Holesail Service Daemon + Bin Client

kernel/etc/bare-os/kernel.d/.README

@@ -0,0 +1,14 @@
+# Kernel boot snippets (trusted)
+
+Same execution rules as `../rc.d/.README`: only **digit-prefixed** filenames run, in
+lexicographic order, after `rc.local` in the stock kernel boot graph.
+
+## Holesail (bundled `ctx.bare.holesail`)
+
+Guest `/bin` and `/boot/init.js` scripts are **not** Node modules: use **`ctx.bare.holesail`**
+(the class from the drive bundle under `/lib/bare/bundles/holesail.js`), not `require('holesail')`.
+
+Booter-side operators use initd unit **`bare-holesail`** (on by default in managed mode; **`/bin/holesail`**
+for persisted tunnels), or the early booter path — see
+`handbook/04-the-booter-runtime.md` and env vars `BARE_OS_HOLESAIL_*`. Upstream **holesail** is
+**AGPL-3.0**.

kernel/etc/bare-os/posix_utilities.json

@@ -1,7 +1,7 @@
 {
   "schema": 2,
   "profileId": "bare-os-posix-like",
-  "generatedAt": "2026-04-09T02:26:36.652Z",
+  "generatedAt": "2026-04-09T23:26:09.246Z",
   "note": "Sparse POSIX Issue 7 coverage hints for /bin utilities. Omitted command names are not yet profiled here.",
   "commandIndex": [
     {
@@ -196,6 +196,10 @@
       "name": "help",
       "tier": "tier1_bin"
     },
+    {
+      "name": "holesail",
+      "tier": "tier1_bin"
+    },
     {
       "name": "hostid",
       "tier": "tier1_bin"

kernel/etc/bare-os/units/bare-holesail.unit.example

@@ -0,0 +1,16 @@
+# Example drop-in for bare-holesail (copy to ~/.config/bare-os/units/bare-holesail.unit).
+# Stock boot already enables managed bare-holesail (no env required). Use this file for ordering
+# or to document overrides. Disable: BARE_OS_HOLESAIL_INITD=0 or systemctl disable bare-holesail.
+#
+# Single tunnel (turn off managed first):
+#   BARE_OS_HOLESAIL_MANAGED=0
+#   BARE_OS_HOLESAIL_SERVER=1
+#   BARE_OS_HOLESAIL_SECURE=1
+#
+# Multi-tunnel (default; persisted state via /bin/holesail):
+#   # optional: BARE_OS_HOLESAIL_STATE=~/.holesail/state.json
+#
+# Optional ordering override:
+[Unit]
+After=kernel-logger
+# ConditionEnvironment=BARE_OS_HOLESAIL_INITD=1  # optional gate if you disable by default in a custom image