Not stable yet. WolOS is in active development and the current ISO is a test build: try it in a virtual machine or on a spare disk, not on a computer you depend on.

WolOS

Pages

Manual

Changelog

What changed, release by release.

Written as it happened, newest first. The same list ships with the system.

Unreleased / 0.12

  • Coding standards (docs/STANDARDS.md) and the post-change audit brief (docs/REVIEW.md): clippy -D warnings, cargo fmt, cargo audit, script headers and decision-record parts are checked in CI; PKGBUILDs are shellchecked; a change is done only after an independent audit on a real machine.

0.11.5

  • VirtualBox (VMSVGA): the desktop starts after install. GTK used GL on the vmwgfx render node, Hyprland rejected its buffers, the shell died and the start-up lock respawned behind a black screen; on vmwgfx WolOS now renders with cairo.
  • Install WolOS shows the mouse pointer (the installer hid it and never showed it again).
  • Disk unlock: when the TPM refuses (for example after Secure Boot was switched), your account password unlocks the disk before the recovery key, and the next start is automatic again (the TPM slot is sealed again). Changing the password in Settings keeps the disk password in step.
  • The lock screen comes back when it crashes, without giving up, and a crash never shows the compositor's stock page.
  • VMs draw the pointer themselves (no cursor plane on vmwgfx), with the WolOS cursor theme in every session.
  • The live ISO no longer prints "memdisk not found" at start.
  • Built the new way: one recipe repository (wolos-pkgbuilds), clean-chroot builds on the AWS build farm, signed from this repository, ISO tested in QEMU and VirtualBox.

0.11.4

  • Image build: the work directory is cleared without crossing into mounts a stopped build left behind (it could delete the build host's /dev).
  • Secure Boot for the live ISO, prepared: shim first, systemd-boot second and one signed UKI with Install and Try (image/sb-layout.sh, ADR 0025), off until the WolOS live image key exists. With Secure Boot on, the ISO still needs it turned off for now.
  • Analyze with ClamAV: the "not ready" window shows its information icon (it named one the WolOS theme does not ship).
  • Install and Try: the welcome card fits small and scaled screens (1024x600, 1366x768, a VM window): the installer, setup and login screens run at scale 1 like the desktop, and a screen smaller than the card scrolls instead of cutting off the buttons.
  • Boot splash: the WolOS mark from power-on, also on the live ISO (it showed the Arch Linux splash: the theme was set before plymouth was installed). Upgrades switch systems that kept the Arch splash.
  • Virtual machines: VirtualBox, VMware, SPICE and QEMU guest support, each started only under its own hypervisor. In VirtualBox the screen follows the window size (VBoxClient --vmsvga).

