diff --git a/patches/tcc-0.9.27-glibc-2.34.patch b/patches/tcc-0.9.27-glibc-2.34.patch
new file mode 100644
index 0000000..ea22a59
--- /dev/null
+++ b/patches/tcc-0.9.27-glibc-2.34.patch
@@ -0,0 +1,13 @@
+--- a/lib/bcheck.c
++++ b/lib/bcheck.c
+@@ -50,7 +50,9 @@
+  || defined(__OpenBSD__) \
+  || defined(__NetBSD__) \
+  || defined(__dietlibc__) \
+- || defined(_WIN32)
++ || defined(_WIN32) \
++ || (defined(__GLIBC__) && defined(__GLIBC_PREREQ) \
++     && __GLIBC_PREREQ(2, 34))
+ //#warning Bound checking does not support malloc (etc.) in this environment.
+ #undef CONFIG_TCC_MALLOC_HOOKS
+ #undef HAVE_MEMALIGN
diff --git a/stable/autoconf.kap b/stable/autoconf.kap
new file mode 100644
index 0000000..6d809af
--- /dev/null
+++ b/stable/autoconf.kap
@@ -0,0 +1,36 @@
+/*
+ * autoconf — generates configure scripts (the heart of autotools).
+ *
+ * Perl-based; needs m4 (it drives m4 to generate scripts) and perl at
+ * both build and runtime.  The release tarball ships its own configure.
+ */
+package "autoconf" {
+    const version = "2.73"
+    const source  = "https://ftp.gnu.org/gnu/autoconf/autoconf-${version}.tar.gz"
+    sha256 = "259ddfa3bddc799cfb81489cc0f17dfdf1bd6d1505dda53c0f45ff60d6a4f9a7"
+    license = "GPL-3.0-or-later"
+
+    provides = ["autoconf", "autom4te", "autoreconf"]
+
+    depends = [
+        { name = "perl" },
+        { name = "m4" },
+        { name = "make" },
+    ]
+
+    prepare {
+        curl -L -o autoconf-${version}.tar.gz ${source}
+        echo "259ddfa3bddc799cfb81489cc0f17dfdf1bd6d1505dda53c0f45ff60d6a4f9a7  autoconf-${version}.tar.gz" | sha256sum -c -
+        tar xf autoconf-${version}.tar.gz --strip-components=1
+        ROOT=$KAPPA_ROOT; [ -z $ROOT ] && ROOT=/usr/local/kappa; if [ -d $ROOT/temp/perl/destdir/usr/bin ]; then echo $ROOT/temp/perl/destdir/usr/bin; else echo $ROOT/bin/$(grep '^perl ' $ROOT/db/installed | tail -1 | cut -d' ' -f3)/usr/bin; fi > perl.path; if [ -d $ROOT/temp/m4/destdir/usr/bin ]; then echo $ROOT/temp/m4/destdir/usr/bin; else echo $ROOT/bin/$(grep '^m4 ' $ROOT/db/installed | tail -1 | cut -d' ' -f3)/usr/bin; fi > m4.path
+    }
+
+    build {
+        PATH=$(cat perl.path):$(cat m4.path):$PATH ./configure --prefix=${prefix}
+        PATH=$(cat perl.path):$(cat m4.path):$PATH make -j${jobs}
+    }
+
+    install {
+        PATH=$(cat perl.path):$(cat m4.path):$PATH make DESTDIR=${destdir} install
+    }
+}
diff --git a/stable/automake.kap b/stable/automake.kap
new file mode 100644
index 0000000..d393a09
--- /dev/null
+++ b/stable/automake.kap
@@ -0,0 +1,38 @@
+/*
+ * automake — generates Makefile.in from Makefile.am.
+ *
+ * Perl-based; aclocal/automake shell out to autoconf/autom4te at
+ * runtime, so perl + autoconf + m4 are all required.  The release
+ * tarball ships its own configure.
