bpf

plugin-bpf — Served by	plugin-bpf
plugin-bpf — Placement	runtime (out-of-process over gRPC)
plugin-bpf — Version	2026.243.0001
plugin-bpf — Served by	plugin-bpf
plugin-bpf — Placement	runtime (out-of-process over gRPC)
plugin-bpf — Version	2026.243.0001

bpf is a command word served by 2 plugin candies — plugin-bpf and plugin-bpf — at different points in the command tree. Both are real invocations; charly --help prints which is which.

About plugin-bpf, which serves it

OUT-OF-TREE GENERIC charly BPF/eBPF kernel plugin — the one canonical surface for BPF kernel-feature readiness on any venue (bare host or VM guest): command:bpf (status | lsm | config | probe) plus the verb:bpf declarative check steps any candy can bake into its plan. Reads the kernel state directly and READ-ONLY: /sys/kernel/security/lsm (the BPF-LSM gate cardwire-class tools need), /sys/kernel/btf/vmlinux, CONFIG_BPF_LSM/CONFIG_DEBUG_INFO_BTF, the BPF sysctl knobs, memlock and lockdown. Read-only by default; probe is a verify-only attach-requirements report (a real transient attach probe requires an explicit –attach flag + root + bpftool). Dual-class (plugin-mcp precedent): command:bpf is CLI-dispatched (charly fork/execs the binary), verb:bpf is served over gRPC with a self-contained #BpfInput schema. First consumer: plugin-cardwire’s status gates on the same BPF-LSM facts (R3: one canonical surface, no ad-hoc copies).

About plugin-bpf, which serves it

OUT-OF-TREE GENERIC charly BPF/eBPF kernel plugin — the one canonical surface for BPF kernel-feature readiness on any venue (bare host or VM guest): command:bpf (status | lsm | config | probe) plus the verb:bpf declarative check steps any candy can bake into its plan. Reads the kernel state directly and READ-ONLY: /sys/kernel/security/lsm (the BPF-LSM gate cardwire-class tools need), /sys/kernel/btf/vmlinux, CONFIG_BPF_LSM/CONFIG_DEBUG_INFO_BTF, the BPF sysctl knobs, memlock and lockdown. Read-only by default; probe is a verify-only attach-requirements report (a real transient attach probe requires an explicit –attach flag + root + bpftool). Dual-class (plugin-mcp precedent): command:bpf is CLI-dispatched (charly fork/execs the binary), verb:bpf is served over gRPC with a self-contained #BpfInput schema. First consumer: plugin-cardwire’s status gates on the same BPF-LSM facts (R3: one canonical surface, no ad-hoc copies).

charly --help prints the command tree, including where each bpf is invoked and under which parent.