What EuroOS can do, today.

What it is. EuroOS’s own UEFI bootloader and kernel bring-up: it boots on standard UEFI firmware, captures the framebuffer, calls ExitBootServices, and from then on runs entirely on its own GDT/IDT/paging, no GRUB, no shim, no inherited kernel.

Why we do it this way. A sovereign OS must own the machine from the first instruction; relying on a foreign bootloader or kernel would put the trust boundary outside our control. Single-stage UEFI keeps the boot path small and auditable.

How it's used / how you use it. Flash the image to USB or run ./scripts/run-qemu.sh; the serial log narrates every boot step ([euro] …). On real hardware it boots to the desktop in ~1.5–2 s.

What it is. EuroMM: a bitmap physical frame allocator built from the real UEFI memory map, plus hand-built 4-level paging with per-process address spaces and guarded kernel stacks.

Why we do it this way. Owning memory management is what makes the security guarantees real: W^X, SMEP/SMAP and per-process isolation are enforced in our own page tables, not inherited. Guard pages turn silent stack overflows into deterministic faults.

How it's used / how you use it. It’s transparent to you, every process gets an isolated 2 MiB arena and its own CR3; free/mem in the shell show live usage. A faulting program is killed without taking down the system.

What it is. A preemptive scheduler (100 Hz APIC timer) with full register-saving context switches, the Unix process model (fork/execve/wait/pipes/futexes), SMP with per-CPU run-queues, and EuroInit (PID-1) supervising services.

Why we do it this way. Real preemption + per-CPU queues are required to run a responsive desktop and untrusted programs side by side; an in-house scheduler lets us bind each task to its EuroGuard identity for the audit trail.

How it's used / how you use it. Run programs by name in the shell or let EuroInit start services; ps lists tasks, kill stops them, services/euroctl shows the supervised daemons. Crashed services restart with an anti-storm cap.

What it is. A from-scratch copy-on-write filesystem with an A/B dual superblock, XXH3 end-to-end checksums, a background scrubber, CoW snapshots + rollback, and a VFS mount table, on virtio-blk and NVMe.

Why we do it this way. Integrity-first by design: CoW + an A/B superblock survive torn writes (the top reliability risk for any FS), and per-file checksums catch bit-rot instead of returning silent garbage. This was audited and the crash-consistency logic verified sound.

How it's used / how you use it. Files persist across reboots automatically; fsck/scrub verifies integrity, eurosnap takes/rolls back snapshots, df shows per-mount usage. A degraded superblock self-heals from its A/B copy on mount.

What it is. Alongside its own EuroFS, EuroOS mounts the world's filesystems: FAT32, exFAT and Linux ext2, read + write (ext3/4 read), and SMB2/3 + NFSv3 network shares, with a format/mkfs command, an auto-detecting mount/umount/lsblk, USB-stick auto-mount and a TRIM/discard path.

Why we do it this way. Sovereignty doesn't mean isolation. To be usable, an OS has to read the USB sticks, disks and shares people already have, so every driver was written from scratch and verified against the real reference tools (fsck.fat/mtools, mkfs.exfat, mkfs.ext4, Samba, Linux nfsd), never a mock.

How it's used / how you use it. Plug in a disk and mount it, or mount //server/share and mount nfs://server/export; lsblk shows each volume and its type, format prepares a new disk. The whole stack was load- and stress-tested across many disk sizes.

What it is. Ring-3 userspace: a SYSV64 syscall path, an ELF loader that verifies an Ed25519 signature before executing any binary, ~200 Linux syscall dispatch arms, and validated user-pointer access at the kernel boundary.

Why we do it this way. Verify-before-execute means only signed code runs, the foundation of a trustworthy platform. The recent audit hardened the syscall boundary (user pointers are now bounds-checked against the calling process’s arena) and made the ELF loader overflow-safe.

How it's used / how you use it. Build a program with the EuroToolchain, sign it, drop it in /bin, and run it by name; an unsigned or tampered binary is refused ([sec] … GEWEIGERD).

What it is. A Linux ABI bridge: unmodified musl-libc binaries run via the syscall shim + a dynamic linker (DT_NEEDED resolution, GOT relocation).