+ */
+package "automake" {
+    const version = "1.18"
+    const source  = "https://ftp.gnu.org/gnu/automake/automake-${version}.tar.gz"
+    sha256 = "af6043a5d4b3beef0c48161f4a6936259321cd101a34c1ab0768328515626c8a"
+    license = "GPL-2.0-or-later"
+
+    provides = ["automake", "aclocal"]
+
+    depends = [
+        { name = "perl" },
+        { name = "autoconf" },
+        { name = "m4" },
+        { name = "make" },
+    ]
+
+    prepare {
+        curl -L -o automake-${version}.tar.gz ${source}
+        echo "af6043a5d4b3beef0c48161f4a6936259321cd101a34c1ab0768328515626c8a  automake-${version}.tar.gz" | sha256sum -c -
+        tar xf automake-${version}.tar.gz --strip-components=1
+        ROOT=$KAPPA_ROOT; [ -z $ROOT ] && ROOT=/usr/local/kappa; if [ -d $ROOT/temp/perl/destdir/usr/bin ]; then echo $ROOT/temp/perl/destdir/usr/bin; else echo $ROOT/bin/$(grep '^perl ' $ROOT/db/installed | tail -1 | cut -d' ' -f3)/usr/bin; fi > perl.path; if [ -d $ROOT/temp/autoconf/destdir/usr/bin ]; then echo $ROOT/temp/autoconf/destdir/usr/bin; else echo $ROOT/bin/$(grep '^autoconf ' $ROOT/db/installed | tail -1 | cut -d' ' -f3)/usr/bin; fi > ac.path; if [ -d $ROOT/temp/m4/destdir/usr/bin ]; then echo $ROOT/temp/m4/destdir/usr/bin; else echo $ROOT/bin/$(grep '^m4 ' $ROOT/db/installed | tail -1 | cut -d' ' -f3)/usr/bin; fi > m4.path
+    }
+
+    build {
+        PATH=$(cat perl.path):$(cat ac.path):$(cat m4.path):$PATH ./configure --prefix=${prefix}
+        PATH=$(cat perl.path):$(cat ac.path):$(cat m4.path):$PATH make -j${jobs}
+    }
+
+    install {
+        PATH=$(cat perl.path):$(cat ac.path):$(cat m4.path):$PATH make DESTDIR=${destdir} install
+    }
+}
diff --git a/stable/bash.kap b/stable/bash.kap
new file mode 100644
index 0000000..362dcae
--- /dev/null
+++ b/stable/bash.kap
@@ -0,0 +1,41 @@
+/*
+ * bash — the Bourne Again SHell.
+ *
+ * Links the store readline (static, via ncurses) for line editing and
+ * history.  The sh link is distro-managed (busybox provides sh via ash).
+ * The testsuite is long and interactive-hostile — check is omitted.
+ */
+package "bash" {
+    const version = "5.3"
+    const source  = "https://ftp.gnu.org/gnu/bash/bash-${version}.tar.gz"
+    sha256 = "0d5cd86965f869a26cf64f4b71be7b96f90a3ba8b3d74e27e8e9d9d5550f31ba"
+    license = "GPL-3.0-or-later"
+
+    provides = ["bash"]
+
+    depends = [
+        { name = "readline" },
+        { name = "ncurses" },
+        { name = "make" },
+    ]
+
+    prepare {
+        curl -L -o bash-${version}.tar.gz ${source}
+        echo "0d5cd86965f869a26cf64f4b71be7b96f90a3ba8b3d74e27e8e9d9d5550f31ba  bash-${version}.tar.gz" | sha256sum -c -
+        tar xf bash-${version}.tar.gz --strip-components=1
+        ROOT=$KAPPA_ROOT; [ -z $ROOT ] && ROOT=/usr/local/kappa; if [ -d $ROOT/temp/readline/destdir/usr ]; then echo $ROOT/temp/readline/destdir/usr; else echo $ROOT/bin/$(grep '^readline ' $ROOT/db/installed | tail -1 | cut -d' ' -f3)/usr; fi > readline.path; if [ -d $ROOT/temp/ncurses/destdir/usr ]; then echo $ROOT/temp/ncurses/destdir/usr; else echo $ROOT/bin/$(grep '^ncurses ' $ROOT/db/installed | tail -1 | cut -d' ' -f3)/usr; fi > ncurses.path
+        // multi-flag CPPFLAGS/LDFLAGS as files: a bare "VAR=-I.. -I.." line
+        // makes the shell treat the second flag as a command.
+        echo -I$(cat readline.path)/include -I$(cat ncurses.path)/include > cppflags.txt
+        echo -L$(cat readline.path)/lib -L$(cat ncurses.path)/lib > ldflags.txt
+    }
+
+    build {
+        CPPFLAGS=$(cat cppflags.txt) LDFLAGS=$(cat ldflags.txt) ./configure --prefix=${prefix}
+        make -j${jobs}
+    }
+
+    install {
+        make DESTDIR=${destdir} install
+    }
+}
diff --git a/stable/busybox.kap b/stable/busybox.kap
new file mode 100644
index 0000000..896d9cc
--- /dev/null
+++ b/stable/busybox.kap
@@ -0,0 +1,41 @@
+/*
+ * busybox — the multi-call binary: hundreds of applets in one binary
+ * (ash, wget, ip, sed, grep, ... — the ISO's base userland).
+ *
+ * defconfig enables every applet.  CONFIG_TC is force-disabled: the tc
+ * applet references kernel-header constants (TCA_CBQ_*) that modern
+ * kernels removed — a known busybox-vs-new-headers breakage.  Everything
+ * else builds clean.
+ *
+ * Install uses CONFIG_PREFIX (busybox's DESTDIR): the busybox binary
+ * plus applet symlinks land in bin/ sbin/ usr/bin/ usr/sbin/.