0.11.3

  • WolKernel 1:1.0+7.3-4: the series in kernel/linux/patches through 0034 (kernel/SERIES.md): futex spinning, prechecks and inline vectors for futex_waitv, pipe and semaphore wake paths, SLUB sheaf sizing, ntsync inline waits, large folios cleared on idle CPUs, and the syscall exit fixes. Each has a runtime off switch.
  • Arch Linux snapshot 2026-10-31.
  • linux-wolos-headers ships vmlinux without debug info (BTF kept), as Arch does: 390 MB less on disk, and the ISO stays one 2 GiB download.
  • Window title strip: follows light and dark. Kit windows show the title once, and strip plus toolbar take 64 px instead of 80.
  • The search window is wol-search and the app grid is Apps; a saved shortcut that named the old program needs setting again.
  • The image no longer adds files to Firefox's folder.
  • The kernel series and scx_wolos are in this repository, GPL-2.0-only.
  • Memory Saver switches flip back when they could not save. The installer's password fields show the Caps Lock note.
  • sudo works: sudo-rs ships no /etc/sudoers and no PAM service, so every sudo failed, for administrators too, and the live installer found no disk. WolOS now ships both.
  • The live desktop has Install WolOS first in the dock and in Search, and never locks itself.
  • Secure Boot (ADR 0025): every computer makes its own boot keys at install. In Setup Mode they join Microsoft's in the firmware; otherwise one key screen at first start; with neither, WolOS still starts and says so. Each slot boots one signed image holding kernel, initramfs and command line, with kernel lockdown and module signature checks on. The disk key follows signed kernels, so updates keep unlocking and a changed kernel, command line or initramfs does not. An older slot can't be started once it is retired.
  • A failed update now really rolls back: three failed starts fall back to the other slot. Before, the loader kept starting the failed slot.
  • The system file check runs on every start, in 0.4 s instead of 7 s. A sealed system gets its machine id at install, so D-Bus starts.
  • rEFInd and GRUB of another system can start WolOS (/usr/share/wolos/boot/41_wolos).
  • AUR laws (ADR 0022, archicture/modules/aurlaws.md): wopkg audit <pkg> reads a package's files and code as a graph and checks them against named laws, each with a severity. Every package gets one state: No Law Broken, Needs Review, Blocked or Not Checked. No state says a package is safe. On 40 fresh malicious fixtures, 30 were flagged; on 300 fresh popular packages, 59 were flagged, so expect to read findings on packages that are fine.
  • App Store: the AUR is never in browse or search. It has its own tab with the risk first, and opening that tab asks for an administrator's password, once each time the App Store runs. AUR installs stay in Terminal. Develop lists SDKs and toolchains.
  • App Store: tiles say where an app comes from. One app is one entry, joined by AppStream id, and its page lists every source and version, picks which one Get installs, and offers update, Keep This Version and Roll Back. Two sources with no shared id stay two entries.
  • Administrator passwords work on an installed system: wol-admind looked for its password helper in the wrong folder.
  • Installed systems: packages added live stay after a restart, NetworkManager runs, and updates can build the next slot. Flatpak ships and Flathub is added on first use. A package change no longer reports failure after it worked, and a refused system update no longer says everything is up to date.
  • wopkg: wopkg pin and unpin keep a package through updates; wopkg update <name> updates one app; search reads Arch's AppStream, and Flathub's public list when Flatpak has none.
  • One app cannot take the desktop with it (ADR 0027): each app has task and memory limits, the session keeps its memory and CPU share, and a fork storm is killed within seconds, on its own. A memory bomb used to stop new programs for 95 s; now they start in 3.5 ms.
  • Memory Saver (ADR 0026): a background app gives its memory back to zram 30 s after it stops being used, and takes it back as it runs. Sound, video, games and the apps you exclude are left alone. On by default, with its row in Settings.
  • Shader precompile (fossilize_replay) runs in the Background class, so a game keeps its frames during a replay. Steam's children malloc on transparent huge pages (wol games steam): shader compiles take 8% less time for 11% more memory.
  • Malware check (ADR 0024, archicture/modules/security.md): a layer of protection against known malware, on this computer only. Downloads, removable disks, AppImages, .wol, Windows programs and new programs are checked the first time they open; a clean file is never read again until it changes. Nothing appears when nothing is wrong. A stopped file gets one sentence, Move to Trash, and a deliberate Open Anyway in Settings > Privacy & Security. Signature updates are signed. wol security scan, and libxguard.so.1 or wol-xguard scan --json for installers. New malware can get past it.
  • Full malware signatures (ADR 0028), off by default: a switch in Settings > Privacy & Security fetches the ClamAV database straight to this computer and keeps it current, and new downloads, Windows programs and installs are then checked by ClamAV too. It runs in its own process, only when needed, and uses about 1 GB of memory while it does. wopkg now checks through wol-xguard scan.
  • Files: right-click a file and choose Analyze with ClamAV for a clear result: nothing found, the signature it matched, or a check that did not finish. With the signatures off it checks nothing and offers Settings.
  • Install WolOS is a real installer (ADR 0023): boot offers Install or Try, and Install stays light. Language and keyboard, time zone (searchable, guessed), then Erase Disk, Install Alongside with a size slider for Windows or Linux, or Manual (create, delete, resize, mount points, file system, keep an existing /home). Encryption with a password or the TPM, an account, and a summary of exactly what will change before anything is written. A plan names the partitions it may touch; if anything else moves, the install stops. The boot medium is refused. Manual layouts without btrfs keep one copy of WolOS and say so.
  • libwol 1.2: window menus and toolbars (keys come back to the app; a shortcut like cmd+s works in the window), and an app can replace or withdraw a notification it posted, which only the process that posted it can do.
  • libwol 1.3: clipboard text (wol_clipboard_copy_text, wol_clipboard_set_text), behind two new permissions in Privacy & Security. wold checks the app, then asks the desktop of its account.
  • libwol 1.4: an app keeps its own preferences (wol_prefs_), held by wold per account and executable so no app can reach another's, and service answers arrive as one read-only tree (wol_info_).
  • libwol 1.5: file panels (wol_panel_open, wol_panel_save). The person picks, and the app gets that one file already open, never a path.
  • libwol 1.6: battery and Low Power Mode facts (wol_power_copy_info), and wol_power_keep_awake, which lasts as long as the app does.
  • libwol 1.7: whether the computer is online and over what (wol_network_copy_info), never an address or a network name.
  • libwol 1.8: read the volume and what is playing (wol_audio_copy_info) and change the volume or mute (wol_audio_set_volume, wol_audio_set_muted), behind separate permissions.
  • libwol 1.9: apps search apps and Settings pages, and with permission add rows to Search, which sees each row's app from the kernel.
  • libwol 1.10: apps read the name of the account running them, and only that one.
  • libwol 1.11: apps of one account send each other messages through wold, with a grant per peer app; the receiver sees the sender as the kernel does.
  • libwol 1.12: apps list devices and, with a grant per device, get a USB device opened by wold; keyboards, disks and hubs are never handed out.
  • libwol 1.13: apps offer text; the person sees it and chooses to copy it, save it or cancel.
  • libwol 1.14: apps run parts of themselves as services under wold, as the account and only as their own executable.
  • Search finds files and folders by name under your home folder (hidden folders and build output left out; the list is refreshed at login, hourly and when Search opens), finds every Settings page by its name or words ("dark", "menu bar"; "Menu Bar & Dock" and "Hardware" opened Appearance), and with nothing found says "No results for “…”" and offers Search the web.

