FHS and LSB profile

Standards position

FHS conformance without a compatibility fiction

The AMD64 LSB ABI specifies glibc-family loader and library names. Akadata uses /lib/ld-musl-x86_64.so.1 and does not create false libc.so.6 or ld-lsb-x86-64.so.3 aliases.

The hierarchy is an interface

Root is root; /usr and /usr/local retain distinct jobs

/bin, /sbin, /lib, and /usr are real directories. None is replaced by a usrmerge symlink. Early-boot OpenRC executables remain in /sbin, and service scripts continue to use #!/sbin/openrc-run.

/                         Current image: /dev/vda1, ext4, read-write
├── bin                   Essential early-boot user commands
├── sbin                  System binaries — init, OpenRC, rescue tools
├── lib                   musl loader, essential shared libraries, kernel modules
└── usr                   Distribution-managed userland
    ├── bin               Standard user commands and applications
    ├── sbin              Non-essential administration programs and daemons
    └── local             First-party and administrator hierarchy
        ├── bin
        ├── sbin
        ├── lib
        └── src

Immutable recovery topology

A planned mount design, not a Version 0 release claim

The current Stage3 image creates one ext4 partition at /dev/vda1, mounts it at /, and boots it read-write. Saphira does not yet ship separate read-only root and read-write userland partitions.

The proposed recovery topology preserves the already-enforced directory boundary while adding independent mount policy:

/                         Proposed separate read-only recovery root
├── bin                   Rescue shell and essential early-boot tools
├── sbin                  init, OpenRC, filesystem and network recovery tools
└── lib                   musl loader and complete early-boot library closure

/usr                      Proposed separately mounted managed userland
├── bin                   Applications and standard userland
├── sbin                  Managed non-essential daemons and administration tools
└── local                 Local administrator and first-party overrides
    ├── bin
    ├── sbin
    └── lib

Before this can become a release guarantee, the image builder must create and identify the separate filesystems; /var, runtime state, package transactions, configuration writes, upgrades, and rollback must receive an explicit writable design; and boot acceptance must prove that the complete rescue closure works with /usr unavailable.

The recovery objective is credible only after destructive boot tests demonstrate it. The documentation will not promise flawless recovery or operation without rescue media before that evidence exists.

BSD lineage

Wheel, spokes, and the local hierarchy

Akadata keeps the BSD-derived wheel administrative convention. In the Stage4 account policy, wheel is GID 1, contains root, and is accompanied by the deliberately named spokes group at GID 2. The names express the relationship between privileged administration, delegated participation, and the root hub.

/usr/local carries the same respect for local administration: distribution packages own their declared system paths, while locally maintained programs and overrides have a stable hierarchy that automated package replacement does not need to occupy.

Auditable claims

Source contracts and target-root validation

The conformance position is maintained as matrices and executable validators rather than inferred from directory names.

./build.sh fhs-audit --source-only
./build.sh lsb-audit --source-only
./build.sh fhs-audit
./build.sh lsb-audit

• The FHS validator rejects usrmerge links and root-hierarchy executables resolving below /usr.
• The LSB validator checks compatible commands while rejecting misleading glibc loader and library aliases.
• Stage4 rejects packages that replace protected root directories or move essential root-hierarchy files into /usr.