LordOS 0.8.3-beta

Added

• X11 apps. Programs that only speak X11 (xterm, Java/Swing apps, many games and older tools) now open in LordOS through Xwayland (the xwayland package), with the theme's window frame, their icon in the Dock (matched to their launcher by WM_CLASS), menus and tooltips above everything, fullscreen, minimize and close, and LordOS's cursor. Xwayland only starts when an X11 app connects and stops 10 seconds after the last one closes. LordOS's own X window manager is written in C and speaks the X11 protocol itself, without new libraries in lord-server.
• Clipboard with X11 apps, both ways, for the normal clipboard and the primary selection (select to copy, middle click to paste); large copies and images included.
• Primary selection for Wayland apps (middle-click paste between GTK, Qt and other apps).
• Classic, a second full appearance. The Classic theme is no longer a template: it is a complete desktop for people used to a taskbar layout, with the same apps as Lord Default. A centered taskbar (or aligned to the start, on any side of the screen) with the start button, search, task view, the pinned and open apps and the Trash last; a start menu with a search field that searches like the system search (apps, settings, files, notes, the calculator, Help), a grid of pinned apps you arrange with a right click, recently used apps, every app A–Z, and the user and power button (Lock, Switch User, Log Out, Restart…, Shut Down…); a tray with quick settings (network, Bluetooth, Do Not Disturb, Night Light, dark mode, transparency, volume, what is playing, battery) and a notification panel with a month calendar; notifications above the taskbar; and a window frame with the title at the start and the buttons at the end. Everything is our own design: LordOS icons drawn by the theme, Inter, the LordOS wallpapers and names. Switch between the two in Settings → Appearance → Desktop style, live and without logging out: the windows that were open come back in the new one. Light and dark mode, right-to-left languages and the accent colors work in both. See docs/DESIGN.md, "Classic".
• Window snapping. In Classic, drag a window to the left or right edge to fill that half of the screen, to a corner for a quarter, or to the top edge to maximize it; a preview shows where it will go. Hovering over the maximize button offers layouts (halves, two thirds and one third, thirds, quarters), and Super+arrows move the window in front between them. Dragging a snapped window away gives it back its size. See docs/WINDOWS.md, "Snapping".
• Task view. Super+Tab (or the taskbar button) shows every window side by side, live and smaller, over a dimmed desktop: click one to bring it to the front, or close it from there.
• Themes restyle every app. The shared controls (buttons, fields, segmented controls, sidebars, menus, tooltips, grouped forms, confirmations and the Restart/Shut Down sheet) now take their shape from the theme: corner radii, a light or accent menu highlight, an accent bar or a fill for the selected sidebar row, an underline or a ring on the focused field, and bordered buttons. Lord Default looks as before; Classic uses smaller radii, borders and subtle highlights. Isolated apps (Mail, Calendar, Contacts, Reminders, Passwords) follow it too.
• Remote desktop: allowlist, blocklist and temporary blocks. Settings → Sharing chooses who may connect: the local network (the default: private and link-local addresses and connections over a VPN of this computer), only these addresses (the allowlist), or any address; keeps a blocklist of addresses and networks that are always refused; and lists the temporarily blocked addresses with the time left, Unblock and Block permanently. You get a notification when an address is blocked.
• Monitor → Network shows the remote desktop as one more app while it's on: the browsers connected with their traffic, the recent failed sign-ins (address and the name typed, for administrators), the blocks and the lists, with Block and Unblock.

