§9a. PlanarianOS (Phase C)
planarian @ a924e09 · Spec v4.6 · snapshot main · all versions
PlanarianOS is a NixOS distribution in which Planarian governs the machine from first boot. It exists for the guarantees a module installed on an existing machine cannot make: no older, unmonitored generations in the boot menu; a boot chain locked from install (Secure Boot with a signed unified kernel image via Lanzaboote, bootloader editing disabled, TPM measured boot where available); failure posture and the first administrator set before anyone logs in; a known starting configuration against which catalog coverage is measured; and Planarian-native defaults (hash-chained journal from the first boot, sandbox tier where KVM exists, no out-of-band rebuild path in the default configuration). Planarian also remains installable as a module on any NixOS.
| Profile | For | Default posture | Includes | Leaves out by default |
|---|---|---|---|---|
| Agent host | Machines that agents operate | Guarded | Sandbox tier, journal export, capability-scoped agent principals | Desktop, local model |
| Server / fleet node | Unattended servers and edge devices | Sealed | Signed external desired state, signed health reports | Desktop, local model |
| Personal | Desktops and laptops, including remotely administered ones | Standard | COSMIC reference desktop, optional console, quiet mode, model residency, Flatpak, remote administration | — |
Gates (GC), per profile. Agent host: an agent holding a user account completes a scripted set of real administration tasks; zero unsafe changes reach the real machine; every change attributed; every Tested change carries a passing sandbox run. Server: unattended under the full fault catalog for a set period; every fault repaired or escalated; every posture response verified by injection. Personal: a person new to Linux installs it and completes common tasks (connect to Wi-Fi, change display scaling, install an app) through whichever frontend the profile ships; catalog coverage above the owner-set threshold (set after the first catalog survey); invisibility budget met.
Accounts. The everyday login is a user account with no administrator authority, never shown an AskFirst prompt it cannot answer. Administrator authority is a capability, grantable to a local account, to a remote principal, or both (I17: the set is never empty). The installer creates the first administrator, then an everyday account, and says plainly that the everyday account is the one to use daily. An administrator may drop the capability only while another remains. Lost-administrator recovery requires physical presence: a local session (in E, the secure attention key).
Live mode. A live image has no generations: planariad runs with max_tier = Runtime and reports “no baseline,” and every frontend says so. The live image is also the gym’s VM image.