Where Cerberus is going, and how it got here.

Phase 12, Pane, has started: the window server runs as a user program.

Added

• Pane (/bin/pane), the window server as an ordinary program: it maps the screen through /dev/fb0, reads /dev/input/*, and programs put windows on it through the port pane with shared-memory buffers. First slice: decorated windows (title bar, close button), move by the title bar, stacking and focus by click, keyboard to the focused window, pointer events to the window under it, damage-driven compositing (a 10x10 change recomposites 100 pixels), frame callbacks, Alt+F4, Ctrl+Alt+Q to leave. A client only ever sees its own windows and input; a malformed message disconnects that client, never Pane.
• pane in the shell runs it in place of the kernel desktop and brings the desktop back afterwards; pane --demo adds four demo windows; gui stop / gui start hand the screen to any program and back.
• libpane (userland/libpane), the client library: connect, create a window, draw into its buffer, damage, commit, receive events. panetest is the first client.
• mmap with MAP_SHARED on /dev/fb0 maps the screen write-combined into a program; FBIO_SET_MODE changes the resolution from a program.
• /dev/input/mouse0 reports the host pointer's absolute position (EV_ABS) under VirtualBox, so a user-mode compositor follows it too.
• fstat on a shared-memory descriptor reports the block's size.

Fixed

• VirtualBox: the mouse pointer follows the host's pointer again instead of jumping only when a button is clicked (B-016). The desktop now asks the guest device for the pointer position on every tick.

Round 3 continued (hard links) and round 4 of polish, the eight picks of the 0.0.5i list, as far as a three-hour box allowed. Built and fully tested on 2026-10-06 (53 of 53 tests); released on 2026-10-13.

Security

• The desktop can lock itself after 1, 5, 15 or 30 idle minutes (Settings → Security, once a password is set).

Fixed

• Settings scrolls with the wheel when its content does not fit (B-012).
• Task buttons no longer run under the tray when the taskbar is full.

Added

• Hard links: ln a b on cerfs and tmpfs (link system call 16).
• Virtual desktops: four of them; Super+1..4 switches, Super+Shift+1..4 moves the focused window; squares on the taskbar show which hold windows (click to switch).
• System Monitor: CPU and memory graphs over the last minute, a process table with each process's CPU share, and End task.
• Image Viewer: opens BMP files (Print Screen's output) from Files; "Set as wallpaper" makes the picture the background.
• Reminders repeat: start the text with daily or weekly; a reminder's notification has a Snooze button (five minutes).
• Taskbar button right-click: Restore, Minimise, Maximise, Snap left, Snap right, Close.
• Terminal: clear and Ctrl+L.
• Power off and Restart in the launcher ask twice ("Sure?").

Performance

• The first touch of a page (a minor page fault) takes 1.4 µs instead of 2.1 µs: frames are zeroed ahead of time by a background thread (B-015).

Added

• sigprocmask: a thread can block signals; a blocked signal waits until it is unblocked. SIGKILL cannot be blocked. New threads and children inherit the mask.
• port_try_send: as port_send, but EAGAIN instead of waiting when the queue is full.
• The keyboard's Caps Lock and Num Lock lights follow the keys.

Security

• A lock screen: Super+L (or the tray's Lock) locks the desktop behind a password set in Settings → Security; the password is stored as a salted SHA-256 hash, compared in constant time, and a wrong try waits a second. (Argon2id and real users come with phase 15.)

Added

• Saved settings and reminders (B-011): the first disk holding a cerfs volume labelled data is mounted at /data at boot; Settings → Storage sets a blank disk up for it. Everything in Settings, the custom accent, the keyboard choices and reminders survive a restart.
• Text selection and a clipboard: drag over the terminal to select (it copies), Ctrl+C / Ctrl+V in the terminal, the launcher, the calendar and the new applications.
• Files: browse folders and disks, sizes and dates, New folder, Rename, Delete (asks twice), open a text file in Notes with a double-click.
• Notes: a text editor with selection, undo, find, Ctrl+S (to /data or /tmp), mouse and wheel; 64 KiB per file.
• Calculator: typed or clicked expressions with brackets, ^ and %, six decimals, the result in hex and binary, memory, copy.
• Keyboard settings: US, UK, German and French (AZERTY) layouts with AltGr, repeat delay and rate; CAPS / NUM-off pills on the taskbar.
• Tray (the chevron beside the clock): night light, show desktop, lock, Settings, accent swatches, frame rate, a CPU meter per core, RAM, and the notification history.
• Settings tabs: Keyboard, Storage, Security.
• test sha256 (FIPS vectors).

