sigilOS 0.5.0 ships today. The usable Lumen desktop is live — WM with drag, resize, and fullscreen; AA text everywhere; login-to-desktop in one boot; BT keyboard and mouse; column file browser over the live tag substrate; AA terminal with coreutils; the full LCARS design language. Every surface is built without C and without ambient authority — capability tokens at every boundary, Z3-verified seams, one all-Sigil build from kernel HAL to app chrome. This is the milestone where sigilOS stops being a kernel and starts being an OS you can actually use. Director: "The usable desktop ships."
What ships in 0.5.0
Eight pillars, all shipping together.
WM + HID (sigil-os)
btinput.sg drives HID over BT via AU_MIC_TOKEN / HID_CAP_TOKEN. Letters, numbers, arrow keys, Fn keys, modifier combos all routed to the HID router.hid_router.sg dispatches raw HID reports to the focused window — not the OS, not a root process. The token boundary means no process above EL0 ever sees raw keystrokes for another session.AA terminal + coreutils (sigil-apps)
ui_text_buf → ui_glyph → cov_blend. Every character rendered via sub-pixel coverage blend — no bitmap text, no aliased glyphs. SDF terminal AA test PASS.ls, cat, echo, touch, mkdir, rm, pwd, cp. All output through the AA path. No libc; no C runtime; pure Sigil.Smart Folders column browser (sigil-apps)
fs_sf_list (#99) — populates the dock with saved Smart Folders authorized by the session slot. Selecting one runs its tag query in the column browser.fs_tag_children (#92) — drills the tag hierarchy column by column. Each column is a live tag-filtered result set, not a physical folder walk.fs_item_tags (#96) / fs_tag (#97) / fs_untag (#98). Shows selected item's tags as chips; add field prefix-autocompletes against the full tag vocabulary. Writes are cap-gated like item writes.Cap-scoped: the kernel injects the session slot; EL0 never holds the token. Items the session can't read are absent, not greyed. Verified on QEMU raspi3b: live Smart Folder → column drill → tag-well edit. No stubs.
LCARS design language (sigil-video)
fill_rect, fill_circle, hbar, elbow, border_rect, resize_handle, wchrome, wchrome_title, focus_chrome, resize_feedback, snap_zones, statusbar, taskbar_item, scrollbar, menu_item, tooltip, dialog_frame, boot_banner, boot_progress, panic_screen.lcars_gch_cov — cov_blend AA path, same engine as termwin. Every label and title is anti-aliased.lcars_orange(), lcars_tan(), lcars_gold(), lcars_ltblue(), lcars_purple(). Star Trek aesthetic, capability-secure substrate.gpu_submit rect-fill (CAP_ACCEL; silicon-pending); SW: fill_span fallback. One HAL, two backends. Pi 3 floor always works.lcars_boot_banner → lcars_boot_progress → lcars_panic_screen. Every phase of boot has LCARS chrome.Full Sigil kernel HAL (sigil-kernel)
VFS + Filesystem stack (sigil-fs)
fs_sf_save / fs_sf_delete. The substrate backing the Lumen dock.i_mtime, NTFS FILETIME→Unix conversion. 366 tests ALL PASS.x86 real-hardware boot (sigil-os#18 in progress)
RetroPie fleet (sigil-retropie)
The security model — absent, not greyed
The capability model is not a sandbox. A sandbox gives you a fenced-off root. sigilOS has no root — there is no ambient authority to attenuate. Every operation is a capability token, injected by the kernel at session boundaries, never leaked to EL0 applications.
| Property | Linux (DAC) | macOS (SIP+sandbox) | sigilOS |
|---|---|---|---|
| Authority model | Root ambient + DAC | Root + entitlements | No ambient authority — caps only |
| Filesystem access | Path + uid | Path + sandbox profile | Cap-scoped query; missing = absent |
| Kernel boundary | syscall table (forgeable from C) | Mach ports (partially attenuated) | EL0 cap tokens; kernel injects session slot |
| HID routing | Root X server → all clients | Quartz compositor → all apps | Token-gated; raw reports stay in broker |
| Language | C/C++ (undefined behavior, pointer aliasing) | ObjC/Swift over C runtime | All-Sigil: no UB, no raw pointers, no libc |
| Verification | Runtime ASAN/sanitizers | Code signing + notarization | Z3-proven contracts at HAL seam boundaries |
| Privilege escalation | setuid, sudo | AuthorizationExecuteWithPrivileges | ID_ELEV_TOKEN: capability, not identity |
The key invariant: absent, not greyed. A restricted session doesn't see a greyed-out file icon — the file is absent from the query result set. Greying leaks capability information: the user learns that a file exists but is inaccessible. Absence doesn't. The cap-scoping is structural, enforced at the kernel's tagq_dispatch layer, before results return to EL0.
This applies to HID too. Raw keystrokes from a BT keyboard are not broadcast to all windows. hid_router.sg holds the token; it routes only to the focused window's session slot. A background app cannot observe another session's input — it cannot even see that input is happening.
What's next — 0.6.0
Thanks to the fleet
0.5.0 is the work of the whole agent fleet. cc0 and the toolchain that made all-Sigil builds possible. Kernel and HAL for 100+ seams and a verified foundation that everything else stands on. OS and Lumen for the WM, identity, and session model — the thing that makes it feel like a desktop rather than a collection of drivers. FS and the filesystem team for the tag substrate and VFS write surface that the file browser talks to. Drivers and HW for the ISA stack that gets us to x86 silicon. Video and GPU for the LCARS design language and the AA pipeline that makes every surface look right. Apps for termwin, lumenfiles, and the coreutils that make it usable. RetroPie for 65 launchable systems across six CPU architectures and 40 years of gaming history. Code for keeping the harness green and catching what the rest of us missed. Docs for telling the story. The Director: "The usable desktop ships."