Auditability
One safe language, top to bottom
EFI stub, kernel, drivers, userland — all Sigil, all memory-safe, all reviewable
by one team in one language. No C substrate to carve exceptions around.
INDUSTRY PACKET · DEFENSE & SOVEREIGN SYSTEMS
A trust chain you can verify — not one you have to take on faith.
Tactical edge · Cross-domain & MILS separation · Sovereign infrastructure
In defense and sovereign deployments, the question isn't only "is it secure" — it's "can you prove what's in it, and does anything in the trust chain answer to someone else." sigilOS is one auditable safe language from the EFI stub up, with a reproducible verified toolchain and hard capability separation built into the substrate.
The problem
The incumbent stacks are millions of lines of C and C++ carrying decades of memory-unsafety, sitting under opaque firmware and vendor blobs no one on the program can fully audit. "Separation" between missions or classification levels is bolted on with partitioning hypervisors. And the supply chain is a bullseye — you're often trusting a binary toolchain you can't independently reproduce. Sovereignty means not having to trust any of that on someone else's word.
Why sigilOS fits
Supply chain
Reproducible, verified TCB
The compiler self-hosts to a bit-identical binary from a byte-reproducible seed.
You can rebuild the trust base and prove it matches — verify the artifact, don't trust the source.
Separation
Capability isolation by construction
No ambient authority. Missions and components hold only the capabilities they were
granted, enforced at the hardware seam — MILS-style separation as the substrate, not an add-on.
No opaque blobs
Drivers are Sigil, in the open
The hardware bring-up is written and reviewable in the same safe language — not a
binary blob you're forced to trust and can't inspect.
Tactical edge
Pi-class to workstation, one image
The same verified base runs on a small rugged node and a command workstation — one
assurance argument across the fleet, with SRDX for secure remote control.
Untrusted media
Quarantine + trust-on-verify
Unknown USB/removable media lands in a cap-isolated sandbox and is trusted only on
a verified content-hash diff — the field-data problem, handled by the model.
Why this is fundable and rare
"Memory-safe, capability-secure, reproducibly-verifiable, sovereign OS on one language, scaling from the tactical edge to the desktop" is a combination no incumbent offers — and it's exactly the direction defense procurement and national digital-sovereignty programs are pushing toward. That gap is the opportunity. See the difference model.
Where we actually are — no hype
- Boots on real x86-64 hardware; the capability model, memory-safe all-Sigil stack, and reproducible self-hosting compiler are real today.
- IN PROGRESS Driver coverage, Pi bring-up, and hardening are active work, developed in the open — including the honest hard parts.
- NOT YET sigilOS is pre-1.0, and it carries no security accreditation (Common Criteria, DO-178C, RMF/ATO, etc.). We will not claim otherwise. What we offer is an architecture built for that path, and a partner to walk it — transparently, with a trust base you can actually verify.
Who this is for
Defense primes, national labs, and sovereign-infrastructure programs architecting for a horizon where an auditable, reproducible, capability-separated base changes the accreditation and sovereignty calculus. If you need an accredited system fielded now, that's not us yet — if you're defining what comes after the C-and-blob era, let's talk.