Changed

• Settings → Desktop & Dock in Classic adds Taskbar alignment (center or start).
• The lordos package recommends xwayland, and the ISO and the Raspberry Pi 5 image include it, so X11 apps open out of the box.
• The theme engine paints a scaled window that contains a blurred surface (a translucent Terminal) at its scaled size; its blur then only shows the window's own content. Before, such a window was drawn at full size during the Dock's minimize effect.
• Scroll bars stay out of the way. Scroll bars across the system are now thin overlay bars drawn at the very edge of a list or panel: hidden until you scroll (mouse wheel, touchpad, keyboard or dragging the bar) or bring the pointer near the edge, 6 px wide and 10 px under the pointer, fading out a second after the last scroll. They no longer take a strip of their own and never cover text. Settings → Appearance → Show scroll bars: Automatically (the default), When scrolling or Always (the persistent bar, for accessibility). With Reduce motion they appear and disappear without a fade; in right-to-left languages they are on the left. The Classic theme draws them with its own squarer style, and the Terminal's history bar matches.
• Monitor → Network: a tidier detail panel. The right panel's sections (Process, Rule, Connections, Data, Ports and protocols, Destinations, and the summary's) fold with a click on their header and stay folded the next time. App names in "Top apps by traffic", the app list and the panel header wrap to two lines instead of being cut, long destinations wrap too, and the app list gives the name more room (the counts moved next to the traffic bar, the Data and Rule columns are narrower).
• Debian's smartd stays off. Installing smartmontools from Disks no longer leaves its monitoring daemon polling the disks every 30 minutes; Disks and the Monitor read SMART on demand. Administrators can opt back in (docs/SYSTEM.md, "smartd").
• Remote desktop now accepts the local network only by default. Connections from public internet addresses are refused unless you choose Any address (or list them) in Settings → Sharing; a VPN of this computer still works. Browsers signed in before the update sign in once more (the sign-in cookie changed).

Security

• X11 apps run in their app's scope, so per-app firewall rules and the Monitor apply to them.
• X11 apps never see Wayland apps, LordOS's screen, Passwords or the keyring prompt, nor the keys typed into them; what is copied outside X enters X only while an X window has the keyboard, and passwords copied in Passwords never do. Synthetic input between X11 apps (XTEST) is off. Xwayland runs without network, in its own scope. X11 apps can still see each other, as in any X11 desktop (see the privacy documentation).
• Apps with device or "no files" restrictions get no X display.
• Clipboard offers to Wayland apps are bound to the selection they were made for and to the app with the keyboard.
• The per-app firewall applies to open connections, not only to new ones. A rule change used to leave established TCP connections and connected UDP sockets (QUIC) outside the policy until they closed. lord-netperm's packet filter (the cgroup programs that already counted bytes per app) now takes the same decision as at connect time for every packet of an app whose rules deny something, and lord-netperm destroys those sockets over sock_diag netlink (its unit now also allows AF_NETLINK; it still creates no internet sockets). "No incoming connections" now also cuts connections already accepted. The Raspberry Pi kernel build enables CONFIG_INET_DIAG_DESTROY; on a kernel without it the packets are still dropped.
• Remote desktop: 3 failed sign-ins block the address. For 15 minutes, then 1 hour, then 24 hours if it happens again within a day (IPv6 counted per /64). Blocked addresses are cut before any TLS work and stay blocked after a restart (/var/lib/lordos/remote/blocklist, root only). Accounts are never locked (that would let anybody lock you out); repeated failures for one account only slow it down. Every failure and block goes to the journal (address and a sanitized user name, never the password).
• Remote desktop: a full security review and hardening (docs/REMOTE.md). The page and the server check every field strictly (user names a-z 0-9 _ - up to 32, passwords 1–1024 bytes); the request, the form, the cookie, the WebSocket and the input messages are parsed strictly and refused otherwise; a wrong user name and a wrong password take exactly the same time; connections that are slow, too many from one address, or from addresses not allowed are closed early; the sign-in cookie is a __Host- cookie stored only as a hash, tied to the password (a password change or lock ends it) and ended for every browser of a user when that user locks the screen; sign-in and sign-out only accept requests from the page itself; TLS 1.2+ with AEAD ciphers only; the part that serves the desktop runs as the user with no shared state, no other descriptors and no way back to root. root can never sign in remotely.

Fixed

• Java (AWT/Swing) windows were blank or shifted (non-reparenting window manager).
• The Passwords and Backups icons sat off center in the Dock and the launcher.
• Blocking an app now cuts the connections it already has open. Turning an app's rule off in Monitor → Network (or adding a deny rule for a destination or domain, or a restriction such as "no internet") counted its new connections as denied, but what was already open kept flowing: a video kept playing over its established TCP and QUIC connections. N...

