feat(kernel): Wave 6 mega-phase — bits6, protocol, booter, docs, CI

- Add sixth capability word (bits6), STOCK_V6, FEATURE6_* in bare-os-protocol;
  seed caps, channel.js, seed-rpc-methods registry, replication/handshake fields
- Booter: Wave 6 /proc JSON surfaces, ctx 1.15.0, Pear/DHT hooks, subprocess
  snapshot v3, audit v3, extension registry v3 edges, hrpc stub, worker/sandbox
- Kernel: boot.policy v6 enforcement (requireFeatureBits6, booter semver, ctx min,
  extension deny/hash pins, offline LKG strict); example policy + seeder kernel sync
- Schemas: boot.policy v6, OTel JSONL v3 + example; validate-example-schemas pairs
- CI: verify-kernel-roadmap-wave6 (100 rows), verify-pear-no-static-node-import,
  extend wave3/compat-matrix/ctx verifiers; pretest wiring
- Docs: ADR 001 v6, kernel-capabilities-index Word 6, kernel-extensions,
  feature-roadmap Wave 6 table, compatibility matrix, handbook ch.11, developer-guide
  (privacy, bare-boot alignment, bare-fetch), http-curl, scripts/README, DOCUMENTATION
- Tests: booter /proc readdir expectations for new bare_os_* nodes
This commit is contained in:
Raven Scott
2026-04-04 04:49:38 -04:00
parent 268b46dd3a
commit faaf5f13d8
54 changed files with 2285 additions and 499 deletions
@@ -7,6 +7,12 @@
"requireFeatureBits3": 0,
"requireFeatureBits4": 0,
"requireFeatureBits5": 0,
"requireFeatureBits6": 0,
"requireBooterSemver": "0.0.0",
"requireCtxApiMin": "0.0.0",
"denyKernelExtensionIds": [],
"kernelExtensionHashPins": {},
"offlineLkgIntegrityStrict": false,
"maxExecLineDepth": 48,
"denyEnvKeys": ["EXAMPLE_UNWANTED"],
"requireProcNodes": ["/proc/bare_os/features", "/proc/version"],
@@ -0,0 +1,29 @@
{
"otlSchemaVersion": 3,
"resourceLogs": [
{
"resource": {
"attributes": [
{ "key": "service.name", "value": { "stringValue": "bare-os" } }
]
},
"scopeLogs": [
{
"scope": { "name": "bare-os-booter", "version": "1.0.0" },
"logRecords": [
{
"timeUnixNano": "1700000000000000000",
"severityText": "INFO",
"body": { "stringValue": "example.boot.phase" },
"events": [],
"links": [],
"attributes": [
{ "key": "phase", "value": { "stringValue": "kernel_ready" } }
]
}
]
}
]
}
]
}
+133 -1
View File
@@ -118,9 +118,38 @@ function shouldSkipBootPhase(ctx, phase) {
* `{ "skipPhases": ["rc.d"], "denyBootPhases": ["onboot"], "minKernelFeatureMask": 1, "requireSeedCaps": 1,
* "maxExecLineDepth": 32, "denyEnvKeys": ["FOO"], "requireProcNodes": ["/proc/bare_os/features"] }`.
* Boot policy v5 (optional): `requireFeatureBits5`, `requireInitJsSha256` (hex sha256 of `/boot/init.js` raw bytes).
* Boot policy v6 (optional): `requireFeatureBits6`, `requireBooterSemver`, `requireCtxApiMin`, `denyKernelExtensionIds`,
* `kernelExtensionHashPins`, `offlineLkgIntegrityStrict`.
