TRUST

Built to stay up. Built to stay private.

Reliability, security and privacy are structural properties of Sabas OS, not features bolted on after the fact.

RELIABILITY

Built to stay up.

Every layer of Sabas OS is designed with a clear failure boundary so that one component going wrong never takes the whole session down.

Supervised process tree

The bootstrap supervisor monitors compositor and shell as separate OS processes. Either can crash and be restarted independently — a shell hang never freezes the display.

crash-limited restart - 10 / 15 attempt thresholds
GC-free render loop

Frame execution, damage tracking and buffer reads are pooled and allocation-free. The garbage collector never runs during a frame — so a GC pause can't cause a dropped frame or visible stutter.

zero per-frame allocation - pooled SHM + DMA-BUF reads
Adaptive throttle policy

The deadline scheduler tracks consecutive missed frames and degrades gracefully through four levels — normal, degraded, critical, emergency — shedding work to protect frame delivery.

5 / 15 / 30 miss thresholds - 120-frame startup grace
Flip-driven frame pacing

The frame loop is driven by DRM page-flip completion events — not a timer. The display hardware itself paces rendering, giving zero jitter at any refresh rate including VRR.

no frame timer - epoll / io_uring - VRR-native
Hotplug resilience

Display hotplug events re-run OutputPathSelector per output without tearing down the session. Plugging or unplugging a monitor reconfigures DRM atomically — no compositor restart required.

DRM atomic - per-output path re-selection at hotplug
Session persistence

The shell saves workspace state, open app positions and panel configuration to disk. After a compositor restart or reboot, the session is restored to exactly where you left it.

workspace save / restore - panel state - app positions
SECURITY

Least privilege by default.

Security in Sabas OS is structural, not bolted on. Every process boundary is a capability boundary, and every workspace is a namespace boundary.

Linux capability scoping

Each JVM process is launched with only the Linux capabilities it needs. The compositor holds CAP_SYS_TTY_CONFIG and DRM device access; the shell holds neither. A compromised shell process cannot escalate to compositor-level privileges.

Workspace namespace isolation

Every workspace gets its own PID, mount, IPC, UTS, network, user and cgroup namespaces via unshare(2) called directly through Panama FFM. Apps in workspace A cannot see processes, files, or network connections in workspace B.

Wayland protocol enforcement

Clients communicate with the compositor only through the Wayland wire protocol — there is no shared memory region a client can corrupt. Each client gets exactly the protocol objects it negotiated; the compositor validates every request before acting on it.

MCP security gate

The AI subsystem's agentic loop runs behind a security gate that inspects every tool call before execution. PII is redacted before any data crosses a process boundary. Every action is written to a tamper-evident audit log you can inspect at any time.

GraalVM native hardening

The compositor and greeter compile to GraalVM Native Image — a closed-world AOT binary with no dynamic class loading, no reflection surface beyond what's explicitly registered, and no JVM attach mechanism. The attack surface is significantly smaller than a JVM process running bytecode.

PAM authentication

The greeter authenticates users through PAM — the same mechanism used by every major Linux login manager. Session launch is handled by a minimal native helper that drops privileges before exec'ing the session, ensuring the desktop never runs as root.

PRIVACY

Your machine, your data.

No telemetry calls, no usage analytics, and no cloud dependencies in the core OS. Every feature that touches a network is opt-in and clearly labelled.

Zero telemetry

No usage data, crash reports, or analytics are sent anywhere. The OS makes no outbound network connections on its own. There is no opt-out — there is nothing to opt out of.

Local-first AI

The AI subsystem runs inference locally through Ollama. Model weights live on your machine. No query, file content, or context window is sent to a remote server unless you explicitly configure a cloud endpoint.

Workspace isolation

Each workspace is a separate namespace boundary. Apps in one workspace cannot read files, inspect processes, or observe network traffic from another — enforced by the kernel, not by policy.

Audit log

Every action taken by the AI agent is written to a tamper-evident audit log stored locally. You can inspect exactly what the agent read, wrote, or executed — at any time, without a network connection.

PII redaction

The MCP security gate automatically redacts personally identifiable information before any data crosses a process boundary — even when talking to a locally-running model.

Open source, auditable

Every line of code that runs on your machine is publicly available. There are no binary blobs, no closed-source components in the OS itself, and no obfuscated network calls.