# Kernel subsystem map (booter + guest image)

This document is the **boundary map** for the Bare operating system runtime: which responsibilities live in which layer, and which modules are the canonical entry points.

## Subsystems

| Subsystem | Role | Canonical modules |
| --- | --- | --- |
| **boot** | Swarm join, MBR, Hyperdrive replication, timeout, offline LKG | [`packages/bare-os-booter/index.js`](../../packages/bare-os-booter/index.js), [`bare-os-kernel-loader.js`](../../packages/bare-os-booter/lib/bare-os-kernel-loader.js), [`bare-os-lifecycle-manager.js`](../../packages/bare-os-booter/lib/bare-os-lifecycle-manager.js) |
| **vfs** | Two-drive routing, pseudo `/proc`/`/sys`/`/run`/`/dev`, policy; optional **`$HOME/.www` → `/mnt/www**` when HDMS label **`www`** is mounted | [`vfs.js`](../../packages/bare-os-booter/lib/vfs.js), [`vfs-posix-meta.js`](../../packages/bare-os-booter/lib/vfs-posix-meta.js) |
| **initd services** | Stock **`bare-initd`** units (logger, static **`~/.www`**, Holesail, cron, SSH, …) | [`bare-initd.js`](../../packages/bare-os-booter/lib/bare-initd.js), [`bare-os-www-initd.js`](../../packages/bare-os-booter/lib/bare-os-www-initd.js), [`bare-holesail.js`](../../packages/bare-os-booter/lib/bare-holesail.js), [`bare-cron.js`](../../packages/bare-os-booter/lib/bare-cron.js), [`bare-openssh.js`](../../packages/bare-os-booter/lib/bare-openssh.js) |
| **process** | Synthetic process table, jobs/shell coordination | [`bare-os-process-table.js`](../../packages/bare-os-booter/lib/bare-os-process-table.js), [`shell.js`](../../packages/bare-os-booter/lib/shell.js) |
| **ipc** | FIFOs, JSON-RPC, fan-out | [`bare-os-ipc.js`](../../packages/bare-os-booter/lib/bare-os-ipc.js) |
| **net** | Hyperswarm, Protomux, peer disk I/O | [`swarm-disk.js`](../../packages/bare-os-booter/lib/swarm-disk.js), [`bare-os-swarm-connection-manager.js`](../../packages/bare-os-booter/lib/bare-os-swarm-connection-manager.js) |
| **security** | Identity, vault, ACL evaluation, audit chain | [`identity-session.js`](../../packages/bare-os-booter/lib/identity-session.js), [`identity-account.js`](../../packages/bare-os-booter/lib/identity-account.js), [`bare-os-acl-eval.js`](../../packages/bare-os-booter/lib/bare-os-acl-eval.js), [`bare-os-audit-chain.js`](../../packages/bare-os-booter/lib/bare-os-audit-chain.js) |
| **capabilities** | Stock kernel capability words, seed strict matrix | [`bare-os-capability-registry.js`](../../packages/bare-os-booter/lib/bare-os-capability-registry.js), [`bare-os-protocol`](../../packages/bare-os-protocol/) |

## Guest image (`kernel/`)

| Stage | Source |
| --- | --- |
| Boot policy, rc, extensions | [`kernel/init.js`](../../kernel/init.js) |
| Stock `/bin` | [`packages/bare-os-coreutils`](../../packages/bare-os-coreutils/) (seeded into image) |

## Related

- [Documentation home](../README.md) · [Glossary](../glossary.md)
- [KERNEL_CONTRACT.md](KERNEL_CONTRACT.md) — trust and replication contract.
- [POSIX conformance matrix](../reference/conformance-matrix.md) — Issue 7 tracking.
- [Environment and POSIX appendix](../reference/environment-and-posix-appendix.md) — env vars and userland gaps.