* @param {Record<string, unknown>} ctx
* @returns {Promise<boolean>} false when strict policy fails (caller should abort boot)
*/
/**
* @param {string} s
* @returns {number[] | null}
*/
function parseSemverTriplet(s) {
const m = String(s)
.trim()
.match(/^(\d+)\.(\d+)\.(\d+)/)
if (!m) return null
return [Number(m[1]), Number(m[2]), Number(m[3])]
}
/**
* @param {string} have
* @param {string} need
*/
function semverGte(have, need) {
const a = parseSemverTriplet(have)
const b = parseSemverTriplet(need)
if (!a || !b) return false
for (let i = 0; i < 3; i++) {
if (a[i] > b[i]) return true
if (a[i] < b[i]) return false
}
return true
}
async function applyBootPolicyFile(ctx) {
const en = ctx.env && ctx.env.BARE_OS_BOOT_POLICY
if (en !== '1' && en !== 'true') return true
@@ -242,6 +271,86 @@ async function applyBootPolicyFile(ctx) {
}
}
}
if (
typeof pol.requireFeatureBits6 === 'number' &&
pol.requireFeatureBits6 > 0
) {
const adv6 = ctx.bareOsAdvertisedKernelBits6
const need6 = pol.requireFeatureBits6 >>> 0
const ok = typeof adv6 === 'number' && ((adv6 >>> 0) & need6) === need6
if (!ok) {
console.error('[boot-policy] requireFeatureBits6 not satisfied')
if (strictPol) {
if (typeof ctx.requestBooterExit === 'function') {
ctx.requestBooterExit(1)
}
return false
}
}
}
if (
typeof pol.requireBooterSemver === 'string' &&
String(pol.requireBooterSemver).trim()
) {
const needS = String(pol.requireBooterSemver).trim()
const haveS =
typeof ctx.bareOsBooterPackageVersion === 'string'
? ctx.bareOsBooterPackageVersion.trim()
: ''
const ok = haveS && semverGte(haveS, needS)
if (!ok) {
console.error('[boot-policy] requireBooterSemver not satisfied')
if (strictPol) {
if (typeof ctx.requestBooterExit === 'function') {
ctx.requestBooterExit(1)
}
return false
}
}
}
if (
typeof pol.requireCtxApiMin === 'string' &&
String(pol.requireCtxApiMin).trim()
) {
const needS = String(pol.requireCtxApiMin).trim()
const haveS =
typeof ctx.bareOsCtxApiVersion === 'string'
? ctx.bareOsCtxApiVersion.trim()
: String(ctx.bareOsCtxApiVersion || '').trim()
const ok = haveS && semverGte(haveS, needS)
if (!ok) {
console.error('[boot-policy] requireCtxApiMin not satisfied')
if (strictPol) {
if (typeof ctx.requestBooterExit === 'function') {
ctx.requestBooterExit(1)
}
return false
}
}
}
if (Array.isArray(pol.denyKernelExtensionIds) && ctx.env) {
const parts = pol.denyKernelExtensionIds
.map((x) => String(x).trim())
.filter(Boolean)
if (parts.length)
ctx.env.BARE_OS_BOOT_POLICY_DENY_KERNEL_EXT_IDS = parts.join(',')
}
if (
pol.kernelExtensionHashPins &&
typeof pol.kernelExtensionHashPins === 'object' &&
ctx.env
) {
try {
ctx.env.BARE_OS_BOOT_POLICY_EXTENSION_HASH_PINS_JSON = JSON.stringify(
pol.kernelExtensionHashPins
)
} catch {
/* ignore */
}
}
if (pol.offlineLkgIntegrityStrict === true && ctx.env) {
ctx.env.BARE_OS_OFFLINE_LKG_INTEGRITY_STRICT = '1'
}