LordOS 0.8.2-beta

Added

• New wallpapers. Eleven original LordOS wallpapers in three categories: Signature (Crystal Crown, Eternal Dawn, Royal Flow, Royal Waves, Violet Horizon), Lumo (Celestial, Aurora) and Cosmos (Event Horizon, Infinite Galaxy, Solar Odyssey, Stellar Voyage), created by iPERFEX with an AI image generator. Settings → Wallpaper now lists every wallpaper grouped by category, with the previous four gradients as "Gradients". They are installed once in /usr/share/backgrounds/lordos/ as high-quality JPEG (about 4 MB in total) with small thumbnails for the pickers, and a higher-resolution version added later is used automatically on the screens that need it.
• Suggested for your computer. Store → Discover now starts with packages for the hardware LordOS finds in the computer, each with the reason it appears ("We detected a printer from HP connected by USB"): the guest tools of a VMware or QEMU virtual machine, the proprietary graphics driver for an NVIDIA card (labeled as not free software, never preselected, with what changes: DKMS, Secure Boot key enrollment, older cards, and that the free nouveau driver stays the default), vendor drivers for USB printers and scanners, driverless USB printing (ipp-usb), the Raspberry Pi 5's board tools, and the firmware package a Wi-Fi, Bluetooth, network or graphics device asked for and didn't find. One click shows the usual plan and installs through the package engine; "Don't suggest again" hides a card for good. When something new is suggested, the Store's Discover item shows a count and one notification says so. For a VirtualBox virtual machine the card explains that its guest utilities aren't part of Debian 13. Detection only reads the kernel's hardware files; nothing is sent anywhere. The rules are data (assets/store/suggestions.json); see docs/PACKAGES.md.
• Monitor → Disks: each disk's temperature and health. The Disks tab now shows every physical disk's live temperature, read from the kernel without root: NVMe and M.2 drives through the nvme driver's own sensor (also on a Raspberry Pi 5 with an M.2 HAT), SATA disks through the drivetemp module, which the lordos package now loads at boot. Memory cards, virtual disks and adapters without a sensor say "No sensor", never a made-up value. The chosen disk gets a 30-minute temperature chart with the drive's own limits when it reports them, and an OK / Check / Failing light from a cached SMART summary, with "Open in Disks". Spinning disks are only read while they are in use, so a resting disk is never woken up (docs/MONITOR.md).
• Disks: the full SMART report with smartmontools. The first time, the health card offers to install Debian's smartmontools through the Store's package engine (an administrator). Then it shows the overall health and why in plain words, temperature and limits, SSD wear (% of its rated life used), power-on hours and cycles, reallocated and pending sectors, every attribute with a plain name, the NVMe health log, the error log, the disk's own temperature history, and short and long self-tests with progress and results. USB disks behind adapters that pass SMART through work too. smartctl runs only through four new closed, validated root helper actions (smart-info, smart-health, smart-test, smart-abort) on real whole disks, at a fixed path, with JSON output (docs/SYSTEM.md).
• Notifications when a disk gets too hot or its health gets worse, at most once per disk every 30 minutes for heat, and only when the health is worse than last seen. On by default, with a switch in Monitor → Disks.
• Smooth video in the browser without hardware decoding. Video sites that send VP9 or AV1 make the browser decode them on the processor when the graphics card can't (virtual machines, older PCs, the Raspberry Pi 5), and the video stutters. LordOS now checks at every boot what the hardware decodes (VA-API profiles through lord-media, V4L2 memory-to-memory decoders on ARM, virtual graphics cards count as "no"; cached per boot) and, when VP9 or AV1 is missing, asks the browsers for H.264 instead, which is far lighter to decode. Settings → Displays → Video in the browser: "Optimize video for this computer" (Automatic by default, Always, Never) and "Lower quality automatically when video stutters" (off by default). Nothing is sent anywhere (docs/VIDEO.md).
• Our own small browser extension (/usr/share/chromium/extensions/lordos-video, MIT), loaded by Debian's Chromium: on YouTube it reports VP9/AV1 as unsupported so the site sends H.264, and when a video keeps dropping frames it shows a small notice that offers a lower quality (or lowers it by itself, if enabled). Its settings come from a managed policy written by the closed admin action video-optimize (fixed text, no user text). Firefox ESR only loads signed extensions, so for now it gets AV1 turned off through a default preference (it then uses VP9); the extension for Firefox waits for signing.
• Allow or block each destination inside Monitor's app rows. Open an app in Monitor → Network and every name it reached (or address, when the system resolver gave no name) has its own allow/block switch, showing what the app's rules decide for it right now and why ("By the rule *.example.com", "Follows this app's default", "Blocked by this app's restrictions"). A click writes, flips or removes the rule for exactly that name, the same rule Settings → Privacy → Network rules by app shows, and lord-netperm applies it at once. Long lists show eight and "N more…"; rows keep their place while the list is open (docs/MONITOR.md).
• Traffic history. The Network tab's chart now zooms out from the live minute to 1 hour, 24 hours, 7 days and 30 days, steps back and forward one window at a time and has Now; with an app selected its own chart follows the same window, and the summary lists the apps that moved the most in it. Your session records bytes received and sent per minute (7 days) and per hour (30 days), for the computer and for each of your apps, in a small file in your home folder (~/.local/state/lordos/net-history.bin): never an address, a name or a country. Settings → Privacy → Monitor has Keep a traffic history (on) and Clear History (docs/MONITOR.md).
• About LordOS shows a "System app" badge and the state of the system code: "Verified", or "Development build" for an unsigned development tree.
• lord-server --check-code [<folder>] checks a whole installed tree against the signed manifest (troubleshooting, and the .deb build).
• SHA-256 uses the CPU's SHA-256 instructions on the Raspberry Pi 5 (5× faster there), and the portable code is about twice as fast.
• Design study: an immutable LordOS with A/B system images (docs/IMMUTABLE.md). It compares dm-verity system partitions, fs-verity, composefs, OSTree, A/B root partitions and btrfs snapshots against Debian 13, the Store, the Raspberry Pi 5 and LordOS's threat model, and recommends a separate, optional edition: a read-only /usr verified by dm-verity in two slots, one signed boot image per version, automatic fallback to the previous version when an update doesn't start, and /etc and the home folders kept on their own partition. The classic edition, install.sh and in-place updates stay as they are; there is no conversion of existing systems.
• Experimental build of that design (tools/immutable/, not part of the regular ISO or Raspberry Pi image): a disk image for UEFI virtual machines with the A/B layout, a signed update into the other slot, and a scripted demonstration in which a deliberately broken version fails three times and the machine returns to the previous version on its own. Its payload is a minimal Debian 13, not the LordOS desktop yet; the rest of the plan moves to later versions.

