Boot Fruix from native FreeBSD world and kernel

2026-04-03 02:21:23 +02:00
parent 4def04a357
commit 94e498f57d
8 changed files with 541 additions and 13 deletions
--- a/docs/PROGRESS.md
+++ b/docs/PROGRESS.md
@@ -3058,3 +3058,103 @@ Next recommended step:
 1. wire the image/boot path to use the native kernel/world outputs end-to-end
 2. validate locally with QEMU/UEFI
 3. validate on the approved XCP-ng VM and VDI path
+
+## 2026-04-03 — Phase 13.3: booted Fruix from native FreeBSD kernel/world outputs
+
+Completed work:
+
+- wrote the Phase 13.3 report:
+  - `docs/reports/phase13-native-base-boot-freebsd.md`
+- completed the first end-to-end boot path using native `/usr/src`-built FreeBSD base artifacts in `/frx/store`
+- fixed the first native-image sizing problem:
+  - the old fixed `root-size=256m` was too small once the image carried a native world
+  - added explicit root filesystem sizing support to the CLI/image path:
+    - `scripts/fruix.scm` now accepts `--root-size SIZE`
+    - image metadata now records `root_size`
+  - `tests/system/run-phase8-system-image.sh` now accepts:
+    - `ROOT_SIZE`
+    and records:
+      - `root_size`
+      - `native_base_store_count`
+      - `native_base_stores`
+- fixed a follow-up image metadata bug:
+  - `materialize-bhyve-image` now returns:
+    - `native-base-stores`
+  - this removed the `length #f` failure in the native image path
+- generalized the local PID1 QEMU harness a bit further:
+  - `tests/system/run-phase11-shepherd-pid1-qemu.sh` now accepts `OS_TEMPLATE`
+- added dedicated Phase 13.3 native-base boot wrappers:
+  - `tests/system/run-phase13-native-base-qemu.sh`
+  - `tests/system/run-phase13-native-base-xcpng.sh`
+- these wrappers reuse the validated PID1 boot path but additionally require the image metadata to prove the booted system is really using the intended Phase-13 base split:
+  - native kernel present
+  - native world present
+  - host base reduced to bootloader only
+
+Working native-base boot configuration:
+
+- local QEMU:
+  - `ROOT_SIZE=6g`
+  - `DISK_CAPACITY=8g`
+- real XCP-ng:
+  - `ROOT_SIZE=6g`
+  - disk capacity kept matched to the fixed 30 GiB VDI as before
+
+Validation:
+
+- local QEMU/UEFI/TCG boot passes through the new wrapper:
+  - `tests/system/run-phase13-native-base-qemu.sh`
+  - workdir: `/tmp/phase13-3-qemu3-1775174863`
+  - result: `PASS phase13-native-base-qemu`
+  - confirmed:
+    - `disk_capacity=8g`
+    - `root_size=6g`
+    - `native_base_store_count=2`
+    - `host_base_store_count=1`
+    - `shepherd_pid=1`
+    - `sshd_status=running`
+    - `native_base_boot=ok`
+- real XCP-ng boot passes through the new wrapper:
+  - `tests/system/run-phase13-native-base-xcpng.sh`
+  - workdir: `/tmp/phase13-3-xcpng-1775175086`
+  - result: `PASS phase13-native-base-xcpng`
+  - confirmed:
+    - `vm_id=90490f2e-e8fc-4b7a-388e-5c26f0157289`
+    - `vdi_id=0f1f90d3-48ca-4fa2-91d8-fc6339b95743`
+    - `guest_ip=192.168.213.62`
+    - `root_size=6g`
+    - `native_base_store_count=2`
+    - `host_base_store_count=1`
+    - `shepherd_pid=1`
+    - `sshd_status=running`
+    - `compat_prefix_shims=absent`
+    - `guile_module_smoke=ok`
+    - `native_base_boot=ok`
+- validated native-base closure/image composition now boots with:
+  - native kernel store:
+    - `/frx/store/93f35ddcb9a03f63f83c9e8ae29788685d339789da664f881822b4a1914f5ff6-freebsd-native-kernel-15.0-STABLE`
