Manual section L

Guided concept trails.

Each trail is a short route through the machine. Run the command, observe the record, then read the source plate that gives the mechanism.

Field setup

Keep the guest and source side by side.

host$ cd slos
host$ make
host$ make run-nographic
slos:/$ events 10
slos:/$ journal recent 5

Cross references

Where to continue.

Use these trails with subsystem chapters, execution walks, the causality notes, manual, source atlas, showcase, and glossary.

Trail 01

Boot to shell

Locate the exact handoff from Multiboot entry to a causal, interrupt-driven prompt.

MultibootGDTIDTschedulershell

Procedure

```
host$ make
```
Builds the default x86 image with host gcc -m32, NASM, ld, and embedded user programs.
```
host$ make run-nographic
```
Boots QEMU on serial stdio; watch the ordered kernel initializers.
```
slos:/$ status
```
Confirms memory, tasking, filesystem, network, causal graph, timelines, and actors are live.
```
slos:/$ events 10
```
Shows the recent hot-ring events caused by entering and using the shell.

Source path Boot to shell

arch/x86/boot.asm

kernel/core/main.c

kernel/core/x86.c

kernel/core/interrupt.c

kernel/apps/shell.c

Trail 02

Syscall crosses rings

Watch a ring-3 program cross INT 0x80 and return to user code with causal context attached.

ring 3INT 0x80ELFstrace

Procedure

```
slos:/$ ringdemo
```
Runs the small ring-boundary demonstration program.
```
slos:/$ strace hello
```
Prints the syscalls made by a minimal user ELF.
```
slos:/$ events 12
```
Finds syscall records with pid and syscall names in the recent event list.
```
slos:/$ trace <syscall-event-id>
```
Walks the recent parent chain back toward the shell or task that caused the call.

Source path Syscall crosses rings

programs/ringdemo.c

programs/hello.c

arch/x86/interrupt.asm

kernel/core/syscall.c

include/syscall.h

kernel/core/elf.c

Trail 03

Packet becomes TCP data

Follow one HTTP request as it sheds VirtIO, Ethernet, IPv4, and TCP wrappers.

VirtIOARPIPv4TCPHTTP

Procedure

```
slos:/$ ifconfig
```
Confirms the QEMU user-network address and VirtIO MAC.
```
slos:/$ httpd
```
Starts the user-space HTTP server on port 80 inside SlOS.
```
host$ curl http://localhost:8080/
```
Uses the Makefile host forward to send a request into the guest.
```
slos:/$ tcptrace
```
Shows TCP state transitions, byte movement, and close events.
```
slos:/$ events 20
```
Correlates network, syscall, and shell activity in the causal ring.

Source path Packet becomes TCP data

kernel/drivers/virtio_net.c

kernel/net/net.c

kernel/net/tcp.c

kernel/net/dhcp.c

kernel/apps/cmd_net.c

programs/httpd.c

Trail 04

Note becomes timeline

Turn application text into a replayable timeline event and inspect its cause.

notestimelinereplaySlFS

Procedure

slos:/$ note add field log begins at the prompt

Creates a notes timeline event with typed payload.

```
slos:/$ note tag last boot
```
Appends another event whose parent is the previous notes head.
```
slos:/$ tl show notes
```
Lists the ordered event chain for the notes application.
```
slos:/$ why <note-event-id>
```
Explains the recent ancestry of the selected note event.

Source path Note becomes timeline

kernel/apps/notes.c

kernel/graph/timeline.c

kernel/graph/causal.c

include/notes.h

include/timeline.h

Trail 05

Actor message crosses mesh

See named actor delivery locally, then read the same route as mesh/federation machinery.

actorsmailboxNoisefederation

Procedure

```
slos:/$ actors
```
Lists local and remote actor records.
```
slos:/$ send shell local loop
```
Places a typed message in a named mailbox.
```
slos:/$ recv shell
```
Removes the mailbox message and emits a receive edge.
```
slos:/$ mesh
```
Shows SPIFFE identity and peer transport state.
```
slos:/$ federation
```
Reports cross-node actor and graph replication state.

Source path Actor message crosses mesh

kernel/graph/actor.c

kernel/graph/mesh.c

kernel/graph/federation.c

kernel/core/noise.c

kernel/apps/cmd_graph.c

Trail 06

Causal history and time-travel

Move from recent events to durable explanation, replayed state, and a counterfactual.

eventsjournalscrubwhatif

Procedure

```
slos:/$ events 10
```
Starts with the hot causal ring.
```
slos:/$ why last
```
Explains the newest event while it is still recent.
```
slos:/$ journal recent 10
```
Reads persisted cjournal records from SlFS.
```
slos:/$ scrub event last
```
Focuses one event with parents and effects in the time-travel inspector.
```
slos:/$ scrub whatif last
```
Asks what downstream facts disappear if that event is dropped.