Changed

• New default wallpaper: new users start on Celestial; anyone who already chose a wallpaper keeps it. The login screen (and the remote login page) now shows Crystal Crown.
• The Control Center shows the current wallpaper and three from the collection; the rest are in Settings → Wallpaper (Change Wallpaper…).
• The map's moving dots are cheaper to draw: they are small ready-made images and the map's frame is opaque, so a repaint starts there. Repainting several small rectangles per frame instead of the one box around every change (which halved the animation's cost in our measurements) is in this version but off by default: in one test a minimized window left a grey rectangle on the screen, and correctness comes first. LORD_DAMAGE=multi in lord-server's environment turns it on for testing (docs/MONITOR.md).
• Isolated apps start faster: the app host is compiled to bytecode once per session, so an app's JavaScript loads in ~23 ms instead of ~110 ms (Mail's window: ~145 ms from the click to its first frame on a 1.8 GHz test machine).
• The Dock's quick actions and New window now work for the apps that run in their own process; Passwords stays a single window.
• An isolated app's process is named after the app (mail), not exe, in ps and Monitor.
• Releases: tools/release/sign-code.sh signs the system-code manifest on the maintainer's machine before the build; `make -C server RELEASE...

LordOS 0.8.1-beta

A maintenance and polish release on top of 0.8.0-beta, and the first one that installed systems can update to in place: from here on, new versions arrive through Store → Updates (or apt) from a signed LordOS repository, with no reinstall. It also brings a Dock you arrange yourself, remote login over SSH from Settings, Restart and Shut Down in the crown menu, process actions and complete traffic accounting in Monitor, Bluetooth on the Raspberry Pi 5, and fixes for typing lag and black windows on the GPU path and for legacy BIOS boot in virtual machines.

Added

• A Dock you arrange yourself. Drag any app (a LordOS app, an installed package or a Linux app such as Firefox) from the app launcher onto the Dock and it lands where you drop it; drag icons along the Dock to reorder them (the neighbours slide aside); drag one away and hold it for a moment to remove it with a "poof", or use Keep in Dock / Remove from Dock in the menus. Files stays first and the Trash last (it shows when it is full, opens in Files, takes files dropped from Files and empties after a confirmation); Files, Settings and the app launcher can't be removed. The Dock's menu starts with quick actions: an app's own (Settings' sections, Files' folders, Mail's New Message, Monitor's tabs) or a Linux app's desktop actions from its .desktop file. Settings → Desktop & Dock → Reset Dock to defaults puts the theme's apps back. The Classic theme's taskbar works the same way, with a drop line. The arrangement from 0.8.0 is migrated on first login (docs/DOCK.md).
• Update LordOS from the Store, without reinstalling. Store → Updates now shows "LordOS is available" with the release notes and an Update button, next to Debian's updates; files, settings and accounts are kept, and a "Restart required" notice appears when the new version (or a new kernel) is installed. It works the same on the ISO install, the Raspberry Pi image, Debian with install.sh and servers, and sudo apt update && sudo apt upgrade does the same. An optional daily check (on by default, never installs anything) notifies when something new is available (docs/UPDATES.md).
• Settings → Sharing → Remote login (SSH). A new switch, off by default on every install, turns the standard SSH server on and off for good (systemctl enable --now / disable --now). The first time, it installs openssh-server through the package engine (the Store's path). The page shows ssh <user>@<address> for this computer and its ED25519 host key fingerprint, and lets you allow all users or only administrators. Root never logs in (PermitRootLogin no in a drop-in shipped by the lordos package). The Raspberry Pi image's ssh switch file keeps working and shows up as on (docs/REMOTE.md).