+  - native world store:
+    - `/frx/store/3f6f7f8c06ed8dad4cae21a1e8ac8ba4823bdb7cf54328c9bbcccaeb858beb77-freebsd-native-world-15.0-STABLE`
+  - remaining host base store:
+    - `/frx/store/8ffcfe0356fea815726b610514a1280a11266851c2acb870047d559795569f0e-freebsd-bootloader-15.0-STABLE`
+
+Important findings:
+
+- the native world is large enough that the older 256 MiB rootfs assumption is no longer realistic; explicit image sizing is now part of the practical Phase-13 path
+- after the native-base transition, the remaining transitional boundary is now much narrower and explicit:
+  - host-staged bootloader/boot assets
+  - native kernel
+  - native core world runtime
+- the real XCP-ng upload path still works with the larger native-world image, but the dynamic VHD is naturally much bigger now (~4.42 GiB)
+
+Current assessment:
+
+- Phase 13 is complete
+- Fruix now builds FreeBSD kernel/world artifacts from `/usr/src` into `/frx/store` and successfully boots a declarative system from those native outputs
+- this is the main architectural pivot Plan 3 called for before Phase 14
+
+Next recommended step:
+
+1. begin Phase 14 by replacing the remaining host-copy boot assets first
+2. keep shrinking the host-staged base boundary around the now-working native world/kernel path
+3. revisit cleaner runtime vs. development splits after the boot asset transition
--- a/docs/reports/phase13-native-base-boot-freebsd.md
+++ b/docs/reports/phase13-native-base-boot-freebsd.md
@@ -0,0 +1,191 @@
+# Phase 13.3: booted Fruix using native store-built FreeBSD base artifacts
+
+Date: 2026-04-03
+
+## Goal
+
+Phase 13.3 was the first end-to-end boot validation of the new native FreeBSD base path.
+
+The target was a Fruix system/image that boots using:
+
+- native `/usr/src`-built kernel output in `/frx/store`
+- native `/usr/src`-built world output in `/frx/store`
+- host-staged bootloader only, as the remaining explicit transitional boundary
+
+Validation still followed the established strategy:
+
+- local QEMU/UEFI/TCG
+- real XCP-ng on the approved VM/VDI path
+
+## Issues found and fixed
+
+### 1. The old fixed 256 MiB root filesystem image was too small
+
+The first native-base image attempt failed during `makefs` with:
+
+```text
+size of .../image-rootfs is larger than the maxsize of 268435456
+```
+
+That was expected once the image started carrying a native world instead of the earlier curated host-copy runtime slice.
+
+To fix this cleanly, Fruix image generation gained an explicit root filesystem size parameter:
+
+- `scripts/fruix.scm` now accepts:
+  - `--root-size SIZE`
+- image metadata now emits:
+  - `root_size=...`
+- `tests/system/run-phase8-system-image.sh` now accepts:
+  - `ROOT_SIZE`
+  and records the reported root size in metadata
+
+For the native-base boot validation, the working values were:
+
+- local QEMU:
+  - `ROOT_SIZE=6g`
+  - `DISK_CAPACITY=8g`
+- real XCP-ng:
+  - `ROOT_SIZE=6g`
+  - disk capacity kept matched to the fixed 30 GiB VDI as before
+
+### 2. `materialize-bhyve-image` needed to propagate native-base metadata
+
+After adding the new `native_base_*` metadata path, the first native image run hit a Scheme error because `materialize-bhyve-image` still returned:
+
+- `host-base-stores`
+- `fruix-runtime-stores`
+
+but not:
+
+- `native-base-stores`
+
+That was corrected so image-generation results now carry the native-base store set too.
