commit 5f93867198fbbf17ffd310ff34e5ac8872b0fa2b
Author: huntedbytheirs <huntedbyth3irs@gmail.com>
Date:   Tue Aug 18 00:31:50 2026 -0400

    First push!

diff --git a/stable/binutils.kap b/stable/binutils.kap
new file mode 100644
index 0000000..acd3ab7
--- /dev/null
+++ b/stable/binutils.kap
@@ -0,0 +1,44 @@
+/*
+ * binutils — GNU assembler, linker, and binary tools (as, ld, ar, nm,
+ * objdump, strip, readelf, ...).
+ *
+ * gcc needs as/ld on PATH when it builds libgcc, so gcc's recipe resolves
+ * this package's bin dir.  Compressed debug sections use the BUNDLED zlib
+ * (no external dependency).
+ *
+ * PORTABILITY: --disable-werror (never fail builds on warnings from any
+ * host compiler) and --disable-nls (no gettext/libintl — keeps every
+ * binary free of distro-specific libintl).  The test suite requires
+ * dejagnu (runtest), which is not part of the bootstrap chain — check is
+ * deliberately omitted.
+ */
+package "binutils" {
+    const version = "2.47"
+    const source  = "https://ftp.gnu.org/gnu/binutils/binutils-${version}.tar.gz"
+    sha256 = "15f5abd0db9cf8ea116f516a9ce12bc1cefef491ef9e50942868093d8f92a6f3"
+    license = "GPL-3.0-or-later"
+
+    provides = ["as", "ld", "ar", "nm", "objdump", "strip", "readelf"]
+
+    depends = [
+        { name = "make" },
+    ]
+
+    prepare {
+        curl -L -O ${source}
+        echo "15f5abd0db9cf8ea116f516a9ce12bc1cefef491ef9e50942868093d8f92a6f3  binutils-${version}.tar.gz" | sha256sum -c -
+        tar xf binutils-${version}.tar.gz --strip-components=1
+    }
+
+    build {
+        ./configure --prefix=${prefix} --disable-werror --disable-nls
+        make -j${jobs}
+    }
+
+    install {
+        make DESTDIR=${destdir} install
+        // Strip libtool .la files: they record stale absolute paths that
+        // break dependents linking against these libraries.
+        find ${destdir} -name '*.la' -delete
+    }
+}
diff --git a/stable/doas.kap b/stable/doas.kap
new file mode 100644
index 0000000..201b9af
--- /dev/null
+++ b/stable/doas.kap
@@ -0,0 +1,46 @@
+/*
+ * doas — OpenDoas, the portable OpenBSD-style privilege escalation tool.
+ *
+ * A minimal, auditable alternative to sudo.  Configured with --without-pam
+ * so it authenticates against /etc/shadow directly (getspnam + libcrypt) —
+ * no PAM configuration to get wrong, no extra runtime dependencies.
+ *
+ * BUILD REQUIREMENTS
+ * ==================
+ * - GNU make (the GNUmakefile is not portable to other make flavours)
+ * - yacc (bison) — parse.y is compiled at build time, not shipped pre-built
+ * - a C toolchain
+ * - libcrypt (libxcrypt on modern glibc) at build AND runtime
+ * - root: the install target chowns doas to root:root and chmods it 4755
+ *   (setuid), which fails as a non-root user
+ *
+ * CONFIG
+ * ======
+ * doas.conf is deliberately NOT installed — upstream ships no default and
+ * the format is simple (permit/deny rules).  Write /etc/doas.conf by hand.
+ */
+package "doas" {
+    const version = "6.8.2"
+    const source  = "https://github.com/Duncaen/OpenDoas/releases/download/v${version}/opendoas-${version}.tar.gz"
+    sha256 = "28dca29adec5f4336465812d9e2243f599e62a78903de71c24f0cd6fe667edac"
+    license = "ISC"
+
+    provides = ["doas"]
+
+    // No package-level env: the GNUmakefile already forces -O2 and appends
+    // the user's CFLAGS.  Optimization belongs in config.kap, not here.