• Restart… and Shut Down… in the crown menu (and behind a Power button in the Classic theme's start menu); before, they were only on the login screen. Each opens a confirmation that does it by itself after 60 seconds unless cancelled, lists the apps still open and warns when other users are logged in. The session asks lord-sessiond, which only accepts those two words: any user may do it alone, and only an administrator while other users have sessions open (docs/SESSIONS.md).
• Monitor → Processes: stop a process and Get Info. Select a row and use the new Stop and Info buttons, the right-click menu, a double click, ❖/Ctrl+I or Delete. Stop asks first, with Quit (SIGTERM), Force Quit (SIGKILL) and Cancel. Your own processes are signalled by the session itself with pidfd_send_signal after checking the process's start time, so a reused PID is never hit; another user's or root's need an administrator and go through two new fixed, validated root helper actions (proc-signal, proc-info). PID 1, kernel threads, your session, LordOS's services and helpers and PipeWire can't be stopped: the sheet explains why. Get Info shows memory (real, virtual, shared, private, proportional), statistics (parent, group, CPU time, threads, context switches, page faults, start time, nice, control group and LordOS restrictions), open files and ports (with the addresses of each socket), the executable and the command line, updated every second (docs/MONITOR.md).
• Bluetooth on the Raspberry Pi 5 image. The on-board CYW43455 controller (on a UART, brought up by the kernel) now works out of the box: the image ships BlueZ, the chip's firmware patch (bluez-firmware), headset audio in PipeWire (libspa-0.2-bluetooth) and a small helper of our own, lordos-rpi-bt@hciN, that routes call audio (SCO) over HCI so headset microphones work. Settings → Bluetooth uses it as on a PC. Scanning is verified on a Pi 5; pairing a device on the board is still to be tested (docs/RASPBERRY.md).
• Guest tools on VMware. The ISO (and so every installed system) ships open-vm-tools: shutdown and restart from the hypervisor, time sync and the guest's IP address. Its services only run under VMware. Shared clipboard and automatic screen resize are not supported yet (docs/ISO.md).
• A signed LordOS package repository at https://lordos.org/apt (suite stable, amd64 and arm64), signed with a dedicated OpenPGP key (Ed25519, fingerprint 1DDA F390 107D F264 FA8A 0918 3972 CC6D E4DA 2336) shipped as /usr/share/keyrings/lordos-archive-keyring.gpg; the lordos package adds /etc/apt/sources.list.d/lordos.sources and removes it when uninstalled. Built and signed on the maintainer's machine by tools/release/apt-repo.sh, tested on a staging path first.
• Migrations between versions. The package's postinst applies each version's system changes once and in order (/usr/lib/lordos/migrate, packaging/migrations/), so skipping versions converges to the same state; each user's settings get the same treatment at login (sdk/settings.js). The first two enable per-app network permissions where they were left off, and keep root's SSH key login on servers upgraded from 0.8.0 (0.8.1 turns root login off).
• Local repositories in the package engine: a file:/path source (a disk or a USB stick) is read like a download, as nobody, and checked the same way.
• tools/diag/keylag.sh: where does the typing delay come from? In two minutes it reports the composition mode, the VM and its guest tools and Chromium's complaints, and with lordos.inputdebug=1 on the kernel line (one boot, root only) it times each stage of a key in ms: read by lord-server, delivered to the app, the app's answer, on screen. The trace holds timings only (no key, character or modifier), only for keys sent to Linux apps (never LordOS's own fields, the Terminal, Passwords, login or lock), in a 0600 file in the session's runtime folder, and stops after 120 s (docs/TROUBLESHOOTING.md).
• verify-board checks Bluetooth and the BPF LSM on a freshly flashed board: the controller on its UART, bluetoothd, the SCO helper, the board address, bpf in the LSM list, the kernel's BTF and lord-netperm.