0.11.2

  • Helium is the default browser (Chromium based; package helium-browser from the official release, signature checked at build): Dock, Search web search, default apps for web links and pages, privacy defaults (no usage reports, surveys or sign-in prompts), video decode on the GPU. Firefox stays in the App Store.
  • WolKernel 1:1.0+7.3-2: services with a syscall filter no longer log an audit warning on every boot when audit is on. WolOS boots with audit=0 (it ships no audit tools or audit-based security module).
  • libwol, the app API (ADR 0020, archicture/modules/abi.md): wol.h and libwol.so.1 for apps in any language, with a stable C ABI (versioned symbols; a test fails on any removed or changed symbol or declaration). First calls: version, errors, strings, an event loop any language can drive (fd + dispatch) with subscriptions to system events, system facts (OS, kernel, appearance, accent), posting notifications, and window content built from stacks, labels and buttons with click callbacks. The desktop draws app windows with Kit parts and shows app notifications as banners, with their buttons. Apps ask WolOS for services; WolOS checks the app's permission, and Settings > Privacy & Security lists and switches Notifications like the other permissions. No telemetry: libwol talks only to WolOS itself.
  • libwol 1.1: rows, lists, spacers, text fields, toggles, sliders and images; changing a part's text or value redraws its window; apps hear when the person edits, toggles, slides or closes; notifications with up to three buttons, and a pressed button reaches only the app that posted it. Apps built for 1.0 keep working unchanged.
  • Lua desktop widgets (runtime): one .lua file (layout, data, refresh, click handlers) becomes a Kit view tree, reloaded when the file changes; an example Clock ships with it. Scripts run sandboxed (no files, programs or network) and reach only the services they declare. The desktop runs them from ~/.config/wolos/widgets/ (wol widgets add lua:clock), on the same calm timer as the other widgets.
  • Package mirrors (ADR 0019): [wolos], then [wolos-cachy] (x86-64-v3 builds of the same Arch versions, frozen at each release, on only on CPUs that run them), then Arch at the release date. wol mirror status|rank|gate|kernel; wol update moves all three repos together.
  • One picture from power-on to the desktop (ADR 0012): the WolOS mark replaces the loader's kernel splash, boot text never reaches a video console (rc.d wolos_quiet; serial consoles stay readable), every compositor starts black and every first window fades in from black and out to it. One account: its session starts directly behind the lock screen (no login window hop). The Hyprland fork hides the desktop under a lock taken over at boot or after a crash; wol-lock respawns a crashed lock screen and never unlocks on its own; Ctrl+Alt+Fn cannot show a console. The start-up lock opens the login keyring. grep wolos-boot /var/log/messages lists each boot stage with its time. If passwords can't be checked, the lock screen says so and offers Restart.
  • Setup Assistant, redone (ADR 0013): the Welcome art, then four questions on one card each: Language & Region (language and keyboard on one page, guessed from the time zone and console keymap; the keyboard applies at once, so the password is typed on it), Wi-Fi (scanned by wol-login, skipped on a wired machine, a wrong password says so), Create Your Account (full name fills the account name; colour for the avatar; administrator with zsh and sudo), Appearance (Light, Dark or Auto, and three looks), then You're All Set and Get Started fades into the desktop. Return continues, Escape goes back; every problem is one sentence on the page that has it.
  • Install WolOS is an app (ADR 0013): pick the disk by name and size, a clear erase warning, Erase and Install, progress with the Pocket Watch, the step it is on and the time left (the screen stays on and closing the lid does not sleep the machine meanwhile), then Restart into Setup. It runs the boot menu's installer without a terminal or a password (the live user may run libexec/wolos/install-run with sudo): GPT with EFI and BIOS boot, ZFS with boot environments, the system, the boot loader, the apps. Each step reports wolos-install: <stage> <percent> <message>; a stop says where it stopped, cleans up and offers Try Again.
  • Error copy in one place (shell::copy, archicture/modules/ux-journeys.md): every failure sentence says what happened and what to do; tests/copy_lint.rs bans raw error text (errno, exit codes, paths, program names, "failed") and {e} outside logs. Fixed: Software Update said "Make sure pkg is installed"; App Store said "X was not installed. The change did not work"; auth messages without a full stop.
  • Wi-Fi join (FreeBSD) waits up to 20 s for the network instead of reporting success after wpa_cli reconfigure: a refused password is WrongPassword ("“Home” didn't accept that password. Check it and try again."), not a false "Connected" or the administrator sheet; a password of the wrong length says "8 to 63 characters".
  • App menu: Force Quit <App> ends every window of a frozen app (Hyprland killwindow; wol-app force-quit).
  • Licenses: BSD-2-Clause by default, crates/shell GPL-3.0-or-later, brand art and screenshots CC BY-NC-ND 4.0 (COPYRIGHT). © 2026 Julia Klee.