+ * The test suite needs a separate harness — check is omitted.
+ */
+package "busybox" {
+    const version = "1.38.0"
+    const source  = "https://busybox.net/downloads/busybox-${version}.tar.bz2"
+    sha256 = "34f9ea6ff8636f2c9241153b9114eefa9e65674a45318ae1ef95bb5f31c53bb2"
+    license = "GPL-2.0-only"
+
+    provides = ["busybox", "sh"]
+
+    depends = [
+        { name = "make" },
+    ]
+
+    prepare {
+        curl -L -o busybox-${version}.tar.bz2 ${source}
+        echo "34f9ea6ff8636f2c9241153b9114eefa9e65674a45318ae1ef95bb5f31c53bb2  busybox-${version}.tar.bz2" | sha256sum -c -
+        tar xf busybox-${version}.tar.bz2 --strip-components=1
+    }
+
+    build {
+        make defconfig
+        sed -i 's/CONFIG_TC=y/CONFIG_TC=n/' .config
+        make -j${jobs}
+    }
+
+    install {
+        make install CONFIG_PREFIX=${destdir}
+    }
+}
diff --git a/stable/cmake.kap b/stable/cmake.kap
new file mode 100644
index 0000000..7bc812a
--- /dev/null
+++ b/stable/cmake.kap
@@ -0,0 +1,39 @@
+/*
+ * cmake — the cross-platform build system generator.
+ *
+ * Bootstraps itself (./bootstrap builds a mini cmake, then the full
+ * build compiles the real one) — needs only a C++ compiler and make.
+ * All bundled third-party libs (libarchive, curl, jsoncpp, zlib, ...)
+ * are used by default, so no external deps.
+ *
+ * OpenSSL is forced OFF: the host may provide libssl, but the store
+ * cmake must not link against a host-only shared lib (the showoff ISO
+ * has none).  HTTPS in cmake scripts comes later with an openssl package.
+ */
+package "cmake" {
+    const version = "4.4.1"
+    const source  = "https://cmake.org/files/v4.4/cmake-${version}.tar.gz"
+    sha256 = "95d4721f3625fb0d9d6ca480dd59a46c84b4c157f7fadd2e9b179ef9c871174d"
+    license = "BSD-3-Clause"
+
+    provides = ["cmake", "ctest", "cpack"]
+
+    depends = [
+        { name = "make" },
+    ]
+
+    prepare {
+        curl -L -o cmake-${version}.tar.gz ${source}
+        echo "95d4721f3625fb0d9d6ca480dd59a46c84b4c157f7fadd2e9b179ef9c871174d  cmake-${version}.tar.gz" | sha256sum -c -
+        tar xf cmake-${version}.tar.gz --strip-components=1
+    }
+
+    build {
+        ./bootstrap --prefix=${prefix} -- -DCMAKE_USE_OPENSSL=OFF
+        make -j${jobs}
+    }
+
+    install {
+        make DESTDIR=${destdir} install
+    }
+}
diff --git a/stable/index.kap b/stable/index.kap
index 2c63050..ee29a25 100644
--- a/stable/index.kap
+++ b/stable/index.kap
@@ -8,4 +8,20 @@ index "local" {
     mpc { version = "1.3.1" }
     binutils { version = "2.47" }
     gcc { version = "16.2.0" }
+    pkgconf { version = "3.0.5" }
+    python { version = "3.14.7" }
+    ninja { version = "1.13.2" }
+    meson { version = "1.12.0" }
+    openrc { version = "0.63.3" }
+    tcc { version = "0.9.27" }
+    musl { version = "1.2.6" }
+    perl { version = "5.42.3" }
+    cmake { version = "4.4.1" }
+    autoconf { version = "2.73" }
+    automake { version = "1.18" }
+    libtool { version = "2.5.4" }
+    busybox { version = "1.38.0" }
+    bash { version = "5.3" }
+    ncurses { version = "6.6" }
+    readline { version = "8.3" }
 }
diff --git a/stable/libtool.kap b/stable/libtool.kap
new file mode 100644
index 0000000..1b4ee5e
--- /dev/null
+++ b/stable/libtool.kap
@@ -0,0 +1,37 @@
+/*
+ * libtool — the portable shared-library builder (libtoolize + ltmain).
+ *
+ * Shell-based; libtoolize may consult autoconf/automake at runtime, so
+ * they are declared as deps.  The release tarball ships its own
+ * configure and the generated libltdl.