+    prepare {
+        curl -L -O ${source}
+        echo "28dca29adec5f4336465812d9e2243f599e62a78903de71c24f0cd6fe667edac  opendoas-${version}.tar.gz" | sha256sum -c -
+        tar xf opendoas-${version}.tar.gz --strip-components=1
+    }
+
+    build {
+        ./configure --prefix=${prefix} --without-pam
+        make -j${jobs}
+    }
+
+    install {
+        make DESTDIR=${destdir} install
+    }
+}
diff --git a/stable/gcc.kap b/stable/gcc.kap
new file mode 100644
index 0000000..a69eff6
--- /dev/null
+++ b/stable/gcc.kap
@@ -0,0 +1,69 @@
+/*
+ * gcc — the GNU C and C++ compiler.
+ *
+ * The seed compiler for the whole distro.  Out-of-tree build (gcc refuses
+ * in-tree configure) with the default 3-stage bootstrap: the compiler
+ * builds itself twice, so what lands in the store is self-hosted.
+ *
+ * LANGUAGES: c,c++ — gcc's bootstrap FORCES the C++ frontend even for a
+ * C-only request (configure.ac: "If bootstrapping, C++ must be enabled"),
+ * so the explicit c,c++ is the honest configuration.  It also ships
+ * libstdc++, which everything downstream (including kappa itself) needs.
+ * LTO is always enabled.
+ *
+ * BUILD REQUIREMENTS
+ * ==================
+ * - the three math libs via --with-gmp/--with-mpfr/--with-mpc (resolved
+ *   from the dependency paths below; they build static-only, so gcc links
+ *   them statically and needs no runtime lib resolution)
+ * - binutils: its bin dir is prepended to PATH so gcc finds as/ld
+ * - a C++ compiler on the bootstrap system: cc1 is C++, even for the C
+ *   frontend (the seed toolchain that built kappa provides one)
+ * - make
+ *
+ * PORTABILITY
+ * ===========
+ * - --disable-multilib: barebones systems have no 32-bit libs to link
+ * - --disable-nls: no gettext dependency
+ * - prebuilt .info pages ship in the tarball, so texinfo is NOT required
+ * - the testsuite needs dejagnu and takes hours — check is omitted
+ * - bootstrap needs ~10 GB of temp space; keep KAPPA_ROOT off tmpfs
+ */
+package "gcc" {
+    const version = "16.2.0"
+    const source  = "https://ftp.gnu.org/gnu/gcc/gcc-${version}/gcc-${version}.tar.gz"
+    sha256 = "071d00a097579e5ef7ce97fc4a9e58e73fd3503c0a013c765c970370a5a53b9b"
+    license = "GPL-3.0-or-later WITH GCC-exception-3.1"
+
+    provides = ["cc", "gcc", "cpp"]
+
+    depends = [
+        { name = "gmp" },
+        { name = "mpfr" },
+        { name = "mpc" },
+        { name = "binutils" },
+        { name = "make" },
+    ]
+
+    prepare {
+        curl -L -O ${source}
+        echo "071d00a097579e5ef7ce97fc4a9e58e73fd3503c0a013c765c970370a5a53b9b  gcc-${version}.tar.gz" | sha256sum -c -
+        // Rebuilds reuse the temp work dir — wipe any stale out-of-tree
+        // build state before extracting a fresh source tree.