  • Dock apps are real: Files (Nautilus), Mail (Geary), Music (Amberol), Photos (Shotwell), Calendar, Notes (Gnote), keeping WolOS names and icons; Trash opens in Files. Running dots and the menu bar name follow each app's window class; Apps lists each pinned app once. Also shipped: Calculator, Clocks, Papers (PDF), Celluloid + mpv, File Roller, Disk Usage, default file-type apps (mimeapps.list, Firefox for the web). 71 packages, 689 MiB installed (archicture/modules/userland.md); Weather is the desktop widget, not an app.
  • Administrators can use sudo (/usr/local/etc/sudoers.d/wolos). Accounts made in Settings get the same groups as the Setup Assistant's (administrators: wheel, video, operator; standard accounts: video).
  • Themes: 13 new (Matte Black, Jade Horse, Ristretto, Flexoki Light, Ethereal, Hackerman, Vantablack, White, Miasma, Lumon, Lupine, Retro 82, Solitude). Every theme passes a stricter contrast check: text >= 4.5:1 on windows, cards and sidebars, secondary text >= 3:1. Accent and status text in apps is darkened or lightened until readable.
  • One look across apps, switched live: Helium (GTK mode, light/dark and accent from the system), Firefox (toolbar, tabs, address bar, menus, new tab; window buttons on the left), GTK 3 apps (colours are now a GTK theme, so open windows restyle on a switch), Text Editor and other GtkSourceView apps (generated light/dark schemes), zsh prompt colours. GTK 3 CSS no longer uses GTK 4-only properties (Firefox logged a parse error).
  • zsh for every new account (Setup Assistant, Settings > Accounts, live user; root keeps /bin/sh for recovery): system zshrc with autosuggestions, syntax highlighting, extra completions, shared history, case-insensitive menu completion, Home/End/Delete/Ctrl-arrow keys, colour ls, and a pure-zsh prompt (ready in ~30 ms with all plugins, no zsh setup wizard; theme colours from ~/.config/wolos/toolkits/zsh/colors.zsh). Your ~/.zshrc is never touched.
  • First session creates Desktop, Documents, Downloads, Music, Pictures, Videos; the login keyring unlocks with the login password, so Mail and Calendar do not ask.
  • Printing (CUPS + driverless network printers via Avahi) and USB sticks (FAT, exFAT, NTFS) under /media, writable by WolOS accounts.
  • wol-admind starts at boot (wold job org.wol.admin): on the image it was never started, so every administrator action (Settings, Control Center, wol hw fix, updates) failed.
  • App Store is in the image: wol-store installed, a Dock tile before System Settings, "App Store…" in the WolOS menu, and .wol files open in it.
  • Control Center: Screenshot and Record tiles open the capture toolbar (they ran wol capture, which does not exist; Record opens it in record mode, wol shell show screen-record). New detail pages: Bluetooth devices (power, connect/disconnect paired devices), Sound output picker, Focus (Do Not Disturb, for 1 hour, until tomorrow morning; banners stay quiet, the menu bar shows the moon). Now Playing shows cover art, previous/next and progress (playerctl). Battery module with time remaining and Low Power Mode (power-profiles-daemon; FreeBSD: powerd flags through wol-admind power-mode). Keyboard Brightness and Accessibility shortcuts (Reduce Motion, Increase Contrast, Zoom) as optional modules; Settings picks modules (control_center in shell.json). Night Shift shows only while hyprsunset runs. FreeBSD menu bar: battery from hw.acpi.battery, wired/Wi-Fi state from the default route.
  • Hardware (archicture/modules/hardware.md): one catalogue picks driver, firmware, packages and loader lines per device (CPU, GPU, Wi-Fi, Ethernet, Bluetooth, audio, webcam, I2C touchpads, card readers, backlight). wol hw lists devices and their state (ready, needs driver, needs firmware, unsupported) with a one-line hint; wol hw status shows problems only; wol hw fix loads missing modules through wol-admind (hw-load, catalogue modules only) and installs missing packages with --yes. New rc.d wolos_hw (before netif) runs wol hw boot every boot: loads the modules, writes next-boot loader lines (early CPU microcode, RTL8125/8126 driver, NVIDIA modeset) and publishes /var/run/wolos-hw.json; wolos_wifi and wolos_gpu no longer pick drivers, and machines without Wi-Fi skip the 10 s wait.
  • Offline repo adds CPU microcode (Intel 31.5 MB, AMD 0.6 MB), Bluetooth firmware (Intel, Realtek, Broadcom), RTL8125/8126 Ethernet, USB cameras (webcamd, started on plug-in, /dev/video* for group video) and PipeWire on sound(4); all GPU firmware comes with drm-kmod. NVIDIA is detected and installed online (~520 MB).
  • powerd runs only where cpufreq can steer the CPU (not with Intel HWP or in a VM, where it failed at boot); wol hw boot alone decides (rc.conf no longer enables it). wol sys hw gives the hardware list as a System API topic. ntpd refreshes the leap-second file and re-resolves its pool once DHCP has a lease. Desktop tunables, each commented: scheduler preemption threshold 224, user mounts, no keyboard debug keys, cuse at boot.
  • Low Power Mode works on Speed Shift CPUs (powerd off there): wol-admind power-mode sets the energy preference on every CPU (dev.hwpstate_intel.N.epp, kept in /etc/sysctl.conf.local) and the powerd flags only where powerd runs; the switch reads the preference first and hides when there is nothing to steer.