+
+## Harness updates
+
+### Reused/extended existing Phase 11 boot harnesses
+
+- `tests/system/run-phase11-shepherd-pid1-qemu.sh`
+  - now accepts `OS_TEMPLATE` like the XCP-ng PID1 harness already did
+- `tests/system/run-phase8-system-image.sh`
+  - now records:
+    - `native_base_store_count`
+    - `native_base_stores`
+    - `root_size`
+
+### Added native-base boot wrappers
+
+New wrappers:
+
+- `tests/system/run-phase13-native-base-qemu.sh`
+- `tests/system/run-phase13-native-base-xcpng.sh`
+
+These wrappers reuse the already-validated PID1 boot path but require the image metadata to confirm that the booted system really uses the intended Phase-13 base split:
+
+- `native_base_store_count=2`
+- native kernel present
+- native world present
+- `host_base_store_count=1`
+- host base reduced to bootloader only
+
+## Validation
+
+### Local QEMU / UEFI / TCG
+
+Passing run:
+
+- `PASS phase13-native-base-qemu`
+- workdir: `/tmp/phase13-3-qemu3-1775174863`
+
+Key metadata:
+
+```text
+disk_capacity=8g
+root_size=6g
+native_base_store_count=2
+host_base_store_count=1
+shepherd_pid=1
+sshd_status=running
+native_base_boot=ok
+```
+
+The wrapped underlying Phase 11 PID1 harness also confirmed the full guest runtime path:
+
+- ready marker present
+- `/run/current-system` correct
+- Shepherd socket present
+- Shepherd PID is `1`
+- `sshd` running
+- activation completed successfully
+- `/etc/login.conf` regular + databases present
+
+### Real XCP-ng VM
+
+Passing run:
+
+- `PASS phase13-native-base-xcpng`
+- workdir: `/tmp/phase13-3-xcpng-1775175086`
+
+Key metadata:
+
+```text
+vm_id=90490f2e-e8fc-4b7a-388e-5c26f0157289
+vdi_id=0f1f90d3-48ca-4fa2-91d8-fc6339b95743
+guest_ip=192.168.213.62
+root_size=6g
+native_base_store_count=2
+host_base_store_count=1
+shepherd_pid=1
+sshd_status=running
+compat_prefix_shims=absent
+guile_module_smoke=ok
+native_base_boot=ok
+```
+
+The dynamic VHD upload remained workable even with the larger native-world image payload, though naturally much larger than the earlier minimal image path:
+
+- upload size: `4740784128` bytes (~4.42 GiB)
+
+## What booted
+
+The validated native-base system closure used:
+
+- native kernel store:
+  - `/frx/store/93f35ddcb9a03f63f83c9e8ae29788685d339789da664f881822b4a1914f5ff6-freebsd-native-kernel-15.0-STABLE`
+- native world store:
+  - `/frx/store/3f6f7f8c06ed8dad4cae21a1e8ac8ba4823bdb7cf54328c9bbcccaeb858beb77-freebsd-native-world-15.0-STABLE`
+- remaining host base store:
+  - `/frx/store/8ffcfe0356fea815726b610514a1280a11266851c2acb870047d559795569f0e-freebsd-bootloader-15.0-STABLE`
+
+That means Phase 13 has now crossed its main success boundary:
+
+- the kernel is native
+- the core world runtime is native
+- the system actually boots from those outputs
+
+## Assessment
+
+Phase 13 is complete.
+
+Fruix has now moved from:
+
+- building a FreeBSD system from curated host copies
+
+into:
+
+- building kernel/world artifacts from `/usr/src` into `/frx/store`, then booting a declarative Fruix system from those outputs.
+
+The remaining major transitional boundary is now much narrower and explicit:
+
+- host-staged bootloader/boot assets remain
+- native kernel + native core world runtime are already in place
+
+That is a real architectural shift, not just more documentation.