+        rm -rf gcc-${version}
+        tar xf gcc-${version}.tar.gz
+        ROOT=$KAPPA_ROOT; [ -z $ROOT ] && ROOT=/usr/local/kappa; if [ -d $ROOT/temp/gmp/destdir/usr ]; then echo $ROOT/temp/gmp/destdir/usr; else echo $ROOT/bin/$(grep '^gmp ' $ROOT/db/installed | tail -1 | cut -d' ' -f3)/usr; fi > gmp.path; if [ -d $ROOT/temp/mpfr/destdir/usr ]; then echo $ROOT/temp/mpfr/destdir/usr; else echo $ROOT/bin/$(grep '^mpfr ' $ROOT/db/installed | tail -1 | cut -d' ' -f3)/usr; fi > mpfr.path; if [ -d $ROOT/temp/mpc/destdir/usr ]; then echo $ROOT/temp/mpc/destdir/usr; else echo $ROOT/bin/$(grep '^mpc ' $ROOT/db/installed | tail -1 | cut -d' ' -f3)/usr; fi > mpc.path; if [ -d $ROOT/temp/binutils/destdir/usr/bin ]; then echo $ROOT/temp/binutils/destdir/usr/bin; else echo $ROOT/bin/$(grep '^binutils ' $ROOT/db/installed | tail -1 | cut -d' ' -f3)/usr/bin; fi > bin.path
+        mkdir -p gcc-${version}/build
+    }
+
+    // "c,c++" is double-quoted because a bare comma is a DSL token that gets
+    // re-joined with a space (--enable-languages=c, c++ would split argv).
+    build {
+        GMP=$(cat gmp.path); MPFR=$(cat mpfr.path); MPC=$(cat mpc.path); BIN=$(cat bin.path); cd gcc-${version}/build; PATH=$BIN:$PATH ../configure --prefix=${prefix} --with-gmp=$GMP --with-mpfr=$MPFR --with-mpc=$MPC --enable-languages="c,c++" --disable-multilib --disable-nls
+        BIN=$(cat bin.path); cd gcc-${version}/build; PATH=$BIN:$PATH make -j${jobs}
+    }
+
+    install {
+        BIN=$(cat bin.path); cd gcc-${version}/build; PATH=$BIN:$PATH make DESTDIR=${destdir} install
+    }
+}
diff --git a/stable/gmp.kap b/stable/gmp.kap
new file mode 100644
index 0000000..3bb815c
--- /dev/null
+++ b/stable/gmp.kap
@@ -0,0 +1,54 @@
+/*
+ * gmp — GNU Multiple Precision Arithmetic Library.
+ *
+ * Foundation of the compiler chain: mpfr, mpc, and gcc all build against
+ * it.  Build-time tools: m4 (processes the architecture asm files) and
+ * make.
+ *
+ * STATIC-ONLY: --disable-shared.  kappa has no activation step yet (no
+ * ld.so.conf / rpath wiring), and the rebuild pipeline builds all packages
+ * before installing any — so a shared libgmp would be unfindable at runtime
+ * by dependents.  Static keeps the whole bootstrap chain self-contained;
+ * revisit when kappa gains store activation.
+ *
+ * DEPENDENCY PATHS: kappa's scheduler builds dependencies into
+ * $KAPPA_ROOT/temp/<dep>/destdir/usr before starting dependents, and only
+ * installs everything into $KAPPA_ROOT/bin/<hash>/usr afterwards.  The
+ * prepare phase resolves each dep from whichever location exists.