if (
typeof pol.requireInitJsSha256 === 'string' &&
String(pol.requireInitJsSha256).trim()
@@ -831,6 +940,15 @@ async function runKernelExtDropins(ctx) {
const { drive, console } = ctx
const run = ctx.bareOsRunImageScript
if (typeof run !== 'function') return true
const denyRaw = String(
ctx.env?.BARE_OS_BOOT_POLICY_DENY_KERNEL_EXT_IDS || ''
).trim()
const deny = new Set(
denyRaw
.split(',')
.map((s) => s.trim())
.filter(Boolean)
)
/** @type {string[]} */
const names = []
try {
@@ -848,8 +966,20 @@ async function runKernelExtDropins(ctx) {
if (!buf) continue
const pol = JSON.parse(ctx.b4a.toString(buf))
if (!pol || typeof pol !== 'object') continue
const extId =
pol.id != null
? String(pol.id).trim()
: name.replace(/\.json$/i, '')
if (deny.has(extId)) {
console.error(`[kernel.ext.d] denied by policy id: ${extId}`)
continue
}
const scripts = pol.scripts
if (!Array.isArray(scripts)) continue
/** @type {string[]} */
const dependsOn = Array.isArray(pol.dependsOn)
? pol.dependsOn.map((d) => String(d).trim()).filter(Boolean).slice(0, 16)
: []
for (const sp of scripts) {
const imgPath = String(sp).trim()
if (!imgPath.startsWith('/lib/bare-os/extensions/')) {
@@ -860,7 +990,9 @@ async function runKernelExtDropins(ctx) {
if (typeof ctx.bareOsRegisterKernelExtensionRecord === 'function') {
ctx.bareOsRegisterKernelExtensionRecord({
dropin: name,
script: imgPath
script: imgPath,
id: extId,
dependsOn
})
}
}
+196 -196
View File
@@ -25,30 +25,30 @@
"compactEncoding"
]
},
{
"path": "/lib/bare/bundles/bareUrl.js",
"keys": [
"bareUrl"
]
},
{
"path": "/lib/bare/bundles/barePath.js",
"keys": [
"barePath"
]
},
{
"path": "/lib/bare/bundles/protomux.js",
"keys": [
"protomux"
]
},
{
"path": "/lib/bare/bundles/bareUrl.js",
"keys": [
"bareUrl"
]
},
{
"path": "/lib/bare/bundles/bareEncoding.js",
"keys": [
"bareEncoding"
]
},
{
"path": "/lib/bare/bundles/barePath.js",
"keys": [
"barePath"
]
},
{
"path": "/lib/bare/bundles/bareEvents.js",
"keys": [
@@ -91,12 +91,6 @@
"bareCrypto"
]
},
{
"path": "/lib/bare/bundles/bareApk.js",
"keys": [
"bareApk"
]
},
{
"path": "/lib/bare/bundles/bareAppKit.js",
"keys": [
@@ -110,9 +104,15 @@
]
},
{
"path": "/lib/bare/bundles/fetch.js",
"path": "/lib/bare/bundles/bareAssert.js",
"keys": [
"fetch"
"bareAssert"
]
},
{
"path": "/lib/bare/bundles/bareApk.js",
"keys": [
"bareApk"
]
},
{
@@ -122,9 +122,9 @@
]
},
{
"path": "/lib/bare/bundles/bareAssert.js",
"path": "/lib/bare/bundles/fetch.js",
"keys": [
"bareAssert"
"fetch"
]
},
{
@@ -133,24 +133,30 @@
"bareBmp"
]
},
{
"path": "/lib/bare/bundles/bareBundle.js",
"keys": [
"bareBundle"
]
},
{
"path": "/lib/bare/bundles/bareBundleCompile.js",
"keys": [
"bareBundleCompile"
]
},
{
"path": "/lib/bare/bundles/bareBundle.js",
"keys": [
"bareBundle"
]
},
{
"path": "/lib/bare/bundles/bareBuffer.js",
"keys": [
"bareBuffer"
]
},
{
"path": "/lib/bare/bundles/bareBundleEvaluate.js",
