feat(bare-os): kernel wave 3 — bits3, seed RPCs, policy, proc, CI schemas
Add third capability word (STOCK_V3) and word2 tail bits; seed RPCs snapshot_hints and peer_firewall_stats; /proc mirrors (snapshot_hints, pear_trust, rlimits, hdms_health, initd_graph) and /proc/net/udp; boot policy v3 (requireFeatureBits2/3, Pear IPC allowlist, VFS deny prefixes, initd restart cap); VFS enforcement for boot-policy path denies; delegate in-flight caps; gated shell local/declare; initd path conditions, ordered suspend/resume, OnInactiveSec timers; vfs.watch swarm/replication; validate-example-schemas.mjs + ajv in pretest; extend verify-ctx for V3; bump ctx API to 1.12.0; ADR 001, protocol, handbook, dev-guide, and reference docs; seeder/kernel parity and booter tests. Chore: Prettier table alignment in CHANGELOG and READMEs; compact bareOsRequestPearReload signature in bare-os-ctx.d.ts.
This commit is contained in:
Raven Scott
@@ -18,55 +18,63 @@ Former **DOCUMENTATION.md** §14, §14a. [Reference index →](README.md)
|
||||
| `MANWIDTH` | `/bin/man` | Wrap width for manual text (default `72`; minimum `40`) |
|
||||
| `NO_COLOR` | `/bin/man` | If set, disable ANSI bold for section headings on a TTY |
|
||||
|
||||
**Host → session passthrough** (booter copies into **`shellEnv`** when the host sets a non-empty value): `BARE_OS_PIPELINE_MAX_STAGES`, `BARE_OS_PIPELINE_MAX_BYTES`, `BARE_OS_PIPELINE_MAX_LINES`, `BARE_OS_SHELL_STREAMING`, `BARE_OS_SHELL_STREAMING_MULT`, `BARE_OS_SHELL_CMDSUBST`, `BARE_OS_SHELL_CMDSUBST_MAX_BYTES`, `BARE_OS_SHELL_PARAM_EXPANSION`, `BARE_OS_SHELL_PARAM_EXPANSION_V2`, `BARE_OS_ENV_DASH_S`, `BARE_OS_VFS_WATCH_PSEUDO`, `BARE_OS_DIAGNOSTICS_SUBSCRIBE`, `BARE_OS_AUTOPASS_INVITE_URL`, `BARE_OS_BIN_WORKER_OFFLOAD`, `BARE_OS_BIN_WORKER_ALLOW`, `BARE_OS_BOOT_PROFILE`, `BARE_OS_ONBOOT`, `BARE_OS_BOOT_STRICT`, `BARE_OS_RC_D_SKIP`, `BARE_OS_BOOT_MINIMAL`, `BARE_OS_BOOT_SKIP`, `BARE_OS_BOOT_TRACE`, `BARE_OS_KERNEL_SELFTEST`, `BARE_OS_SELFTEST_FORMAT`, `BARE_OS_AUDIT`, `BARE_OS_AUDIT_JSON`, `BARE_OS_AUDIT_REDACT`, `BARE_OS_IMAGE_DIGEST`, `BARE_OS_EXEC_MAX_DEPTH`, `BARE_OS_EXEC_LINE_BUDGET_MS`, `BARE_OS_IPC_MAX_BYTES`, `BARE_OS_IPC_CHANNEL_MAX_BYTES`, `BARE_OS_IPC_RPC_TOKEN`, `BARE_OS_IPC_FANOUT`, `BARE_OS_IPC_JSON_MAX_BYTES`, `BARE_OS_IPC_NAMESPACE`, `BARE_OS_VFS_WATCH`, `BARE_OS_VFS_UNION_PREFIXES`, `BARE_OS_VFS_UNION_WRITE_DENY`, `BARE_OS_VFS_BIN_CACHE`, `BARE_OS_BOOT_ALLOWLIST`, `BARE_OS_BOOT_MANIFEST`, `BARE_OS_BOOT_MANIFEST_SIGN`, `BARE_OS_BOOT_MANIFEST_PUBKEY_HEX`, `BARE_OS_BOOT_POLICY`, `BARE_OS_BOOT_POLICY_STRICT`, `BARE_OS_LAZY_PERSONAL_DRIVE`, `BARE_OS_SYSTEM_REVISION_ID`, `BARE_OS_SYSTEM_REVISION_PENDING`, `BARE_OS_SYSTEM_SLOT`, `BARE_OS_DELEGATE_ALLOW`, `BARE_OS_DELEGATE_MAX_PER_MIN`, `BARE_OS_DELEGATE_GIT_MAX_PER_MIN`, `BARE_OS_DELEGATE_CURL_MAX_PER_MIN`, `BARE_OS_DELEGATE_WGET_MAX_PER_MIN`, `BARE_OS_DELEGATE_SYSTEMCTL_MAX_PER_MIN`, `BARE_OS_DELEGATE_AUDIT_ONLY`, `BARE_OS_DNS_ALLOWLIST`, `BARE_OS_KERNEL_HOT_RELOAD`, `BARE_OS_SANDBOX_SCRIPT`, `BARE_OS_SANDBOX_WORKER`, `BARE_OS_INITD_MAX_PARALLEL`, `BARE_OS_INITD_JOURNAL_MAX_LINES`, `BARE_OS_URANDOM_CRYPTO`, `BARE_OS_TELEMETRY_NDJSON`, `BARE_OS_TELEMETRY_OTEL_JSONL`, `BARE_OS_PROC_POLL_MS`, `BARE_OS_SEED_RPC_HANDSHAKE`, `BARE_OS_SEED_CAP_STRICT`, `BARE_OS_SEED_CAP_FAIL`, `BARE_OS_HTTP_ALLOWLIST`, `BARE_OS_HTTP_DENYLIST`, `BARE_OS_TLS_PIN_SHA256`, `BARE_OS_BARE_MODULES`, `BARE_OS_BARE_DRIVE_BUNDLES`, `BARE_OS_PEAR_CHANNEL`, `BARE_OS_PEAR_RELEASE`, `PEAR_CHANNEL`, `BARE_OS_FIND_EXEC_MAX`, `BARE_OS_YES_MAX_LINES`, `BARE_OS_SHUF_MAX_LINES`, `BARE_OS_SPLIT_MAX_FILES`, `BARE_OS_NPROC`, `BARE_OS_BLIND_BOOTSTRAP_URL`, `BARE_OS_BLIND_BOOTSTRAP_JSON`, `BARE_OS_MIRROR_READ_KEY`, **`TERM`**, **`COLORTERM`**.
|
||||
**Host → session passthrough** (booter copies into **`shellEnv`** when the host sets a non-empty value): `BARE_OS_PIPELINE_MAX_STAGES`, `BARE_OS_PIPELINE_MAX_BYTES`, `BARE_OS_PIPELINE_MAX_LINES`, `BARE_OS_SHELL_STREAMING`, `BARE_OS_SHELL_STREAMING_MULT`, `BARE_OS_SHELL_CMDSUBST`, `BARE_OS_SHELL_CMDSUBST_MAX_BYTES`, `BARE_OS_SHELL_PARAM_EXPANSION`, `BARE_OS_SHELL_PARAM_EXPANSION_V2`, `BARE_OS_ENV_DASH_S`, `BARE_OS_VFS_WATCH_PSEUDO`, `BARE_OS_VFS_WATCH_SWARM`, `BARE_OS_SHELL_LOCAL_DECLARE`, `BARE_OS_DIAGNOSTICS_SUBSCRIBE`, `BARE_OS_AUTOPASS_INVITE_URL`, `BARE_OS_BIN_WORKER_OFFLOAD`, `BARE_OS_BIN_WORKER_ALLOW`, `BARE_OS_BOOT_PROFILE`, `BARE_OS_ONBOOT`, `BARE_OS_BOOT_STRICT`, `BARE_OS_RC_D_SKIP`, `BARE_OS_BOOT_MINIMAL`, `BARE_OS_BOOT_SKIP`, `BARE_OS_BOOT_TRACE`, `BARE_OS_KERNEL_SELFTEST`, `BARE_OS_SELFTEST_FORMAT`, `BARE_OS_AUDIT`, `BARE_OS_AUDIT_JSON`, `BARE_OS_AUDIT_REDACT`, `BARE_OS_IMAGE_DIGEST`, `BARE_OS_EXEC_MAX_DEPTH`, `BARE_OS_EXEC_LINE_BUDGET_MS`, `BARE_OS_IPC_MAX_BYTES`, `BARE_OS_IPC_CHANNEL_MAX_BYTES`, `BARE_OS_IPC_RPC_TOKEN`, `BARE_OS_IPC_FANOUT`, `BARE_OS_IPC_JSON_MAX_BYTES`, `BARE_OS_IPC_NAMESPACE`, `BARE_OS_VFS_WATCH`, `BARE_OS_VFS_UNION_PREFIXES`, `BARE_OS_VFS_UNION_WRITE_DENY`, `BARE_OS_VFS_BIN_CACHE`, `BARE_OS_BOOT_ALLOWLIST`, `BARE_OS_BOOT_MANIFEST`, `BARE_OS_BOOT_MANIFEST_SIGN`, `BARE_OS_BOOT_MANIFEST_PUBKEY_HEX`, `BARE_OS_BOOT_POLICY`, `BARE_OS_BOOT_POLICY_STRICT`, `BARE_OS_LAZY_PERSONAL_DRIVE`, `BARE_OS_SYSTEM_REVISION_ID`, `BARE_OS_SYSTEM_REVISION_PENDING`, `BARE_OS_SYSTEM_SLOT`, `BARE_OS_DELEGATE_ALLOW`, `BARE_OS_DELEGATE_MAX_PER_MIN`, `BARE_OS_DELEGATE_MAX_CONCURRENT`, `BARE_OS_DELEGATE_GIT_MAX_PER_MIN`, `BARE_OS_DELEGATE_CURL_MAX_PER_MIN`, `BARE_OS_DELEGATE_WGET_MAX_PER_MIN`, `BARE_OS_DELEGATE_SYSTEMCTL_MAX_PER_MIN`, `BARE_OS_DELEGATE_AUDIT_ONLY`, `BARE_OS_DNS_ALLOWLIST`, `BARE_OS_KERNEL_HOT_RELOAD`, `BARE_OS_SANDBOX_SCRIPT`, `BARE_OS_SANDBOX_WORKER`, `BARE_OS_INITD_MAX_PARALLEL`, `BARE_OS_INITD_JOURNAL_MAX_LINES`, `BARE_OS_URANDOM_CRYPTO`, `BARE_OS_TELEMETRY_NDJSON`, `BARE_OS_TELEMETRY_OTEL_JSONL`, `BARE_OS_PROC_POLL_MS`, `BARE_OS_SEED_RPC_HANDSHAKE`, `BARE_OS_SEED_CAP_STRICT`, `BARE_OS_SEED_CAP_FAIL`, `BARE_OS_HTTP_ALLOWLIST`, `BARE_OS_HTTP_DENYLIST`, `BARE_OS_TLS_PIN_SHA256`, `BARE_OS_BARE_MODULES`, `BARE_OS_BARE_DRIVE_BUNDLES`, `BARE_OS_PEAR_CHANNEL`, `BARE_OS_PEAR_RELEASE`, `PEAR_CHANNEL`, `BARE_OS_FIND_EXEC_MAX`, `BARE_OS_YES_MAX_LINES`, `BARE_OS_SHUF_MAX_LINES`, `BARE_OS_SPLIT_MAX_FILES`, `BARE_OS_NPROC`, `BARE_OS_BLIND_BOOTSTRAP_URL`, `BARE_OS_BLIND_BOOTSTRAP_JSON`, `BARE_OS_MIRROR_READ_KEY`, `BARE_OS_PEAR_TRUST_JSON`, `BARE_OS_HOST_BUNDLE_EVALUATE`, **`TERM`**, **`COLORTERM`**.