+ */
+package "gmp" {
+    const version = "6.3.0"
+    const source  = "https://ftp.gnu.org/gnu/gmp/gmp-${version}.tar.gz"
+    sha256 = "e56fd59d76810932a0555aa15a14b61c16bed66110d3c75cc2ac49ddaa9ab24c"
+    license = "GPL-3.0-or-later"
+
+    provides = ["libgmp.a", "gmp"]
+
+    depends = [
+        { name = "m4" },
+        { name = "make" },
+    ]
+
+    prepare {
+        curl -L -O ${source}
+        echo "e56fd59d76810932a0555aa15a14b61c16bed66110d3c75cc2ac49ddaa9ab24c  gmp-${version}.tar.gz" | sha256sum -c -
+        tar xf gmp-${version}.tar.gz --strip-components=1
+        ROOT=$KAPPA_ROOT; [ -z $ROOT ] && ROOT=/usr/local/kappa; if [ -d $ROOT/temp/m4/destdir/usr/bin ]; then echo $ROOT/temp/m4/destdir/usr/bin; else echo $ROOT/bin/$(grep '^m4 ' $ROOT/db/installed | tail -1 | cut -d' ' -f3)/usr/bin; fi > m4.path
+    }
+
+    build {
+        PATH=$(cat m4.path):$PATH ./configure --prefix=${prefix} --disable-shared
+        PATH=$(cat m4.path):$PATH make -j${jobs}
+    }
+
+    check {
+        PATH=$(cat m4.path):$PATH make check
+    }
+
+    install {
+        PATH=$(cat m4.path):$PATH make DESTDIR=${destdir} install
+        // Strip libtool .la files: they record stale absolute paths (the
+        // rpath /usr/lib rewrite of uninstalled deps) that break dependents.
+        find ${destdir} -name '*.la' -delete
+    }
+}
diff --git a/stable/index.kap b/stable/index.kap
new file mode 100644
index 0000000..2c63050
--- /dev/null
+++ b/stable/index.kap
@@ -0,0 +1,11 @@
+index "local" {
+    zlib { version = "1.3.2" }
+    doas { version = "6.8.2" }
+    m4 { version = "1.4.21" }
+    make { version = "4.4.1" }
+    gmp { version = "6.3.0" }
+    mpfr { version = "4.2.2" }
+    mpc { version = "1.3.1" }
+    binutils { version = "2.47" }
+    gcc { version = "16.2.0" }
+}
diff --git a/stable/m4.kap b/stable/m4.kap
new file mode 100644
index 0000000..1a1ec52
--- /dev/null
+++ b/stable/m4.kap
@@ -0,0 +1,37 @@
+/*
+ * m4 — GNU macro processor.
+ *
+ * The universal autotools helper: every autoconf-generated configure
+ * script and many build systems (gmp's asm, gettext, bison) invoke m4.
+ * Standalone build — needs only a C compiler and make.
+ *
+ * PORTABILITY: built with defaults; no distro-specific flags.
+ */
+package "m4" {
+    const version = "1.4.21"
+    const source  = "https://ftp.gnu.org/gnu/m4/m4-${version}.tar.gz"
+    sha256 = "38ae59f7a30bf9c108193cc5c25fbb06014f21e230c7ede2eff614f7b7c37ed8"
+    license = "GPL-3.0-or-later"
+
+    provides = ["m4"]
+
+    prepare {
+        curl -L -O ${source}
+        echo "38ae59f7a30bf9c108193cc5c25fbb06014f21e230c7ede2eff614f7b7c37ed8  m4-${version}.tar.gz" | sha256sum -c -
+        tar xf m4-${version}.tar.gz --strip-components=1
+    }
+
+    build {
+        ./configure --prefix=${prefix}
+        make -j${jobs}
+    }
+
+    // NOTE: no check phase — the bundled gnulib test-suite fails to compile
+    // on modern glibc (test-float-h.c: FLT_IS_IEC_60559 / DBL_IS_IEC_60559 /
+    // LDBL_IS_IEC_60559 undeclared).  Upstream issue, not a build failure:
+    // the m4 binary itself compiles cleanly.
+
+    install {
+        make DESTDIR=${destdir} install
+    }
+}
diff --git a/stable/make.kap b/stable/make.kap
new file mode 100644
index 0000000..2b1b9ef
--- /dev/null
+++ b/stable/make.kap
@@ -0,0 +1,38 @@
+/*
+ * make — GNU make, the build tool that builds everything else.
+ *
+ * First package in the bootstrap chain: it is the host build driver for
+ * every autotools package below it (including itself, bootstrapped by the
+ * seed system's make).
+ *
+ * The test suite is perl-based (tests/run_make_tests.pl), so it only runs
+ * when a perl exists; barebones systems without perl skip it rather than
+ * failing the build.