+ */
+package "libtool" {
+    const version = "2.5.4"
+    const source  = "https://ftp.gnu.org/gnu/libtool/libtool-${version}.tar.gz"
+    sha256 = "da8ebb2ce4dcf46b90098daf962cffa68f4b4f62ea60f798d0ef12929ede6adf"
+    license = "GPL-2.0-or-later"
+
+    provides = ["libtool", "libtoolize"]
+
+    depends = [
+        { name = "autoconf" },
+        { name = "automake" },
+        { name = "make" },
+    ]
+
+    prepare {
+        curl -L -o libtool-${version}.tar.gz ${source}
+        echo "da8ebb2ce4dcf46b90098daf962cffa68f4b4f62ea60f798d0ef12929ede6adf  libtool-${version}.tar.gz" | sha256sum -c -
+        tar xf libtool-${version}.tar.gz --strip-components=1
+        ROOT=$KAPPA_ROOT; [ -z $ROOT ] && ROOT=/usr/local/kappa; if [ -d $ROOT/temp/autoconf/destdir/usr/bin ]; then echo $ROOT/temp/autoconf/destdir/usr/bin; else echo $ROOT/bin/$(grep '^autoconf ' $ROOT/db/installed | tail -1 | cut -d' ' -f3)/usr/bin; fi > ac.path; if [ -d $ROOT/temp/automake/destdir/usr/bin ]; then echo $ROOT/temp/automake/destdir/usr/bin; else echo $ROOT/bin/$(grep '^automake ' $ROOT/db/installed | tail -1 | cut -d' ' -f3)/usr/bin; fi > am.path
+    }
+
+    build {
+        PATH=$(cat ac.path):$(cat am.path):$PATH ./configure --prefix=${prefix}
+        PATH=$(cat ac.path):$(cat am.path):$PATH make -j${jobs}
+    }
+
+    install {
+        PATH=$(cat ac.path):$(cat am.path):$PATH make DESTDIR=${destdir} install
+    }
+}
diff --git a/stable/meson.kap b/stable/meson.kap
new file mode 100644
index 0000000..5aa45d0
--- /dev/null
+++ b/stable/meson.kap
@@ -0,0 +1,41 @@
+/*
+ * meson — the build system.
+ *
+ * Pure-python; installed by a plain file copy (no setuptools dependency):
+ * meson.py becomes /usr/bin/meson and mesonbuild/ lands in the store
+ * python's site-packages.  At runtime meson shells out to pkg-config and
+ * ninja, so both must be on PATH when meson is used.
+ */
+package "meson" {
+    const version = "1.12.0"
+    const source  = "https://github.com/mesonbuild/meson/archive/refs/tags/${version}.tar.gz"
+    sha256 = "5ab1c86446d9dfe073f07141088cde545e43f8ddb2f97ebe3f600ab12e77ca1f"
+    license = "Apache-2.0"
+
+    provides = ["meson"]
+
+    depends = [
+        { name = "python" },
+        { name = "pkgconf" },
+    ]
+
+    prepare {
+        curl -L -o meson-${version}.tar.gz ${source}
+        echo "5ab1c86446d9dfe073f07141088cde545e43f8ddb2f97ebe3f600ab12e77ca1f  meson-${version}.tar.gz" | sha256sum -c -
+        tar xf meson-${version}.tar.gz --strip-components=1
+        ROOT=$KAPPA_ROOT; [ -z $ROOT ] && ROOT=/usr/local/kappa; if [ -d $ROOT/temp/python/destdir/usr/bin ]; then echo $ROOT/temp/python/destdir/usr/bin; else echo $ROOT/bin/$(grep '^python ' $ROOT/db/installed | tail -1 | cut -d' ' -f3)/usr/bin; fi > py.path
+    }
+
+    // Installs mesonbuild NEXT TO the script: meson.py's own self-fixup adds
+    // its directory to sys.path when mesonbuild is a sibling, so no
+    // PYTHONPATH games are needed in the store.  meson.py ships +x.
+    build {
+        mkdir -p ${destdir}/usr/bin
+        cp meson.py ${destdir}/usr/bin/meson
+        cp -r mesonbuild ${destdir}/usr/bin/mesonbuild
+    }
+
+    install {
+        true
+    }
+}
diff --git a/stable/musl.kap b/stable/musl.kap
new file mode 100644
index 0000000..2cad8aa
--- /dev/null
+++ b/stable/musl.kap
@@ -0,0 +1,51 @@
+/*
+ * musl — the musl C library.
+ *
+ * A library building block, NOT a system switch: glibc remains the
+ * system libc; this package makes musl available in the store (headers,
+ * static libc.a, shared libc.so + ld-musl loader, crt objects).
+ *
+ * CONSUMING MUSL (no musl-gcc wrapper ships in 1.2.6 — it was replaced
+ * by clang-based wrappers, and we ship gcc).  Link with gcc directly:
+ *
+ *   gcc -nostdinc -isystem $MUSL/usr/include \
+ *       -nostdlib -L$MUSL/usr/lib -Wl,-dynamic-linker,$MUSL/lib/ld-musl-x86_64.so.1 \
+ *       -static -lcrt1.o -lc -lgcc ...