Changed

• Monitor → Network: a fluid traffic chart. The sparse per-second bars are now a continuous mirrored strip for the last 60 s: sent above the baseline, received below, one bar per second on a faint track, scrolling smoothly at 4 samples per second, auto-scaled, with the minute's totals as pills. The selected app gets the same chart, each app row a small live activity indicator, and the summary shows "↓ received · ↑ sent" per app and destination (docs/MONITOR.md).
• Monitor → Network: the map shows which way the traffic flows. Dots travel along each arc, sent from "This computer" to the place and received back, more and faster with the rate; idle arcs are dimmed. Reduce motion shows still markers instead; the animation runs at 12 frames per second, only on screen, and stops when the window is minimized.
• More audio headroom in virtual machines. When LordOS runs in a VM, emulated sound outputs get 8 periods of 1024 frames, 8192 frames of headroom and interrupt-driven scheduling (a WirePlumber rule that only matches in a VM; real hardware keeps its low latency). On VMware this stopped YouTube stuttering in Chromium (docs/SOUND.md).
• Background work yields to the desktop after login. Mail sync runs at nice 19 with idle I/O and the thumbnail worker at the lowest I/O priority, so they don't compete with sound and the first windows.
• The input level meter in Settings → Sound reads a normal 48 kHz stream instead of a 25 Hz peak stream, which in PipeWire ran as a node with a quantum of 1.
• The LordOS Raspberry Pi kernel gains the BPF LSM, BTF and Yama (6.18.57-2+lordos, same Raspberry Pi source as 0.8.0's -1): CONFIG_BPF_LSM, CONFIG_DEBUG_INFO_BTF (from pahole; modules stripped, no debug package) and CONFIG_SECURITY_YAMA. The active LSM list on the Pi is now capability,landlock,yama,bpf.

Fixed

• Typing no longer lags in Chromium and Firefox on GPU composition. A Linux app's new frame is only a texture on the GPU path, and a display with no other change was not flipped, so a typed character appeared only when ...