+ */
+package "make" {
+    const version = "4.4.1"
+    const source  = "https://ftp.gnu.org/gnu/make/make-${version}.tar.gz"
+    sha256 = "dd16fb1d67bfab79a72f5e8390735c49e3e8e70b4945a15ab1f81ddb78658fb3"
+    license = "GPL-3.0-or-later"
+
+    provides = ["make", "gmake"]
+
+    prepare {
+        curl -L -O ${source}
+        echo "dd16fb1d67bfab79a72f5e8390735c49e3e8e70b4945a15ab1f81ddb78658fb3  make-${version}.tar.gz" | sha256sum -c -
+        tar xf make-${version}.tar.gz --strip-components=1
+    }
+
+    build {
+        ./configure --prefix=${prefix}
+        make -j${jobs}
+    }
+
+    check {
+        if command -v perl >/dev/null 2>&1; then make check; fi
+    }
+
+    install {
+        make DESTDIR=${destdir} install
+    }
+}
diff --git a/stable/mpc.kap b/stable/mpc.kap
new file mode 100644
index 0000000..0484de2
--- /dev/null
+++ b/stable/mpc.kap
@@ -0,0 +1,43 @@
+/*
+ * mpc — GNU MPC library (complex numbers, built on gmp and mpfr).
+ *
+ * The last of the three libraries gcc needs at configure time.  Same
+ * static-only + dependency-path pattern as mpfr.kap.
+ */
+package "mpc" {
+    const version = "1.3.1"
+    const source  = "https://ftp.gnu.org/gnu/mpc/mpc-${version}.tar.gz"
+    sha256 = "ab642492f5cf882b74aa0cb730cd410a81edcdbec895183ce930e706c1c759b8"
+    license = "LGPL-3.0-or-later"
+
+    provides = ["libmpc.a", "mpc"]
+
+    depends = [
+        { name = "gmp" },
+        { name = "mpfr" },
+        { name = "make" },
+    ]
+
+    prepare {
+        curl -L -O ${source}
+        echo "ab642492f5cf882b74aa0cb730cd410a81edcdbec895183ce930e706c1c759b8  mpc-${version}.tar.gz" | sha256sum -c -
+        tar xf mpc-${version}.tar.gz --strip-components=1
+        ROOT=$KAPPA_ROOT; [ -z $ROOT ] && ROOT=/usr/local/kappa; if [ -d $ROOT/temp/gmp/destdir/usr ]; then echo $ROOT/temp/gmp/destdir/usr; else echo $ROOT/bin/$(grep '^gmp ' $ROOT/db/installed | tail -1 | cut -d' ' -f3)/usr; fi > gmp.path; if [ -d $ROOT/temp/mpfr/destdir/usr ]; then echo $ROOT/temp/mpfr/destdir/usr; else echo $ROOT/bin/$(grep '^mpfr ' $ROOT/db/installed | tail -1 | cut -d' ' -f3)/usr; fi > mpfr.path
+    }
+
+    build {
+        ./configure --prefix=${prefix} --with-gmp=$(cat gmp.path) --with-mpfr=$(cat mpfr.path) --disable-shared
+        make -j${jobs}
+    }
+
+    check {
+        make check
+    }
+
+    install {
+        make DESTDIR=${destdir} install
+        // Strip libtool .la files: they record stale absolute paths (the
+        // rpath /usr/lib rewrite of uninstalled deps) that break dependents.
+        find ${destdir} -name '*.la' -delete
+    }
+}
diff --git a/stable/mpfr.kap b/stable/mpfr.kap
new file mode 100644
index 0000000..134d65c
--- /dev/null
+++ b/stable/mpfr.kap
@@ -0,0 +1,46 @@
+/*
+ * mpfr — GNU MPFR library (multiple-precision floating-point).
