Features
What works, and what's in progress.
anonymOS is under active development. Below, each capability is marked honestly: done (verified by booting the full desktop), partial, or in development. Nothing here is aspirational marketing — it mirrors the project's own status table.
Security domains & the object-capability kernel
Status: done
The kernel is a from-scratch x86-64 kernel in D (-betterC, no GC). Every task,
file, window, identity and service is an object with capabilities in a validated
Object-Reference-Graph. Seven built-in identities — System, Personal, Work, Banking,
Development, Untrusted, Disposable — plus domains you declare or clone. Each domain has
its own identity, a restricted namespace, copy-on-write private files, device and USB gates, a
network route and a colour. The appgate exec gate refuses to run an app in a
domain it was not delegated to, and only the System domain's Domain Manager can change
delegations. Hyprland draws each window's titlebar in its domain's colour, sourced from the
kernel, so an app cannot spoof its domain.
Immutable system & A/B updates
Status: partial
/usr is read-only and verified; /etc is an overlay. Plain installs
carry two 512 MiB system slots behind a UEFI A/B arbiter — a boot-state sector with
retries and automatic rollback. Updates are whole-image .hosupd units, verified
with Ed25519 against a pinned key. The whole system is driven by one declarative
system.json, compiled into a signed manifest the kernel applies at boot.
Partial: encrypted installs have no A/B slots yet, and a signed release
channel over the AXON anonymous overlay network is still to come.
Installer, encryption & deniability
Status: done
The native installer collects every choice into one install.json and writes
nothing until the Summary page. Three disk modes: a plain A/B install; full-disk XTS
encryption with one password at boot; or a Hidden OS — a real decoy
Linux (Alpine + XFCE) that boots on a decoy password, with the real system hidden inside an
encrypted outer volume. Every sector is erased first so used and unused space look alike, and
the decoy and real paths take the same time.
Blockchain boot attestation (the network gate)
Status: in development
With boot integrity enabled, the installer records the system's boot-file hashes — the
SHA-256 of every boot module and their Merkle root — on-chain. You create or import a
wallet in the installer (seed shown once, written locked-down), and the system deploys its own
BootIntegrityRegistry contract, signed on-device. At every boot the kernel hashes
each booted module and, when the gate is on, holds the whole desktop until a full-screen gate
verifies an authentic network, a live chain in sync, and that the on-chain record matches the
system that actually booted. An offline disk or analysis sandbox cannot produce that proof.
Development uses an Ethereum testnet (Sepolia). In development: the
end-to-end install-time deploy and boot-time chain-sync gating are still being finished.
Native hypervisor & firewall VM
Status: done
src/kernel/d/core/virt/ is a native hypervisor: Intel VT-x with EPT (plus an AMD
SVM/NPT backend), an in-kernel LAPIC, an MMIO decoder, CPUID/MSR emulation and a
KVM-compatible /dev/kvm. That is enough for an unmodified Cloud Hypervisor to boot
OPNsense (FreeBSD), Alpine linux-virt, and a PVH test guest. If chosen in the installer, an
OPNsense firewall VM autostarts headless in System; each domain can route direct, through the
firewall VM, through another domain, or be blocked — and routes persist, failing closed
if they no longer resolve.
The desktop, wallpaper & Software Center
Status: done · animated wallpaper just added
Hyprland 0.55 renders on the kernel's DRM/KMS emulation with Mesa llvmpipe, with a top bar (Activities, a desktops strip, clock, network indicator), a launcher dock, and a full-screen Activities dash with per-domain lenses. The desktop wallpaper is the animated dendritic "full canopy": the branching artwork is pre-rendered into a 28-frame sprite sheet and CPU-blitted frame by frame on a timer (a seamless 3.5 s loop at 8 fps) — no browser or GPU on the guest — and it replaces the previous Conky desktop widget as the desktop's living element. The Software Center installs from a 73,000+ package offline catalog (Alpine main + community are installable with verified checksums and dependency resolution); installs survive reboots and are delegated to domains like any other app.
Memory hardening
Status: done (SMAP enforcement pending)
W^X / NX by default, NX stacks, stack canaries in userspace and the kernel, stack-clash protection, full ASLR (libraries, ld.so, PIE image, mmap and stack), mmap guard pages, SMEP and a heap double-free guard — each verified by booting the full desktop under it. Partial: the SMAP infrastructure is in place but gated off, because a trial enablement still stalls desktop bring-up.
Compatibility & the honest frontier
Status: partial / in development
A Linux personality (about 177 x86-64 syscalls) runs unmodified musl binaries; the native
object ABI drives the dash shell. Android (Waydroid) runs init, servicemanager,
zygote, system_server and SurfaceFlinger, but memory pressure is the current frontier.
macOS (Darling) and Windows (Wine) have launchers and kernel surface in place, but no foreign
app is verified yet. SMP runs one application processor under a big kernel lock, and the
software desktop has not yet been verified on bare metal (Framework 13 is the target).