Notes from building an ultralight, secure OS for SI: verified boot, atomic updates, KyberCells, keyboard-first defaults and the hardware it runs on.
Agent loops with people at the decision points are coming to bookkeeping and purchasing. They will land on machines with no admin, so the system must supply the conditions.
Kyber is a Linux block I/O scheduler built for fast SSDs and NVMe. How its latency targets work, how to switch to it and when mq-deadline, BFQ or none is the better choice.
NVIDIA's reference architecture for agent security names Canonical, SUSE, Red Hat and Windows, not Debian. What that says about choosing a base for agents.
When SI agents are first-class users, logs are an interface for them and evidence for people. How one log serves both readers, and what must never be in it.
Build your own deck means hardware the OS authors never tested. How an opinionated system handles unknown boards honestly, and what it refuses to ship.
XREAL Aura puts a full Android computer with ADB in your pocket. Debug access is real openness, but it is not ownership. Here is where the line runs.
Android XR runs on the Linux kernel, like every Android device. The kernel is the smallest part of what you trust when an assistant sees through your glasses.
An agent that reads the web while running as you can reach everything you can. A KyberCell is the system's answer: fixed files, closed network, every step logged.
A system that leaves every choice to you spends your first week on setup and leaves your assistant guessing. Decisions written down help people and SI alike.
Work that leaves your device usually lands on a system you cannot see. A KyberFusion node runs the same KyberLinux you carry, so the rules travel with the job.
A single-board computer in a drawer could be a private node for your assistant. What usually stops it is the system, not the hardware. Here is what changes that.
A band on your wrist, a node on a shelf, a robot and a cloud node usually run four different systems. Here is what that costs, and what one base changes.
A distribution built to run everything is a poor foundation for a machine that runs one thing. The cost is not disk space — it is patching, auditing and blast radius.
A read-only root and a verified boot chain are not exciting features. They buy you the ability to know what is running, which turns out to be everything.
On battery-powered and fanless hardware, watts spent by the system are watts not spent on the model. Idle draw is a design decision, not an accident.
A package update that fails halfway leaves a machine in a state nobody designed. When the machine is a robot in a warehouse, that is a van and an afternoon.
Open source tells you what the code says. A reproducible build tells you that the binary you are running is what the code says — which is a different claim.
