Briefing
SlOS records kernel and application activity as causal events, allowing commands to inspect what changed, which earlier events caused it, and what followed.
Recent events are queried from a live ring, while cjournal preserves selected history on disk. cwatch streams new activity; scrub and /causal expose replay and graph inspection. The wm desktop displays CPU and system panels, and telnetd or noiseshd provide remote terminal sessions.
Boot and entry
Start with make doctor, make first-user-check, then make dev. The host-native 64-bit target uses DOOM=0, a fresh disposable disk, serial I/O, and no host forwards. Native QEMU SMP defaults to four CPUs. DEV_MODE=graphical adds a VGA window on x86-64 only; DEV_DISK=my-slos.img requests persistence. Successful disposable sessions remove their image; failures retain it. Type halt or Ctrl-a x to exit; /start has prerequisites.
For remote access, /start documents explicit loopback SLOS_QEMU_HOSTFWD rules with a persistent DEV_DISK. The legacy run-nographic workflow instead reuses disk.img and opens its standard host forwards beyond loopback. Older operator labs retain that workflow and their historical application scope. Start the intended guest service separately.
Causal inspection
An event has an ID, node hash, Lamport time, wall tick, type, subsystem, description, optional payload, schema data, and up to four parents. Parent IDs turn logs into a DAG.
Use events, why, trace, graph, blast, cpath, and cdot for the hot graph. Use events -a, cq -a, why -a, and trace -a when the answer must read through durable journal segments.
Durable history and proofs
cjournal persists causal events to SlFS segments. The journal records segment indexes, event hashes, Merkle roots, and proof material so archived history can be queried and checked.
Use journal recent, find, type, subsystem, stats, filter, verify, json, selfcheck, proof-health, and epoch-proof. Use cq selectors for typed query work: type=, subsystem=, desc~, since=, until=, id=, segment=, and limit=.
Time travel
Replay reconstructs state by scanning events forward to a tick. scrub makes this operator-visible: scrub for a TUI, scrub <tick> for a single frame, scrub event for focus, scrub diff for deltas, and scrub json for machine-readable state.
whatif is counterfactual rather than restorative. It asks which downstream effects would be eliminated if one event were dropped from analysis.
Remote workstation
Under the default QEMU run, telnetd is reachable from the host at localhost:2323 and noiseshd at localhost:5200. On real hardware or bridged networking, use guest ports 23 and 5200. The encrypted path uses the host script scripts/noise-shell-client.py.
Telnet is unencrypted, and the Noise shell does not authenticate the server; neither is OpenSSH. Terminal redirection provides ANSI output, cooked-key input, telnet NAWS sizing, and remote full-screen editing. Filesystem commands use the same namespace, and detached services can survive disconnect.
Applications and transport
Timelines provide common controls for graph-native applications: tl list, show, rewind, forward, at, mark, and tail. Notes, mail, editor, process views, and scheduled commands build on this model.
Actors, mesh, and federation expose named message endpoints, routes, encrypted peer channels, and remote graph or actor delivery. Use actors, send, recv, routes, mesh, federation, ping, netstat, and arp as field instruments.
Develop and retain application work
Use make development-console to open a fresh native workbench with the editor, develop client and trusted host compiler worker. Configure the worker using the printed guest command. init creates a C project; init PROJECT hew creates a real Hew actor starter when matching compiler/library/runtime inputs are supplied.
Edit declared sources, then build and run. diagnostics retains checked feedback, edit opens its safe source line, and status distinguishes current edits from selected/previous programs. A failed build does not replace the last good application. rollback selects the predecessor without restoring source or unrelated application data.
The editor uses Ctrl-S to save and Ctrl-Q to quit, with repeated confirmation for unsaved changes. Failed saves keep the modified buffer open. The buffer has no persistent recovery copy: save failures, confirmed discard and a lost guest must not be confused with saved work.
For a normal handoff, save, fsck and halt, then resume the unchanged stopped session. For an interrupted session, keep the original offline and private. Checked rescue, production replay on a new v2 copy when needed, and DEVELOPMENT_IMPORT_PROJECT start a fresh workbench with new credentials. Import and DEVELOPMENT_SESSION are mutually exclusive; only checked project files are imported.
Installed work, versions and data
The local Hew tools provide familiar text, filesystem, data, system and network workflows through bounded command profiles. Installed help belongs to the selected application, not the separate C rescue builtin. Use /hew for the command families and /applications for worked examples.
Ledger entries, queue state and report work live outside program-version directories. Stop a running service before an update or rollback; selecting older code does not restore its application data. The queue retains pending work and supervises two actor workers; the installed report workspace retains immutable input snapshots and checked reports.
The renderer and durable debugger are native Hew user programs. The browser displays guest work and evidence, not host-computed accepted results. Remote observations and offline caches remain distinct from verified current local state. The recorded compute tour uses labelled excerpts; the three complete sessions preserve continuous real-time execution.
SMP and desktop operation
x86-64 and AArch64/QEMU virt default to SMP=1 CPUS=4. Explicitly AP-pinned kernel work is preemptive; user programs, allocation, filesystems, networking and general services stay on CPU 0. Native automatic offload and user migration are not implemented; SMP=0 CPUS=1 retains UP debugging.
The older i386 cooperative offload and 1024x768 wm desktop recordings remain historical examples. Current native SMP checks prove concurrent AP work and lifecycle handling alongside a BSP user process, not multicore Hew execution or a port of every graphical application.
Web explorer
httpd serves both a dashboard and the /causal explorer. /causal draws a live SVG DAG and lets the reader focus events and scrub state. The companion endpoints are /api/causal/state, /api/causal/recent, /api/causal/graph, and /api/causal/dot.
The browser and shell views share the kernel event and replay interfaces. programs/httpd.c implements the page and API routes.