O is designed to support freedom above a protected base, not instead of one.
The system should remain:
- open
- programmable
- transparent
- recoverable
- difficult to casually damage
- hard to tamper with at the trust/root level
- safe boot
- protected secure folders
- trust anchors
- destructive-action barriers
- recovery path
- non-bypassable safety hooks
- firewall
- privacy ledger
- trust management
- code risk analysis
- superuser gating
- promotion validation
- incident response
- isolation
- runtime restrictions
- network mode
- device access
- relation policy
- snapshot and destruction controls
- normal
- visible
- strict
- paranoid
- dead man mode
- drunk mode
- child lock mode
- user-defined experience modes
Sub O internet access is off by default unless allowed.
Mother O network posture is user-selectable:
- local (including server)
- online repo only
- full online
The firewall should expose an understandable app/path/data-use view similar to a simplified process/network monitor.
The privacy ledger is always available. Live on-screen visibility is optional.
It records:
- data sent and received
- source and destination
- files touched
- subsystem involved
- model use
- device use
- updates and mutations
Risk evaluation combines:
- static rules
- runtime observation
- small-model intent explanation
Behavior:
- safe → allow
- suspicious → warn
- high-risk → hold for confirmation or stronger path
Fresh reinstall and trusted recovery are part of the security model. O should always maintain a path back to a trusted state.