kingwl
0a486f09c9
Bring the node-addon-landlock-run tree (tag v0.0.1, commit 614f7fd) into native/landlock-run as its source of record: launcher development happens here, next to the harness consumers, and the standalone repository becomes the release mirror the tree is exported to for packing and publishing (procedure in native/README.md). The subtree keeps its own pnpm workspace and lockfile and is NOT added to the harness workspace: harness installs, gates, and CI never touch it. The mirror's .github/ stays out of the subtree; a separate manually-dispatched workflow (.github/workflows/landlock-run.yml) runs the subtree's CI legs — the per-architecture native builds, real-kernel launcher proofs, and pack rehearsal — adapted with working-directory/cache paths. eslint ignores the subtree like vendor/; AGENTS.md gains the native/ layout line (+5 words on its budget ceiling).
1.1 KiB
Naming
npm packages
The public package family is unscoped, using the node-addon-landlock-run package prefix; platform packages append platform information only:
node-addon-landlock-run
node-addon-landlock-run-<platform>
Platform suffixes carry no libc component (binaries are static musl) and no variant component — variants stay inside prebuilds.json and binary filenames.
Binaries
The launcher executable is landlock-run, shipped at bin/landlock-run inside each platform package.
Environment variables
The NALR_ prefix (Node Addon Landlock Run) is reserved for build/test orchestration:
NALR_REQUIRE_LANDLOCK test-only: an unenforcing kernel fails instead of skipping
Runtime binaries and entry packages read NO environment variables — a runtime safety rule (AGENTS.md), not a naming convention. Do not include the npm scope in environment variable names.
C symbols
The launcher is a single C file with static linkage; there is no exported symbol namespace. Kernel UAPI constants keep their kernel names prefixed LL_ where locally defined.