  • wol-admind verbs for System Settings: ntp, hostname, remote-login (sshd), firewall (pf with /usr/local/share/wolos/pf.conf: block in, pass out; ping, DHCP, IPv6 neighbours, mDNS), lid, printer-add|remove|default, consent (compositor grants), bt-pair|forget, wifi-forget. Services start or stop only when not already so; Controls::admin_request sends any of them.
  • Desktop widgets (ADR 0010, archicture/modules/widgets.md): Clock, Calendar, Weather (Open-Meteo, a city you pick by name), Music (Now Playing), Batteries and System, each in small, medium and large, on a grid above the wallpaper. Right-click the desktop for Edit Widgets: a gallery with real-size previews and Add Widget, drag to move, minus to remove; right-click a card for its size and options. Build your own from a folder with a widget.json layout of the same Kit parts and a script that prints data: wol widgets validate names each problem and every empty binding; a broken widget shows one sentence and Show Details, never a blank card. wol widgets list|add|remove|reload. One timer wakes every widget together, music and batteries follow D-Bus events, and nothing runs while a window is fullscreen.
  • Helpers ask before they change anything (archicture/modules/automation.md): when wol mcp clients or WOL_HELPER scripts change a setting, wol-shell shows a sheet with who asks and what will change, in plain words: Deny, Always Allow (per helper and kind of change, journaled; wol helpers forget <helper>), Allow Once. Administrator changes ask for the password every time and run in the shell, never in the helper. Requests queue (4 waiting at most); no answer in 50 s is a no; without a session nothing changes. One audit record per call.
  • .wol app packages (ADR 0011, archicture/modules/packages.md): one file holding Info.json, a pkg(8) package and a SHA-256 manifest, signed with Ed25519. wol install <file.wol|app|package>, wol remove, wol list, wol search (App Store catalogue and the package index), wol update apps. wol-admind wol-install verifies its own copy, installs dependencies from FreeBSD pkg and pkg adds the payload after a restore point; an unsigned package needs the password every time, a bad signature or hash is refused. wol-remove deletes the package and dependencies nothing else uses. Packages and the index come from github.com/wonderlandos/wol-packages.
  • WolKernel (kernel/README.md): the kernel is named WolKernel in uname -i, About and the boot menu; uname -s stays FreeBSD (pkg ABI, ports, Linux ABI). Config is GENERIC plus HZ=1000 (VMs default to 100) and no debug options, one reason per line. kernel/check.sh dry-runs the build on any host; an extra patch that does not apply now stops the kernel or DRM build (exit 3) instead of being skipped.
  • Wi-Fi (archicture/modules/wifi.md): MediaTek MT7921/MT7922 driver built with WolKernel (802.11a/b/g; not yet run on the card). Qualcomm ath10k/ath11k/ath12k and MediaTek MT7925 have no working FreeBSD 15.1 driver: their firmware is no longer shipped and wol hw says why. The Wi-Fi doc lists the link each card gets.
  • NVIDIA (archicture/modules/hardware.md): driver 595 for Turing and newer, 580 for Maxwell/Pascal/Volta, Kepler reported unsupported with the reason. First boot installs it online and loads it with modesetting (wol hw boot --online; tunables set with kenv before the module loads), so the first login already runs on it. The session names only installed NVIDIA libraries (GBM, GLX, VA-API nvidia-drm; was nvidia, a driver that does not exist); wol-realtime gpu offload prints one app's PRIME offload environment; render nodes are matched to GPUs by PCI id, so driver load order no longer swaps them. Not yet run on NVIDIA hardware.
  • wol about reports the kernel (kern.ident) and the base (FreeBSD 15.1-RELEASE-pN) separately.
  • Apps look like WolOS apps (archicture/modules/app-theming.md): Files, Calendar, Calculator, Clocks, Papers, Disk Usage and Text Editor get the Kit toolbar (52 px glass bar, 13 px semibold title, 24 px controls), a source-list sidebar with the accent pill, 10 px cards with hairlines, segmented view switchers, glass menus, popovers and sheets, in every theme, light and dark. Metrics come from one place shared with the Kit (shared::theme::scaffold). Window buttons are 12 px circles 22 px apart, first centre 23 px from the window edge in GTK 3, GTK 4, Firefox and the title bar (GTK 3 had 28 px). The accent replaces libadwaita's blue palette too (Clocks, Calendar). Files selects with the accent; Calculator has card keys; Text Editor's bar is 52 px like the rest. GTK 3 apps (Mail, Photos, Notes, Archive Manager) get the same 52 px bar, accent sidebar pill, accent selection and 6/10 px radii. Firefox hides the bookmarks toolbar by default.
  • Games (archicture/modules/games.md): Steam is in Apps, Search and the App Store, and steam:// links open it. Its first start says "Getting Steam ready" while the Steam client downloads (linux-steam-utils), then Steam's own updater runs. In a game's Properties > Compatibility, "WolOS Proton (native wine-proton)" runs Windows games on wine-proton, a native FreeBSD Wine, with DXVK, vkd3d-proton and dxvk-nvapi from an installed Proton of the same version; only the Steam client uses the Linux ABI. wol games doctor checks the Linux ABI, linux-steam-utils, wine-proton, 32-bit support, Vulkan, NVIDIA and DXVK and prints the exact fix for each problem; wol games steam-setup writes the tool. Double-clicking a .exe or .msi runs it on wine-proton in its own prefix (wol-run --exe). The image turns on what the Steam client checks (unprivileged chroot, real interface names, nullfs). .wol Proton targets no longer require the Linux ABI. Not yet run on real hardware.