+
+## Next recommended step
+
+Proceed to Phase 14:
+
+1. replace the remaining host-copy boot assets first
+2. then keep reducing the older host-staged FreeBSD base slice around the now-working native world/kernel path
+3. revisit cleaner runtime vs. development splits once the boot asset transition is done
--- a/modules/fruix/system/freebsd.scm
+++ b/modules/fruix/system/freebsd.scm
@@ -1666,6 +1666,7 @@
      (root-image . ,root-image)
      (closure-path . ,closure-path)
      (host-base-stores . ,(assoc-ref closure 'host-base-stores))
+      (native-base-stores . ,(assoc-ref closure 'native-base-stores))
      (fruix-runtime-stores . ,(assoc-ref closure 'fruix-runtime-stores))
      (host-base-provenance-file . ,(assoc-ref closure 'host-base-provenance-file))
      (store-layout-file . ,(assoc-ref closure 'store-layout-file))
--- a/scripts/fruix.scm
+++ b/scripts/fruix.scm
@@ -20,6 +20,7 @@ Options:\n\
  --system NAME          Scheme variable holding the operating-system object.\n\
  --store DIR            Store directory to use (default: /frx/store).\n\
  --disk-capacity SIZE   Disk capacity for 'image' (example: 30g).\n\
+  --root-size SIZE       Root filesystem size for 'image' (example: 6g).\n\
  --rootfs DIR           Rootfs target for 'rootfs'.\n\
  --help                 Show this help.\n")
  (exit code))
@@ -89,6 +90,7 @@ Options:\n\
                (system-name #f)
                (store-dir "/frx/store")
                (disk-capacity #f)
+                (root-size #f)
                (rootfs #f))
       (match args
         (()
@@ -98,29 +100,34 @@ Options:\n\
              (system-name . ,system-name)
              (store-dir . ,store-dir)
              (disk-capacity . ,disk-capacity)
+              (root-size . ,root-size)
              (rootfs . ,rootfs))))
         (("--help")
          (usage 0))
         (((? (lambda (arg) (string-prefix? "--system=" arg)) arg) . tail)
-          (loop tail positional (option-value arg "--system=") store-dir disk-capacity rootfs))
+          (loop tail positional (option-value arg "--system=") store-dir disk-capacity root-size rootfs))
         (("--system" value . tail)
-          (loop tail positional value store-dir disk-capacity rootfs))
+          (loop tail positional value store-dir disk-capacity root-size rootfs))
         (((? (lambda (arg) (string-prefix? "--store=" arg)) arg) . tail)
-          (loop tail positional system-name (option-value arg "--store=") disk-capacity rootfs))
+          (loop tail positional system-name (option-value arg "--store=") disk-capacity root-size rootfs))
         (("--store" value . tail)
-          (loop tail positional system-name value disk-capacity rootfs))
+          (loop tail positional system-name value disk-capacity root-size rootfs))
         (((? (lambda (arg) (string-prefix? "--disk-capacity=" arg)) arg) . tail)
-          (loop tail positional system-name store-dir (option-value arg "--disk-capacity=") rootfs))
+          (loop tail positional system-name store-dir (option-value arg "--disk-capacity=") root-size rootfs))
         (("--disk-capacity" value . tail)
-          (loop tail positional system-name store-dir value rootfs))
+          (loop tail positional system-name store-dir value root-size rootfs))
+         (((? (lambda (arg) (string-prefix? "--root-size=" arg)) arg) . tail)
+          (loop tail positional system-name store-dir disk-capacity (option-value arg "--root-size=") rootfs))
+         (("--root-size" value . tail)