|
||||
|
||||
| Variable | Used by | Meaning |
|
||||
| -------- | ------- | ------- |
|
||||
| `BARE_OS_VFS_UNION_PREFIXES` | Booter / VFS | Comma-separated logical path prefixes where **`readFile`** may union system + overlay sources. |
|
||||
| `BARE_OS_VFS_UNION_WRITE_DENY` | Booter / VFS | When **`1`** / **`true`**, block **`writeFile`** / **`unlink`** on paths under union read prefixes (read-only union overlay). |
|
||||
| `BARE_OS_IPC_CHANNEL_MAX_BYTES` | Booter / IPC | Optional JSON map **`{"fifoName": maxBytes}`** (or legacy comma form) capping buffered bytes per FIFO name under **`/run/bare-os/ipc/`**. |
|
||||
| `BARE_OS_VFS_BIN_CACHE` | VFS | When **`1`** / **`true`**, LRU read cache for **`/bin`**; invalidated on **`vfs.watch`** when enabled. |
|
||||
| `BARE_OS_BOOT_MANIFEST` | Stock kernel | Enable digest check of **`/etc/bare-os/boot.manifest.json`**. |
|
||||
| `BARE_OS_BOOT_MANIFEST_SIGN` | Stock kernel + booter | When **`1`**, require valid Ed25519 signature file **`/etc/bare-os/boot.manifest.sig`** (see **`BARE_OS_BOOT_MANIFEST_PUBKEY_HEX`**). |
|
||||
| `BARE_OS_BOOT_MANIFEST_PUBKEY_HEX` | Booter / kernel | 64 hex chars — public key for signed boot manifest verification. |
|
||||
| `BARE_OS_BOOT_POLICY` | Stock kernel | When **`1`** / **`true`**, merge **`skipPhases`** / **`denyBootPhases`** from **`/etc/bare-os/boot.policy.json`**; optional **`minKernelFeatureMask`** / **`requireSeedCaps`**; v2 optional **`maxExecLineDepth`**, **`denyEnvKeys`**, **`requireProcNodes`** (see **`kernel/etc/bare-os/boot.policy.example.json`**). |
|
||||
| `BARE_OS_BOOT_POLICY_STRICT` | Stock kernel | When **`1`**, abort boot if **`minKernelFeatureMask`** or **`requireSeedCaps`** checks fail. |
|
||||
| `BARE_OS_LAZY_PERSONAL_DRIVE` | Booter | When **`1`**, defer mounting the personal Hyperdrive until session setup (after kernel bytes are loaded). |
|
||||
| `BARE_OS_SYSTEM_REVISION_ID` / `BARE_OS_SYSTEM_REVISION_PENDING` / `BARE_OS_SYSTEM_SLOT` | Booter | Pear-style hints exposed as **`ctx.bareOsSystemRevision`**. |
|
||||
| `BARE_OS_DELEGATE_ALLOW` | Host delegates | Comma list **`git`**, **`curl`**, **`wget`**, **`systemctl`** — empty = all allowed. |
|
||||
| `BARE_OS_DNS_ALLOWLIST` | curl / wget | Optional host allowlist for http(s) URLs (`*.example.com` suffix form supported). |
|
||||
| `BARE_OS_KERNEL_HOT_RELOAD` | Booter | Dev: allow **`ctx.bareOsRequestKernelReload()`** to re-read **`/boot/init.js`**. |
|
||||
| `BARE_OS_IPC_NAMESPACE` | VFS / mkfifo / initd | Prefix simulated FIFO keys as **`<ns>__<name>`** while logical paths stay **`/run/bare-os/ipc/<name>`**. |
|
||||
| `BARE_OS_SANDBOX_SCRIPT` | `ctx.bareOsSandboxRunScript` | Set **`0`** / **`false`** to disable sandbox script helper. |
|
||||
| `BARE_OS_SANDBOX_WORKER` | Booter | When **`1`**, defers **`bareOsSandboxRunScript`** on a **fresh microtask** (async boundary); **not** a separate thread or isolate. |
|
||||
| `BARE_OS_INITD_MAX_PARALLEL` | bare-initd | Max concurrent unit **starts** per DAG level (integer ≥ **1**; default **1**). |
|
||||
| `BARE_OS_INITD_JOURNAL_MAX_LINES` | bare-initd / unit journals | Cap lines retained per unit NDJSON journal under **`/run/bare-os/unit-journal/`**. |
|
||||
| `BARE_OS_TELEMETRY_NDJSON` | Booter | Absolute or **`~/…`** path in the **guest VFS**: append capped NDJSON telemetry records (**`telemetrySchemaVersion` / `lifecycleSchemaVersion`: 3**, **`ts`**, …) mirroring structured boot/kernel events. |
|
||||
| `BARE_OS_TELEMETRY_OTEL_JSONL` | Booter / var-log | Guest VFS path for OTLP-inspired JSON lines (var-log mirrors). |
|
||||
| `BARE_OS_PROC_POLL_MS` | VFS | Coalescing interval for **`/proc/bare_os/metrics_live.json`** (250–60000). |
|
||||
| `BARE_OS_SHELL_PARAM_EXPANSION` | Shell | When **`1`**, enable **`${VAR:-word}`** and **`${VAR#prefix}`** in **`expandWord`**. |
|
||||
| `BARE_OS_SHELL_PARAM_EXPANSION_V2` | Shell | With param expansion on, enable **`${VAR:=word}`**, **`${VAR##*/}`** / **`${VAR#*/}`**, **`${VAR%%suffix}`** / **`${VAR%suffix}`** (bounded patterns). |
|
||||
| `BARE_OS_ENV_DASH_S` | `/bin/env` | When **`1`**, enable **`-S` / `--split-string`** and **`--env-file`** (bounded). |
|
||||
| `BARE_OS_VFS_WATCH_PSEUDO` | VFS | When **`1`**, allow **`vfs.watch`** on coalesced **`/proc/bare_os/metrics_live.json`**. |
|
||||
| `BARE_OS_DIAGNOSTICS_SUBSCRIBE` | Booter | When **`1`**, **`ctx.bareOsDiagnosticsSubscribe`** receives structured booter events. |
|
||||
| `BARE_OS_AUTOPASS_INVITE_URL` | `/proc/bare_os/hdms_hints.json` | Optional operator invite URL hint (guest does not fetch it). |
|
||||
| `BARE_OS_BIN_WORKER_OFFLOAD` | Reserved | With **`BARE_OS_BIN_WORKER_ALLOW`** (comma list), gates future bare-thread **`/bin`** offload; stock booter still runs in-process. |
|
||||
| `BARE_OS_EXEC_LINE_BUDGET_MS` | Booter | Reject top-level **`execLine`** when cumulative wall time exceeds budget. |
|
||||
| `BARE_OS_DELEGATE_MAX_PER_MIN` | Host delegates | Global per-minute cap (sliding window) on delegate invocations. |
|
||||
| `BARE_OS_DELEGATE_*_MAX_PER_MIN` | Host delegates | Per-kind override (**`GIT`**, **`CURL`**, **`WGET`**, **`SYSTEMCTL`**). |
|
||||
| `BARE_OS_DELEGATE_AUDIT_ONLY` | Host delegates | With **`BARE_OS_AUDIT`**, log delegate calls and skip execution (**exit 0**). |
|
||||
| `BARE_OS_SEED_RPC_HANDSHAKE` | Booter | Set **`0`** / **`false`** to skip the pre-MBR **`bare_os.capabilities`** RPC against the first peer. |
|
||||
| `BARE_OS_SEED_CAP_STRICT` | Booter | When **`1`** / **`true`**, require seeder feature **`bits`** / **`bits2`** to cover stock booter **`BARE_OS_KERNEL_FEATURES_STOCK_V1`** / **`STOCK_V2`** or throw. |
|
||||
| `BARE_OS_SEED_CAP_FAIL` | Booter | When **`1`** / **`true`**, rethrow after a failed handshake instead of recording the error and continuing. |
|
||||
| `BARE_OS_URANDOM_CRYPTO` | VFS **`/dev/urandom`** | Set **`0`** to use non-crypto PRNG for synthetic urandom (default prefers crypto where available). |
|
||||
| `BARE_OS_BLIND_BOOTSTRAP_URL` | `/proc/bare_os_bootstrap` | Non-empty URL string echoed into the proc JSON for host/operator wiring (guest does not fetch it). |
|
||||
| `BARE_OS_BLIND_BOOTSTRAP_JSON` | `/proc/bare_os_bootstrap` | Inline JSON string parsed and exposed under **`blindBootstrap`** (invalid JSON yields an error object in the proc file). |
|
||||
| `BARE_OS_MIRROR_READ_KEY` | Replication proc / mirror hint | Optional mirror drive key string included in replication snapshot for operators. |
|
||||
| `BARE_OS_SHELL_LOOP_MAX` | Shell | Max iterations for **`while`** / **`for`** (default **10000**). |
|
||||
| `BARE_OS_SHELL_CASE_MAX_BRANCHES` | Shell | Max **`case`** branches (default **32**). |
|
||||
| `BARE_OS_GREP_FILTER_MAX` | **`grep -r`** | Max **`--include` / `--exclude` / `--exclude-dir`** glob patterns (default **32**). |
|
||||
| `BARE_OS_SED_NULL_MAX_RECORDS` | **`sed -z`** | Max NUL-separated records per run (default **100000**). |
|
||||
| `BARE_OS_HYPER_MULTISIG_VERIFY` | Seeder | When set, runs **`hyper-multisig verify`** via **[`bare-subprocess`](https://github.com/holepunchto/bare-subprocess)** under Pear/Bare (dependency of **`bare-os-seeder`**), or **`child_process`** on Node. Requires **`hyper-multisig`** on **`PATH`**. |
|
||||
| Variable | Used by | Meaning |
|
||||
| ---------------------------------------------------------------------------------------- | ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| `BARE_OS_VFS_UNION_PREFIXES` | Booter / VFS | Comma-separated logical path prefixes where **`readFile`** may union system + overlay sources. |
|
||||
| `BARE_OS_VFS_UNION_WRITE_DENY` | Booter / VFS | When **`1`** / **`true`**, block **`writeFile`** / **`unlink`** on paths under union read prefixes (read-only union overlay). |
|
||||
| `BARE_OS_IPC_CHANNEL_MAX_BYTES` | Booter / IPC | Optional JSON map **`{"fifoName": maxBytes}`** (or legacy comma form) capping buffered bytes per FIFO name under **`/run/bare-os/ipc/`**. |
|
||||
| `BARE_OS_VFS_BIN_CACHE` | VFS | When **`1`** / **`true`**, LRU read cache for **`/bin`**; invalidated on **`vfs.watch`** when enabled. |
|
||||
| `BARE_OS_BOOT_MANIFEST` | Stock kernel | Enable digest check of **`/etc/bare-os/boot.manifest.json`**. |
|
||||
