Engineering roadmap
Development roadmap & milestones
A transparent ledger tracking all 13 phases of Snigdha OS Decentralized development — from base kernel initialization to independent security audits and public release.
Phases 0 through 9 verified in codebase
Phase 10: Update, Recovery & Lifecycle
Independent audit & public 1.0 release
- Verified0
Phase 0 • Baseline Kernel
Foundation & Bootable Live ISO
Minimal bootable x86_64 ArchISO baseline image with unprivileged build root and reproducible build harness.
Key deliverables
ArchISO 92-1 configuration treeLinux LTS kernel integration (6.18.62-1-lts)Unprivileged user-namespace build scriptAutomated Makefile build harnessEvidence: Bootable ISO generated with volume label SNIGDHA_DEC.Read documentation - Verified1
Phase 1 • Everblush Workspace
i3wm Desktop Foundation
Lightweight, keyboard-driven i3 window manager with Picom blur compositor, Polybar system tray, Rofi launcher, and Everblush color palette.
Key deliverables
Modular i3 configuration with strict keybindingsEverblush GTK-2.0, GTK-3.0, and GTK-4.0 theme stylingPolybar security monitors for Tor, Amnesia, and PersistenceDedSec GRUB2 bootloader theme with customized artworkEvidence: Desktop screenshot captured and verified in docs/screenshots/desktop-phase1.png.Read documentation - Verified2
Phase 2 • Volatile Memory Guard
Snigdha Amnesia Subsystem
Read-only root filesystem backed by compressed erofs with volatile tmpfs upperdir. Zero active swap and automated media-removal watchdog.
Key deliverables
Compressed airootfs.erofs image with read-only mount enforcementSwap disabling unit masking all physical swap devicesC99 snigdha-media-watchdog daemon monitoring live USB mediuminit_on_free=1 and page_alloc.shuffle=1 memory scrubbingEvidence: Amnesia verification test suite passed. Unit tests verified in amnesia/tests/.Read documentation - Verified3
Phase 3 • NetGuard Sentinel
Snigdha NetGuard Transparent Torification
Atomic nftables firewall redirecting all non-Tor TCP to TransPort (9040), intercepting DNS (5353), dropping UDP/QUIC, and enforcing a fail-closed kill switch.
Key deliverables
nftables ruleset with dual-stack IPv4/IPv6 parityDisableNetwork 1 initial startup lock gating all network packetsRofi NetGuard menu for network connection and bridge managementAutomated network namespace isolation tests with fault injectionEvidence: Zero cleartext leaks confirmed under simulated network failure tests.Read documentation - Verified4
Phase 4 • LUKS2 Fortress
User-Controlled Encrypted Persistence
Modular, selective persistent storage container formatted with LUKS2 and Argon2id key derivation, mounted via isolated bind mounts.
Key deliverables
snigdha-persistence CLI and D-Bus backend daemonPolybar persistence status indicator and Rofi management menuIndividual feature toggles (GnuPG, SSH, NetworkManager, Tooling)Automated unit tests validating manifest integrity and teardownEvidence: Persistence container unlock, mount, and clean teardown verified in persistence/tests/.Read documentation - Verified5
Phase 5 • Containment Matrix
Application Isolation & Sandboxing
Mandatory Access Control using AppArmor enforce profiles, Bubblewrap ephemeral user namespaces, and compiled Seccomp-BPF filters.
Key deliverables
12 dedicated AppArmor profiles in strict enforce modesnigdha-sandbox Bubblewrap runner with private tmpfs and masked homeCustom C Seccomp compiler generating BPF syscall filtersSession D-Bus filtering via xdg-dbus-proxy blocking privileged endpointsEvidence: Boundary escape prevention tests passed in security/tests/.Read documentation - Verified6
Phase 6 • Private Ecosystem
Hardened Privacy Application Suite
Integrated and hardened client applications: Tor Browser with control socket broker proxy, OnionShare, KeePassXC, Thunderbird, and Metadata Cleaner.
Key deliverables
snigdha-tor-broker control socket filtering proxyPre-configured Thunderbird profile with Tor proxy and autoconfig disabledKeePassXC database integration with persistence feature bindingMetadata Cleaner desktop integration with AppArmor sandboxEvidence: Application launch tests and control socket filtering validated.Read documentation - Verified7
Phase 7 • Control Deck
Native Snigdha Security Center
Native GTK4 + Rust application aggregating telemetry from NetGuard, Amnesia, Persistence, AppArmor, and hardware status into a unified dashboard.
Key deliverables
Dual GTK4 GUI and CLI interface in RustUnprivileged D-Bus telemetry consumption (UID 1000, zero root escalation)Interactive diagnostic runner with sanitized report export14 Rust integration tests covering all subsystem modelsEvidence: Rust test suite passed. Application screenshots captured in docs/screenshots/.Read documentation - Verified8
Phase 8 • Root of Trust
Trust, Boot Integrity & Supply Chain
Unified Kernel Images (UKIs) signed for UEFI Secure Boot, dm-verity Merkle tree root integrity, SLSA v1.0 provenance, and SPDX 2.3 SBOM generation.
Key deliverables
dm-verity hash tree creation with fail-closed kernel panic on corruptionSecure Boot UKI bundling kernel, initramfs, cmdline, and SBATIsolated 4096-bit RSA signing key architectureMachine-readable release-manifest.json with detached OpenPGP signaturesEvidence: Cryptographic keys, manifest, and signatures verified in trust/ and build/out/.Read documentation - Verified9
Phase 9 • Security Forge
Snigdha Penetration Center & Tooling Ecosystem
Native GTK4 + Rust package discovery, installation, and launcher ecosystem integrating Arch Linux, BlackArch, and Chaotic-AUR repositories with strict signature policies.
Key deliverables
snigdha-penetration-center GUI and snigdha-penetration CLIStrict policy: third-party repositories disabled by defaultMandatory OpenPGP signature enforcement preventing partial upgradesDeep integration with Phase 4 Persistence and Phase 7 Security CenterEvidence: 10 high-resolution screenshots and test suite verified in penetration-center/.Read documentation - In progress10
Phase 10 • Resilience Lifecycle
Update, Recovery & Lifecycle Management
Cryptographically verified atomic block updates of the live ISO image over Tor without touching encrypted persistence, plus boot recovery tools.
Key deliverables
Atomic A/B partition updates with block-level delta transfersAutomatic rollback upon failed boot verificationPersistent volume header backup and restoration utilitiesEmergency diagnostic rescue shell with offline hardware inspectionEvidence: Architectural specification complete; implementation in active development.Read documentation - Planned11
Phase 11 • Independent Proof
Independent Security Audit & Formal Verification
Third-party cryptographic, kernel, and network leak audit by accredited security research teams before public production release.
Key deliverables
External penetration test and network leak audit reportFormal verification of nftables ruleset invariantsPublic audit report publication with remediation timelineCVE vulnerability disclosure and bounty coordinationEvidence: Scheduled following completion of Phase 10. - Planned12
Phase 12 • Sovereign Release
Production Readiness & Public Stable Release
Official public production milestone: general availability of audited ISO downloads, mirror synchronization, and global release verification key publishing.
Key deliverables
Production signing ceremony with air-gapped root keysGlobal mirror infrastructure over HTTPS and Tor Onion ServiceWeb Key Directory (WKD) publication and keyserver distributionOfficial 1.0.0 ISO images with multi-architecture documentationEvidence: Culmination milestone gating public stable download distribution.