"keys": [
"bareBundleEvaluate"
]
},
{
"path": "/lib/bare/bundles/bareBluetoothApple.js",
"keys": [
@@ -164,15 +170,9 @@
]
},
{
"path": "/lib/bare/bundles/bareBundleEvaluate.js",
"path": "/lib/bare/bundles/bareChannel.js",
"keys": [
"bareBundleEvaluate"
]
},
{
"path": "/lib/bare/bundles/bareConsole.js",
"keys": [
"bareConsole"
"bareChannel"
]
},
{
@@ -182,9 +182,15 @@
]
},
{
"path": "/lib/bare/bundles/bareDebugLog.js",
"path": "/lib/bare/bundles/bareConsole.js",
"keys": [
"bareDebugLog"
"bareConsole"
]
},
{
"path": "/lib/bare/bundles/bareDaemon.js",
"keys": [
"bareDaemon"
]
},
{
@@ -194,15 +200,9 @@
]
},
{
"path": "/lib/bare/bundles/bareChannel.js",
"path": "/lib/bare/bundles/bareDebugLog.js",
"keys": [
"bareChannel"
]
},
{
"path": "/lib/bare/bundles/bareDaemon.js",
"keys": [
"bareDaemon"
"bareDebugLog"
]
},
{
@@ -218,9 +218,9 @@
]
},
{
"path": "/lib/bare/bundles/bareCov.js",
"path": "/lib/bare/bundles/bareDgram.js",
"keys": [
"bareCov"
"bareDgram"
]
},
{
@@ -236,9 +236,9 @@
]
},
{
"path": "/lib/bare/bundles/bareDgram.js",
"path": "/lib/bare/bundles/bareCov.js",
"keys": [
"bareDgram"
"bareCov"
]
},
{
@@ -248,9 +248,9 @@
]
},
{
"path": "/lib/bare/bundles/bareFormat.js",
"path": "/lib/bare/bundles/bareFfmpegEncodings.js",
"keys": [
"bareFormat"
"bareFfmpegEncodings"
]
},
{
@@ -260,15 +260,9 @@
]
},
{
"path": "/lib/bare/bundles/bareFileLogger.js",
"path": "/lib/bare/bundles/bareFormat.js",
"keys": [
"bareFileLogger"
]
},
{
"path": "/lib/bare/bundles/bareFfmpegEncodings.js",
"keys": [
"bareFfmpegEncodings"
"bareFormat"
]
},
{
@@ -277,6 +271,24 @@
"bareGif"
]
},
{
"path": "/lib/bare/bundles/bareHeif.js",
"keys": [
"bareHeif"
]
},
{
"path": "/lib/bare/bundles/bareFileLogger.js",
"keys": [
"bareFileLogger"
]
},
{
"path": "/lib/bare/bundles/bareGtk.js",
"keys": [
"bareGtk"
]
},
{
"path": "/lib/bare/bundles/bareFs.js",
"keys": [
@@ -289,18 +301,6 @@
"bareHrtime"
]
},
{
"path": "/lib/bare/bundles/bareHeif.js",
"keys": [
"bareHeif"
]
},
{
"path": "/lib/bare/bundles/bareGtk.js",
"keys": [
"bareGtk"
]
},
{
"path": "/lib/bare/bundles/bareHttpParser.js",
"keys": [
@@ -319,48 +319,42 @@
"bareImageResample"
]
},
{
"path": "/lib/bare/bundles/bareInspect.js",
"keys": [
"bareInspect"
]
},
{
"path": "/lib/bare/bundles/bareHttp1.js",
"keys": [
"bareHttp1"
]
},
{
"path": "/lib/bare/bundles/bareInspect.js",
"keys": [
"bareInspect"
]
},
{
"path": "/lib/bare/bundles/bareHttps.js",
"keys": [
"bareHttps"
]
},
{
"path": "/lib/bare/bundles/bareIntl.js",
"keys": [
"bareIntl"
]
},
{
"path": "/lib/bare/bundles/bareJpeg.js",
"keys": [
"bareJpeg"
]
},
{
"path": "/lib/bare/bundles/bareLief.js",
"keys": [
"bareLief"
]
},
{
"path": "/lib/bare/bundles/bareIpc.js",
"keys": [
"bareIpc"
]
},
{
"path": "/lib/bare/bundles/bareIntl.js",
"keys": [
"bareIntl"
]
},
{
"path": "/lib/bare/bundles/bareInspector.js",
"keys": [
@@ -368,9 +362,9 @@
]