  • Super is Command (⌘), as on a Mac (desktop/README.md): ⌘C/V/X, ⌘Z/⇧⌘Z, ⌘A/S/O/P/F/G/T/W/N/R/L and ⌘+/−/0 reach the app in front as its own Ctrl key (a terminal gets Ctrl+Shift+C/V, so ⌘C never interrupts a running command; ⌘W closes a terminal without tabs). Held keys repeat. The Hyprland fork sends these keys in any layout and puts the held modifiers back (patch 0006). System shortcuts are the Mac ones: ⌘Space Search, ⇧⌘3/4/5, ⌃↑ and ⌘↑ Overview, ⌘Tab, ⌃⌘Q lock, ⌥⌘Esc Force Quit Applications (pick an app, Force Quit), ⌃⌘Space Emoji & Symbols, ⌃F2 and ⌃F3 put the keyboard in the menu bar and the Dock (Esc gives it back). No system shortcut takes a plain ⌘ letter any more (Control Center, Notifications, Files, light/dark and lock had ⌘A/N/E/⇧T/L; tiling float is ⌥⌘F). Settings > Keyboard Shortcuts lists the App commands group.
  • Notification banners leave with Esc or a swipe; Esc closes Notification Center. Banners show an app's buttons (two at most, e.g. Restart after a driver install) and stay until one is chosen; a click on the banner runs the app's default action. System notices carry the WolOS mark.
  • wol wallpaper set and Settings change the desktop picture at once (the desktop showed one fixed picture); Dynamic follows the time of day.
  • Screenshots (⇧⌘3/4) are saved to the Desktop; the banner says "Screenshot saved to Desktop" and shows the picture instead of its path.
  • Power follows the power source (ADR 0014, archicture/modules/power.md): wol power apply runs on AC changes (devd), at boot and after resume. It picks the Speed Shift preference per CPU, the powerd flags only where powerd runs, the deepest idle state, and Wi-Fi power save on battery. Low Power and High Power Mode override it (wol power mode auto|low|high). On battery the display turns off after 2 minutes and the computer sleeps after 10. Every sleep locks first. PCI devices without a driver are powered down.
  • Restart, Shut Down and Log Out ask first, with a 60 s countdown. Sleep, Restart and Shut Down work for standard accounts too: the account at the computer needs no password, unless another account has a session. Notifications appear at 20, 10 and 5 % battery, and at 3 % the computer sleeps. A notification appears when the startup disk is under 5 % free.
  • Wi-Fi join and forget, Wi-Fi and Bluetooth power, pairing and the power mode need no password for the account at the computer (logged in the audit log). Hidden networks can be joined. Network names and passwords may contain quotes and backslashes.
  • On by default (ADR 0015, archicture/modules/security.md): the firewall (inbound blocked except replies and local discovery), no remote login, the system log off the network, and kernel hardening (other accounts' processes hidden, kernel messages for root only, no hard links to others' files, random PIDs). The compositor refuses direct screen copy, cursor position and input capture to apps, and loads plugins only from the system folder. wol security and wol firewall on|off|status.
  • Updates are checked daily in the background (packages, known vulnerabilities, FreeBSD fixes) and only downloaded. One "Updates Available" notification per check says when security fixes are included. Update Now installs FreeBSD fixes and packages after a restore point. FreeBSD's updater never replaces WolKernel. wol update status.
  • Encrypted homes (off by default): each account can have its own encrypted ZFS home, opened at login with the login password and locked at logout.
  • System Settings, complete: 24 panes in six groups with search (Wi-Fi, Bluetooth, Network, Notifications, Sound, General with About, Software Update, Storage, Date & Time, Language & Region, Login Items and Sharing, Appearance with every theme as a preview card, Accessibility, Control Center, Desktop & Dock, Displays, Wallpaper, Effects & Looks, Widgets, Battery, Lock Screen, Privacy & Security, Users & Groups, Keyboard and Keyboard Shortcuts, Trackpad & Mouse, Printers, Hardware, Assistants & Automation, Restore). Effects & Looks shows a live picture of the desktop and Looks that set every effect at once (WolOS, Compact, Focus and more; import and export your own; Custom once you change one), then each effect on its own: corners, space around windows, blur strength and quality, glass, window opacity, border width and gradient colours, shadows, dimming, open and desktop animations and their speed. Changes apply at once, and heavy blur on integrated graphics gets a quiet hint. Every change from Settings is journaled: a toast offers Undo right away, and Restore lists recent changes (with who made them) and restore points to start from. Hardware lists each device with its driver and fixes what is missing in one click. About names WolKernel and the FreeBSD release. Controls without a working backend are not shown.