| `BARE_OS_BOOT_MANIFEST_SIGN` | Stock kernel + booter | When **`1`**, require valid Ed25519 signature file **`/etc/bare-os/boot.manifest.sig`** (see **`BARE_OS_BOOT_MANIFEST_PUBKEY_HEX`**). |
|
||||
| `BARE_OS_BOOT_MANIFEST_PUBKEY_HEX` | Booter / kernel | 64 hex chars — public key for signed boot manifest verification. |
|
||||
| `BARE_OS_BOOT_POLICY` | Stock kernel | When **`1`** / **`true`**, merge **`skipPhases`** / **`denyBootPhases`** from **`/etc/bare-os/boot.policy.json`**; optional **`minKernelFeatureMask`** / **`requireSeedCaps`**; v2 **`maxExecLineDepth`**, **`denyEnvKeys`**, **`requireProcNodes`**; v3 **`requireFeatureBits2`**, **`requireFeatureBits3`**, **`allowedPearIpcChannels`**, **`denyVfsPrefixes`**, **`maxInitdRestartsPerUnit`** (see **`kernel/etc/bare-os/boot.policy.example.json`** and **[`docs/schemas/boot.policy.schema.json`](../schemas/boot.policy.schema.json)**). |
|
||||
| `BARE_OS_BOOT_POLICY_STRICT` | Stock kernel | When **`1`**, abort boot if **`minKernelFeatureMask`** or **`requireSeedCaps`** checks fail. |
|
||||
| `BARE_OS_BOOT_POLICY_DENY_VFS` | Stock kernel / **`boot.policy` v3** | Comma-separated absolute prefixes; VFS denies read/write/stat/readdir/chdir/unlink under them (set from **`denyVfsPrefixes`**). |
|
||||
| `BARE_OS_BOOT_POLICY_PEAR_IPC_CHANNELS` | Stock kernel / **`boot.policy` v3** | Comma-separated Pear IPC channel allowlist for **`ctx.bareOsPearIpcEmit`** (from **`allowedPearIpcChannels`**). |
|
||||
| `BARE_OS_LAZY_PERSONAL_DRIVE` | Booter | When **`1`**, defer mounting the personal Hyperdrive until session setup (after kernel bytes are loaded). |
|
||||
| `BARE_OS_SYSTEM_REVISION_ID` / `BARE_OS_SYSTEM_REVISION_PENDING` / `BARE_OS_SYSTEM_SLOT` | Booter | Pear-style hints exposed as **`ctx.bareOsSystemRevision`**. |
|
||||
| `BARE_OS_DELEGATE_ALLOW` | Host delegates | Comma list **`git`**, **`curl`**, **`wget`**, **`systemctl`** — empty = all allowed. |
|
||||
| `BARE_OS_DNS_ALLOWLIST` | curl / wget | Optional host allowlist for http(s) URLs (`*.example.com` suffix form supported). |
|
||||
| `BARE_OS_KERNEL_HOT_RELOAD` | Booter | Dev: allow **`ctx.bareOsRequestKernelReload()`** to re-read **`/boot/init.js`**. |
|
||||
| `BARE_OS_IPC_NAMESPACE` | VFS / mkfifo / initd | Prefix simulated FIFO keys as **`<ns>__<name>`** while logical paths stay **`/run/bare-os/ipc/<name>`**. |
|
||||
| `BARE_OS_SANDBOX_SCRIPT` | `ctx.bareOsSandboxRunScript` | Set **`0`** / **`false`** to disable sandbox script helper. |
|
||||
| `BARE_OS_SANDBOX_WORKER` | Booter | When **`1`**, defers **`bareOsSandboxRunScript`** on a **fresh microtask** (async boundary); **not** a separate thread or isolate. |
|
||||
| `BARE_OS_INITD_MAX_PARALLEL` | bare-initd | Max concurrent unit **starts** per DAG level (integer ≥ **1**; default **1**). |
|
||||
| `BARE_OS_INITD_JOURNAL_MAX_LINES` | bare-initd / unit journals | Cap lines retained per unit NDJSON journal under **`/run/bare-os/unit-journal/`**. |
|
||||
| `BARE_OS_TELEMETRY_NDJSON` | Booter | Absolute or **`~/…`** path in the **guest VFS**: append capped NDJSON telemetry records (**`telemetrySchemaVersion` / `lifecycleSchemaVersion`: 3**, **`ts`**, …) mirroring structured boot/kernel events. |
|
||||
| `BARE_OS_TELEMETRY_OTEL_JSONL` | Booter / var-log | Guest VFS path for OTLP-inspired JSON lines (var-log mirrors). |
|
||||
| `BARE_OS_PROC_POLL_MS` | VFS | Coalescing interval for **`/proc/bare_os/metrics_live.json`** (250–60000). |
|
||||
| `BARE_OS_SHELL_PARAM_EXPANSION` | Shell | When **`1`**, enable **`${VAR:-word}`** and **`${VAR#prefix}`** in **`expandWord`**. |
|
||||
| `BARE_OS_SHELL_PARAM_EXPANSION_V2` | Shell | With param expansion on, enable **`${VAR:=word}`**, **`${VAR##*/}`** / **`${VAR#*/}`**, **`${VAR%%suffix}`** / **`${VAR%suffix}`** (bounded patterns). |
|
||||
| `BARE_OS_ENV_DASH_S` | `/bin/env` | When **`1`**, enable **`-S` / `--split-string`** and **`--env-file`** (bounded). |
|
||||
| `BARE_OS_VFS_WATCH_PSEUDO` | VFS | When **`1`**, allow **`vfs.watch`** on coalesced **`/proc/bare_os/metrics_live.json`**. |
|
||||
| `BARE_OS_VFS_WATCH_SWARM` | VFS | When **`1`**, allow bounded **`vfs.watch`** on **`/proc/bare_os/swarm`**, flat **`/proc/bare_os_swarm`**, **`/proc/bare_os/replication`**, **`/proc/bare_os_replication`** (poll interval **`BARE_OS_PROC_POLL_MS`**). |
|
||||
| `BARE_OS_SHELL_LOCAL_DECLARE` | Shell | When **`1`**, **`local`** and read-only **`declare -r`** apply per shell line (shallow **`vfs.env`** copy). |
|
||||
| `BARE_OS_DIAGNOSTICS_SUBSCRIBE` | Booter | When **`1`**, **`ctx.bareOsDiagnosticsSubscribe`** receives structured booter events. |
|
||||
| `BARE_OS_AUTOPASS_INVITE_URL` | `/proc/bare_os/hdms_hints.json` | Optional operator invite URL hint (guest does not fetch it). |
|
||||
| `BARE_OS_BIN_WORKER_OFFLOAD` | Reserved | With **`BARE_OS_BIN_WORKER_ALLOW`** (comma list), gates future bare-thread **`/bin`** offload; stock booter still runs in-process. |
|
||||
| `BARE_OS_EXEC_LINE_BUDGET_MS` | Booter | Reject top-level **`execLine`** when cumulative wall time exceeds budget. |
|
||||
| `BARE_OS_DELEGATE_MAX_PER_MIN` | Host delegates | Global per-minute cap (sliding window) on delegate invocations. |
|
||||
| `BARE_OS_DELEGATE_*_MAX_PER_MIN` | Host delegates | Per-kind override (**`GIT`**, **`CURL`**, **`WGET`**, **`SYSTEMCTL`**). |
|
||||
| `BARE_OS_DELEGATE_MAX_CONCURRENT` | Host delegates | Max parallel delegate runs globally (integer **1–64**; **`0`** / unset = unlimited). |
|
||||
| `BARE_OS_DELEGATE_*_MAX_CONCURRENT` | Host delegates | Per-kind in-flight cap (**`GIT`**, **`CURL`**, **`WGET`**, **`SYSTEMCTL`**). |
|
||||
| `BARE_OS_DELEGATE_AUDIT_ONLY` | Host delegates | With **`BARE_OS_AUDIT`**, log delegate calls and skip execution (**exit 0**). |
|
||||
| `BARE_OS_SEED_RPC_HANDSHAKE` | Booter | Set **`0`** / **`false`** to skip the pre-MBR **`bare_os.capabilities`** RPC against the first peer. |
|
||||
| `BARE_OS_SEED_CAP_STRICT` | Booter | When **`1`** / **`true`**, require seeder **`bits`** / **`bits2`** / **`bits3`** to cover stock booter **`STOCK_V1`** / **`STOCK_V2`** / **`STOCK_V3`** or throw. |
|
||||
| `BARE_OS_SEED_CAP_FAIL` | Booter | When **`1`** / **`true`**, rethrow after a failed handshake instead of recording the error and continuing. |
|
||||
| `BARE_OS_URANDOM_CRYPTO` | VFS **`/dev/urandom`** | Set **`0`** to use non-crypto PRNG for synthetic urandom (default prefers crypto where available). |
|
||||
| `BARE_OS_BLIND_BOOTSTRAP_URL` | `/proc/bare_os_bootstrap` | Non-empty URL string echoed into the proc JSON for host/operator wiring (guest does not fetch it). |
|
||||
| `BARE_OS_BLIND_BOOTSTRAP_JSON` | `/proc/bare_os_bootstrap` | Inline JSON string parsed and exposed under **`blindBootstrap`** (invalid JSON yields an error object in the proc file). |
|
||||
| `BARE_OS_MIRROR_READ_KEY` | Replication proc / mirror hint | Optional mirror drive key string included in replication snapshot for operators. |
|
||||
| `BARE_OS_PEAR_TRUST_JSON` | `/proc/bare_os/pear_trust.json` | Optional operator JSON merged into trust summary (guest does not verify multisig). |
|
||||
| `BARE_OS_HOST_BUNDLE_EVALUATE` | `ctx.bareOsHostCapability` | When **`1`**, advertise host **`bundleEvaluate`** for optional cross-worker / **`bare-bundle-evaluate`** paths (host-only). |
|
||||
| `BARE_OS_SHELL_LOOP_MAX` | Shell | Max iterations for **`while`** / **`for`** (default **10000**). |
|
||||
| `BARE_OS_SHELL_CASE_MAX_BRANCHES` | Shell | Max **`case`** branches (default **32**). |
|
||||
| `BARE_OS_GREP_FILTER_MAX` | **`grep -r`** | Max **`--include` / `--exclude` / `--exclude-dir`** glob patterns (default **32**). |
|
||||
| `BARE_OS_SED_NULL_MAX_RECORDS` | **`sed -z`** | Max NUL-separated records per run (default **100000**). |
|
||||
| `BARE_OS_HYPER_MULTISIG_VERIFY` | Seeder | When set, runs **`hyper-multisig verify`** via **[`bare-subprocess`](https://github.com/holepunchto/bare-subprocess)** under Pear/Bare (dependency of **`bare-os-seeder`**), or **`child_process`** on Node. Requires **`hyper-multisig`** on **`PATH`**. |
|
||||
|
||||
**Session env (set by booter, not user configuration):** `USER`, `LOGNAME`, `HOME`, `PWD`, `UID`, `GID`, `GROUP`, `BARE_OS_IDENTITY` (`guest` or `unlocked`), `BARE_OS_CTX_API_VERSION`, `BARE_OS_SESSION_ID`, `BARE_OS_BOOT_PROFILE_RESOLVED`, and when unlocked `BARE_OS_PUBLIC_KEY` (hex Ed25519 public key).