+ *
+ * or for fully static binaries, the simpler:
+ *
+ *   gcc -nostdinc -isystem $MUSL/usr/include -nostdlib -static \
+ *       -L$MUSL/usr/lib -lcrt1.o -lc -lgcc -lgcc_eh
+ *
+ * where $MUSL is the store install root.  Build requires only a C
+ * compiler and make; no external deps.
+ */
+package "musl" {
+    const version = "1.2.6"
+    const source  = "https://musl.libc.org/releases/musl-${version}.tar.gz"
+    sha256 = "d585fd3b613c66151fc3249e8ed44f77020cb5e6c1e635a616d3f9f82460512a"
+    license = "MIT"
+
+    provides = ["musl", "libc.a", "ld-musl"]
+
+    depends = [
+        { name = "make" },
+    ]
+
+    prepare {
+        curl -L -O ${source}
+        echo "d585fd3b613c66151fc3249e8ed44f77020cb5e6c1e635a616d3f9f82460512a  musl-${version}.tar.gz" | sha256sum -c -
+        tar xf musl-${version}.tar.gz --strip-components=1
+    }
+
+    build {
+        ./configure --prefix=${prefix}
+        make -j${jobs}
+    }
+
+    // NOTE: no check phase — musl 1.2.6's Makefile has no check/test target.
+
+    install {
+        make DESTDIR=${destdir} install
+    }
+}
diff --git a/stable/ncurses.kap b/stable/ncurses.kap
new file mode 100644
index 0000000..308da43
--- /dev/null
+++ b/stable/ncurses.kap
@@ -0,0 +1,41 @@
+/*
+ * ncurses — terminal handling library + terminfo database.
+ *
+ * Built wide-char (ncurses 6.x default) with --with-termlib so the
+ * terminal-capability code is split into libtinfow.  The narrow names
+ * (libncurses, libtinfo, ...) are symlinked to the wide libs — the
+ * standard distro arrangement — so consumers linking -lncurses/-ltinfo
+ * resolve to the wide implementations (symbols are compatible).
+ */
+package "ncurses" {
+    const version = "6.6"
+    const source  = "https://ftp.gnu.org/gnu/ncurses/ncurses-${version}.tar.gz"
+    sha256 = "355b4cbbed880b0381a04c46617b7656e362585d52e9cf84a67e2009b749ff11"
+    license = "MIT"
+
+    provides = ["libncurses.a", "libtinfo.a", "terminfo"]
+
+    depends = [
+        { name = "make" },
+    ]
+
+    prepare {
+        curl -L -o ncurses-${version}.tar.gz ${source}
+        echo "355b4cbbed880b0381a04c46617b7656e362585d52e9cf84a67e2009b749ff11  ncurses-${version}.tar.gz" | sha256sum -c -
+        tar xf ncurses-${version}.tar.gz --strip-components=1
+    }
+
+    build {
+        ./configure --prefix=${prefix} --with-termlib
+        make -j${jobs}
+    }
+
+    install {
+        make DESTDIR=${destdir} install
+        ln -sf libncursesw.a ${destdir}/usr/lib/libncurses.a
+        ln -sf libtinfow.a ${destdir}/usr/lib/libtinfo.a
+        ln -sf libpanelw.a ${destdir}/usr/lib/libpanel.a
+        ln -sf libmenuw.a ${destdir}/usr/lib/libmenu.a
+        ln -sf libformw.a ${destdir}/usr/lib/libform.a
+    }
+}
diff --git a/stable/ninja.kap b/stable/ninja.kap
new file mode 100644
index 0000000..a50313f
--- /dev/null
+++ b/stable/ninja.kap
@@ -0,0 +1,37 @@
+/*
+ * ninja — the build system generator's engine.
+ *
+ * Built with its own bootstrap (python3 configure.py --bootstrap) — no
+ * cmake needed.  Requires a C++17 compiler on PATH (c++).
+ *
+ * Ninja's configure.py also needs python3: resolved from the store and
+ * prepended to PATH (the store python may be the only one on barebones).
