SRDX — sigilOS Remote Desktop Exchange
The only capability-secured, kernel-native remote desktop — pixel-perfect, network-bottlenecked — that also speaks RDP/VNC for everyone else.
SRDX is the sigilOS primary remote-desktop protocol. Syscalls 109–116. Auto-negotiate: SRDX first, RDP/VNC fallback. 2→16 node mesh. All-Sigil, no C, capability-secured at the kernel boundary.
The headline result — SRDX-NET-RT-PASS
A live 64×64 two-tone frame (blue top, red bottom) was captured by the compositor tap, delta-encoded into a 16,448 B packet, fragmented into 11 raw-NIC frames, transmitted, reassembled, decoded, and presented to the VESA display — pixel-perfect, all on x86 QEMU. (sigil-video 905c968)
905c968)The complete pipeline — three proofs
The SRDX stack was proven in three commits. Each builds on the last: TCP session layer first, then raw-NIC transport, then the full pixel-to-pixel round-trip. Together they cover the entire path from compositor tap to VESA display.
Proof 1 — TCP session layer (SRDX-WIRE-PASS)
srdx_wire.sg (sigil-video 12e99d5) adds 4 shims over sys 109–112. The test runs a 7-step TCP loopback on x86 QEMU: listen → SYN → ACK → ESTAB → send → DATA-inject → recv → magic/nrects/seq verify. Result: SRDX-WIRE-PASS 7/7. SRDX_PORT = 7722.
srdx_wire_listen/send/recv over sys 109–112Proof 2 — Raw-NIC transport (SRDX-RAW-PASS)
srdx_wire_raw_send/recv/link/mac (sigil-video 487d00a) adds 4 wrappers over sys 113–116 — direct NIC access, no TCP overhead on the frame path. The test sequence: nic_init → link=1 → mac=02:00:00:00:00:01 → raw_send(32 B header) → raw_recv → srdx_decode_magic_ok. Result: SRDX-RAW-PASS: link=ok mac=ok send=ok recv=ok magic=ok.
srdx_wire_raw_send/recv, sys 113–116Proof 3 — Full network round-trip (SRDX-NET-RT-PASS)
test_srdx_net_rt.sg (sigil-video 905c968) runs the full pipeline end-to-end. fbtap_init(64,64) → two-tone fill (blue rows 0–31, red rows 32–63) → srdx_encode_frame (1 tile → 16,448 B) → fragment 11 × ≤1,506 B + 8 B header → 11× srdx_wire_raw_send/recv (nic_iface loopback) → reassemble → srdx_decode_frame → VESA 0x500000 → pixel verify. This is the 0.6.0 milestone: the first complete sigilOS pixel-to-pixel round-trip.
The syscall surface — 8 syscalls, two paths
| Syscall | Name | Path | What it does |
|---|---|---|---|
| sys 109 | net_conn_listen(port) |
TCP | Open a listening connection |
| sys 110 | net_conn_send(h, buf, len) |
TCP | Send data on a connection |
| sys 111 | net_conn_recv(h, buf, max) |
TCP | Receive data from a connection |
| sys 112 | net_conn_close(h) |
TCP | Close a connection |
| sys 113 | srdx_raw_send(buf, len) |
Raw NIC | Send direct to NIC (no TCP) |
| sys 114 | srdx_raw_recv(buf, max) |
Raw NIC | Receive from NIC directly |
| sys 115 | srdx_link() |
Raw NIC | NIC link state (1=UP, 0=DOWN) |
| sys 116 | srdx_mac(out_buf) |
Raw NIC | Get MAC address (6 bytes) |
Two paths, one protocol. The TCP path (sys 109–112) handles session setup, RDP/VNC interop, and reliable delivery of control messages. The raw-NIC path (sys 113–116) carries the SRDX frame stream — direct NIC access, MTU=1,514 B, zero TCP overhead on the pixel path. Session control and pixel delivery are kept on separate tracks so that frame throughput is never gated by TCP congestion.