0.11.1

  • Login window and Setup use the GTK cairo renderer (no GPU renderer dependency before login); wol-shell stderr goes to $XDG_RUNTIME_DIR/wol-shell.log; the console no longer forces 1920x1080 (panel native mode).
  • Wi-Fi (archicture/modules/wifi.md): offline repo ships Intel iwlwifi (7000..sc, incl. ax210 for ADL CNVi 8086:51f0), Realtek rtw88/rtw89, Qualcomm ath10k/ath11k and MediaTek mt7921/7925 firmware (~21 MB). New rc.d wolos_wifi (before netif, every boot): loads the driver for the wireless NIC present, creates wlan0 on the first net.wlan.devices entry, creates /etc/wpa_supplicant.conf if missing and sets ifconfig_wlan0="WPA DHCP" if unset, so Setup Assistant and Control Center Wi-Fi have an interface.
  • First real-GPU session fixes: GTK apps use the cairo renderer (GSK_RENDERER=cairo; the default renderer never mapped the shell, Setup or login windows on the passthrough iGPU); foot config uses [colors-dark] (foot 1.28 rejects [colors]) and JetBrains Mono; fontconfig maps monospace to JetBrains Mono (it resolved to Font Awesome).
  • Login and Setup screens: no Hyprland banners (guiutils missing, launched without start-hyprland); seen on the first real-GPU boot.
  • Installer never offers the boot media: libexec/wolos/install-disks skips disks holding ufs/FreeBSD_Install, iso9660/WOLOS or a Ventoy stick (msdosfs/VTOYEFI), plus cd/md (the Ventoy stick was eligible).
  • Live ISO (ADR 0009): the default boot is the WolOS desktop, autologin as live, all writes in memory (rc.d wolos_live: tmpfs unionfs over /etc, /usr/local/etc, tmpfs /home). "Install WolOS" in the dock runs the unattended installer; the old installer console needs set wolos.install=1 at the loader prompt.
  • wolos_gpu: a panel backlight left at 0 after the driver loads is raised to 80 (passthrough boot ran the whole desktop on a dark panel); a non-zero level is never changed.
  • i915 fork patch 0002: when no VBT is found (firmware param, OpRegion, ROM), i915 loads /boot/firmware/i915/vbt.bin if present. A VFIO-passed-through laptop iGPU gets no OpRegion under OVMF, so the eDP panel stayed black; copy the host VBT (/sys/kernel/debug/dri/*/i915_vbt) there. Real hardware never reaches the fallback.
  • Compute and power limits (archicture/modules/intel-graphics.md): wol-realtime power show|set --pl1 W --pl2 W reads/writes Intel RAPL package limits (MSR 0x610; refuses a locked MSR). vkpeak ships for Vulkan compute and GPU bandwidth peaks (no Intel OpenCL runtime on FreeBSD). verify-gpu.sh runs it and A/B's PL1 firmware vs 15 W.
  • Memory bandwidth (ADR 0007 accepted, archicture/modules/memory-bandwidth.md): wol-hypr records every frame (time, damaged px) in a realtime ring; wol-realtime hypr stats prints p50/p95 µs, damage %, full-screen frames and derived bytes/frame. wol-realtime gpu caps|sample prints GPU freq range, FBC state and RAPL graphics energy (i915: lindebugfs + cpuctl; other drivers: nulls). Firefox decodes video with VA-API by default.
  • i915 driver fork (ADR 0008, kernel/drm): drm-kmod drm_v6.12.85_3 + patch: a request still running at its vblank deadline is boosted (set_deadline), waitboost only for the frontmost process (compat.linuxkpi.i915_wol_waitboost=2, pid from wold). Ships as drm-fork.tar over pkg drm-612-kmod (locked). verify-gpu.sh gains A/B runs (waitboost, deadline boost, INTEL_DEBUG=noccs) with RAPL watts per side.
  • build-in-vm: copy-back is resumable and sha256-verified (image/vm/fetch.sh; a 3.5 GB ssh cat once stopped at 2.8 GB).
  • Menu bar with no focused window shows no app name and no app/Window menu (was "Files", an app that was not running). Switcher fails closed: it does not open when the compositor does not answer or no window is open (drew "No open windows" over an open window when the Hyprland query failed).
  • Intel graphics (archicture/modules/intel-graphics.md): the offline repo ships i915 DMC/GuC/HuC firmware (gpu-firmware-intel-kmod-alderlake, tigerlake, rocketlake, meteorlake), VA-API iHD (libva-intel-media-driver), vulkan-loader and proof tools (mesa-demos, vulkan-tools, libva-utils, glmark2, vkmark). /boot/loader.conf.d/wolos-i915.conf pins the i915 "unsafe" params at driver defaults (GuC off: FreeBSD shutdown hang). wol-session now sources wol-realtime gpu env (AQ_DRM_DEVICES; LIBVA_DRIVER_NAME=iHD on i915/xe). image/hw/verify-gpu.sh (also /usr/local/libexec/wolos/verify-gpu.sh) writes the native-boot report to /var/log/wolos-gpu-report.txt. test-install.sh uses a scratch install.raw and never deletes a kept disk.raw.
  • wol-run: Proton output redirected to a file was lost (Proton ntdll closes seekable std handles). Proton targets now relay seekable stdout/stderr through pipes (tests/relay.rs). image/vm/test/compat.sh --iso packs the compat run for the installed disk.
  • Icons: no SVG <filter> in design/icons (grey shadow box behind Files/Notes in GTK, Qt, Firefox). App icon depth is baked as offset translucent copies (design/tools/gen.py); store icons stripped with design/tools/nofilter.py; tests/icon_filters.rs guards it. Avatars are fixed squares centred in their row (were 32x40 pills); the layout check fails any non-square .avatar.
  • Performance (archicture/modules/performance.md, design/tools/perf): status refresh is 1 s only while a panel watches, else 10 s with 60 s TTLs (wol-shell idle 0.27 ms/s, 1.8 wakeups/s); volume keys run wol shell show osd, which reads audio on demand; Control Center is a resident shell panel (wol shell toggle control-center, Super+A; 27 ms to frame, no growth over 200 opens); vendored blocking 1.7.0 lets idle pool threads exit (ADR 0006); wolos-perf.conf moved to the overlay and is now sourced; wol shell spawns write the shell socket directly; WOL_SHELL_TIMING adds dock/wallpaper map and Search per-key times.
  • Menu bar: placeholder File/Edit/View/Go/Help menus removed. The bold app menu has About <App> (shell panel), Settings… (apps that open preferences on Ctrl+,), Hide <App> Super+H, Hide Others Super+Alt+H, Quit <App> Super+Q; the Window menu has Minimise Super+M, Zoom, Fill, Centre, Move to Desktop 1-4. All of them run wol-app <verb> (new binary), and the keybinds call the same verbs (Super+Q now closes every window of the app, Super+H hides all of them).