LordOS 0.8.0-beta

LordOS is a free GNU/Linux distribution based on Debian 13 ("trixie") with its own desktop environment. Debian provides the kernel, the drivers, Mesa, PipeWire, CUPS, BlueZ and every package in the archive, with Debian's security updates. On top of that LordOS ships its own graphical layer: a display server and Wayland compositor written in C that drives the screen and input straight from the Linux kernel, its own interface engine running React, a full desktop and 29 native apps. GTK, Qt and other Wayland apps (Chromium and Firefox are preinstalled) open as ordinary windows next to the native ones.

This is the first public release. It documents everything LordOS has today, not only what changed since the last internal build. It is a beta: most of it works and is tested in virtual machines, but some parts have not been tested on real hardware yet (see Known issues and limitations). The project paper, docs/PAPER.md, gives the big picture.

Highlights

• Light enough for modest hardware. The whole system idles at 465–487 MB of RAM and 99 % idle CPU, the live system boots to the desktop in 16.3 s, and lord-server (the display server with the whole desktop) uses 32–36 MB (measured in the final ISO test, see docs/ISO.md).
• A desktop of its own, built on Debian and Wayland. Its own display server and Wayland compositor in C, its own React interface engine, two themes, a Dock, search, a clipboard history, several displays with sharp HiDPI, and smooth window moving even without a GPU.
• Private by design. Third-party apps run sandboxed (Landlock, seccomp, cgroup v2) behind a permission broker, with system-drawn prompts for the camera, microphone, files, screen and network. Passwords and other sensitive windows are black in screenshots, recordings and the remote desktop.
• A visible, per-app firewall. Allow or block the network per app, by domain, address or network, enforced in the kernel with cgroup BPF, and see every app's connections on a world map in Monitor. Linux apps can also be denied the camera, microphone, USB, Bluetooth, screen, notifications and your files.
• 29 native apps. Files, Terminal, Text Editor, Notes, Mail, Calendar, Contacts, Reminders, Passwords, PDF Viewer, Photos, Player, Camera, Recorder, Screenshots, Monitor, Disks, Backups, Store and more, in English, Spanish and Portuguese, right to left included.
• Install it your way. A live and installable ISO for 64-bit PCs (UEFI and BIOS), a Raspberry Pi 5 image, or one command on an existing Debian 13. Every release file is listed in an Ed25519-signed SHA256SUMS and comes with an SPDX SBOM.
• Every language, every script. Full Unicode bidi, Arabic, Indic and about 80 more complex scripts shaped by our own engine, and Korean, Japanese and Chinese input methods.

