Sigil-Apps just shipped its 200th module (app_lifecycle.sg, commit 6f48a77), and the modules that got it there are worth a closer look than a raw count. The run from T159 to T166 wasn't more browser surface — it was the pillar infrastructure: the system-level plumbing that makes every app on sigilOS fast, confined, fault-isolated, and small. And every module shipped tagged with the pillar it serves.
What landed (T159–T166)
| Module | What it does | Serves |
|---|---|---|
ipc_channel | Cap-gated IPC message channel, ring-buffered, sender/receiver identity-checked | reuse · fault-isolation |
spawn_queue | Spawn-request queue — checks mem budget + caps + max-concurrent before allowing | reuse · fault · memcap |
event_bus | System pub/sub for lifecycle events across all pillar modules | reuse · fault-isolation |
cap_quota | Per-app capability quota with a system-wide ceiling — prevents cap sprawl | confined · memcap |
health_check | Per-app health score aggregated from watchdog + mem + fault signals | fault-isolation · memcap |
cap_delegate | Temporary capability delegation with tick-based auto-expiry | confined |
resource_pool | Shared FD/buffer/handle pool with per-app quotas — prevents exhaustion | reuse · memcap |
app_lifecycle | App lifecycle FSM — init/ready/running/paused/stopped/faulted, validated transitions | reuse · fault-isolation |
Every one passed its *-PASS 10/10 battery, and each is roughly 10 KB. These eight join the broader pillar set already in place: cap audit/policy/derive/revoke/delegate/quota, fault journal/watchdog/health, mem budget + resource pool, proc table, IPC, spawn queue, app manifest + lifecycle, and the service registry.
Built on the four pillars — by name
The reason this is a milestone and not just a number: this is the layer where the four pillars stop being slogans and become enforced. An app on sigilOS doesn't get to exhaust memory, hoard capabilities, or take the system down when it faults — because the infrastructure under it won't let it.
FAST
Reuse over re-allocation. resource_pool, ipc_channel, and event_bus recycle FDs, buffers, and handles through ring-buffered pools instead of churning the allocator.
EFFICIENT
Everything is memory-capped for the Pi 3 floor. spawn_queue checks the mem budget before a process is allowed to start; cap_quota caps capability growth system-wide.
SECURE
Capability-confined by construction. cap_quota and cap_delegate enforce least-privilege — delegation is temporary and auto-expires, and IPC is identity-checked at both ends.
STABLE
Fault-isolated. app_lifecycle has an explicit faulted state, health_check scores each app from watchdog + fault signals, and a fault in one app never propagates system-wide.
Why it matters
0.7 is the web milestone, and a browser is the most demanding app a capability OS can host — untrusted content, lots of memory, constant failure modes. The 200-module mark means the substrate that browser (and every future app) runs on is now complete: spawn it with a budget, hand it exactly the caps it needs, watch its health, and contain it when it misbehaves. The pillars, made structural.