|
||||
|
||||
@@ -85,11 +93,11 @@ Former **DOCUMENTATION.md** §14, §14a. [Reference index →](README.md)
|
||||
|
||||
## 14a. POSIX userland appendix (implemented vs gaps)
|
||||
|
||||
| Area | Status |
|
||||
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| **VFS** | Two-drive unified paths; **`$HOME`** maps to the personal Hyperdrive; writable mounts under **`/mnt`** when HDMS allows. **`mkdir`/`rmdir`**, **`chmod`** (octal + symbolic subset), **`symlink`/`readlink`**, **`stat`/`lstat`**, **`rm`** recursive, **`watch()`** on Hyperdrive paths (optional host **`BARE_OS_VFS_WATCH=0`** to disable). Synthetic **`/proc`**, **`/sys`**, **`/run`**, **`/dev`** for introspection (quotas JSON, boot JSON, initd snapshot, union policy, seed handshake, virtual registry, etc.). Optional union read overlays (**`BARE_OS_VFS_UNION_PREFIXES`**) with optional write deny (**`BARE_OS_VFS_UNION_WRITE_DENY`**). Empty dirs use **`.bareos_empty`** (same idea as `git-fs-adapter`). |
|
||||
| **Shell** | Pipelines, **`;`**, **`&&`** / **`||`**, redirects, quoting, **`$VAR`**, **`$?`**, optional **`${VAR:-word}`** / **`${VAR#prefix}`** when **`BARE_OS_SHELL_PARAM_EXPANSION=1`**, **`jobs`** / **`fg`** / **`wait`**, optional background **`&`** segments, builtins including bounded **`if`**, **`while`**, **`for`**, **`case`** (caps **`BARE_OS_SHELL_LOOP_MAX`**, **`BARE_OS_SHELL_CASE_MAX_BRANCHES`**). Optional bounded **`$(…)`** when **`BARE_OS_SHELL_CMDSUBST=1`**; optional larger pipeline capture via **`BARE_OS_SHELL_STREAMING`** / **`BARE_OS_SHELL_STREAMING_MULT`**. Branching uses **`ctx.exitCode`**. Bounded pipeline capture (**`BARE_OS_PIPELINE_*`**, **`ctx.bareOsRuntimeCaps`**); optional boot-snippet allowlist (**`BARE_OS_BOOT_ALLOWLIST`** + **`/etc/bare-os/boot.allow`**). No subshells or full POSIX **`sh`**. |
|
||||
| **Ownership** | Display and permission checks use **`UID`/`GID`** and mode bits; **`chown`/`chgrp`** update **`metadata.bareOs`** on the **personal** writable tree (not a multi-user host kernel). |
|
||||
| Area | Status |
|
||||
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| **VFS** | Two-drive unified paths; **`$HOME`** maps to the personal Hyperdrive; writable mounts under **`/mnt`** when HDMS allows. **`mkdir`/`rmdir`**, **`chmod`** (octal + symbolic subset), **`symlink`/`readlink`**, **`stat`/`lstat`**, **`rm`** recursive, **`watch()`** on Hyperdrive paths (optional host **`BARE_OS_VFS_WATCH=0`** to disable). Synthetic **`/proc`**, **`/sys`**, **`/run`**, **`/dev`** for introspection (quotas JSON, boot JSON, initd snapshot, union policy, seed handshake, virtual registry, etc.). Optional union read overlays (**`BARE_OS_VFS_UNION_PREFIXES`**) with optional write deny (**`BARE_OS_VFS_UNION_WRITE_DENY`**). Empty dirs use **`.bareos_empty`** (same idea as `git-fs-adapter`). |
|
||||
| **Shell** | Pipelines, **`;`**, **`&&`** / \*\*` | | `**, redirects, quoting, **`$VAR`**, **`$?`**, optional **`${VAR:-word}`** / **`${VAR#prefix}`** when **`BARE*OS_SHELL_PARAM_EXPANSION=1`**, **`jobs`** / **`fg`** / **`wait`**, optional background **`&`** segments, builtins including bounded **`if`**, **`while`**, **`for`**, **`case`** (caps **`BARE_OS_SHELL_LOOP_MAX`**, **`BARE_OS_SHELL_CASE_MAX_BRANCHES`**). Optional bounded **`$(…)`** when **`BARE_OS_SHELL_CMDSUBST=1`**; optional larger pipeline capture via **`BARE_OS_SHELL_STREAMING`** / **`BARE_OS_SHELL_STREAMING_MULT`**. Branching uses **`ctx.exitCode`**. Bounded pipeline capture (**`BARE_OS_PIPELINE*\*`**, **`ctx.bareOsRuntimeCaps`**); optional boot-snippet allowlist (**`BARE_OS_BOOT_ALLOWLIST`** + **`/etc/bare-os/boot.allow`**). No subshells or full POSIX **`sh`\*\*. |
|
||||
| **Ownership** | Display and permission checks use **`UID`/`GID`** and mode bits; **`chown`/`chgrp`** update **`metadata.bareOs`** on the **personal** writable tree (not a multi-user host kernel). |
|
||||
| **Utilities** | Tier-1 JS **`/bin`** (**~113** commands; see [§12.10](package-bare-os-coreutils-and-ci.md#1210-package-bare-os-coreutils)): text tools include **`paste`**, **`split`**, **`tac`**, **`rev`**, **`expand`**, **`unexpand`**, **`fold`**, **`fmt`**, **`comm`**, **`cmp`**, **`join`**, **`pr`**, **`yes`** (line-capped via **`BARE_OS_YES_MAX_LINES`** / **`getconf`**), **`shuf`** (capped via **`BARE_OS_SHUF_MAX_LINES`**), **`tsort`**, **`factor`**, **`expr`** (integer-focused subset), **`numfmt`** (**`--to=iec`** / **`--to=si`**). Checksums: **`md5sum`** (bundled MD5), **`sha1sum`**, **`sha256sum`**, **`sha512sum`** (Web Crypto where available), **`sum`**, **`base32`**, **`basenc`** (**`--base16`**). Files: **`truncate`**, **`unlink`**, **`install`**, **`df`** (synthetic Hyperdrive row; **`-h`** human sizes), **`sync`** (no-op), **`timeout`** (wall-clock cap; exit **124** on timeout when **`BARE_OS_FEATURE_ABORT_TIMEOUT`** is advertised). Session stubs: **`arch`**, **`groups`**, **`hostid`**, **`nproc`**, **`uptime`**, **`users`**, **`who`**. Plus earlier parity: **`man`**, **`sed`** (including **`-z`**, **`BARE_OS_SED_NULL_MAX_RECORDS`**), **`awk`**, **`grep`** (**`-r`** with **`--include`/`--exclude`/`--exclude-dir`**, **`BARE_OS_GREP_FILTER_MAX`**), **`cp`** (**`-u`/`-v`/`-p`**), **`mv`**, **`find`** (**`-regex`**, **`-exec`/`-ok`**, **`BARE_OS_FIND_EXEC_MAX`**), **`mktemp`**, **`git-pear`**, **`cksum`**, **`getconf`** (includes pipeline / cap names + **`-a`**), **`xargs`**, **`dircolors`**, **`theme`**, **`ls`**, **`uniq`**, **`realpath`**, **`base64`**, **`rm`** **`-d`**, **`stat`** **`%F`**. **`dir`** / **`vdir`** call **`ls`**. Large **`sed`/`awk`** are not byte-identical to GNU on all inputs. **`mkfifo`** → **`/run/bare-os/ipc/`**. Online help: **`/share/man/man.json`** and **`man`**. |
|
||||
|
||||
**Handbook:** [handbook/09-posix-utilities-shell-and-vfs.md](../../handbook/09-posix-utilities-shell-and-vfs.md) — narrative catalog, engine notes, and Issue 7 alignment. **Manual pages:** [handbook/10-manpages-and-online-help.md](../../handbook/10-manpages-and-online-help.md).