+ *
+ * Builds against gmp (static-only, see gmp.kap for the reasoning) and
+ * feeds gmp + mpfr into mpc and gcc.  --with-gmp points at the resolved
+ * gmp install root from the prepare phase.
+ */
+package "mpfr" {
+    const version = "4.2.2"
+    const source  = "https://ftp.gnu.org/gnu/mpfr/mpfr-${version}.tar.gz"
+    sha256 = "826cbb24610bd193f36fde172233fb8c009f3f5c2ad99f644d0dea2e16a20e42"
+    license = "LGPL-3.0-or-later"
+
+    provides = ["libmpfr.a", "mpfr"]
+
+    depends = [
+        { name = "gmp" },
+        { name = "make" },
+    ]
+
+    prepare {
+        curl -L -O ${source}
+        echo "826cbb24610bd193f36fde172233fb8c009f3f5c2ad99f644d0dea2e16a20e42  mpfr-${version}.tar.gz" | sha256sum -c -
+        tar xf mpfr-${version}.tar.gz --strip-components=1
+        ROOT=$KAPPA_ROOT; [ -z $ROOT ] && ROOT=/usr/local/kappa; if [ -d $ROOT/temp/gmp/destdir/usr ]; then echo $ROOT/temp/gmp/destdir/usr; else echo $ROOT/bin/$(grep '^gmp ' $ROOT/db/installed | tail -1 | cut -d' ' -f3)/usr; fi > gmp.path
+    }
+
+    // NOTE: mpfr_get_str crashes (SIGSEGV in get_str_aux) on this glibc —
+    // confirmed identical on the host's system libmpfr, so it is an upstream
+    // bug, not this build.  All arithmetic/set_str/get_d paths verify fine.
+    build {
+        ./configure --prefix=${prefix} --with-gmp=$(cat gmp.path) --disable-shared
+        make -j${jobs}
+    }
+
+    check {
+        make check
+    }
+
+    install {
+        make DESTDIR=${destdir} install
+        // Strip libtool .la files: they record stale absolute paths (the
+        // rpath /usr/lib rewrite of uninstalled deps) that break dependents.
+        find ${destdir} -name '*.la' -delete
+    }
+}
diff --git a/stable/zlib.kap b/stable/zlib.kap
new file mode 100644
index 0000000..bec46d0
--- /dev/null
+++ b/stable/zlib.kap
@@ -0,0 +1,43 @@
+/*
+ * zlib — general-purpose compression library.
+ *
+ * The foundation of the dependency tree: nearly everything downstream
+ * (openssl, curl, postgresql, nginx) links against libz.  Autotools-style
+ * build: ./configure, make, make check, make DESTDIR install.
+ *
+ * DEPENDENCIES
+ * ============
+ * Runtime: none.  Build-time: a C toolchain (clang/gcc).
+ *
+ * NOTE: install goes into ${destdir} exclusively — kappa moves that tree
+ * into the store.  Never point zlib's install at ${prefix} directly.
+ */
+package "zlib" {
+    const version = "1.3.2"
+    const source  = "https://zlib.net/zlib-${version}.tar.gz"
+    sha256 = "bb329a0a2cd0274d05519d61c667c062e06990d72e125ee2dfa8de64f0119d16"
+    license = "Zlib"
+
+    provides = ["libz", "libz.so.1"]
+
+    // No package-level env: optimization flags belong to the user's system
+    // config (config.kap env {}), which kappa propagates to every build.
+    prepare {
+        curl -L -O ${source}
+        echo "bb329a0a2cd0274d05519d61c667c062e06990d72e125ee2dfa8de64f0119d16  zlib-${version}.tar.gz" | sha256sum -c -
+        tar xf zlib-${version}.tar.gz --strip-components=1
+    }
+
+    build {
+        ./configure --prefix=${prefix}
+        make -j${jobs}
+    }
+
+    check {
+        make check
+    }
+
+    install {
+        make DESTDIR=${destdir} install
+    }
+}