Why we do it this way. Compatibility is a convenience, not the identity, it lets existing tooling run while the sovereign core (EuroGuard/EuroIPC/EuroFS) remains the real surface. It is deliberately a shim on the side, never the thing that defines the OS.

How it's used / how you use it. Compile ordinary C/musl programs and run them as-is; the kernel maps their Linux syscalls onto EuroOS facilities. Native EuroOS programs use the sovereign API directly.

What it is. The hardware + platform breadth. EuroOS boots on a modern machine and installs onto it: PCIe ECAM config, from-scratch NVMe and AHCI/SATA storage drivers with install-to-and-boot-from disk, Intel e1000 and USB ethernet NICs, real xHCI USB (through hubs, report-descriptor-driven HID, mass storage, and USB audio), Intel HD-Audio, ACPI (power button + an AML interpreter), MSI-X interrupts, and a unified device model, with crash-dump recovery and a SMART health engine.

Why we do it this way. A desktop OS needs genuine hardware drivers, not emulation shims, each was written from scratch and boot-verified against the real device protocols so the platform is honest about what works.

How it's used / how you use it. Plug in a USB keyboard/storage device and it just works; lsdev shows the device tree, eurohealth the SMART/FS/memory health score, eurocrash the last kernel crash dump.

What it is. The sovereignty spine: EuroGuard capabilities, an append-only tamper-evident audit log, per-file immutability, a TPM 2.0 driver (measured boot), ChaCha20 full-disk encryption keyed from the TPM, the EuroPol policy engine, and the EuroVault secrets store.

Why we do it this way. Security is an architectural property, not a feature bolted on: every binary is signed, every privileged action is a capability that is logged, and the trust anchor is the local TPM, not a remote cloud. A full-stack security audit (see below) verified the crypto and capability model sound and hardened the rest.

How it's used / how you use it. caps/euroguard shows the capability model, audit the tamper-evident log, europol the policy, vault the secrets store; FDE + measured boot run automatically when a TPM is present.

What it is. EuroNet: a from-scratch TCP/IP stack with EuroTLS 1.3 (own X.509 validator + a 25-root EU trust store), a stateful firewall (EuroFW), and a sovereign forward-secret VPN (EuroVPN).

Why we do it this way. Network sovereignty means the security-critical path, TLS, certificate validation, the VPN handshake, is our own auditable code anchored in an EU trust store, with no foreign dependency. The audit confirmed the TLS key-schedule, AEAD, signature verification, X.509 parser and VPN key-separation are sound; TLS entropy is now TPM-seeded and the VPN has an anti-replay window.

How it's used / how you use it. ping/nslookup/fetch/https exercise the stack; firewall shows the packet filter, vpn your sovereign tunnel key (WireGuard-style config).

What it is. EuroDesktop: a compositor with a real Wayland wire-protocol display server over AF_UNIX, drawing app windows with an in-house AA font rasterizer and the EuroDesign light theme.

Why we do it this way. A sovereign desktop needs its own display server and protocol so the whole UI stack, input routing, window management, rendering, is auditable and not tied to foreign middleware.

How it's used / how you use it. It comes up at boot showing a live System window and an interactive Terminal; apps connect over the display socket to open windows.

What it is. An interactive terminal with pipes (a | b), redirection, a GNU-compatible coreutils set, and every subsystem exposed as a command.

Why we do it this way. A real shell with composable built-ins makes the whole OS explorable and scriptable today, and the coreutils are pure, host-tested functions so their behaviour matches GNU exactly.

How it's used / how you use it. Type help for the live list; pipe built-ins (cat f | grep x | sort), run signed programs by name, and reach every subsystem (vault, europol, euroagent, locale, eurosuite, …).

What it is. The build + distribution stack: the EuroToolchain (freestanding C/musl → signed ring-3 ELF), the eupkg package format (ZIP + manifest + SHA-256 + Ed25519), the EuroPkg dependency resolver, and EuroRepro reproducible-build attestations.

Why we do it this way. Sovereignty requires verifiability: a third party must be able to prove a binary comes from the published source. Signed packages, semver dependency resolution, and independent-builder reproduction consensus close the source→binary→signed-image chain.