Changed

• Launcher search ranks name matches above keyword matches.
• The large display fonts include digits (the lock screen's clock).

Fixed

• VirtualBox at 1920x1080 (and any scaled window): the mouse pointer no longer stops short of the screen's edges. A driver for VirtualBox's guest device takes the host's pointer position, so the pointer sits exactly under the host's and the mouse need not be captured (B-003).
• The boot menu no longer waits (it did not count down on VirtualBox and needed Enter): the ISO boots straight into Cerberus (B-002).
• The About window has a minimum size and shortens its subtitle instead of clipping it (B-004).

Added

• Calendar: click the clock. A month view with today marked; page with the arrows, the wheel or Left/Right; "Today".
• Reminders: type 14:30 Call home (or just the text, for 09:00) into the calendar and press Enter; a notification appears at that minute. Days with reminders show a dot. Kept in memory until a restart.
• Notifications: cards in the top-right corner, gone after 8 s or when clicked; notify <text> in the terminal shows one.
• Animations: windows fade and slide when opened, closed, minimised or restored; the launcher and the calendar rise out of the taskbar.
• Window snapping: drop a window at the left or right edge for half the screen, at the top to maximise (an outline previews it); Super+Left, Super+Right, Super+Up; Super+Down restores, then minimises. Dragging a maximised or snapped window gives it its old size back.
• Double-click a title bar to maximise or restore.
• Alt+Tab switcher: tiles of every window; Tab moves on, Shift+Tab back, releasing Alt picks, Escape cancels.
• Super+D hides every window and brings them back in the same order.
• Middle-click a taskbar button to close its window.
• Right-click the desktop: Terminal, Settings, Change wallpaper, Show desktop, About.
• Print Screen saves the screen as /tmp/screenshot-N.bmp.
• Terminal: command history with Up/Down and Tab completion of command names.
• Settings: any accent colour from a hue strip (click or drag); three more wallpapers (Ocean, Sunset, Graphite) on their own tab; time zone (UTC offset); 18 resolutions from 800x600 to 5120x1440 including ultrawide (2560x1080, 3440x1440, 3840x1600); a frame rate cap of 30–144 Hz.

Changed

• Settings is laid out as titled cards with icons in the sidebar, and the hint sentences are gone. Tabs: Appearance, Wallpaper, Window borders, Display.
• The test probe can type shifted punctuation (!key 14:30), press key combinations (!keys alt tab) and double-click (!dblclick).

Spec phase 11, programs talking to each other, is complete, and the desktop gained a Settings window, a new launcher and resolution switching.

Security

• A named port has an project and permission bits like a file; a program without write permission cannot connect to it (tested as user 1000).
• The receiver of a connection learns the other side's process, user and group from the kernel, not from the message, so it cannot be faked.
• Message sizes, descriptors per message and queue lengths are limited; a sender that finds a queue full waits, and nothing is dropped.
• A signal can be sent only to a process of the same user (root: any).
• A process can give up root (setuid, setgid) and cannot take it back.
• Every thread of a program shares its open files; a file being used by one thread stays valid while another closes it.