+ */
+package "ninja" {
+    const version = "1.13.2"
+    const source  = "https://github.com/ninja-build/ninja/archive/refs/tags/v${version}.tar.gz"
+    sha256 = "974d6b2f4eeefa25625d34da3cb36bdcebe7fbce40f4c16ac0835fd1c0cbae17"
+    license = "Apache-2.0"
+
+    provides = ["ninja"]
+
+    depends = [
+        { name = "python" },
+    ]
+
+    prepare {
+        curl -L -o ninja-${version}.tar.gz ${source}
+        echo "974d6b2f4eeefa25625d34da3cb36bdcebe7fbce40f4c16ac0835fd1c0cbae17  ninja-${version}.tar.gz" | sha256sum -c -
+        tar xf ninja-${version}.tar.gz --strip-components=1
+        ROOT=$KAPPA_ROOT; [ -z $ROOT ] && ROOT=/usr/local/kappa; if [ -d $ROOT/temp/python/destdir/usr/bin ]; then echo $ROOT/temp/python/destdir/usr/bin; else echo $ROOT/bin/$(grep '^python ' $ROOT/db/installed | tail -1 | cut -d' ' -f3)/usr/bin; fi > py.path
+    }
+
+    build {
+        PATH=$(cat py.path):$PATH python3 configure.py --bootstrap
+    }
+
+    install {
+        mkdir -p ${destdir}/usr/bin
+        cp ninja ${destdir}/usr/bin/ninja
+    }
+}
diff --git a/stable/openrc.kap b/stable/openrc.kap
new file mode 100644
index 0000000..eb61af4
--- /dev/null
+++ b/stable/openrc.kap
@@ -0,0 +1,60 @@
+/*
+ * openrc — the service manager / init system (first init).
+ *
+ * kappa generates openrc service files (boot.init = "openrc") — this
+ * package provides the manager itself: openrc-init, openrc-run,
+ * rc-update, start-stop-daemon, plus the /etc/init.d + runlevel layout.
+ *
+ * BUILD REQUIREMENTS: meson + ninja + python + pkg-config (all kappa
+ * packages, prepended to PATH).  Optional deps (pam/audit/selinux) are
+ * disabled for barebones compatibility.
+ *
+ * ROOT HANDOFF (kappa has no activation step yet)
+ * ==============================================
+ * The store cannot boot anything by itself.  To actually boot this init:
+ *   cp -a <store>/bin/<hash>/sbin/. /sbin/
+ *   cp -a <store>/bin/<hash>/bin/.  /bin/
+ *   cp -a <store>/bin/<hash>/lib/.  /lib/
+ *   cp -a <store>/bin/<hash>/etc/init.d /etc/
+ *   cp -a <store>/bin/<hash>/etc/conf.d /etc/
+ * then set `init=/sbin/openrc-init` on the kernel command line.
+ * kappa's rebuild writes generated service scripts into /etc/init.d.
+ */
+package "openrc" {
+    const version = "0.63.3"
+    const source  = "https://github.com/OpenRC/openrc/archive/${version}.tar.gz"
+    sha256 = "f5bc2257f22ca7f0920a12698ad1e8f85a0f91a90e8e83106611514ea409b8ec"
+    license = "BSD-2-Clause"
+
+    provides = ["openrc", "rc-update", "openrc-init"]
+
+    depends = [
+        { name = "python" },
+        { name = "meson" },
+        { name = "ninja" },
+        { name = "pkgconf" },
+    ]
+
+    // $ORIGIN rpath: the store has no activation/ld.so.conf wiring, so
+    // openrc's own shared libs (librc, libeinfo) must resolve relative to
+    // the binary.  $ORIGIN is interpreted by the linker, not the shell.
+    env {
+        LDFLAGS = "-Wl,-rpath,$ORIGIN/../usr/lib"
+    }
+
+    prepare {
+        curl -L -o openrc-${version}.tar.gz ${source}
+        echo "f5bc2257f22ca7f0920a12698ad1e8f85a0f91a90e8e83106611514ea409b8ec  openrc-${version}.tar.gz" | sha256sum -c -
+        tar xf openrc-${version}.tar.gz --strip-components=1
+        ROOT=$KAPPA_ROOT; [ -z $ROOT ] && ROOT=/usr/local/kappa; if [ -d $ROOT/temp/python/destdir/usr/bin ]; then echo $ROOT/temp/python/destdir/usr/bin; else echo $ROOT/bin/$(grep '^python ' $ROOT/db/installed | tail -1 | cut -d' ' -f3)/usr/bin; fi > py.path; if [ -d $ROOT/temp/meson/destdir/usr/bin ]; then echo $ROOT/temp/meson/destdir/usr/bin; else echo $ROOT/bin/$(grep '^meson ' $ROOT/db/installed | tail -1 | cut -d' ' -f3)/usr/bin; fi > meson.path; if [ -d $ROOT/temp/ninja/destdir/usr/bin ]; then echo $ROOT/temp/ninja/destdir/usr/bin; else echo $ROOT/bin/$(grep '^ninja ' $ROOT/db/installed | tail -1 | cut -d' ' -f3)/usr/bin; fi > ninja.path; if [ -d $ROOT/temp/pkgconf/destdir/usr/bin ]; then echo $ROOT/temp/pkgconf/destdir/usr/bin; else echo $ROOT/bin/$(grep '^pkgconf ' $ROOT/db/installed | tail -1 | cut -d' ' -f3)/usr/bin; fi > pc.path
+    }
+
+    build {
+        PATH=$(cat meson.path):$(cat ninja.path):$(cat py.path):$(cat pc.path):$PATH meson setup builddir --prefix=${prefix} -Daudit=disabled -Dpam=false -Dselinux=disabled
+        PATH=$(cat ninja.path):$PATH ninja -C builddir
+    }
+
+    install {
+        PATH=$(cat ninja.path):$PATH DESTDIR=${destdir} ninja -C builddir install
+    }
+}
diff --git a/stable/perl.kap b/stable/perl.kap
new file mode 100644
index 0000000..5799086
--- /dev/null
+++ b/stable/perl.kap
@@ -0,0 +1,36 @@
+/*
+ * perl — the interpreter behind autotools (autoconf, automake) and much
+ * of the classic toolchain.