  • No Hyprland nag banners: wol-session launches start-hyprland (watchdog); fork patch 0003 drops the .conf deprecation notice; misc:disable_hyprland_guiutils_check (guiutils is not shipped). WOLOS_SHARE overrides the defaults dir (live tests).
  • Fork patch 0004: Hyprland advertises minimise, and a client's minimise button moves the window to special:hidden (libadwaita drew it disabled). wol-hypr raises the window that becomes active (switcher and menu focus left floating windows behind).
  • Live fixes, title bars and window placement (Hyprland 0.56.2 + hyprbars 7644cec): traffic lights now close/minimise/zoom left to right in kit colours, 12 px, centres 22.5/44.5/66.5 px (were green-yellow-red, 20 px apart); double-click on the title zooms; GTK CSD apps (no xdg-decoration) are tagged wol-csd by wol-hypr and get no hyprbars bar (was a double title bar); new floating windows are placed by wol-hypr after the layout pass (centred, 1/3 down the area between menu bar and dock; the move rule is gone); open/close animations use the realtime curves (220 ms ease-out, 180 ms ease-in, no spring overshoot); the Settings window is named "System Settings" in the menu bar and marks its dock pin running (pin id is now org.wolos.settings).
  • Live fixes, screenshot: bar bottom-centre and thumbnail bottom-right (anchors were left/bottom-left); wol-screenshot keeps wl-copy off stdout (the shell waited forever and never showed the thumbnail); capture waits 150 ms and the bar/thumbnail have no fade-out, so neither lands in the shot; Return captures.
  • Live Hyprland 0.56.2 fixes: wallpaper and Overview span the whole output (exclusive zone -1); blur layer rules match the real namespaces (^(wol-menubar|wol-dock|wol-panel-.*|...)$, ignore_alpha 0.3); menu bar shows the focused app on shell start; switcher hides before focusing (Hyprland refocused on unmap); wol shell accepts overview, screenshot, switcher-prev (panel list now shared::shell::PANELS); Overview thumbnails per window via wol-window-shot (hyprland_toplevel_export_v1).
  • One look for every app: wol theme set (and Dark Mode / Appearance in the shell) regenerates GTK4/libadwaita CSS variables, GTK3 adw-gtk3 colours, qt6ct Fusion palette and foot colours from the active theme into ~/.config/wolos/toolkits, links them from ~/.config (never over user files) and pushes gsettings (color-scheme, accent, Inter, left window controls). Defaults ship in /usr/local/share/wolos. Firefox policies.json: no telemetry/studies/sponsored home, follows the system theme.
  • Notification banners: 344 px glass cards top-right with app icon, app name + time, bold title, body clamped to 2 lines; slide in from the right; one banner per app with stacked edges and "N more notifications".
  • Screenshot toolbar (Super+Shift+5): glass bar with Capture Entire Screen / Window / Selection, Record Screen / Selection (wf-recorder, now in packages.txt), Options (save to Desktop or Pictures, 5/10 s timer); a 5 s thumbnail bottom-right opens on click and drags as a file. wol-screenshot gains window, record, record-region, stop, --dir, --delay and prints the saved path; old full|region|clip unchanged.
  • Overview (Super+Up, 3-finger swipe up): wol-shell overview surface with blurred wallpaper, desktops strip and an aspect-preserving window grid with grim thumbnails (ADR 0005; hyprexpo is not in the plugins pin).
  • App switcher (Super+Tab): glass strip of 64 px app icons grouped by class in MRU order, accent ring + name on the selection; Tab/Shift+Tab cycle, releasing Super focuses (show switcher|switcher-prev, hide switcher).
  • Lock and login window: blurred WolOS wallpaper (night in dark, day in light), 200x28 glass password pill with submit arrow, shake + message on failure. Login window: user tiles, Back, Sleep/Restart/Shut Down.
  • Notifications: zbus connection kept; NotificationClosed emitted on expiry (1), click dismiss (2) and CloseNotification (3), once per id.
  • wol-shell startup: product icon theme pinned (WolOS, Adwaita in dev) instead of the host user's; app icon textures cached; WOL_SHELL_TIMING=1|exit prints stage times. First map median 233 -> 122 ms (10 runs, release, broadway).
  • Lock/login light mode: dark ink on the day wallpaper; pill, placeholder, error (13 px medium) and captions meet 4.5:1, measured from golden pixels.
  • Login window Sleep/Restart/Shut Down go through wol-login (!sleep|!restart|!shutdown, ADR 0003); wire in shared::login.
  • First boot: wol-login runs the setup assistant (wol-setup) when no user exists; !setup-create-user, !setup-wifi (ADR 0004). firstboot no longer prompts for a user in bsddialog.
  • wol-setup: setup assistant UI (Welcome, Language & Region, Keyboard, Wi-Fi, Account, Appearance, Done); goldens at 1280x800 and 1024x640.
  • Setup assistant polish: content-sized 560 px cards, 36 px rows showing whole rows (layout check flags cut rows in whole-rows lists), Wi-Fi signal/lock icons, accent avatar above the fields, per-field problems, Done without Back.
  • First session applies setup.json keyboard; Auto appearance follows time of day (dark 19:00-07:00); setup writes the user theme for Light/Dark; login window shows the password hint after 3 failures.
  • shell --features layer-shell needs gtk4-layer-shell >= 1.2.
  • App switcher: glass strip of 64 px app icons grouped by class in MRU order (Hyprland focusHistoryID), accent ring and name on the selection; Super+Tab / Super+Shift+Tab cycle, releasing Super focuses. Socket: show switcher|switcher-prev, hide switcher commits.

0.11.0

  • Rust workspace (ADR 0002): shared contracts (QoS ABI, jobs, admin wire, theme tokens, bundle Info.json, events, error codes, sys, par), core (System API, theme, jobs, admin, bundle, update), api (wold, wol-admind, rc.d), controller (wol, wol-login, wol-authcheck), proxy (wol-run), realtime (wol-realtime: Hyprland IPC, event bus, QoS boost, GPU env, C ABI for plugins/wol-hypr).
  • Architecture test enforces shared <- core <- adaptors.

0.10.0

  • Initial monorepo: identity, desktop overlay, image build.