Added

• Ports: named message channels between programs. Whole messages of up to 64 KiB, in order, which can carry open files and shared memory.
• Shared memory that several programs map at once.
• Signals: SIGKILL, SIGTERM, SIGSEGV (also SIGILL, SIGFPE), SIGCHLD, SIGUSR1/2, with handlers in programs; a waiting call returns EINTR.
• Threads in programs: pthread_create/join, mutexes and condition variables, thread-local variables (__thread, and errno is one).
• Futexes: locks that enter the kernel only to wait, also between processes through shared memory.
• Event queues (event_create/ctl/wait): one wait over ports, timers and child exit. A waiting server uses no CPU and wakes about 50 microseconds after a message is sent.
• mmap of a file (a private copy), mprotect, kill, getppid, getuid and friends, umask, sysinfo, time_us: 74 system calls now.
• Desktop: the mouse cursor turns into a two-headed arrow over a window's edges and corners, and they are easier to grab, so resizing a window is discoverable.
• Settings (launcher, or search for it): nine accent colours; three wallpapers (Nebula, Aurora, Ember); square, soft or round window corners; floating or docked, glass or solid taskbar; 12- or 24-hour clock with or without seconds.
• Window-border effects in Settings: static, breathing, flashing, rainbow and chase (colours running round the window), with a choice of colour, thickness, speed, glow, and the focused window or all windows.
• Screen resolution can be changed in Settings (800x600 to 1920x1080) on the standard display adapter of VirtualBox and QEMU.
• A new launcher: a "C" logo button in the corner, a search box on the taskbar, and a menu with a search field (type to filter, Enter opens the first match), coloured application icons, and Power off / Restart.
• A new taskbar: a rounded bar floating clear of the screen edges, an icon for each open window with a mark under the focused one, a memory meter, and a bolder clock.
• resolution [<width> <height>] in the shell shows or changes the screen resolution from the keyboard.
• help in the shell is grouped and gives each command one short line; help <command> and help tests show more.
• Programs: ipctest, threadtest, sigtest, eventtest, mmaptest.

Changed

• Taskbar buttons narrow to share the space when many windows are open or the screen is small.
• sleep_ms and waitpid return early (EINTR) when a signal arrives.
• A program's fault is delivered as a signal first; only an unhandled one ends the program.

Spec phase 10, drivers, is complete.

Security

• The screen (/dev/fb0), keyboard and mouse (/dev/input/*) and disks can be opened by root only; a program running as another user is refused (tested with a program run as user 1000).
• /tmp is writable by everyone, and only a file's project can delete or rename it there (the "sticky" rule).
• Everything a device reports (sizes, counts, queue positions) is checked before it is used, in every new driver.

Performance

• SATA commands are completed by an interrupt (MSI) where the controller offers it, so the processor is free while the disk works; VirtualBox's controller does not, and is polled as before.

Added

• poweroff switches the machine off and reboot restarts it, through ACPI, after writing everything to disk (also as the reboot system call).
• NVMe disks (the kind most current PCs have) and virtio disks (QEMU's fast disk) work alongside SATA and IDE.
• Keyboard and mouse events can be read from /dev/input/kbd0 and /dev/input/mouse0: key codes, press, release and repeat, the character typed, the modifier keys; mouse movement, wheel and buttons.
• The whole keyboard works: the numeric keypad with Num Lock, the menu key, Print Screen, Pause, right-hand Ctrl and Alt, keypad Enter and /.
• drivers lists the drivers and what each has attached; runas <uid> <program> runs a program as another user.
• /dev/fb0: the screen as a file, with its size from an ioctl.

Changed

• The keyboard is read in its native mode (scancode set 2) instead of the controller's translation, falling back to the old mode if a keyboard refuses.
• Drivers are found and started through one registry (the driver model).

Smooth text: the desktop no longer looks pixelated.

Changed

• All desktop text is anti-aliased: DejaVu Sans for the interface, DejaVu Sans Mono for the terminal and tables, and a large bold face for the "Cerberus" wordmarks (they were a small pixel font enlarged two and three times, which made every letter stair-stepped).
• The close button's cross is drawn with a smooth thin line.
• The wallpaper is dithered, which removes the visible bands in its dark gradient.
• The terminal's rows are one pixel taller (8×17 cells).

Spec phase 9, files and file systems, is complete: Cerberus can keep files on a disk. The system has a new name: Cerberus.