+          (loop tail positional system-name store-dir disk-capacity value rootfs))
         (((? (lambda (arg) (string-prefix? "--rootfs=" arg)) arg) . tail)
-          (loop tail positional system-name store-dir disk-capacity (option-value arg "--rootfs=")))
+          (loop tail positional system-name store-dir disk-capacity root-size (option-value arg "--rootfs=")))
         (("--rootfs" value . tail)
-          (loop tail positional system-name store-dir disk-capacity value))
+          (loop tail positional system-name store-dir disk-capacity root-size value))
         (((? (lambda (arg) (string-prefix? "--" arg)) arg) . _)
          (error "unknown option" arg))
         ((arg . tail)
-          (loop tail (cons arg positional) system-name store-dir disk-capacity rootfs)))))
+          (loop tail (cons arg positional) system-name store-dir disk-capacity root-size rootfs)))))
    ((_ . _)
     (usage 1))))

@@ -130,6 +137,7 @@ Options:\n\
         (positional (assoc-ref parsed 'positional))
         (store-dir (assoc-ref parsed 'store-dir))
         (disk-capacity (assoc-ref parsed 'disk-capacity))
+         (root-size (assoc-ref parsed 'root-size))
         (rootfs-opt (assoc-ref parsed 'rootfs))
         (system-name (assoc-ref parsed 'system-name))
         (requested-symbol (and system-name (string->symbol system-name))))
@@ -219,6 +227,7 @@ Options:\n\
                                                      #:guile-prefix guile-prefix
                                                      #:guile-extra-prefix guile-extra-prefix
                                                      #:shepherd-prefix shepherd-prefix
+                                                      #:root-size (or root-size "256m")
                                                      #:disk-capacity disk-capacity))
                     (image-spec (assoc-ref result 'image-spec))
                     (store-items (assoc-ref result 'store-items))
@@ -232,6 +241,7 @@ Options:\n\
                   (system_variable . ,resolved-symbol)
                   (store_dir . ,store-dir)
                   (disk_capacity . ,(assoc-ref image-spec 'disk-capacity))
+                   (root_size . ,(assoc-ref image-spec 'root-size))
                   (image_store_path . ,(assoc-ref result 'image-store-path))
                   (disk_image . ,(assoc-ref result 'disk-image))
                   (esp_image . ,(assoc-ref result 'esp-image))
--- a/tests/system/run-phase11-shepherd-pid1-qemu.sh
+++ b/tests/system/run-phase11-shepherd-pid1-qemu.sh
@@ -2,7 +2,7 @@
 set -eu

 repo_root=${PROJECT_ROOT:-$(pwd)}
-os_template=$repo_root/tests/system/phase11-shepherd-pid1-operating-system.scm.in
+os_template=${OS_TEMPLATE:-$repo_root/tests/system/phase11-shepherd-pid1-operating-system.scm.in}
 system_name=${SYSTEM_NAME:-phase11-operating-system}
 metadata_target=${METADATA_OUT:-}
 root_authorized_key_file=${ROOT_AUTHORIZED_KEY_FILE:-$HOME/.ssh/id_ed25519.pub}
--- a/tests/system/run-phase13-native-base-qemu.sh
+++ b/tests/system/run-phase13-native-base-qemu.sh
@@ -0,0 +1,105 @@
+#!/bin/sh
+set -eu
+
+repo_root=${PROJECT_ROOT:-$(pwd)}
+os_template=${OS_TEMPLATE:-$repo_root/tests/system/phase13-native-base-pid1-operating-system.scm.in}
+system_name=${SYSTEM_NAME:-phase13-operating-system}
+disk_capacity=${DISK_CAPACITY:-8g}
+root_size=${ROOT_SIZE:-6g}
+metadata_target=${METADATA_OUT:-}
+cleanup=0
+
+if [ -n "${WORKDIR:-}" ]; then
+  workdir=$WORKDIR
+  mkdir -p "$workdir"
+else
+  workdir=$(mktemp -d /tmp/fruix-phase13-native-qemu.XXXXXX)
