Where sigilOS Stands Alone
Embedded RTOS rigor + verified security + an AI-native desktop — in one image, on one safe language.
Every other OS makes you choose. A real-time microkernel can't give you a desktop. A verified microkernel isn't a full OS. A desktop OS isn't capability-secure or memory-safe at the core. sigilOS is built to be all of it at once — and held to the Four Pillars on every decision. Here is the honest, dimension-by-dimension comparison, and the niche no one else fills.
The comparison matrix
Eight systems across ten dimensions. sigilOS's edge is called out in each row; the column is highlighted. This is a capability-and-architecture comparison, not a benchmark — where a competitor genuinely leads or ties, it's marked honestly.
| Dimension | sigilOS | QNX | LynxOS | FreeRTOS / Zephyr | seL4 | Linux | Windows 11 | macOS |
|---|---|---|---|---|---|---|---|---|
| Security model | ●●cap by construction | ◐microkernel | ◐MILS partitions | ○minimal | ●caps (kernel) | ◐ACL + bolt-on | ◐ACL | ◐ACL + sandbox |
| TCB trust | ●●verify the artifact (DDC) | ○trust toolchain | ○trust toolchain | ○trust toolchain | ●kernel proofs | ○trust toolchain | ○trust toolchain | ○trust toolchain |
| Language / memory-safety | ●●one safe lang, zero-C | ○C/C++ | ○C/C++ | ○C | ◐C (verified) | ○C/C++ | ○C/C++ | ○C/C++/Obj-C |
| Real-time | ●●hard-RT-capable | ●hard RT | ●hard RT | ●hard RT | ●RT-capable | ◐PREEMPT_RT | ○ | ○ |
| AI | ●●AI-first, cap-bounded | ○ | ○ | ○ | ○ | ◐bolt-on | ◐bolt-on | ◐bolt-on |
| HW scaling | ●●one image Pi3→workstation | ◐embedded→auto | ◐embedded | ○MCU only | ◐kernel only | ◐many builds | ◐editions | ◐Apple HW |
| Remote / collab | ●●kernel-native SRDX | ○ | ○ | ○ | ○ | ◐VNC/RDP app | ◐RDP app | ◐VNC app |
| Desktop | ●●Lumen, cap-secure WM | ◐Screen/auto UI | ○ | ○ | ○ | ●full (not cap) | ●full (not cap) | ●full (not cap) |
| Security tooling | ●●Kali-parity, cap-jailed | ○ | ○ | ○ | ○ | ◐Kali (un-jailed) | ○ | ○ |
| Openness | ●Commercial + Community | ○proprietary | ○proprietary | ●open | ●open | ●open | ○proprietary | ○proprietary |
●● defining strength · ● yes / peer · ◐ partial / bolt-on · ○ none
Dimension by dimension
1 · Security model — capability-secure by construction
In sigilOS, every access is a capability and there is no ambient authority: a process holds exactly the caps it declares and nothing else, enforced at runtime by the MMU and the capability gate. Linux, Windows, and macOS are ACL/user models with security hardening bolted on top. QNX's microkernel isolates, but isn't capability-to-this-degree. seL4 is the real peer — a capability microkernel — but it is a kernel, not a full OS. sigilOS carries cap-by-construction all the way up to the desktop.
2 · TCB trust — verify the artifact, don't trust the compiler
Everyone else asks you to trust the toolchain that built their kernel. sigilOS is built to let you verify the artifact itself — diverse double-compilation, translation validation, and reproducible builds from a committed seed. seL4 is the one peer here, with machine-checked proofs of its kernel; sigilOS extends the idea to the whole build pipeline rather than trusting cc0 by faith.
3 · Language & memory-safety — one safe language, zero C
The kernel, drivers, filesystem, compiler, and desktop are all one memory-safe language (Sigil), compiled by a self-hosting native cc0 — no C, no C++, no third-party runtime. Every other production OS here ships a C/C++ kernel and the entire class of memory-unsafety bugs that comes with it. seL4 is C, but verified.
4 · Real-time — RTOS-grade and a full desktop
sigilOS targets a hard-real-time-capable capability kernel (an ARINC 653 / DO-178C track) — the determinism a QNX or LynxOS gives you, in the same OS that also runs the Lumen desktop. QNX and LynxOS have the real-time pedigree but no AI, no full desktop, and no cap-by-construction. Windows and macOS aren't real-time at all.
5 · AI — AI-first and capability-bounded, not bolted on
AI is a first-class, capability-bounded part of the system — per-window agents, a brokered model lane, and a roadmap to local on-device ML + biometric (2.0) — every one of them confined by caps like any other process. Desktop OSes are retrofitting AI assistants on top of an ambient-authority model; the RTOSes have none.
6 · Hardware scaling — one image, Pi 3 to workstation
One unified, multi-arch image (ARM + x86-64) detects the SoC at boot and scales from the Raspberry-Pi-3B floor up to a workstation — the hard floor always works, everything above is additive. Others ship separate builds or editions; the RTOSes are MCU-class only.
7 · Remote & collaboration — a kernel-native protocol, not an app
Remote desktop is built into the kernel as SRDX — GPU-delta pixel streaming, a node mesh, and virtual-USB input, capability-secured at the kernel boundary, with RDP/VNC as an auto-negotiated fallback for everyone else. On every other system, remote access is a user-space app (RDP/VNC) layered over the OS.
8 · Desktop — a capability-secure workspace
The Lumen desktop is a cap-secure window manager with a tag-driven, no-physical-folders file model and a coherent design language. Linux, Windows, and macOS have mature desktops, but none is capability-secure underneath; the RTOSes have no desktop at all.
9 · Security tooling — Kali-parity, every tool cap-jailed
The plan is full Kali-grade security tooling with every tool capability-jailed — the offensive toolkit without the ambient authority that makes a pentest box itself a liability. On Kali/Linux those tools run un-jailed; the other systems don't ship them.
10 · Openness — commercial and community, in the open
sigilOS ships as Commercial and Community editions, openly. Linux, seL4, and the open RTOSes are open too; QNX, LynxOS, Windows, and macOS are proprietary. Openness alone is common — openness plus cap-by-construction and a safe language is not.
The niche no one else fills
sigilOS is the only OS that is, simultaneously:
- ① capability-secure by construction
- ② verified-TCB on one safe language
- ③ hard-real-time-capable (embedded-grade)
- ④ a full AI-native desktop
- ⑤ scales Pi 3 → workstation on one image
- ⑥ open
QNX has real-time but not AI, desktop, or openness. seL4 has capabilities but isn't a full OS. Linux has openness but not capability-by-construction or a safe-language core. Windows and macOS have the desktop but not real-time, not capability security, not a verified TCB. sigilOS spans embedded-RTOS rigor, verified security, and an AI-native desktop in one system — and that intersection is empty for everyone else.
See it in the product: the features and their mockups, SRDX remote desktop, the metal bring-up journal, and the daily build log. Framing is honest and comparison-based; where a competitor leads or ties, the matrix says so.