How it's used / how you use it. Build + sign a program, package it as .eupkg (tampered packages are rejected); europkg resolves dependencies into an install order; eurorepro shows the deterministic build attestation.

What it is. A CLDR-style library covering number/currency formatting, date patterns, plural rules and collation for every EU language, built from scratch, no external data blobs.

Why we do it this way. A European OS must speak every EU language, not just English; baking localisation into the core (and tying screen-reader labels and document language to it) makes that a property of the system, not an add-on.

How it's used / how you use it. locale lists the 24 languages; locale <tag> (e.g. locale de-DE) shows that language’s number, currency, date and plural formatting live.

What it is. Each command is a pure fn(args, input) → bytes tested against expected GNU output, wired into the shell with real pipe-stdin, redirection and tee.

Why we do it this way. A usable shell needs a real userland; writing the coreutils as pure functions means their behaviour matches GNU exactly and is verifiable by host tests with no VM.

How it's used / how you use it. Use them like on Linux: cat f | grep x | sort | uniq -c, find / -name '*.txt', printf, sha256sum, base64. They compose with pipes and redirection.

What it is. Agents are WASM modules with a declarative capability manifest; the trust boundary is the kernel (EuroGuard), an open MCP gateway exposes OS tools, and a local LLM is the default. Every tool call is capability-gated and audited.

Why we do it this way. Unlike platforms that put the trust boundary in a remote cloud + mandatory identity provider, EuroAgent keeps it in the kernel: an agent never exceeds the granting user’s capabilities, runs sandboxed WASM, and works fully offline. EU data residency by construction.

How it's used / how you use it. euroagent shows the runtime; euroagent caps/mcp list/inspect/llm/dispatch test <intent> explore it. An agent’s manifest + WASM ship as an Ed25519-signed .euroa bundle.

What it is. Writer, Calc and Impress share a single document model (EuroDoc); EuroDocIO reads/writes OOXML (.docx) and ODF (.odt) and exports HTML; EuroCalc is a real spreadsheet formula engine.

Why we do it this way. One model for all three apps means import/export and styling are written once and stay consistent; reading the formats Europe actually uses (OOXML + ODF) with our own from-scratch XML parser keeps the document path sovereign.

How it's used / how you use it. Today the computational cores run and are host-tested; eurosuite shows the capabilities and eurosuite calc =SUM(A1:A3)*2 evaluates a formula live. The GUI apps in the compositor are the next (attended) step.

What it is. EuroCA is a local certificate authority; EuroAttest is TPM-based remote attestation; EuroIDM maps users/groups to EuroGuard capabilities with signed tokens; EuroPkg + EuroRepro make the software supply chain verifiable.

Why we do it this way. Sovereignty means not depending on a foreign CA hierarchy or identity provider: an organisation runs its own root, proves machine state from the local TPM, and verifies that binaries come from published source, all anchored locally.

How it's used / how you use it. euroca shows the root-CA fingerprint, euroattest the measured-boot PCRs + attestation key, euroidm the identity→capability mapping, europkg/eurorepro the package + reproducible-build verification.

What it is. An AT-SPI-equivalent: an accessibility tree (roles/names/states), keyboard focus management, and a screen reader that announces each element in the user’s language (labels from EuroLocale).

Why we do it this way. Accessibility is a procurement requirement in the EU (EN 301 549), so it belongs in the core; sourcing labels from EuroLocale means the screen reader speaks every EU language.

How it's used / how you use it. euroaccess shows a sample dialog’s accessibility tree with the Dutch screen-reader announcements; the live EuroDisplay wiring + audio TTS are the attended next step.

What it is. A 5-track parallel audit reviewed the whole stack (kernel, storage, crypto/net, userland, agent sandbox) for memory-safety, isolation, crypto and parser-robustness defects. Findings + status are in docs/SECURITY-AUDIT.md in the repository.

Why we do it this way. “What audits clean is as important as what doesn’t”: an honest OS publishes its audit. The security-critical foundations were confirmed sound, and the concrete defects were fixed and re-verified by boot.

How it's used / how you use it. The fixes are in the build you can download; the audit report lists every finding, its severity, and its status (fixed / tracked).