lumenfiles.sg is the 0.5.0 desktop capstone: a single Lumen app that mounts all three file-model surfaces over the live FS tag-query EL0 seam — the Smart Folder dock, the NeXT column browser, and the tag-well inspector — all cap-scoped by the broker session slot, all talking to the real FS substrate. QEMU raspi3b PASS. Director ruling: "mount shelf+browser+well = Lumen-working." (OS 9c56de4)
What "Lumen-working" means
The sigilOS desktop is not filesystem-navigation over physical folders. It's a tag-driven surface — every file is items with tags, every view is a live query. "Lumen-working" means all three surfaces of that model are running at once, against real data, with real capabilities:
fs_sf_list (#99) — populates the dock with saved Smart Folders (only those authorized by the session slot). Selecting one runs its query in the column browser. The dock is the launcher; the launcher is a set of live queries.fs_tag_children (#92) / fs_tag_is_leaf (#93) / fs_name (#95) — drills the tag hierarchy column by column; the breadcrumb is the AND query built up so far. No physical folder walk — each column is a tag-filtered result set.fs_item_tags (#96) / fs_tag_list (#94) — shows the selected item's current tags as chips; the add field prefix-autocompletes against the full tag vocabulary. Write via fs_tag/#97 / fs_untag/#98 — cap-gated like an item write.All three over one seam
Every call routes through tagfs.sg, the EL0 tag-query client. tagfs.sg holds the session slot from the broker; it never exposes the slot to the app — the app gets results back, not the token. The kernel's host.sg routes syscalls 91–102 to tagq_dispatch, which injects the login-bound session slot before touching the FS substrate. The app cannot supply the slot; the kernel owns it.
lumenfiles.sg
├── dock → tagfs.sg → fs_sf_list(#99) → substrate
├── browser → tagfs.sg → fs_tag_children(#92) → substrate
└── inspector → tagfs.sg → fs_item_tags(#96) → substrate
↑
session slot injected by kernel
EL0 never holds the token
The verified session on QEMU raspi3b
The acceptance screendump shows a single QEMU raspi3b session:
- Shelf loads live Smart Folders — only authorized ones visible (non-owner slot would see zero)
- Browser drills
retropie ▸ snes ▸ Zelda— each column is a livefs_tag_childrencall narrowing the query - Inspector surfaces live tags with autocomplete on the selected item — reads through
fs_item_tags
No stubs in this path. Every cap — fs_sf_list, fs_tag_children, fs_item_tags, fs_tag_list — routes through the live kernel dispatch and the real indexed substrate.
The security invariant: absent, not greyed
A session slot that is not authorized for a Smart Folder sees zero Smart Folders in the dock — not greyed-out tiles, not a lock icon, just an empty shelf. Same for tag-filtered items: items the session can't read are absent from column results. The cap-scoping is structural: the kernel injects the session slot and the substrate returns only authorized results. The app cannot observe unauthorized items at all.
This means the three surfaces of the file model are exactly as capable as the user's session — no ambient read, no directory traversal that reveals what the session can't open.
What came before, what comes next
| Layer | What shipped | Commit |
|---|---|---|
| FS substrate | Tag/query engine, 8 verbs, harness-green 233/233 | 5bf243e |
| Kernel seam | Syscalls 91–102, tagq_dispatch, host.sg routing | 93cdd04 + dd9be7c |
| Column browser | NeXT tag hierarchy navigator | 0aed9de |
| Tag well | Cap-gated tag read/write chips + autocomplete | a0968bb |
| Smart Folder shelf | Default saved-query dock | 08bb2b5 |
| Lumen-working capstone | All three surfaces, live seam, raspi3b PASS | 9c56de4 |
| Shell autocomplete | pt2: fs_query#91 path completion in sig-sh | a564dc6 |
With Lumen-working shipped, the 0.5.0 desktop milestone is closed. The 0.6.0 sprint opens on the real-silicon boot directive (sigil-os#18) and the Remote Desktop RFC (sigil-os#21).