Security

• File permissions are checked on every file operation; a user cannot read another user's private file, write a file they may only read, or look inside a directory closed to them.
• Mount options: read-only, no programs (noexec), no device files (nodev), no set-user (nosuid). The root file system is read-only; /tmp refuses device files; /dev refuses programs.
• The disk file system treats every disk as hostile: every field is checked before use, metadata carries CRC32C checksums, and a damaged disk gives an input/output error, never a crash. It is fuzzed: thousands of damaged disk images a minute are mounted and used by the real driver.
• A disk in use by a mounted file system cannot be opened for writing, so it cannot be formatted or overwritten by accident.
• A new disk block is never shown with what a deleted file left in it.
• Keyboard, mouse and screen device files are readable by root only (this matters from phase 15: until user accounts exist, every program runs as root).

Fixed

• On VirtualBox the clock could run unevenly (it trusted a processor counter that VirtualBox does not keep steady), which made timing self-tests fail there. Cerberus now uses that counter only on real hardware that declares it steady and under KVM, and checks it three times before trusting it.

Performance

• One page cache for file contents and disks, with read-ahead for sequential reads and background write-back every 5 seconds: reading a 64 MiB file a second time takes 6 ms instead of 0.7 s.
• A name cache remembers recently used paths.
• Closed files stay cached, so opening them again finds their data in memory.
• SATA disks are read and written by DMA (about 87 MB/s in QEMU).

Added

• Files and folders: / (read-only, from the boot archive), /tmp (in memory), /dev (devices), and disks mounted anywhere, for example /mnt.
• cerfs, the disk file system, with a journal: pulling the power while files are being written leaves the disk consistent (tested by killing the machine mid-write and checking the disk with an independent reader).
• mkfs.cerfs formats a disk, both inside Cerberus (mkfs.cerfs -y /dev/disk/sda) and on the build machine (mkfs.cerfs --check verifies an image).
• Disk drivers: SATA (AHCI) and the older IDE controller. pci lists the PCI devices.
• Programs: ls, cat, echo, mkdir, rm, rmdir, mv, cp, touch, stat, ln -s, sync, mount, umount, pwd, write, fstest, mkfs.cerfs.
• The shell runs programs by name (ls instead of run /bin/ls), sends their output to a file with > or >>, has cd and pwd, and mount lists file systems and cache statistics.
• System calls for files: open with all the usual flags, openat, seek, stat, lstat, fstat, mkdir, rmdir, unlink, rename, readdir, chdir, getcwd, dup, dup2, ioctl, truncate, sync, fsync, symlink, readlink, chmod, chown, mount, umount, time_ms (docs/SYSCALLS.md). Programs inherit the shell's working directory; close-on-exec works.
• /dev/null, /dev/zero, /dev/random, /dev/urandom, /dev/console.
• Self-tests test vfs and test cerfsfuzz.

Changed

• Opening a file in /bin for writing now fails with "read-only file system" instead of "operation not permitted".
• The operating system is now called Cerberus (it was Lumen). Its disk file system is cerfs (mkfs.cerfs, mount -t cerfs), the release image is dist/cerberus.iso, the shell prompt is cerberus>, and the launcher for Windows is run-cerberus.cmd.

Desktop polish: smoother, rounder, and the terminal scrolls.

Fixed

• Keys typed while the launcher menu is open no longer reach the terminal.

Performance

• Only pixels that changed are written to the screen. Dragging a window writes about a fifth of the pixels it did (82,000 instead of about 424,000 per frame in a measured drag), which matters most in VirtualBox, where writing to the screen is slow.
• Frames are drawn as soon as mouse or keyboard input arrives (up to about 160 per second) instead of waiting for the next 10 ms timer tick; the mouse pointer no longer reads back from video memory.

Added

• The terminal keeps the last 1,000 lines. Scroll with the mouse wheel or Shift+Page Up / Shift+Page Down; a scrollbar shows where you are, and typing jumps back to the bottom.
• test terminal self-test (scrollback), included in test all.
• gui reports the slowest frame since it was last asked and how many pixels were actually written.

Changed

• Window buttons look like Windows: minimise, maximise/restore and close as thin symbols in flat buttons; close turns red under the mouse.
• Rounded corners are larger and anti-aliased (smooth edges instead of steps) on windows, taskbar buttons, the menu and the scrollbar.
• The Super key opens the menu when pressed and released on its own; in a shortcut such as Super+T it no longer toggles the menu.
• Resizing the terminal keeps its text instead of clearing it.
• The About window shortens long values with "…" and no longer claims the Spec compiler is in progress (it has not been started).