},
{
"path": "/lib/bare/bundles/bareDev.js",
"path": "/lib/bare/bundles/bareLief.js",
"keys": [
"bareDev"
"bareLief"
]
},
{
@@ -391,24 +385,36 @@
"bareLink"
]
},
{
"path": "/lib/bare/bundles/bareModule.js",
"keys": [
"bareModule"
]
},
{
"path": "/lib/bare/bundles/bareModuleResolve.js",
"keys": [
"bareModuleResolve"
]
},
{
"path": "/lib/bare/bundles/bareModuleTraverse.js",
"keys": [
"bareModuleTraverse"
]
},
{
"path": "/lib/bare/bundles/bareModule.js",
"keys": [
"bareModule"
]
},
{
"path": "/lib/bare/bundles/bareModuleLexer.js",
"keys": [
"bareModuleLexer"
]
},
{
"path": "/lib/bare/bundles/bareNodeFetch.js",
"keys": [
"bareNodeFetch"
]
},
{
"path": "/lib/bare/bundles/bareNdk.js",
"keys": [
@@ -421,24 +427,18 @@
"bareNative"
]
},
{
"path": "/lib/bare/bundles/bareModuleTraverse.js",
"keys": [
"bareModuleTraverse"
]
},
{
"path": "/lib/bare/bundles/bareNodeFetch.js",
"keys": [
"bareNodeFetch"
]
},
{
"path": "/lib/bare/bundles/bareOpen.js",
"keys": [
"bareOpen"
]
},
{
"path": "/lib/bare/bundles/bareNet.js",
"keys": [
"bareNet"
]
},
{
"path": "/lib/bare/bundles/bareMedia.js",
"keys": [
@@ -452,9 +452,9 @@
]
},
{
"path": "/lib/bare/bundles/bareNet.js",
"path": "/lib/bare/bundles/bareDev.js",
"keys": [
"bareNet"
"bareDev"
]
},
{
@@ -463,6 +463,12 @@
"barePerformance"
]
},
{
"path": "/lib/bare/bundles/barePack.js",
"keys": [
"barePack"
]
},
{
"path": "/lib/bare/bundles/barePng.js",
"keys": [
@@ -475,18 +481,18 @@
"barePackDrive"
]
},
{
"path": "/lib/bare/bundles/barePack.js",
"keys": [
"barePack"
]
},
{
"path": "/lib/bare/bundles/barePipe.js",
"keys": [
"barePipe"
]
},
{
"path": "/lib/bare/bundles/bareNodeRuntime.js",
"keys": [
"bareNodeRuntime"
]
},
{
"path": "/lib/bare/bundles/barePunycode.js",
"keys": [
@@ -505,18 +511,6 @@
"bareQuerystring"
]
},
{
"path": "/lib/bare/bundles/bareNodeRuntime.js",
"keys": [
"bareNodeRuntime"
]
},
{
"path": "/lib/bare/bundles/bareRealm.js",
"keys": [
"bareRealm"
]
},
{
"path": "/lib/bare/bundles/bareQueueMicrotask.js",
"keys": [
@@ -530,9 +524,9 @@
]
},
{
"path": "/lib/bare/bundles/barePromClient.js",
"path": "/lib/bare/bundles/bareRealm.js",
"keys": [
"barePromClient"
"bareRealm"
]
},
{
@@ -542,9 +536,15 @@
]
},
{
"path": "/lib/bare/bundles/bareSdl.js",
"path": "/lib/bare/bundles/bareSemver.js",
"keys": [
"bareSdl"
"bareSemver"
]
},
{
"path": "/lib/bare/bundles/barePromClient.js",
"keys": [
"barePromClient"
]
},
{
@@ -554,9 +554,9 @@
]
},
{
"path": "/lib/bare/bundles/bareSemver.js",
"path": "/lib/bare/bundles/bareSdl.js",
"keys": [
"bareSemver"
"bareSdl"
]
},
{
@@ -565,12 +565,6 @@
"bareRepl"
]
},
{
"path": "/lib/bare/bundles/bareSidecar.js",
"keys": [
"bareSidecar"
]
},
{
"path": "/lib/bare/bundles/bareRun.js",
"keys": [
@@ -583,6 +577,12 @@
"bareSignals"
]
},
{
"path": "/lib/bare/bundles/bareSidecar.js",
"keys": [
"bareSidecar"
]
},
{
"path": "/lib/bare/bundles/bareStringDecoder.js",
