/`** and **`packages/bare-os-booter/lib/`** sources (excludes vendored bundles and tests). Root **`pretest`**.
+
+## `gen-ctx-client-stub.mjs`
+
+**Usage:** `node scripts/gen-ctx-client-stub.mjs`
+
+Emits a TypeScript header with **`BARE_OS_CTX_API_CLIENT_VERSION`** aligned to **`bare-os-ctx-api.js`**. Root **`pretest`** (stdout discarded).
+
+## `verify-extension-manifest-schema.mjs`
+
+**Usage:** `node scripts/verify-extension-manifest-schema.mjs`
+
+Validates [docs/schemas/kernel-extension-manifest.schema.json](../docs/schemas/kernel-extension-manifest.schema.json) root shape. Root **`pretest`**.
+
 ## `verify-ctx-api-feature-bits.mjs`
 
 **Usage:** `node scripts/verify-ctx-api-feature-bits.mjs`

scripts/bundle-kernel-init.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * Concatenate kernel/lib/boot/*.js (sorted) + kernel/init-main.js → kernel/init.js.
+ * Concatenate kernel/lib/boot/*.js (sorted) + kernel/lib/init/init-main.js → kernel/init.js.
  * Run after editing boot fragments or init-main; keep packages/bare-os-seeder/kernel in sync.
  */
 import fs from 'node:fs'
@@ -10,7 +10,7 @@ import { fileURLToPath } from 'node:url'
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
 const bootDir = path.join(root, 'kernel', 'lib', 'boot')
-const mainPath = path.join(root, 'kernel', 'init-main.js')
+const mainPath = path.join(root, 'kernel', 'lib', 'init', 'init-main.js')
 const outPath = path.join(root, 'kernel', 'init.js')
 
 function main() {

scripts/gen-ctx-client-stub.mjs

@@ -1,12 +1,27 @@
 #!/usr/bin/env node
 /**
- * Placeholder for generated ctx client typings from schemas (SDK gen roadmap).
- * Target inputs: `docs/schemas/*.schema.json` + `bare-os-ctx.d.ts` — emit TS module per `bareOsCtxApiVersion`.
- * Emits a short header comment to stdout until the generator pipeline lands.
+ * Emit a tiny TypeScript client header aligned with BARE_OS_CTX_API_VERSION.
+ * Full schema-driven generation remains a follow-up; this replaces the stdout placeholder.
  */
+import fs from 'node:fs'
+import path from 'node:path'
 import process from 'node:process'
+import { fileURLToPath } from 'node:url'
 
-console.log(
-  '// gen-ctx-client-stub: replace with schema-driven output (bareOsCtxApiVersion, capability words).'
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const apiPath = path.join(
+  root,
+  'packages/bare-os-booter/lib/bare-os-ctx-api.js'
 )
-process.exit(0)
+const src = fs.readFileSync(apiPath, 'utf8')
+const m = src.match(/export const BARE_OS_CTX_API_VERSION = '([^']+)'/)
+const ver = m ? m[1] : 'unknown'
+
+const out = `// Auto-generated by scripts/gen-ctx-client-stub.mjs — do not edit by hand.
+// Types: import type { BareOsKernelContext } from 'bare-os-booter/lib/bare-os-ctx.js'
+// (path varies by consumer package layout)
+
+export const BARE_OS_CTX_API_CLIENT_VERSION = '${ver}' as const
+`
+
+process.stdout.write(out)

scripts/verify-ctx-dts.mjs

@@ -29,6 +29,19 @@ const needles = [
   'bareOsBareRuntimeVersion',
   'bareOsEmitStructuredCloneCap',
   'bareOsProtomuxChannelAlias',
+  'bareOsProtomuxAliasRegistrySnapshot',
+  'bareOsRunCurlCli',
+  'bareOsRunWgetCli',
+  'bareOsRunOpensslCli',
+  'bareOsRunSshKeygenCli',
+  'bareOsRunTarCli',
+  'bareOsReleaseKeyHandle',
+  'bareOsAuditLogAppend',
+  'bareOsAclEvaluate',
+  'bareOsMetricInc',
+  'bareOsHostCapabilityProfile',
+  'bareOsEvaluatePeerAdmission',
+  'bareOsPrioritizeReplicationPaths',
   'bareOsEmitPearStageHint',
   'bareOsBareModuleResolveProbe',
   'bareOsBareCryptoCapProbe',