|
||||
|
||||
@@ -8,12 +8,12 @@ Bare OS exposes **`curl`** and **`wget`** as familiar command names, but they ar
|
||||
|
||||
## Where to read more
|
||||
|
||||
| Topic | Location |
|
||||
| ----- | -------- |
|
||||
| Flag parity and history | [`packages/bare-os-booter/CLI_PARITY.md`](../../packages/bare-os-booter/CLI_PARITY.md) |
|
||||
| Topic | Location |
|
||||
| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
||||
| Flag parity and history | [`packages/bare-os-booter/CLI_PARITY.md`](../../packages/bare-os-booter/CLI_PARITY.md) |
|
||||
| Online **`man curl`** / **`man wget`** | Merged manual DB: [`packages/bare-os-coreutils/man/pages/curl.json`](../../packages/bare-os-coreutils/man/pages/curl.json), [`wget.json`](../../packages/bare-os-coreutils/man/pages/wget.json); narrative in [Handbook ch. 10](../../handbook/10-manpages-and-online-help.md) |
|
||||
| Security, allowlists, audit | [Developer guide — Security and trust](../../developer-guide/09-security-and-trust.md) |
|
||||
| Environment variables (tables) | [Environment variables and POSIX appendix](environment-and-posix-appendix.md#14-environment-variables-complete-list) |
|
||||
| Security, allowlists, audit | [Developer guide — Security and trust](../../developer-guide/09-security-and-trust.md) |
|
||||
| Environment variables (tables) | [Environment variables and POSIX appendix](environment-and-posix-appendix.md#14-environment-variables-complete-list) |
|
||||
|
||||
---
|
||||
|
||||
@@ -28,7 +28,7 @@ Order for a simple command name:
|
||||
3. **`*.js` in `$PWD`** — before **`PATH`**.
|
||||
4. **`PATH`** on the **system** drive only — normal **`/bin`** utilities.
|
||||
|
||||
**`BARE_OS_DELEGATE_ALLOW`** (host → session passthrough) may restrict which delegate **kinds** run. When set to a comma- or whitespace-separated list (**`git`**, **`curl`**, **`wget`**, **`systemctl`**), only those kinds are allowed; a denied delegate logs a message and exits with **126**. When unset or empty, all registered delegates are allowed. Optional **per-minute** rate limits use **`BARE_OS_DELEGATE_MAX_PER_MIN`** and per-kind **`BARE_OS_DELEGATE_*_MAX_PER_MIN`**. With **`BARE_OS_AUDIT=1`**, **`BARE_OS_DELEGATE_AUDIT_ONLY=1`** logs invocations and skips the host run (**exit 0**). Optional audit logging for delegate invocations is described in the security guide.
|
||||
**`BARE_OS_DELEGATE_ALLOW`** (host → session passthrough) may restrict which delegate **kinds** run. When set to a comma- or whitespace-separated list (**`git`**, **`curl`**, **`wget`**, **`systemctl`**), only those kinds are allowed; a denied delegate logs a message and exits with **126**. When unset or empty, all registered delegates are allowed. Optional **per-minute** rate limits use **`BARE_OS_DELEGATE_MAX_PER_MIN`** and per-kind **`BARE_OS_DELEGATE_*_MAX_PER_MIN`**. Optional **in-flight** caps use **`BARE_OS_DELEGATE_MAX_CONCURRENT`** (global) and **`BARE_OS_DELEGATE_<KIND>_MAX_CONCURRENT`** (e.g. **`CURL`**, **`GIT`**, **`WGET`**, **`SYSTEMCTL`**) to queue or reject parallel delegate runs. With **`BARE_OS_AUDIT=1`**, **`BARE_OS_DELEGATE_AUDIT_ONLY=1`** logs invocations and skips the host run (**exit 0**). Optional audit logging for delegate invocations is described in the security guide.
|
||||
|
||||
---
|
||||
|
||||
@@ -65,12 +65,12 @@ The booter may also call **`primeGlobalFetchFromBareLibrary(bareLibrary)`** duri
|
||||
|
||||
These are summarized in the [environment appendix](environment-and-posix-appendix.md); the security guide explains threat model and audit interaction.
|
||||
|
||||
| Variable | Role |
|
||||
| -------- | ---- |
|
||||
| **`BARE_OS_HTTP_ALLOWLIST`** / **`BARE_OS_HTTP_DENYLIST`** | Restrict outbound **http(s)** URLs for policy-wrapped fetch (delegated clients and **`ctx.httpFetch`**). |
|
||||
| **`BARE_OS_TLS_PIN_SHA256`** | Optional TLS certificate pinning hint forwarded for pinning-aware hosts. |
|
||||
| **`BARE_OS_DNS_ALLOWLIST`** | Optional host allowlist for **http(s)** URLs in delegated **`curl`** / **`wget`** (suffix forms such as **`*.example.com`** supported). |
|
||||
| **`BARE_OS_DELEGATE_ALLOW`** | Limits which delegate kinds (**`curl`**, **`wget`**, …) may run. |
|
||||
| Variable | Role |
|
||||
| ---------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| **`BARE_OS_HTTP_ALLOWLIST`** / **`BARE_OS_HTTP_DENYLIST`** | Restrict outbound **http(s)** URLs for policy-wrapped fetch (delegated clients and **`ctx.httpFetch`**). |
|
||||
| **`BARE_OS_TLS_PIN_SHA256`** | Optional TLS certificate pinning hint forwarded for pinning-aware hosts. |
|
||||
| **`BARE_OS_DNS_ALLOWLIST`** | Optional host allowlist for **http(s)** URLs in delegated **`curl`** / **`wget`** (suffix forms such as **`*.example.com`** supported). |
|
||||
| **`BARE_OS_DELEGATE_ALLOW`** | Limits which delegate kinds (**`curl`**, **`wget`**, …) may run. |
|
||||
|
||||
---
|
||||
|
||||
|
||||
@@ -1,66 +1,90 @@
|
||||
# Kernel capabilities index (bits, env, `/proc`, `ctx`)
|
||||
|
||||
Single map from optional **feature bits** ([`packages/bare-os-protocol/lib/kernel-feature-bits.js`](../../packages/bare-os-protocol/lib/kernel-feature-bits.js)) to operator env vars, guest **`/proc`** paths, and **`ctx`** fields. Stock booter advertises **`BARE_OS_KERNEL_FEATURES_STOCK_V1`** (word 1) and **`BARE_OS_KERNEL_FEATURES_STOCK_V2`** (word 2, `bits2` on the wire). Governance: [`developer-guide/adr/001-kernel-feature-bits-governance.md`](../../developer-guide/adr/001-kernel-feature-bits-governance.md).
|
||||
Single map from optional **feature bits** ([`packages/bare-os-protocol/lib/kernel-feature-bits.js`](../../packages/bare-os-protocol/lib/kernel-feature-bits.js)) to operator env vars, guest **`/proc`** paths, and **`ctx`** fields. Stock booter advertises **`BARE_OS_KERNEL_FEATURES_STOCK_V1`** (word 1), **`BARE_OS_KERNEL_FEATURES_STOCK_V2`** (`bits2`), and **`BARE_OS_KERNEL_FEATURES_STOCK_V3`** (`bits3`). Governance: [`developer-guide/adr/001-kernel-feature-bits-governance.md`](../../developer-guide/adr/001-kernel-feature-bits-governance.md).
|
||||
|
||||
| Bit (export) | Env / behavior | `/proc` or RPC | `ctx` / notes |
|
||||
|--------------|----------------|----------------|---------------|
|
||||
| 0 `IPC_FANOUT` | `BARE_OS_IPC_FANOUT` | `/run/bare-os/ipc/` | `bareOsIpc` |
|
||||
| 1 `ABORT_TIMEOUT` | — | — | `execLine` / `readLine` opts |
|
||||
| 2 `HTTP_POLICY` | `BARE_OS_HTTP_*` | — | `httpFetch` |
|
||||
| 3 `VIRTUAL_FILES` | — | `/run/bare-os/virtual/` | `bareOsRegisterVirtualFile` |
|
||||
| 4 `HOST_STATS` | — | host bridge | `bareOsHostStats` |
|
||||
| 5 `CRYPTO_URANDOM` | `BARE_OS_URANDOM_CRYPTO=0` disables | `/dev/urandom` | — |
|
||||
| 6 `SANDBOX_SCRIPT` | `BARE_OS_SANDBOX_SCRIPT=0` | — | `bareOsSandboxRunScript` |
|
||||
| 7 `BOOT_PHASE_HOOKS` | — | — | `bareOsRegisterBootPhaseHook` |
|
||||
| 8 `IPC_DUPLEX` | — | — | `bareOsIpc.createDuplexBridge` |
|
||||
| 9 `VFS_UNION` | `BARE_OS_VFS_UNION_PREFIXES` | `/proc/bare_os_union` | — |
|
||||
| 10 `PROC_SWARM` | — | `/proc/bare_os_swarm` | — |
|
||||
| 11 `SHELL_STREAMING_PIPES` | `BARE_OS_SHELL_STREAMING` | `/proc/bare_os_quotas` | — |
|
||||
| 12 `SHELL_CMDSUBST` | `BARE_OS_SHELL_CMDSUBST` | — | — |
|
||||
| 13 `SEED_CAP_RPC` | `BARE_OS_SEED_RPC_HANDSHAKE` | `/proc/bare_os_seed_handshake` | `bareOsSeedCapabilityBits` |
|
||||
| 14 `EXTENDED_PROC` | — | `/proc/self/fd`, `/sys/devices` | — |
|
||||
| 15 `VIRTUAL_FILE_META` | — | `/proc/bare_os_virtual_registry` | virtual `mime` / `ttlMs` |
|
||||
| 16 `VFS_UNION_WRITE_POLICY` | `BARE_OS_VFS_UNION_WRITE_DENY` | `/proc/bare_os_union` | — |
|
||||