"keys": [
@@ -595,12 +595,6 @@
"bareStream"
]
},
{
"path": "/lib/bare/bundles/bareStdio.js",
"keys": [
"bareStdio"
]
},
{
"path": "/lib/bare/bundles/bareStorage.js",
"keys": [
@@ -608,9 +602,9 @@
]
},
{
"path": "/lib/bare/bundles/bareSvg.js",
"path": "/lib/bare/bundles/bareStdio.js",
"keys": [
"bareSvg"
"bareStdio"
]
},
{
@@ -620,15 +614,9 @@
]
},
{
"path": "/lib/bare/bundles/bareSubprocess.js",
"path": "/lib/bare/bundles/bareSvg.js",
"keys": [
"bareSubprocess"
]
},
{
"path": "/lib/bare/bundles/bareTap.js",
"keys": [
"bareTap"
"bareSvg"
]
},
{
@@ -637,6 +625,12 @@
"bareTiff"
]
},
{
"path": "/lib/bare/bundles/bareSubprocess.js",
"keys": [
"bareSubprocess"
]
},
{
"path": "/lib/bare/bundles/bareSystemLogger.js",
"keys": [
@@ -644,9 +638,9 @@
]
},
{
"path": "/lib/bare/bundles/bareTcp.js",
"path": "/lib/bare/bundles/bareTap.js",
"keys": [
"bareTcp"
"bareTap"
]
},
{
@@ -656,9 +650,9 @@
]
},
{
"path": "/lib/bare/bundles/bareTimers.js",
"path": "/lib/bare/bundles/bareTcp.js",
"keys": [
"bareTimers"
"bareTcp"
]
},
{
@@ -668,15 +662,15 @@
]
},
{
"path": "/lib/bare/bundles/bareType.js",
"path": "/lib/bare/bundles/bareTimers.js",
"keys": [
"bareType"
"bareTimers"
]
},
{
"path": "/lib/bare/bundles/bareUnpack.js",
"path": "/lib/bare/bundles/bareType.js",
"keys": [
"bareUnpack"
"bareType"
]
},
{
@@ -698,9 +692,9 @@
]
},
{
"path": "/lib/bare/bundles/bareWalkHandles.js",
"path": "/lib/bare/bundles/bareUnpack.js",
"keys": [
"bareWalkHandles"
"bareUnpack"
]
},
{
@@ -716,9 +710,9 @@
]
},
{
"path": "/lib/bare/bundles/bareUnionBundle.js",
"path": "/lib/bare/bundles/bareWalkHandles.js",
"keys": [
"bareUnionBundle"
"bareWalkHandles"
]
},
{
@@ -727,6 +721,18 @@
"bareWebp"
]
},
{
"path": "/lib/bare/bundles/bareWebKit.js",
"keys": [
"bareWebKit"
]
},
{
"path": "/lib/bare/bundles/bareUnionBundle.js",
"keys": [
"bareUnionBundle"
]
},
{
"path": "/lib/bare/bundles/bareWebKitGtk.js",
"keys": [
@@ -734,9 +740,21 @@
]
},
{
"path": "/lib/bare/bundles/bareWebKit.js",
"path": "/lib/bare/bundles/bareUtils.js",
"keys": [
"bareWebKit"
"bareUtils"
]
},
{
"path": "/lib/bare/bundles/bareV8ToIstanbul.js",
"keys": [
"bareV8ToIstanbul"
]
},
{
"path": "/lib/bare/bundles/bareXdiff.js",
"keys": [
"bareXdiff"
]
},
{
@@ -751,36 +769,12 @@
"bareWinUi"
]
},
{
"path": "/lib/bare/bundles/bareXdiff.js",
"keys": [
"bareXdiff"
]
},
{
"path": "/lib/bare/bundles/bareV8ToIstanbul.js",
"keys": [
"bareV8ToIstanbul"
]
},
{
"path": "/lib/bare/bundles/bareUtils.js",
"keys": [
"bareUtils"
]
},
{
"path": "/lib/bare/bundles/bareZlib.js",
"keys": [
"bareZlib"
]
},
{
"path": "/lib/bare/bundles/bareZmq.js",
"keys": [
"bareZmq"
]
},
{
"path": "/lib/bare/bundles/bareWs.js",
"keys": [
@@ -792,6 +786,12 @@
"keys": [
"bareWorker"
]
},
{
"path": "/lib/bare/bundles/bareZmq.js",
"keys": [
"bareZmq"
]
}
],
"bundleStats": {
File diff suppressed because one or more lines are too long