Spec phase 8, SMP, is complete: Lumen now uses every processor. This is the first release under the new version scheme. It comes after 0.7.0 but is numbered 0.0.5a: from now on each release moves one letter (0.0.5a, 0.0.5b … 0.0.5j, then 0.0.6a).

Security

• Memory that is unmapped or made read-only is withdrawn from every processor before the change returns (TLB shootdown), so no processor can keep using a page that has been taken away.
• The order in which kernel locks may be taken is written down in one place and checked on every acquisition in debug builds; a wrong order stops the kernel with a report instead of becoming a rare deadlock.
• A fatal error stops all processors, not just the one that hit it.
• The kernel's reads and writes of program memory can no longer be steered at kernel memory speculatively.

Fixed

• The scheduler benchmarks no longer depend on there being one processor.
• On machines without an HPET (such as VirtualBox), the clock ran several times too fast when two processors read it at once; it is now read by one processor at a time.
• The scheduler and SMP self-tests measure their busy work in timer ticks and no longer fail on slow virtual machines; test all includes test smp.

Performance

• All processors run threads. Work is spread across idle processors, and a processor with nothing to do takes waiting work from a busy one.
• The kernel heap gives each processor its own pool, so allocating memory does not make processors wait for each other.
• The kernel keeps time with the processor's own counter where it runs at a steady rate, instead of reading a timer chip: reading the time is far cheaper (wake-up latency 7–9 µs instead of 18–19 µs under QEMU).

Added

• test smp self-test, and test exceptions lo (lock-order violation).
• ps shows which processor each thread is on and per-processor statistics.

Changed

• The boot log shows each processor reporting in ("smp: cpu 1 online").
• "init: started as pid 1" is now printed by the kernel when it starts init.

Spec phase 7, userland and system calls, is complete.

Security

• Programs now run in user mode (ring 3), each in its own address space, and reach the kernel only through system calls. A program that crashes, touches kernel memory or runs a privileged instruction is ended and reported; the system carries on.
• Every system-call argument is checked. Bad pointers, lengths that wrap and unknown flags are refused with an error instead of reaching kernel code; the kernel reads and writes program memory through one guarded path only.
• SMEP, SMAP and UMIP are turned on when the CPU has them: the kernel can neither run nor casually touch program memory.
• Address-space layout randomisation: a program's code, stack and mmap memory land at different addresses on every run. Only position-independent programs are loaded, and nothing can be mapped writable and executable.
• A kernel random-number generator (ChaCha20, seeded from the CPU's hardware generator and interrupt timing) now supplies all randomness; programs get it through getrandom.
• Stack-overflow detection (stack protector) in the kernel and in every program.
• make fuzz: the program loader, the boot-archive reader and the system-call interface are attacked with damaged and random input on every release.

Fixed

• The context-switch benchmark (bench, test sched) no longer reports nonsense, or fails, when the shell thread happens to have been lowered in priority; this showed up on VirtualBox.
• A program's output line can no longer be split in the middle by a kernel message.

Added

• System calls exit write read open close mmap munmap fork execve waitpid getpid yield sleep_ms getrandom (reference: docs/SYSCALLS.md, generated from the kernel's table).
• A small C library for programs (userland/libc) and the first programs, carried in a boot archive: init (process 1), hello, and test programs.
• Shell command run <path> [arguments] starts a program and reports how it ended, for example run /bin/hello.
• bench measures a system-call round trip.

Changed

• dist/ holds exactly one file to boot, always named lumen.iso; dist/VERSION.txt says which version it is.

Spec phase 6, threads and scheduling, is complete.

Security

• Every kernel stack now has a guard page below it, including the stacks used for fatal errors. A runaway thread is reported as "kernel stack overflow" with its name instead of overwriting other memory.

Fixed

• The automated tests no longer fail on a busy host, and UEFI boots work in the test tool.

Performance

• The desktop stays responsive while long commands run: the compositor has its own high-priority thread and is woken the moment a key or mouse movement arrives.
• An idle desktop now uses almost no CPU (0% of timer ticks busy in a 3-second sample); before, it spun a full core.