| 17 `IPC_PER_CHANNEL` | `BARE_OS_IPC_CHANNEL_MAX_BYTES` | — | `bareOsIpc.stats` |
|
||||
| 18 `SANDBOX_WORKER` | `BARE_OS_SANDBOX_WORKER` | — | microtask defer |
|
||||
| 19 `TELEMETRY_EXPORT` | `BARE_OS_TELEMETRY_NDJSON` | — | NDJSON v3 schema |
|
||||
| 20 `BOOT_POLICY` | `BARE_OS_BOOT_POLICY` | — | `kernel/init.js` |
|
||||
| 21 `SEED_REPLICATION_STATUS_RPC` | — | `/proc/bare_os_replication` | seed RPC |
|
||||
| 22 `LAZY_PERSONAL_DRIVE` | `BARE_OS_LAZY_PERSONAL_DRIVE` | — | — |
|
||||
| 23 `SYSTEM_REVISION_HOOKS` | `BARE_OS_SYSTEM_REVISION_*` | `/proc/bare_os/provenance` | `bareOsSystemRevision` |
|
||||
| 24 `BARE_MANIFEST_TIERS` | `BARE_OS_BUNDLE_TIER` | — | `ctx.bare` build |
|
||||
| 25 `HOST_DELEGATE_REGISTRY` | `BARE_OS_DELEGATE_*` | audit log | git/curl/wget/systemctl |
|
||||
| 26 `IPC_SESSION_NAMESPACE` | `BARE_OS_IPC_NAMESPACE` | — | FIFO key prefix |
|
||||
| 27 `PROC_BARE_OS_DIR` | — | `/proc/bare_os/index.json` | stable aliases |
|
||||
| 28 `SEED_MANIFEST_HINTS_RPC` | — | `/proc/bare_os/manifest_hints`, replication JSON | RPC `bare_os.manifest_hints` |
|
||||
| 29 `LIFECYCLE_TELEMETRY_V3` | telemetry NDJSON | — | `lifecycleSchemaVersion: 3` |
|
||||
| 30 `BOOT_POLICY_V2` | extended `boot.policy.json` | — | `maxExecLineDepth`, `denyEnvKeys`, `requireProcNodes` |
|
||||
| Bit (export) | Env / behavior | `/proc` or RPC | `ctx` / notes |
|
||||
| -------------------------------- | ----------------------------------- | ------------------------------------------------ | ----------------------------------------------------- |
|
||||
| 0 `IPC_FANOUT` | `BARE_OS_IPC_FANOUT` | `/run/bare-os/ipc/` | `bareOsIpc` |
|
||||
| 1 `ABORT_TIMEOUT` | — | — | `execLine` / `readLine` opts |
|
||||
| 2 `HTTP_POLICY` | `BARE_OS_HTTP_*` | — | `httpFetch` |
|
||||
| 3 `VIRTUAL_FILES` | — | `/run/bare-os/virtual/` | `bareOsRegisterVirtualFile` |
|
||||
| 4 `HOST_STATS` | — | host bridge | `bareOsHostStats` |
|
||||
| 5 `CRYPTO_URANDOM` | `BARE_OS_URANDOM_CRYPTO=0` disables | `/dev/urandom` | — |
|
||||
| 6 `SANDBOX_SCRIPT` | `BARE_OS_SANDBOX_SCRIPT=0` | — | `bareOsSandboxRunScript` |
|
||||
| 7 `BOOT_PHASE_HOOKS` | — | — | `bareOsRegisterBootPhaseHook` |
|
||||
| 8 `IPC_DUPLEX` | — | — | `bareOsIpc.createDuplexBridge` |
|
||||
| 9 `VFS_UNION` | `BARE_OS_VFS_UNION_PREFIXES` | `/proc/bare_os_union` | — |
|
||||
| 10 `PROC_SWARM` | — | `/proc/bare_os_swarm` | — |
|
||||
| 11 `SHELL_STREAMING_PIPES` | `BARE_OS_SHELL_STREAMING` | `/proc/bare_os_quotas` | — |
|
||||
| 12 `SHELL_CMDSUBST` | `BARE_OS_SHELL_CMDSUBST` | — | — |
|
||||
| 13 `SEED_CAP_RPC` | `BARE_OS_SEED_RPC_HANDSHAKE` | `/proc/bare_os_seed_handshake` | `bareOsSeedCapabilityBits` |
|
||||
| 14 `EXTENDED_PROC` | — | `/proc/self/fd`, `/sys/devices` | — |
|
||||
| 15 `VIRTUAL_FILE_META` | — | `/proc/bare_os_virtual_registry` | virtual `mime` / `ttlMs` |
|
||||
| 16 `VFS_UNION_WRITE_POLICY` | `BARE_OS_VFS_UNION_WRITE_DENY` | `/proc/bare_os_union` | — |
|
||||
| 17 `IPC_PER_CHANNEL` | `BARE_OS_IPC_CHANNEL_MAX_BYTES` | — | `bareOsIpc.stats` |
|
||||
| 18 `SANDBOX_WORKER` | `BARE_OS_SANDBOX_WORKER` | — | microtask defer |
|
||||
| 19 `TELEMETRY_EXPORT` | `BARE_OS_TELEMETRY_NDJSON` | — | NDJSON v3 schema |
|
||||
| 20 `BOOT_POLICY` | `BARE_OS_BOOT_POLICY` | — | `kernel/init.js` |
|
||||
| 21 `SEED_REPLICATION_STATUS_RPC` | — | `/proc/bare_os_replication` | seed RPC |
|
||||
| 22 `LAZY_PERSONAL_DRIVE` | `BARE_OS_LAZY_PERSONAL_DRIVE` | — | — |
|
||||
| 23 `SYSTEM_REVISION_HOOKS` | `BARE_OS_SYSTEM_REVISION_*` | `/proc/bare_os/provenance` | `bareOsSystemRevision` |
|
||||
| 24 `BARE_MANIFEST_TIERS` | `BARE_OS_BUNDLE_TIER` | — | `ctx.bare` build |
|
||||
| 25 `HOST_DELEGATE_REGISTRY` | `BARE_OS_DELEGATE_*` | audit log | git/curl/wget/systemctl |
|
||||
| 26 `IPC_SESSION_NAMESPACE` | `BARE_OS_IPC_NAMESPACE` | — | FIFO key prefix |
|
||||
| 27 `PROC_BARE_OS_DIR` | — | `/proc/bare_os/index.json` | stable aliases |
|
||||
| 28 `SEED_MANIFEST_HINTS_RPC` | — | `/proc/bare_os/manifest_hints`, replication JSON | RPC `bare_os.manifest_hints` |
|
||||
| 29 `LIFECYCLE_TELEMETRY_V3` | telemetry NDJSON | — | `lifecycleSchemaVersion: 3` |
|
||||
| 30 `BOOT_POLICY_V2` | extended `boot.policy.json` | — | `maxExecLineDepth`, `denyEnvKeys`, `requireProcNodes` |
|
||||
|
||||
### Word 2 (`bits2`, wave 2)
|
||||
|
||||
| Bit (export) | Env / behavior | `/proc` or RPC | `ctx` / notes |
|
||||
|--------------|----------------|----------------|---------------|
|
||||
| 0 `FEATURE2_SEED_REPLICATION_QUEUE_RPC` | — | seed RPC `replication_queue`; replication JSON | queue / backpressure hints |
|
||||
| 1 `FEATURE2_SEED_CAPABILITY_ATTESTATION_RPC` | `BARE_OS_SEED_CAPABILITY_ATTESTATION_JSON` (seeder) | RPC `capability_attestation` | optional distro attestation JSON |
|
||||
| 2 `FEATURE2_SEED_MBR_LAYOUT_RPC` | — | RPC `mbr_layout`; replication JSON `mbrKeysHex` | MBR failover key hints |
|
||||
| 3 `FEATURE2_PEAR_IPC_REQUEST` | — | — | `bareOsPearIpcRequest` |
|
||||
| 4 `FEATURE2_MIRROR_DRIVE_CTX` | — | — | `bareOsEmitMirrorDriveHint` |
|
||||
| 5 `FEATURE2_AUTOPASS_HDMS_HINTS` | `BARE_OS_AUTOPASS_INVITE_URL` | `/proc/bare_os/hdms_hints.json` | operational pairing hint only |
|
||||
| 6 `FEATURE2_BIN_WORKER_OFFLOAD` | `BARE_OS_BIN_WORKER_OFFLOAD`, `BARE_OS_BIN_WORKER_ALLOW` | — | reserved / gated heavy `/bin` (stock remains in-process) |
|
||||
| 7 `FEATURE2_DIAGNOSTICS_CHANNEL` | `BARE_OS_DIAGNOSTICS_SUBSCRIBE=1` | — | `bareOsDiagnosticsSubscribe` / `Emit` |
|
||||
| 8 `FEATURE2_INITD_IDLE_STOP` | initd `IdleSec=` | — | socket-activated idle stop |
|
||||
| 9 `FEATURE2_INITD_UNITS_D` | — | — | `~/.config/bare-os/units.d/<unit>/*.conf` |
|
||||
| 10 `FEATURE2_CRON_REBOOT_JITTER` | — | — | `@reboot`, `JitterSec=`, timer `JitterSec=` |
|
||||
| 11 `FEATURE2_INITD_BOOT_READY_UNITS` | — | `/run/bare-os/boot.json` | `subsystems.initdActiveUnits` |
|
||||
| 12 `FEATURE2_PROC_CGROUPS_TCP` | — | `/proc/self/cgroups`, `/proc/net/tcp` | Linux-shaped stubs |
|
||||
| 13 `FEATURE2_VFS_WATCH_PSEUDO` | `BARE_OS_VFS_WATCH_PSEUDO=1` | metrics pseudo | bounded `vfs.watch` on metrics |
|
||||
| 14 `FEATURE2_SHELL_PARAM_EXPAND_V2` | `BARE_OS_SHELL_PARAM_EXPANSION_V2=1` (+ param expansion on) | — | `##`, `%%`, `:=`, `*/` basename |
|
||||
| 15 `FEATURE2_ENV_DASH_S` | `BARE_OS_ENV_DASH_S=1` | — | `/bin/env` `-S`, `--env-file` |
|
||||
| 16 `FEATURE2_JSON_SCHEMAS_REPO` | — | [`docs/schemas/`](../../docs/schemas/) | published JSON Schemas |
|
||||
| 17 `FEATURE2_CONTRACT_TESTS_WAVE2` | — | — | expanded contract tests |
|
||||
| 18 `FEATURE2_KERNEL_EXT_PROC` | — | `/proc/bare_os/extensions.json` | `bareOsRegisterKernelExtensionRecord` |
|
||||
| Bit (export) | Env / behavior | `/proc` or RPC | `ctx` / notes |
|
||||
| -------------------------------------------- | ----------------------------------------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------------- |
|
||||
| 0 `FEATURE2_SEED_REPLICATION_QUEUE_RPC` | — | seed RPC `replication_queue`; replication JSON | queue / backpressure hints |
|
||||
| 1 `FEATURE2_SEED_CAPABILITY_ATTESTATION_RPC` | `BARE_OS_SEED_CAPABILITY_ATTESTATION_JSON` (seeder) | RPC `capability_attestation` | optional distro attestation JSON |
|
||||
| 2 `FEATURE2_SEED_MBR_LAYOUT_RPC` | — | RPC `mbr_layout`; replication JSON `mbrKeysHex` | MBR failover key hints |
|
||||
| 3 `FEATURE2_PEAR_IPC_REQUEST` | — | — | `bareOsPearIpcRequest` |
|
||||
| 4 `FEATURE2_MIRROR_DRIVE_CTX` | — | — | `bareOsEmitMirrorDriveHint` |
|
||||
| 5 `FEATURE2_AUTOPASS_HDMS_HINTS` | `BARE_OS_AUTOPASS_INVITE_URL` | `/proc/bare_os/hdms_hints.json` | operational pairing hint only |
|
||||
