Every sigilOS release before this one ran on QEMU. 0.6.0's remote-desktop stack, verified, solid, and entirely simulated. 0.7.0 is the first release that boots and runs on real hardware — an actual Raspberry Pi 4B, actual USB silicon, an actual display, and a login you type on a real keyboard.
It's also the first release built end-to-end under an internal security review: 45 findings across seven repos, worked overnight, all decisions gated through a single reviewing authority, nothing merged without independent verification. Both threads — real metal and hardened security — landed together, which is why 0.7.0 is titled exactly that: Lumen on Metal + Security-Hardened.
What changed from the original plan
0.7.0 was originally slated as the browser release. The sprint went somewhere more foundational instead — proving the OS on real silicon, closing out a security review — and the roadmap was reset to match what actually got built rather than what had been planned months earlier. The capability browser didn't go away; it moved to 0.8.0, alongside the bootloader end-goal and support for exotic architectures. Shipping the release that matches the real work, instead of forcing the calendar to match a stale plan, is itself very on-pillar for this project.
The headline: Lumen boots on a real Pi
The chain, on actual hardware, in order: power on, watch Ex Machina — the boot animation that isn't decoration but a live capability-topology lattice, lighting each detected component green as your specific hardware is found, with a real BIOS-style readout log filling in beside it — then a real login screen (no bypass, sha256-verified credential, wrong password actually rejects you), then the Lumen desktop, at 4K, with a working mouse.
None of that sentence was true a week ago. Getting there meant chasing real hardware down to the metal: a USB-HID keyboard that wouldn't enumerate until the actual xHCI bring-up sequence was right, a memory-map probe that could hang the whole boot on real silicon in ways no emulator would ever expose, and a 4K anti-aliased text renderer that was fast enough in QEMU and unusably slow on the real board until it stopped re-computing its own output sixty times a second. Each of those is its own story — see the boot chain doc and the Ex Machina post for the detail.
The other headline: the security gate closed
Alongside the metal work, an internal review of the sigil* stack surfaced 45 findings — 10 Critical, 18 High, 9 Medium, 8 Low — and the fleet worked through essentially all of them in a single push: both kernel Criticals (arbitrary kernel read/write, a login/user-creation privilege-escalation path), the shared documentation renderer's XSS exposure, crypto primitives (a real PBKDF2 password KDF, a hardware-seeded CSPRNG replacing a placeholder), and domain-specific findings across every repo in the stack. See the security sweep post for the full rundown.
What's next: 0.8.0
Three anchors, set the same day 0.7.0's scope was locked: the bootloader end-goal — a single distributable bootloader that detects hardware on any supported machine (every Raspberry Pi, x86 back to Core2Duo, PowerPC back to Apple's G3), reports the device list it finds, and is itself distributable to anyone running macOS 12, Windows 7, or a comparable Ubuntu; the capability browser, carried over from the original 0.7.0 plan; and exotic-architecture support — PowerPC/G3 as an entirely new backend, legacy BIOS boot, older Raspberry Pi boards.
[Release tag, exact ship date, and download link land here once the 0.7.0 gate closes — this post ships alongside the tagged image, not before it.]