scripts/verify-extension-manifest-schema.mjs

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+/**
+ * CI: ensure kernel-extension-manifest.schema.json is valid JSON Schema draft 2020-12.
+ */
+import fs from 'node:fs'
+import path from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const p = path.join(root, 'docs/schemas/kernel-extension-manifest.schema.json')
+
+function main() {
+  const j = JSON.parse(fs.readFileSync(p, 'utf8'))
+  if (j.$schema !== 'https://json-schema.org/draft/2020-12/schema') {
+    console.error('verify-extension-manifest-schema: expected draft 2020-12 $schema')
+    process.exit(1)
+  }
+  if (j.type !== 'object' || !Array.isArray(j.required)) {
+    console.error('verify-extension-manifest-schema: invalid root')
+    process.exit(1)
+  }
+  console.log('verify-extension-manifest-schema: OK')
+}
+
+main()

scripts/verify-runtime-no-incomplete-markers.mjs

@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+/**
+ * CI: forbid TODO/FIXME markers in hand-authored kernel + booter runtime sources.
+ * Excludes vendored bundles, generated kernel/bin, and test harness files.
+ */
+import fs from 'node:fs'
+import path from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+
+const MARKER_RE = /\b(TODO|FIXME)\b/
+
+/** @param {string} dir */
+function walk(dir) {
+  /** @type {string[]} */
+  const out = []
+  if (!fs.existsSync(dir)) return out
+  for (const ent of fs.readdirSync(dir, { withFileTypes: true })) {
+    const p = path.join(dir, ent.name)
+    if (ent.isDirectory()) {
+      if (ent.name === 'bundles') continue
+      if (ent.name === 'node_modules') continue
+      out.push(...walk(p))
+    } else if (ent.isFile() && ent.name.endsWith('.js')) {
+      out.push(p)
+    }
+  }
+  return out
+}
+
+function shouldSkipFile(rel) {
+  if (rel.startsWith(`packages${path.sep}bare-os-booter${path.sep}test`))
+    return true
+  if (rel === `packages${path.sep}bare-os-booter${path.sep}test.js`) return true
+  if (rel.startsWith(`kernel${path.sep}bin${path.sep}`)) return true
+  if (rel.includes(`${path.sep}bundles${path.sep}`)) return true
+  return false
+}
+
+function main() {
+  const files = [
+    path.join(root, 'kernel', 'init.js'),
+    path.join(root, 'kernel', 'lib', 'init', 'init-main.js'),
+    ...walk(path.join(root, 'kernel', 'lib', 'boot')),
+    ...walk(path.join(root, 'packages', 'bare-os-booter', 'lib')),
+    path.join(root, 'packages', 'bare-os-booter', 'index.js')
+  ]
+
+  /** @type {string[]} */
+  const bad = []
+  for (const abs of files) {
+    if (!fs.existsSync(abs)) continue
+    const rel = path.relative(root, abs)
+    if (shouldSkipFile(rel)) continue
+    const txt = fs.readFileSync(abs, 'utf8')
+    for (let i = 0; i < txt.length; i++) {
+      const slice = txt.slice(i, i + 200)
+      const m = slice.match(MARKER_RE)
+      if (!m) continue
+      const line = txt.slice(0, i).split('\n').length
+      bad.push(`${rel}:${line}:${m[1]}`)
+      break
+    }
+  }
+
+  if (bad.length) {
+    console.error(
+      'verify-runtime-no-incomplete-markers: TODO/FIXME in runtime sources:'
+    )
+    for (const b of bad) console.error(' ', b)
+    process.exit(1)
+  }
+  console.log('verify-runtime-no-incomplete-markers: OK')
+}
+
+main()