| 6 `FEATURE2_BIN_WORKER_OFFLOAD` | `BARE_OS_BIN_WORKER_OFFLOAD`, `BARE_OS_BIN_WORKER_ALLOW` | — | reserved / gated heavy `/bin` (stock remains in-process) |
|
||||
| 7 `FEATURE2_DIAGNOSTICS_CHANNEL` | `BARE_OS_DIAGNOSTICS_SUBSCRIBE=1` | — | `bareOsDiagnosticsSubscribe` / `Emit` |
|
||||
| 8 `FEATURE2_INITD_IDLE_STOP` | initd `IdleSec=` | — | socket-activated idle stop |
|
||||
| 9 `FEATURE2_INITD_UNITS_D` | — | — | `~/.config/bare-os/units.d/<unit>/*.conf` |
|
||||
| 10 `FEATURE2_CRON_REBOOT_JITTER` | — | — | `@reboot`, `JitterSec=`, timer `JitterSec=` |
|
||||
| 11 `FEATURE2_INITD_BOOT_READY_UNITS` | — | `/run/bare-os/boot.json` | `subsystems.initdActiveUnits` |
|
||||
| 12 `FEATURE2_PROC_CGROUPS_TCP` | — | `/proc/self/cgroups`, `/proc/net/tcp` | Linux-shaped stubs |
|
||||
| 13 `FEATURE2_VFS_WATCH_PSEUDO` | `BARE_OS_VFS_WATCH_PSEUDO=1` | metrics pseudo | bounded `vfs.watch` on metrics |
|
||||
| 14 `FEATURE2_SHELL_PARAM_EXPAND_V2` | `BARE_OS_SHELL_PARAM_EXPANSION_V2=1` (+ param expansion on) | — | `##`, `%%`, `:=`, `*/` basename |
|
||||
| 15 `FEATURE2_ENV_DASH_S` | `BARE_OS_ENV_DASH_S=1` | — | `/bin/env` `-S`, `--env-file` |
|
||||
| 16 `FEATURE2_JSON_SCHEMAS_REPO` | — | [`docs/schemas/`](../../docs/schemas/) | published JSON Schemas |
|
||||
| 17 `FEATURE2_CONTRACT_TESTS_WAVE2` | — | — | expanded contract tests |
|
||||
| 18 `FEATURE2_KERNEL_EXT_PROC` | — | `/proc/bare_os/extensions.json` | `bareOsRegisterKernelExtensionRecord` |
|
||||
| 19 `FEATURE2_SEED_SNAPSHOT_HINTS_RPC` | — | RPC `bare_os.snapshot_hints`; `/proc/bare_os/snapshot_hints.json` | corestore-snapshot-style hints (guest does not verify crypto) |
|
||||
| 20 `FEATURE2_SEED_PEER_FIREWALL_STATS_RPC` | — | RPC `bare_os.peer_firewall_stats`; replication JSON | bounded counts / topology sketch |
|
||||
| 21 `FEATURE2_SEED_STAGING_SLOT_SURFACE` | — | `staging_slot` RPC + replication | A/B slot hints |
|
||||
| 22 `FEATURE2_PROC_PEAR_TRUST` | `BARE_OS_PEAR_TRUST_JSON` | `/proc/bare_os/pear_trust.json` | operator trust summary |
|
||||
| 23 `FEATURE2_BLIND_PEER_HINT` | — | Pear IPC `bare_os_blind_peer_hint` | `bareOsEmitBlindPeerHint` |
|
||||
| 24 `FEATURE2_BARE_SUBPROCESS_BRIDGE` | `BARE_OS_BARE_SUBPROCESS_*` | — | documented host-only long-running child bridge |
|
||||
| 25 `FEATURE2_INITD_CONDITION_PATH` | — | — | `ConditionPathExists=` / `AssertPathExists=` |
|
||||
| 26 `FEATURE2_INITD_GRAPH_PROC` | — | `/proc/bare_os/initd_graph.json` | same DAG payload as `initd_dag.json` (+ optional `dot`) |
|
||||
| 27 `FEATURE2_INITD_SUSPEND_RESUME_ORDER` | — | — | mobile suspend/resume walks initd boot order |
|
||||
| 28 `FEATURE2_TIMER_ON_INACTIVE` | — | — | `OnInactiveSec=` / `Persistent=` timers |
|
||||
| 29 `FEATURE2_PROC_NET_UDP` | — | `/proc/net/udp` | Linux-shaped stub |
|
||||
| 30 `FEATURE2_VFS_WATCH_SWARM` | `BARE_OS_VFS_WATCH_SWARM` | swarm / replication pseudo | bounded poll watch |
|
||||
| 31 `FEATURE2_HDMS_HEALTH_PROC` | — | `/proc/bare_os/hdms_health.json` | non-secret vault health |
|
||||
|
||||
**Related `ctx` (1.11.0+):** `bareOsReadProcMetricsLive()` — parsed coalesced metrics (same as `/proc/bare_os/metrics_live.json`); Pear IPC channel names in [`bare-os-pear-ipc-registry.js`](../../packages/bare-os-booter/lib/bare-os-pear-ipc-registry.js).
|
||||
### Word 3 (`bits3`, wave 3)
|
||||
|
||||
| Bit (export) | Env / behavior | `/proc` or RPC | `ctx` / notes |
|
||||
| ---------------------------------- | ----------------------------------- | ---------------------------- | ----------------------------------------------------------------------------------------------- |
|
||||
| 0 `FEATURE3_PROC_RLIMITS_JSON` | — | `/proc/bare_os/rlimits.json` | getrlimit-shaped mirror of runtime caps |
|
||||
| 1 `FEATURE3_BOOT_POLICY_V3` | `boot.policy.json` v3 | — | `requireFeatureBits2/3`, `allowedPearIpcChannels`, `denyVfsPrefixes`, `maxInitdRestartsPerUnit` |
|
||||
| 2 `FEATURE3_DELEGATE_CONCURRENCY` | `BARE_OS_DELEGATE_*_MAX_CONCURRENT` | audit NDJSON | per-kind parallel caps |
|
||||
| 3 `FEATURE3_SHELL_LOCAL_DECLARE` | `BARE_OS_SHELL_LOCAL_DECLARE` | — | `local` / `declare -r` per shell line |
|
||||
| 4 `FEATURE3_HOST_CAPABILITY_PROBE` | `BARE_OS_HOST_BUNDLE_EVALUATE` | — | `bareOsHostCapability('bundleEvaluate')` |
|
||||
| 5 `FEATURE3_CI_SCHEMA_EXAMPLES` | — | — | `scripts/validate-example-schemas.mjs` in **`pretest`** |
|
||||
|
||||
**Related `ctx` (1.12.0+):** `bareOsReadProcMetricsLive()` — parsed coalesced metrics (same as `/proc/bare_os/metrics_live.json`); **`bareOsEmitBlindPeerHint`**, **`bareOsHostCapability`**; Pear IPC channel names in [`bare-os-pear-ipc-registry.js`](../../packages/bare-os-booter/lib/bare-os-pear-ipc-registry.js).
|
||||
|
||||
**Handbook:** [handbook/09-posix-utilities-shell-and-vfs.md](../../handbook/09-posix-utilities-shell-and-vfs.md), [handbook/04-the-booter-runtime.md](../../handbook/04-the-booter-runtime.md).
|
||||
|
||||
|
||||
@@ -18,46 +18,46 @@ Seed RPC **`bare_os.capabilities`** includes **`protocolPackageVersion`**, **`fe
|
||||
|
||||
## Environment quick reference
|
||||
|
||||
| Area | Variable | Effect |
|
||||
|------|----------|--------|
|
||||
| Seed handshake | `BARE_OS_SEED_RPC_HANDSHAKE=0` | Skip `bare_os.capabilities` RPC before MBR read |
|
||||
| Seed strict | `BARE_OS_SEED_CAP_STRICT=1` | Fail boot if seeder feature bits do not cover stock booter bits |
|
||||
| Seed fail | `BARE_OS_SEED_CAP_FAIL=1` | Fail boot on any handshake error |
|
||||
| Pipelines | `BARE_OS_SHELL_STREAMING=1` | Multiply pipeline byte/line caps (`BARE_OS_SHELL_STREAMING_MULT`, default 4×) |
|
||||
| Command subst | `BARE_OS_SHELL_CMDSUBST=1` | Enable bounded `$(…)` in words (`BARE_OS_SHELL_CMDSUBST_MAX_BYTES`) |
|
||||
| Union writes | `BARE_OS_VFS_UNION_WRITE_DENY` | Comma/colon list of path prefixes blocked for writes under union prefixes |
|
||||
| IPC | `BARE_OS_IPC_CHANNEL_MAX_BYTES` | JSON map `{"fifoName": 65536}` per-channel backlog cap |
|
||||
| Initd journal | `BARE_OS_INITD_JOURNAL_MAX_LINES` | Cap NDJSON lines per unit (default 400, max 20000) |
|
||||
| Telemetry | `BARE_OS_TELEMETRY_NDJSON` | Logical path; append NDJSON mirror of `appendVarLog` events (`telemetrySchemaVersion` / `lifecycleSchemaVersion` **3**) |
|
||||
| Telemetry OTel | `BARE_OS_TELEMETRY_OTEL_JSONL` | Logical path; append OTLP-inspired JSON lines for var-log mirrors |
|
||||
| Proc poll | `BARE_OS_PROC_POLL_MS` | Min interval 250ms, max 60s, for coalesced **`/proc/bare_os/metrics_live.json`** |
|
||||
| Shell `${…}` | `BARE_OS_SHELL_PARAM_EXPANSION=1` | Enable `${VAR:-default}` and `${VAR#prefix}` (bounded prefix length) |
|
||||
| Shell `${…}` v2 | `BARE_OS_SHELL_PARAM_EXPANSION_V2=1` | With param expansion on: `${VAR:=x}`, `${VAR##*/}` / `${VAR#*/}`, `${VAR%%pat}` / `${VAR%pat}` (bounded; see handbook ch.9) |
|
||||
| Env GNU-like | `BARE_OS_ENV_DASH_S=1` | `/bin/env` supports `-S` / `--split-string` and `--env-file` (bounded) |
|
||||
| VFS pseudo watch | `BARE_OS_VFS_WATCH_PSEUDO=1` | `vfs.watch` on coalesced **`/proc/bare_os/metrics_live.json`** |
|
||||
| Diagnostics | `BARE_OS_DIAGNOSTICS_SUBSCRIBE=1` | `ctx.bareOsDiagnosticsSubscribe` for structured dev events |
|
||||
| HDMS / autopass hint | `BARE_OS_AUTOPASS_INVITE_URL` | Surfaced in **`/proc/bare_os/hdms_hints.json`** (guest does not open URLs) |
|
||||
| Bin worker (reserved) | `BARE_OS_BIN_WORKER_OFFLOAD=1`, `BARE_OS_BIN_WORKER_ALLOW` | Gate for future bare-thread offload; stock path remains in-process |
|
||||
| Exec budget | `BARE_OS_EXEC_LINE_BUDGET_MS` | Reject top-level `execLine` when session wall time exceeds budget |
|
||||