+ *
+ * Configured with -Duserelocatableinc so @INC resolves relative to the
+ * perl binary — the store prefix is only known at install time.
+ * NOTE: Configure MUST run on a clean tree (stale config.sh breaks the
+ * relocatable flags); kappa's fresh work dir guarantees this.
+ */
+package "perl" {
+    const version = "5.42.3"
+    const source  = "https://www.cpan.org/src/5.0/perl-${version}.tar.gz"
+    sha256 = "1137740985837b5cdf15f0cfab932279dcb4352f912fed6fc144e8b4f0823627"
+    license = "Artistic-1.0 OR GPL-1.0-or-later"
+
+    provides = ["perl", "perl5"]
+
+    depends = [
+        { name = "make" },
+    ]
+
+    prepare {
+        curl -L -o perl-${version}.tar.gz ${source}
+        echo "1137740985837b5cdf15f0cfab932279dcb4352f912fed6fc144e8b4f0823627  perl-${version}.tar.gz" | sha256sum -c -
+        tar xf perl-${version}.tar.gz --strip-components=1
+    }
+
+    build {
+        ./Configure -des -Dprefix=${prefix} -Duserelocatableinc
+        make -j${jobs}
+    }
+
+    install {
+        make DESTDIR=${destdir} install
+    }
+}
diff --git a/stable/pkgconf.kap b/stable/pkgconf.kap
new file mode 100644
index 0000000..aafc146
--- /dev/null
+++ b/stable/pkgconf.kap
@@ -0,0 +1,37 @@
+/*
+ * pkgconf — pkg-config implementation.
+ *
+ * The dependency-discovery tool: virtually every autoconf configure
+ * script and meson build queries *.pc files through it.  Installs the
+ * canonical `pkg-config` name as a symlink (distro convention).
+ *
+ * Builds with only a C compiler and make; no external deps.
+ */
+package "pkgconf" {
+    const version = "3.0.5"
+    const source  = "https://distfiles.ariadne.space/pkgconf/pkgconf-${version}.tar.gz"
+    sha256 = "d0d2ebdb3c7bfa3ae6e879d80b60dfe1dd482cce9f8be8fd8651149d396a4c49"
+    license = "ISC"
+
+    provides = ["pkg-config", "pkgconf"]
+
+    depends = [
+        { name = "make" },
+    ]
+
+    prepare {
+        curl -L -O ${source}
+        echo "d0d2ebdb3c7bfa3ae6e879d80b60dfe1dd482cce9f8be8fd8651149d396a4c49  pkgconf-${version}.tar.gz" | sha256sum -c -
+        tar xf pkgconf-${version}.tar.gz --strip-components=1
+    }
+
+    build {
+        ./configure --prefix=${prefix}
+        make -j${jobs}
+    }
+
+    install {
+        make DESTDIR=${destdir} install
+        ln -sf pkgconf ${destdir}/usr/bin/pkg-config
+    }
+}
diff --git a/stable/python.kap b/stable/python.kap
new file mode 100644
index 0000000..417cf14
--- /dev/null
+++ b/stable/python.kap
@@ -0,0 +1,39 @@
+/*
+ * python — CPython 3.14.
+ *
+ * Needed by the build-tool layer: meson, ninja's configure.py, and most
+ * of modern tooling.  Self-contained build (default configure): the
+ * interpreter links its own bundled libpython statically, so no runtime
+ * lib resolution is needed.
+ *
+ * NOTE: optional deps (libffi → ctypes) are auto-disabled when absent;
+ * the build works on a barebones system without them.  setuptools is NOT
+ * bundled — packages that need it must ship it themselves.