Source path Causal history and time-travel

kernel/graph/causal.c

kernel/graph/cjournal.c

kernel/graph/replay.c

kernel/graph/whatif.c

programs/scrub.c

Trail 07

Web causal explorer

Serve the live causal DAG from SlOS and use the browser-side scrubber as a read-only instrument.

httpd/causalSVGAPI

Procedure

```
slos:/$ httpd
```
Starts the ring-3 HTTP server.
```
host$ xdg-open http://localhost:8080/causal
```
Opens the interactive causal graph explorer through QEMU port forwarding.

host$ curl http://localhost:8080/api/causal/graph

Fetches nodes and parent edges as JSON.

host$ curl 'http://localhost:8080/api/causal/state?tick=100'

Asks replay to reconstruct state at a chosen tick.

```
host$ curl http://localhost:8080/api/causal/dot
```
Retrieves the same recent graph as Graphviz DOT text.

Source path Web causal explorer

programs/httpd.c

kernel/graph/replay.c

kernel/graph/causal.c

kernel/net/tcp.c

Trail 08

Durable queries

Search persisted history, save the query as a lens, and count results with a shell aggregator.

cqlensjournaltally

Procedure

```
slos:/$ cq -a type=syscall limit=10
```
Queries archived syscall events through the journal-backed query path.

slos:/$ lens save syscalls cq -a type=syscall limit=10

Persists a named query in /lens.db on SlFS.

```
slos:/$ lens list
```
Confirms the saved lens is present.
```
slos:/$ lens run syscalls
```
Replays the saved causal query.
```
slos:/$ journal type sched 50 | tally
```
Aggregates journal output in a repeatable shell pipeline.

Source path Durable queries

programs/shell.c

kernel/graph/cjournal.c

kernel/graph/search.c

kernel/graph/integrity.c

Trail 09

Operate the causal toolkit

Drive one incident through the operator commands: verdict, time-search, debug, profile, and a signed receipt.

triagecbisectcdbcprofattest

Procedure

```
slos:/$ triage
```
Reads the whole graph and prints one verdict (HEALTHY/DEGRADED/CRITICAL) plus a single next action.
```
slos:/$ cbisect events 100
```
Binary-searches the tick timeline, reconstructing state per probe via replay, for the earliest tick events >= 100.
```
slos:/$ cdb break type sched; cdb run; cdb bt
```
Sets a predicate breakpoint, stops at the first match, then walks its causes; the cursor persists across calls.
```
slos:/$ cprof
```
Profiles cause-to-effect flow across subsystem boundaries, marking cross-subsystem crossings with *.
```
slos:/$ journal spill 64; journal sign 1; attest first
```
Seals a durable segment, then prints a self-contained Ed25519-signed receipt; attest verify first re-checks it.

Source path Operate the causal toolkit

kernel/graph/triage.c

kernel/graph/cbisect.c

kernel/graph/cdb.c

kernel/graph/cprof.c

kernel/graph/attest.c

docs/causal-toolkit.md

Trail 10

Use it from another host

Treat SlOS as the machine you work in: connect remotely, edit a persistent script, run it, start a service, disconnect, and prove the service survived.

telnetdnoiseshdeditorSlFSslosh

Procedure

```
host$ telnet localhost 2323
```
Connect to telnetd through the default QEMU host forward. On another networked host, use guest port 23 instead.
```
slos:/$ termsize
```
Checks the rows and columns learned from telnet NAWS, or the safe fallback when the client did not negotiate size.
```
slos:/$ edit /home/day/hello.sl
```
Opens the full-screen editor over ANSI terminal redirection; arrows move, Ctrl-S saves, Ctrl-Q exits.
```
slos:/$ run /home/day/hello.sl
```
Runs a persistent slosh file. Functions, for loops, recursion, and shell-command passthrough are available inside the script.
```
slos:/$ httpd; exit
```
Starts a detached service and closes the remote shell.
```
host$ curl http://localhost:8080/
```
Confirms the HTTP service remains reachable after disconnect.
```
host$ python3 scripts/noise-shell-client.py localhost 5200
```
Optional encrypted path: confidential X25519 plus ChaCha20-Poly1305, currently unauthenticated and not OpenSSH.

Source path Use it from another host

docs/remote-access.md

kernel/apps/telnetd.c

kernel/core/syscall.c

kernel/drivers/console.c

programs/editor.c

kernel/apps/script.c

kernel/apps/cmd_files.c

scripts/noise-shell-client.py

Study rule: a command is only the surface. For each trail, name the changed data structure, the event that records it, and the source file that owns it.