+  cleanup=1
+fi
+if [ "${KEEP_WORKDIR:-0}" -eq 1 ]; then
+  cleanup=0
+fi
+
+inner_metadata=$workdir/phase11-native-qemu-inner-metadata.txt
+metadata_file=$workdir/phase13-native-base-qemu-metadata.txt
+
+cleanup_workdir() {
+  if [ "$cleanup" -eq 1 ]; then
+    rm -rf "$workdir" 2>/dev/null || sudo rm -rf "$workdir"
+  fi
+}
+trap cleanup_workdir EXIT INT TERM
+
+KEEP_WORKDIR=1 WORKDIR="$workdir/inner" METADATA_OUT="$inner_metadata" \
+  OS_TEMPLATE="$os_template" SYSTEM_NAME="$system_name" DISK_CAPACITY="$disk_capacity" ROOT_SIZE="$root_size" \
+  "$repo_root/tests/system/run-phase11-shepherd-pid1-qemu.sh"
+
+phase8_metadata=$(sed -n 's/^phase8_metadata=//p' "$inner_metadata")
+closure_path=$(sed -n 's/^closure_path=//p' "$inner_metadata")
+closure_base=$(sed -n 's/^closure_base=//p' "$inner_metadata")
+serial_log=$(sed -n 's/^serial_log=//p' "$inner_metadata")
+ssh_port=$(sed -n 's/^ssh_port=//p' "$inner_metadata")
+shepherd_pid=$(sed -n 's/^shepherd_pid=//p' "$inner_metadata")
+sshd_status=$(sed -n 's/^sshd_status=//p' "$inner_metadata")
+activate_log=$(sed -n 's/^activate_log=//p' "$inner_metadata")
+
+native_base_store_count=$(sed -n 's/^native_base_store_count=//p' "$phase8_metadata")
+native_base_stores=$(sed -n 's/^native_base_stores=//p' "$phase8_metadata")
+host_base_store_count=$(sed -n 's/^host_base_store_count=//p' "$phase8_metadata")
+host_base_stores=$(sed -n 's/^host_base_stores=//p' "$phase8_metadata")
+
+[ "$native_base_store_count" = 2 ] || { echo "expected 2 native base stores, got: $native_base_store_count" >&2; exit 1; }
+[ "$host_base_store_count" = 1 ] || { echo "expected 1 host base store, got: $host_base_store_count" >&2; exit 1; }
+printf '%s\n' "$native_base_stores" | tr ',' '\n' | grep 'freebsd-native-kernel-15.0-STABLE$' >/dev/null || {
+  echo "native base stores do not include the native kernel" >&2
+  exit 1
+}
+printf '%s\n' "$native_base_stores" | tr ',' '\n' | grep 'freebsd-native-world-15.0-STABLE$' >/dev/null || {
+  echo "native base stores do not include the native world" >&2
+  exit 1
+}
+printf '%s\n' "$host_base_stores" | tr ',' '\n' | grep 'freebsd-bootloader-15.0-STABLE$' >/dev/null || {
+  echo "host base stores do not reduce to the bootloader" >&2
+  exit 1
+}
+[ "$shepherd_pid" = 1 ] || { echo "shepherd was not PID 1" >&2; exit 1; }
+[ "$sshd_status" = running ] || { echo "sshd is not running" >&2; exit 1; }
+case "$activate_log" in
+  *fruix-activate:done*) : ;;
+  *) echo "activation log does not show success" >&2; exit 1 ;;
+esac
+
+cat >"$metadata_file" <<EOF
+workdir=$workdir
+inner_metadata=$inner_metadata
+phase8_metadata=$phase8_metadata
+closure_path=$closure_path
+closure_base=$closure_base
+serial_log=$serial_log
+ssh_port=$ssh_port
+disk_capacity=$disk_capacity
+root_size=$root_size
+native_base_store_count=$native_base_store_count
+native_base_stores=$native_base_stores
+host_base_store_count=$host_base_store_count
+host_base_stores=$host_base_stores
+shepherd_pid=$shepherd_pid
+sshd_status=$sshd_status
+boot_backend=qemu-uefi-tcg
+init_mode=shepherd-pid1
+native_base_boot=ok
+EOF
+
+if [ -n "$metadata_target" ]; then
+  mkdir -p "$(dirname "$metadata_target")"
+  cp "$metadata_file" "$metadata_target"
+fi
+
+printf 'PASS phase13-native-base-qemu\n'
+printf 'Work directory: %s\n' "$workdir"
+printf 'Metadata file: %s\n' "$metadata_file"
+if [ -n "$metadata_target" ]; then
+  printf 'Copied metadata to: %s\n' "$metadata_target"
+fi
+printf '%s\n' '--- metadata ---'
+cat "$metadata_file"