Added

• Threads and processes, a four-level preemptive scheduler, sleeping and wait queues, and locks: spinlock, mutex, semaphore, condition variable, reader-writer lock.
• Shell commands ps (thread list) and bench (micro-benchmarks); make bench; docs/BENCH.md with the first recorded numbers.
• test sched self-test.

Changed

• The kernel shell and the desktop run as threads. idle hlt|spin now sets what the idle thread does.

Fixed

• VirtualBox: the keyboard no longer stops responding after a few keys when the VM has more than one CPU. The CPUs the kernel is not using yet now sleep instead of spinning, which also stops them using a full host core each.

Changed

• dist/ now holds only the newest ISO; making a release replaces the old one and points the VirtualBox VM "Lumen" at the new file.

Spec phase 5, the kernel heap, is complete.

Security

• The kernel's memory allocator protects its own bookkeeping: a corrupted free list is detected and stops the system instead of being followed.
• Freeing the same memory twice, or freeing something that was never allocated, stops the system with a clear message.
• Debug builds also catch writes past the end or before the start of an allocation, and writes to memory after it was freed.
• kfree_sensitive wipes memory before releasing it (for keys and passwords in later phases).

Added

• Kernel heap: kmalloc, kzalloc, kfree, krealloc.
• heapstat shell command: heap usage and, in debug builds, every outstanding allocation grouped by the code that made it.
• test heap self-test and three corruption tests (test exceptions fl|waf|df).

Changed

• The desktop's pixel buffers and the memory manager's records now come from the heap.

Spec phase 4, virtual memory, is complete.

Security

• No memory can be both writable and executable; every request for such a mapping is refused.
• All memory outside the kernel's code is now non-executable. Before this release the bootloader's mapping left all of RAM executable.
• Kernel code and read-only data can no longer be written; kernel data can no longer be executed.
• Memory handed to an address space is always zeroed first, so nothing left behind by a previous project can be read.
• The first 64 KiB of an address space can never be mapped, so a null pointer always faults.
• A stack overflow on a guarded kernel stack is reported and stops the system instead of overwriting other memory.
• Stack variables are zero-initialised by the compiler; debug builds stop with the source line on undefined behaviour such as signed overflow.

Added

• Virtual memory manager: private address spaces, memory regions, memory allocated on first use, copy-on-write copies of an address space, 2 MiB pages for large kernel mappings.
• test vmm self-test; test exceptions so (stack overflow) and test exceptions ub (undefined behaviour).

Changed

• The other CPUs now wait inside the kernel instead of inside the bootloader's code.

First release under the 0.PHASE.PATCH scheme: spec phases 0–3 are complete.

Fixed

• Keyboard and mouse can no longer swallow each other's input: both interrupts now read the PS/2 controller through one shared routine that sends each byte to the right device.
• The desktop no longer freezes on VirtualBox when it runs on the Hyper-V backend: while the desktop is up the kernel keeps polling instead of halting the CPU, and copies pixels to the screen with plain stores. (This uses a full CPU while idle; the scheduler in phase 6 replaces it. Verified in QEMU; not yet re-verified on VirtualBox.)

Added

• Shell commands gui (compositor statistics) and irqs (interrupt counts).
• The boot log reports how long the first desktop frame took.

Changed

• Versions are now labelled 0.PHASE.PATCH; development builds show -dev+<commit> after the number. The number lives in the VERSION file.
• Specification version 2: security, privacy, networking and performance are requirements (see docs/DECISIONS.md, 2026-10-03).

First snapshot. Covers spec phases 0–3 and the desktop preview.

Added

• Boots through Limine on BIOS and UEFI; boot banner on screen and serial.
• CPU setup: GDT/TSS, interrupts with symbolised crash dumps, ACPI, APIC, HPET, a 100 Hz timer, real-time clock.
• Physical memory allocator with a self-test.
• Kernel shell with PS/2 keyboard input.
• Desktop preview: windows with shadows that move, resize, stack, minimise and maximise; panel with launcher, task buttons, memory use and clock; Terminal, About, System Monitor and Memory Map windows; PS/2 mouse; Alt+Tab, Alt+F4 and Super hotkeys.