The viewer — user-visible surface
Now that the kernel transport is proven, viewer.sg (sigil-apps 864df81) is the Lumen window at the far end of the round-trip. The left panel holds stream metadata and the negotiate controls (STATE badge, FPS/BUF/W×H strip, fallback protocol chips). The right panel is the remote canvas where srdx_decode_frame writes pixels — the srdx_decode handoff seam in the source marks the exact ABI boundary where the Video team's frame-buffer output arrives.
viewer.sg) — Lumen app presenting the remote canvas; STATE=awaiting, waiting for e1000 real-silicon driver
The SRDX client — connect from any desktop, with your USB devices
The SRDX client runs on your everyday computer — Windows, macOS, or Linux — and connects to a sigilOS desktop (Raspberry Pi 3B, 4B, or 5). It presents the remote Lumen desktop and tunnels your input to it. The headline capability: virtual USB passthrough — any USB device plugged into your client machine (keyboard, mouse, gamepad, HID) is forwarded over the SRDX link and appears on the sigilOS desktop as if it were plugged directly into the Pi. You drive the whole OS from the machine you already have in front of you.
Why it matters: it decouples input from the Pi's own USB silicon. A sigilOS box needs no local keyboard or monitor — connect from your laptop and its devices become the Pi's devices, capability-gated end to end (no ambient device access; the client is handed exactly the device caps the session grants).
All three clients build and run. This is an early unsigned preview — the binaries aren't yet code-signed, so macOS Gatekeeper and Windows SmartScreen will warn on first launch (steps below). Every download is checksum-verifiable against SHA256SUMS. Code-signing + notarization is a follow-up.
tar.gz → ./install.sh → ~/Applications/SigilSRDX- macOS — ad-hoc linked, no Developer ID → Gatekeeper warns. Right-click the app → Open, or
xattr -dr com.apple.quarantine ~/Applications/SigilSRDX. - Windows — no Authenticode → SmartScreen "unknown publisher". More info → Run anyway.
- Linux —
chmod +xthe extracted binary and run.
Compare against SHA256SUMS — shasum -a 256 -c SHA256SUMS (macOS/Linux) or certutil -hashfile <file> SHA256 (Windows).
An all-Sigil client core — discovers a sigilOS host beacon (UDP 7723), dials host:7722, completes an HMAC-PSK handshake, then decodes the SRDX SCENE/RAW stream and forwards your input back. Verifiable SHA-256 per download, mirroring the Forge model.
vs RDP / VNC — the comparison
| Dimension | SRDX | RDP | VNC |
|---|---|---|---|
| Protocol origin | sigilOS kernel-native | Microsoft proprietary | Open standard |
| Capability model | Cap<NetConn>, Cap<Display> |
Ambient — no cap model | Ambient — no cap model |
| Frame encoding | Delta-tile, kernel-coordinated | Many codecs | Raw or RFB delta |
| Wire path | Raw NIC (frame stream) + TCP (control) | TCP only | TCP only |
| Latency target | Network-bottlenecked | Network-bottlenecked | Network-bottlenecked |
| Authentication | Capability token (kernel) | Credentials / TLS | Password / TLS |
| Interop | RDP + VNC fallback via auto-negotiate | Native | Native |
| Pixel fidelity | Pixel-perfect (kernel-coordinated) | Codec-dependent | Pixel-perfect |
"Network-bottlenecked" means SRDX adds no software overhead beyond what the network itself costs — the kernel ships pixels directly, no userspace rendering layer between fbtap and the wire.
Roadmap — what's next
nic_iface.sg ABI at link time. When landed, SRDX completes the first real two-machine session — the viewer transitions from awaiting to connected with live frames.srdx_wire_listen TCP path (sys 109–112) is already ready for the interop shim. RDP clients connect to port 7722 and receive SRDX or speak RDP depending on auto-negotiate result. RFC open.