Section 1
Briefing
SlOS is operated as a causal machine. Build it, boot it, issue one command, and then ask the kernel what changed and why.
The recent causal ring is the first instrument. The persistent cjournal is the durable instrument. cwatch is the live stream; scrub and /causal are visual causal instruments; wm is the framebuffer desktop for live per-core and system panels. For day-to-day work, telnetd and noiseshd let the operator use the machine from another terminal.
Section 2
Boot and entry
Use make for the default x86 build. Use make run for graphical QEMU, make run-nographic for serial operation, and make iso to create a GRUB ISO when the host has the required tools.
QEMU supplies VirtIO block and network devices. The x86 run target forwards host port 8080 to SlOS port 80, so the httpd dashboard and /causal explorer are reachable from the host after httpd starts.
Section 3
Causal inspection
An event has an ID, node hash, Lamport time, wall tick, type, subsystem, description, optional payload, schema data, and up to four parents. Parent IDs turn logs into a DAG.
Use events, why, trace, graph, blast, cpath, and cdot for the hot graph. Use events -a, cq -a, why -a, and trace -a when the answer must read through durable journal segments.
Section 4
Durable history and proofs
cjournal persists causal events to SlFS segments. The journal records segment indexes, event hashes, Merkle roots, and proof material so archived history can be queried and checked.
Use journal recent, find, type, subsystem, stats, filter, verify, json, selfcheck, proof-health, and epoch-proof. Use cq selectors for typed query work: type=, subsystem=, desc~, since=, until=, id=, segment=, and limit=.
Section 5
Time travel
Replay reconstructs state by scanning events forward to a tick. scrub makes this operator-visible: scrub for a TUI, scrub <tick> for a single frame, scrub event for focus, scrub diff for deltas, and scrub json for machine-readable state.
whatif is counterfactual rather than restorative. It asks which downstream effects would be eliminated if one event were dropped from analysis.
Section 6
Remote workstation
Under the default QEMU run, telnetd is reachable from the host at localhost:2323 and noiseshd at localhost:5200. On real hardware or bridged networking, use guest ports 23 and 5200. The encrypted path uses the host script scripts/noise-shell-client.py.
The terminal path is honest: telnet plus a small unauthenticated encrypted channel, not OpenSSH. The useful part is the redirection layer: ANSI output, cooked-key input, telnet NAWS sizing, a remote full-screen editor, coherent file commands, and detached services that survive disconnect.
Section 7
Applications and transport
Timelines provide common controls for graph-native applications: tl list, show, rewind, forward, at, mark, and tail. Notes, mail, editor, process views, and scheduled commands build on this model.
Actors, mesh, and federation expose named message endpoints, routes, encrypted peer channels, and remote graph or actor delivery. Use actors, send, recv, routes, mesh, federation, ping, netstat, and arp as field instruments.
Section 8
SMP and desktop operation
smp offload <n> creates unpinned ap_offloadable kernel tasks; the BSP may retarget them to idle APs. This is cooperative kernel-task offload, not preemptive migration or arbitrary user-task load balancing.
Use cpu for a per-core table, cwatch tail to see scheduler offload events appear in the graph, and wm when the best view is the 1024x768 framebuffer desktop.
Section 9
Web explorer
httpd serves both a dashboard and the /causal explorer. /causal draws a live SVG DAG and lets the reader focus events and scrub state. The companion endpoints are /api/causal/state, /api/causal/recent, /api/causal/graph, and /api/causal/dot.
Treat the web view as another manual plate: it is useful because every visible field has a source path in programs/httpd.c and a corresponding shell command.