+ */
+package "python" {
+    const version = "3.14.7"
+    const source  = "https://www.python.org/ftp/python/${version}/Python-${version}.tgz"
+    sha256 = "62859805f6fdf25e2bcbf3fa3217801e1996887ca33e6a2af80674bdfa2dbe07"
+    license = "PSF-2.0"
+
+    provides = ["python3", "python3.14"]
+
+    depends = [
+        { name = "make" },
+    ]
+
+    prepare {
+        curl -L -O ${source}
+        echo "62859805f6fdf25e2bcbf3fa3217801e1996887ca33e6a2af80674bdfa2dbe07  Python-${version}.tgz" | sha256sum -c -
+        tar xf Python-${version}.tgz --strip-components=1
+    }
+
+    build {
+        ./configure --prefix=${prefix}
+        make -j${jobs}
+    }
+
+    install {
+        make DESTDIR=${destdir} install
+    }
+}
diff --git a/stable/readline.kap b/stable/readline.kap
new file mode 100644
index 0000000..767236f
--- /dev/null
+++ b/stable/readline.kap
@@ -0,0 +1,38 @@
+/*
+ * readline — line editing and history for interactive programs (bash,
+ * and later anything with a REPL).
+ *
+ * Static-only: bash links it in, so no runtime lib resolution is needed
+ * in the store.  --with-curses makes it link the terminal library; the
+ * store ncurses is found via the resolved include/lib paths, and its
+ * libtinfo.a (wide symlink) satisfies readline's -ltinfo.
+ */
+package "readline" {
+    const version = "8.3"
+    const source  = "https://ftp.gnu.org/gnu/readline/readline-${version}.tar.gz"
+    sha256 = "fe5383204467828cd495ee8d1d3c037a7eba1389c22bc6a041f627976f9061cc"
+    license = "GPL-3.0-or-later"
+
+    provides = ["libreadline.a", "readline"]
+
+    depends = [
+        { name = "ncurses" },
+        { name = "make" },
+    ]
+
+    prepare {
+        curl -L -o readline-${version}.tar.gz ${source}
+        echo "fe5383204467828cd495ee8d1d3c037a7eba1389c22bc6a041f627976f9061cc  readline-${version}.tar.gz" | sha256sum -c -
+        tar xf readline-${version}.tar.gz --strip-components=1
+        ROOT=$KAPPA_ROOT; [ -z $ROOT ] && ROOT=/usr/local/kappa; if [ -d $ROOT/temp/ncurses/destdir/usr ]; then echo $ROOT/temp/ncurses/destdir/usr; else echo $ROOT/bin/$(grep '^ncurses ' $ROOT/db/installed | tail -1 | cut -d' ' -f3)/usr; fi > ncurses.path
+    }
+
+    build {
+        CPPFLAGS=-I$(cat ncurses.path)/include LDFLAGS=-L$(cat ncurses.path)/lib ./configure --prefix=${prefix} --disable-shared --with-curses
+        make -j${jobs}
+    }
+
+    install {
+        make DESTDIR=${destdir} install
+    }
+}
diff --git a/stable/tcc.kap b/stable/tcc.kap
new file mode 100644
index 0000000..5118692
--- /dev/null
+++ b/stable/tcc.kap
@@ -0,0 +1,46 @@
+/*
+ * tcc — Tiny C Compiler.  The fast, tiny, self-hosting C compiler.
+ *
+ * Built with the stable 0.9.27 release plus the glibc-2.34 patch
+ * (bcheck.c's __malloc_hook was removed from glibc; the bounds checker
+ * is disabled on glibc >= 2.34, where the API no longer exists).
+ * The patch lives in the repo: patches/tcc-0.9.27-glibc-2.34.patch.
+ *
+ * The check phase verifies self-hosting: tcc compiles its own compiler
+ * and the result runs.
+ */
+package "tcc" {
+    const version = "0.9.27"
+    const source  = "https://download.savannah.nongnu.org/releases/tinycc/tcc-${version}.tar.bz2"
+    sha256 = "de23af78fca90ce32dff2dd45b3432b2334740bb9bb7b05bf60fdbfc396ceb9c"
+    license = "LGPL-2.1-or-later"
+
+    provides = ["tcc", "cc"]
+
+    depends = [
+        { name = "make" },
+    ]
+
+    prepare {
+        curl -L -O ${source}
+        echo "de23af78fca90ce32dff2dd45b3432b2334740bb9bb7b05bf60fdbfc396ceb9c  tcc-${version}.tar.bz2" | sha256sum -c -
+        tar xf tcc-${version}.tar.bz2 --strip-components=1
+        curl -L -O https://files.spectoria.dev/kappa-packages/patches/tcc-0.9.27-glibc-2.34.patch
+        echo "d5c2b6865cd4f80c646ffc85a0fe53e15e3a1877e0a8d29556d01742e5094d6e  tcc-0.9.27-glibc-2.34.patch" | sha256sum -c -
+        patch -p1 < tcc-0.9.27-glibc-2.34.patch
+    }
+
+    build {
+        ./configure --prefix=${prefix}
+        make -j${jobs}
+    }
+
+    check {
+        ./tcc -o tcc-selfhost tcc.c -I. -DONE_SOURCE -lm -ldl
+        ./tcc-selfhost -v
+    }
+
+    install {
+        make DESTDIR=${destdir} install
+    }
+}