--- a/tests/system/run-phase13-native-base-xcpng.sh
+++ b/tests/system/run-phase13-native-base-xcpng.sh
@@ -0,0 +1,111 @@
+#!/bin/sh
+set -eu
+
+repo_root=${PROJECT_ROOT:-$(pwd)}
+os_template=${OS_TEMPLATE:-$repo_root/tests/system/phase13-native-base-pid1-operating-system.scm.in}
+system_name=${SYSTEM_NAME:-phase13-operating-system}
+root_size=${ROOT_SIZE:-6g}
+metadata_target=${METADATA_OUT:-}
+cleanup=0
+
+if [ -n "${WORKDIR:-}" ]; then
+  workdir=$WORKDIR
+  mkdir -p "$workdir"
+else
+  workdir=$(mktemp -d /tmp/fruix-phase13-native-xcpng.XXXXXX)
+  cleanup=1
+fi
+if [ "${KEEP_WORKDIR:-0}" -eq 1 ]; then
+  cleanup=0
+fi
+
+inner_metadata=$workdir/phase11-native-xcpng-inner-metadata.txt
+metadata_file=$workdir/phase13-native-base-xcpng-metadata.txt
+
+cleanup_workdir() {
+  if [ "$cleanup" -eq 1 ]; then
+    rm -rf "$workdir"
+  fi
+}
+trap cleanup_workdir EXIT INT TERM
+
+KEEP_WORKDIR=1 WORKDIR="$workdir/inner" METADATA_OUT="$inner_metadata" \
+  OS_TEMPLATE="$os_template" SYSTEM_NAME="$system_name" ROOT_SIZE="$root_size" \
+  "$repo_root/tests/system/run-phase11-shepherd-pid1-xcpng.sh"
+
+phase8_metadata=$(sed -n 's/^phase8_metadata=//p' "$inner_metadata")
+closure_path=$(sed -n 's/^closure_path=//p' "$inner_metadata")
+closure_base=$(sed -n 's/^closure_base=//p' "$inner_metadata")
+guest_ip=$(sed -n 's/^guest_ip=//p' "$inner_metadata")
+vm_id=$(sed -n 's/^vm_id=//p' "$inner_metadata")
+vdi_id=$(sed -n 's/^vdi_id=//p' "$inner_metadata")
+shepherd_pid=$(sed -n 's/^shepherd_pid=//p' "$inner_metadata")
+sshd_status=$(sed -n 's/^sshd_status=//p' "$inner_metadata")
+compat_prefix_shims=$(sed -n 's/^compat_prefix_shims=//p' "$inner_metadata")
+guile_module_smoke=$(sed -n 's/^guile_module_smoke=//p' "$inner_metadata")
+activate_log=$(sed -n 's/^activate_log=//p' "$inner_metadata")
+
+native_base_store_count=$(sed -n 's/^native_base_store_count=//p' "$phase8_metadata")
+native_base_stores=$(sed -n 's/^native_base_stores=//p' "$phase8_metadata")
+host_base_store_count=$(sed -n 's/^host_base_store_count=//p' "$phase8_metadata")
+host_base_stores=$(sed -n 's/^host_base_stores=//p' "$phase8_metadata")
+
+[ "$native_base_store_count" = 2 ] || { echo "expected 2 native base stores, got: $native_base_store_count" >&2; exit 1; }
+[ "$host_base_store_count" = 1 ] || { echo "expected 1 host base store, got: $host_base_store_count" >&2; exit 1; }
+printf '%s\n' "$native_base_stores" | tr ',' '\n' | grep 'freebsd-native-kernel-15.0-STABLE$' >/dev/null || {
+  echo "native base stores do not include the native kernel" >&2
+  exit 1
+}
+printf '%s\n' "$native_base_stores" | tr ',' '\n' | grep 'freebsd-native-world-15.0-STABLE$' >/dev/null || {
+  echo "native base stores do not include the native world" >&2
+  exit 1
+}
+printf '%s\n' "$host_base_stores" | tr ',' '\n' | grep 'freebsd-bootloader-15.0-STABLE$' >/dev/null || {
+  echo "host base stores do not reduce to the bootloader" >&2
+  exit 1
+}
+[ "$shepherd_pid" = 1 ] || { echo "shepherd was not PID 1" >&2; exit 1; }
+[ "$sshd_status" = running ] || { echo "sshd is not running" >&2; exit 1; }
+[ "$compat_prefix_shims" = absent ] || { echo "compatibility prefix shims reappeared" >&2; exit 1; }
+[ "$guile_module_smoke" = ok ] || { echo "guest Guile module smoke failed" >&2; exit 1; }
+case "$activate_log" in
+  *fruix-activate:done*) : ;;
+  *) echo "activation log does not show success" >&2; exit 1 ;;
+esac
+
+cat >"$metadata_file" <<EOF
+workdir=$workdir
+inner_metadata=$inner_metadata
+phase8_metadata=$phase8_metadata
+closure_path=$closure_path