Added

Desktop and display

• Display server (lord-server): our own DRM/KMS modesetting with double buffering and page flips, our own evdev input, and a 2D rasterizer with antialiased rounded rectangles, shadows and blur. It drops root after opening the display and input.
• GPU composition with Mesa (EGL, GBM, GLES2), linux-dmabuf, direct scanout for fullscreen apps and a hardware cursor plane; the CPU path stays as the fallback and as "safe mode" (docs/GPU.md).
• Interface engine: QuickJS embedded in the server, a native node tree, a CSS subset, our own flexbox layout (with flexWrap), text ellipsis, per-side borders, logical (start/end) edges, scale and rotate transforms, damage tracking and cached shadows. React 19 runs on it through the stock react-reconciler. Painting got faster before the release: a full-screen paint went from 12.5 to 4.8 ms, and dragging across two displays from 11.3 to 2.5 ms per frame.
• Wayland compositor: GTK, Qt and other Wayland apps open as LordOS windows with the theme's frame, in the Dock and the app launcher, with a shared clipboard (images too, surviving the source app), xdg-decoration, popups, app cursors, real fullscreen, wp_presentation, wp_viewporter, relative pointer and pointer constraints for games, and fractional scale (docs/WAYLAND.md).
• Linux apps from the launcher: installed .desktop apps appear in the app launcher (by freedesktop category), the start menu and the Dock, each in its own cgroup scope; "Open With" in Files and default apps per file type.
• Two themes, "Lord Default" (menu bar, magnifying Dock, Control Center) and "Classic" (taskbar and start menu), switchable live, in light and dark mode with accent colours.
• Dock at the bottom, left or right, with size, magnification and auto-hide (docs/DOCK.md).
• Search for apps, files, notes, Store packages, help articles and a calculator, and an advanced clipboard with history (❖V) that keeps passwords out (docs/SPOTLIGHT.md).
• Moving and resizing windows: pointer motion coalesced to one per frame, moving and resizing done in C, resizing from all four sides and corners, and LordOS's own cursors (docs/WINDOWS.md).
• Several displays and HiDPI: extend or mirror, each display at 100, 125, 150, 175 or 200 %, rasterized at the display's real resolution, so a 4K panel next to a 1080p one is sharp on both (docs/DISPLAYS.md).
• Touchpads and touchscreens with our own multitouch driver: acceleration, tap to click, scrolling with inertia, pinch to zoom (Chromium's too) and three-finger swipes (docs/TRACKPAD.md).
• Sessions (lord-sessiond): LordOS's own login screen, screen lock (❖L), fast user switching, parallel sessions and Settings → Users (docs/SESSIONS.md).
• Remote desktop from a browser on the local network: open https://<machine IP>:5673 and sign in with a user of the machine. Nothing to install on the other computer. Off by default (docs/REMOTE.md).
• Notifications for native and Linux apps (org.freedesktop.Notifications), with per-app settings, Do Not Disturb with a schedule, and menu-bar status items.

Apps

• Files: tabs, four views, freedesktop Trash, Quick Preview, Get Info, background copy and move, drag and drop, colour tags, search, mounted disks, browsing inside archives, Extract Here and Compress (docs/FILES.md, docs/DOCUMENTS.md).
• Terminal: our own xterm-256color emulator in C with tabs, split panes, profiles and colour schemes, inline images and Sixel, shell integration (bash, zsh, fish), triggers, Instant Replay, tmux -CC with native tabs, ligatures, colour emoji, and sessions that survive a server restart (docs/TERMINAL.md).
• Text Editor: our own code editor with syntax highlighting, projects, go to file, find and replace and multiple cursors (docs/EDITOR.md).
• Notes: markdown notes with a reading view and index, images, attachments and emoji, and sticky notes on the desktop; saved in ~/Notes (docs/NOTES.md).
• Mail, Calendar, Contacts and Reminders: IMAP (with IDLE) and SMTP for any provider, conversations, a unified inbox and categories, HTML mail shown through our own sanitizer with remote images blocked until asked, tracking pixels dropped and deceptive links flagged; CalDAV calendars and reminders, CardDAV contacts, and meeting invitations answered from Mail. A 10,000-message folder syncs in about 2 s (docs/MAIL.md).
• Passwords, which is also the system keyring: our own encrypted .lvault format (XChaCha20-Poly1305, Argon2id), unlock with a master password, a FIDO2 security key, a key file on a USB stick or a recovery key; 2FA codes, a generator, a security report, Wi-Fi QR codes, KDBX and CSV import, and the freedesktop Secret Service, so Chromium, Firefox and secret-tool keep their secrets there (docs/PASSWORDS.md).
• Documents: a PDF Viewer (search, outline, annotations saved as a copy, forms, dark pages, printing), Quick Preview for PDFs, fonts and archives, Fonts and Emoji & Symbols (❖.) (docs/DOCUMENTS.md).
• Printing and scanning: add driverless network printers, a system print dialog with preview, and a Scanner app over eSCL. LordOS speaks IPP to CUPS with its own client and finds devices over mDNS (docs/PRINTING.md).
• Media: Photos (HEIC, AVIF, WebP, animated GIF, basic editing), Player (video with subtitles, picture in picture, a music library), Screenshots (screen, window or area, annotation, screen recording to MP4), Camera and Recorder. Decoding runs in a sandboxed helper; a 1080p video costs 13 % of a core windowed and 15 % fullscreen (docs/MEDIA.md).
  ...