| Delegates | `BARE_OS_DELEGATE_MAX_PER_MIN`, `BARE_OS_DELEGATE_CURL_MAX_PER_MIN`, … | Per-minute caps on host delegates (sliding minute window) |
|
||||
| Delegates | `BARE_OS_DELEGATE_AUDIT_ONLY=1` | With `BARE_OS_AUDIT=1`, log delegate invocations and skip host run (exit 0) |
|
||||
| Boot policy | `BARE_OS_BOOT_POLICY=1` | Merge `skipPhases` / `denyBootPhases` from `/etc/bare-os/boot.policy.json`; optional `minKernelFeatureMask` / `requireSeedCaps`; v2 fields `maxExecLineDepth`, `denyEnvKeys`, `requireProcNodes` |
|
||||
| Boot policy strict | `BARE_OS_BOOT_POLICY_STRICT=1` | Abort boot when policy checks fail |
|
||||
| Lazy personal drive | `BARE_OS_LAZY_PERSONAL_DRIVE=1` | Mount personal Hyperdrive at session setup instead of immediately after kernel fetch |
|
||||
| System revision | `BARE_OS_SYSTEM_REVISION_ID`, `BARE_OS_SYSTEM_REVISION_PENDING`, `BARE_OS_SYSTEM_SLOT` | Exposed as `ctx.bareOsSystemRevision` (Pear OTA–style hints) |
|
||||
| Delegates | `BARE_OS_DELEGATE_ALLOW` | Comma list: `git`, `curl`, `wget`, `systemctl` (empty = all) |
|
||||
| DNS | `BARE_OS_DNS_ALLOWLIST` | Host allowlist for curl/wget http(s) URLs (`*.suffix` supported) |
|
||||
| IPC namespace | `BARE_OS_IPC_NAMESPACE` | Prefix FIFO keys as `<ns>__<name>` for isolation |
|
||||
| Kernel hot reload | `BARE_OS_KERNEL_HOT_RELOAD=1` | Dev: `ctx.bareOsRequestKernelReload()` re-reads `/boot/init.js` |
|
||||
| Sandbox | `BARE_OS_SANDBOX_WORKER=1` | Try `bare-worker` when available; else microtask defer |
|
||||
| Bundle tier | `BARE_OS_BUNDLE_TIER=core` | `bare-os-bare-libs` build: only manifest rows with matching `tier` (`all` = default) |
|
||||
| Area | Variable | Effect |
|
||||
| --------------------- | -------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| Seed handshake | `BARE_OS_SEED_RPC_HANDSHAKE=0` | Skip `bare_os.capabilities` RPC before MBR read |
|
||||
| Seed strict | `BARE_OS_SEED_CAP_STRICT=1` | Fail boot if seeder feature bits do not cover stock booter bits |
|
||||
| Seed fail | `BARE_OS_SEED_CAP_FAIL=1` | Fail boot on any handshake error |
|
||||
| Pipelines | `BARE_OS_SHELL_STREAMING=1` | Multiply pipeline byte/line caps (`BARE_OS_SHELL_STREAMING_MULT`, default 4×) |
|
||||
| Command subst | `BARE_OS_SHELL_CMDSUBST=1` | Enable bounded `$(…)` in words (`BARE_OS_SHELL_CMDSUBST_MAX_BYTES`) |
|
||||
| Union writes | `BARE_OS_VFS_UNION_WRITE_DENY` | Comma/colon list of path prefixes blocked for writes under union prefixes |
|
||||
| IPC | `BARE_OS_IPC_CHANNEL_MAX_BYTES` | JSON map `{"fifoName": 65536}` per-channel backlog cap |
|
||||
| Initd journal | `BARE_OS_INITD_JOURNAL_MAX_LINES` | Cap NDJSON lines per unit (default 400, max 20000) |
|
||||
| Telemetry | `BARE_OS_TELEMETRY_NDJSON` | Logical path; append NDJSON mirror of `appendVarLog` events (`telemetrySchemaVersion` / `lifecycleSchemaVersion` **3**) |
|
||||
| Telemetry OTel | `BARE_OS_TELEMETRY_OTEL_JSONL` | Logical path; append OTLP-inspired JSON lines for var-log mirrors |
|
||||
| Proc poll | `BARE_OS_PROC_POLL_MS` | Min interval 250ms, max 60s, for coalesced **`/proc/bare_os/metrics_live.json`** |
|
||||
| Shell `${…}` | `BARE_OS_SHELL_PARAM_EXPANSION=1` | Enable `${VAR:-default}` and `${VAR#prefix}` (bounded prefix length) |
|
||||
| Shell `${…}` v2 | `BARE_OS_SHELL_PARAM_EXPANSION_V2=1` | With param expansion on: `${VAR:=x}`, `${VAR##*/}` / `${VAR#*/}`, `${VAR%%pat}` / `${VAR%pat}` (bounded; see handbook ch.9) |
|
||||
| Env GNU-like | `BARE_OS_ENV_DASH_S=1` | `/bin/env` supports `-S` / `--split-string` and `--env-file` (bounded) |
|
||||
| VFS pseudo watch | `BARE_OS_VFS_WATCH_PSEUDO=1` | `vfs.watch` on coalesced **`/proc/bare_os/metrics_live.json`** |
|
||||
| Diagnostics | `BARE_OS_DIAGNOSTICS_SUBSCRIBE=1` | `ctx.bareOsDiagnosticsSubscribe` for structured dev events |
|
||||
| HDMS / autopass hint | `BARE_OS_AUTOPASS_INVITE_URL` | Surfaced in **`/proc/bare_os/hdms_hints.json`** (guest does not open URLs) |
|
||||
| Bin worker (reserved) | `BARE_OS_BIN_WORKER_OFFLOAD=1`, `BARE_OS_BIN_WORKER_ALLOW` | Gate for future bare-thread offload; stock path remains in-process |
|
||||
| Exec budget | `BARE_OS_EXEC_LINE_BUDGET_MS` | Reject top-level `execLine` when session wall time exceeds budget |
|
||||
| Delegates | `BARE_OS_DELEGATE_MAX_PER_MIN`, `BARE_OS_DELEGATE_CURL_MAX_PER_MIN`, … | Per-minute caps on host delegates (sliding minute window) |
|
||||
| Delegates | `BARE_OS_DELEGATE_AUDIT_ONLY=1` | With `BARE_OS_AUDIT=1`, log delegate invocations and skip host run (exit 0) |
|
||||
| Boot policy | `BARE_OS_BOOT_POLICY=1` | Merge `skipPhases` / `denyBootPhases` from `/etc/bare-os/boot.policy.json`; optional `minKernelFeatureMask` / `requireSeedCaps`; v2 `maxExecLineDepth`, `denyEnvKeys`, `requireProcNodes`; **v3** `requireFeatureBits2`, `requireFeatureBits3`, `allowedPearIpcChannels` → session env, `denyVfsPrefixes` (VFS deny), `maxInitdRestartsPerUnit` → `BARE_OS_INITD_RESTART_MAX_DEFAULT` |
|
||||
| Boot policy strict | `BARE_OS_BOOT_POLICY_STRICT=1` | Abort boot when policy checks fail |
|
||||
| Lazy personal drive | `BARE_OS_LAZY_PERSONAL_DRIVE=1` | Mount personal Hyperdrive at session setup instead of immediately after kernel fetch |
|
||||
| System revision | `BARE_OS_SYSTEM_REVISION_ID`, `BARE_OS_SYSTEM_REVISION_PENDING`, `BARE_OS_SYSTEM_SLOT` | Exposed as `ctx.bareOsSystemRevision` (Pear OTA–style hints) |
|
||||
| Delegates | `BARE_OS_DELEGATE_ALLOW` | Comma list: `git`, `curl`, `wget`, `systemctl` (empty = all) |
|
||||
| DNS | `BARE_OS_DNS_ALLOWLIST` | Host allowlist for curl/wget http(s) URLs (`*.suffix` supported) |
|
||||
| IPC namespace | `BARE_OS_IPC_NAMESPACE` | Prefix FIFO keys as `<ns>__<name>` for isolation |
|
||||
| Kernel hot reload | `BARE_OS_KERNEL_HOT_RELOAD=1` | Dev: `ctx.bareOsRequestKernelReload()` re-reads `/boot/init.js` |
|
||||
| Sandbox | `BARE_OS_SANDBOX_WORKER=1` | Try `bare-worker` when available; else microtask defer |
|
||||
| Bundle tier | `BARE_OS_BUNDLE_TIER=core` | `bare-os-bare-libs` build: only manifest rows with matching `tier` (`all` = default) |
|
||||
|
||||
## POSIX utility notes
|
||||
|
||||
| Utility | Notes |
|
||||
|---------|--------|
|
||||
| `cmp` | Two-file byte compare; exit 1 on difference |
|
||||
| `wait` | Shell builtin: wait for background jobs by id or all |
|
||||
| Utility | Notes |
|
||||
| ------- | ---------------------------------------------------- |
|
||||
| `cmp` | Two-file byte compare; exit 1 on difference |
|
||||
| `wait` | Shell builtin: wait for background jobs by id or all |
|
||||
|
||||
## Cookbook snippets
|
||||
|
||||
|
||||
@@ -9,9 +9,21 @@
|
||||
"denyBootPhases": { "type": "array", "items": { "type": "string" } },
|
||||
"minKernelFeatureMask": { "type": "integer", "minimum": 0 },
|
||||
"requireSeedCaps": { "type": "integer", "minimum": 0 },
|
||||
"requireFeatureBits2": { "type": "integer", "minimum": 0 },
|
||||
"requireFeatureBits3": { "type": "integer", "minimum": 0 },
|
||||
"maxExecLineDepth": { "type": "integer", "minimum": 1 },
|
||||
"denyEnvKeys": { "type": "array", "items": { "type": "string" } },
|
||||
"requireProcNodes": { "type": "array", "items": { "type": "string" } },
|
||||
"allowedUnionPrefixes": { "type": "array", "items": { "type": "string" } }
|
||||
"allowedUnionPrefixes": { "type": "array", "items": { "type": "string" } },
|
||||
"allowedPearIpcChannels": {
|
||||
"type": "array",
|
||||
"items": { "type": "string" }
|
||||
},
|
||||
"denyVfsPrefixes": { "type": "array", "items": { "type": "string" } },
|
||||
"maxInitdRestartsPerUnit": {
|
||||
"type": "integer",
|
||||
"minimum": 1,
|
||||
"maximum": 32
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user