+closure_base=$closure_base
+vm_id=$vm_id
+vdi_id=$vdi_id
+guest_ip=$guest_ip
+root_size=$root_size
+native_base_store_count=$native_base_store_count
+native_base_stores=$native_base_stores
+host_base_store_count=$host_base_store_count
+host_base_stores=$host_base_stores
+shepherd_pid=$shepherd_pid
+sshd_status=$sshd_status
+compat_prefix_shims=$compat_prefix_shims
+guile_module_smoke=$guile_module_smoke
+boot_backend=xcp-ng-xo-cli
+init_mode=shepherd-pid1
+native_base_boot=ok
+EOF
+
+if [ -n "$metadata_target" ]; then
+  mkdir -p "$(dirname "$metadata_target")"
+  cp "$metadata_file" "$metadata_target"
+fi
+
+printf 'PASS phase13-native-base-xcpng\n'
+printf 'Work directory: %s\n' "$workdir"
+printf 'Metadata file: %s\n' "$metadata_file"
+if [ -n "$metadata_target" ]; then
+  printf 'Copied metadata to: %s\n' "$metadata_target"
+fi
+printf '%s\n' '--- metadata ---'
+cat "$metadata_file"
--- a/tests/system/run-phase8-system-image.sh
+++ b/tests/system/run-phase8-system-image.sh
@@ -8,6 +8,7 @@ os_file=${OS_FILE:-$script_dir/phase7-minimal-operating-system.scm}
 system_name=${SYSTEM_NAME:-phase7-operating-system}
 store_dir=${STORE_DIR:-/frx/store}
 disk_capacity=${DISK_CAPACITY:-}
+root_size=${ROOT_SIZE:-}
 metadata_target=${METADATA_OUT:-}

 [ -x "$fruix_cmd" ] || {
@@ -61,19 +62,25 @@ printf 'Using fruix command: %s\n' "$fruix_cmd"
 printf 'Working directory: %s\n' "$workdir"
 printf 'Store directory: %s\n' "$store_dir"

+set -- "$fruix_cmd" system image "$os_file" --system "$system_name" --store "$store_dir"
 if [ -n "$disk_capacity" ]; then
-  action_env "$fruix_cmd" system image "$os_file" --system "$system_name" --store "$store_dir" --disk-capacity "$disk_capacity" >"$build_metadata"
-else
-  action_env "$fruix_cmd" system image "$os_file" --system "$system_name" --store "$store_dir" >"$build_metadata"
+  set -- "$@" --disk-capacity "$disk_capacity"
 fi
+if [ -n "$root_size" ]; then
+  set -- "$@" --root-size "$root_size"
+fi
+action_env "$@" >"$build_metadata"

 image_store_path=$(sed -n 's/^image_store_path=//p' "$build_metadata")
 disk_image=$(sed -n 's/^disk_image=//p' "$build_metadata")
 closure_path=$(sed -n 's/^closure_path=//p' "$build_metadata")
 disk_capacity_reported=$(sed -n 's/^disk_capacity=//p' "$build_metadata")
+root_size_reported=$(sed -n 's/^root_size=//p' "$build_metadata")
 store_item_count=$(sed -n 's/^store_item_count=//p' "$build_metadata")
 host_base_store_count=$(sed -n 's/^host_base_store_count=//p' "$build_metadata")
 host_base_stores=$(sed -n 's/^host_base_stores=//p' "$build_metadata")
+native_base_store_count=$(sed -n 's/^native_base_store_count=//p' "$build_metadata")
+native_base_stores=$(sed -n 's/^native_base_stores=//p' "$build_metadata")
 fruix_runtime_store_count=$(sed -n 's/^fruix_runtime_store_count=//p' "$build_metadata")
 fruix_runtime_stores=$(sed -n 's/^fruix_runtime_stores=//p' "$build_metadata")
 host_base_provenance_file=$(sed -n 's/^host_base_provenance_file=//p' "$build_metadata")
@@ -143,9 +150,12 @@ closure_base=$closure_base
 raw_sha256=$raw_sha256
 image_size_bytes=$image_size_bytes
 disk_capacity=$disk_capacity_reported
+root_size=$root_size_reported
 store_item_count=$store_item_count
 host_base_store_count=$host_base_store_count
 host_base_stores=$host_base_stores
+native_base_store_count=$native_base_store_count
+native_base_stores=$native_base_stores
 fruix_runtime_store_count=$fruix_runtime_store_count
 fruix_runtime_stores=$fruix_runtime_stores
 host_base_provenance_file=$host_base_provenance_file