Moos

Moos is the malleable operating system that grows with the user

Moos is radically LLM-based, agentic and extendable. You talk to the system in prompts. You use its apps in plain language. And when an app does not have the feature, the step or the screen you had in mind, it offers to build it.

A dialog opens — the same kind of prompt your phone shows when an app wants the camera. It says what Moos would build, which rights it would need, and what it would not touch. You press yes, type a correction to have the brief rewritten, or decline.

Accepting starts a supervised build run in its own git worktree. It has to prove itself before it is allowed to change anything, it lands as a single commit, and taking it back out is one revert.

The proposal dialog, drawn here in this page’s own styling over a placeholder desktop. The real one lives in the desktop shell and can be reached from a text box inside any app, from the dock, or from chat.
Run it on your machine Source on GitHub Go and git, one binary, no account.

What happens when you say yes

A build run is a bounded, watchable unit of work, not a black box. The Builder app shows where it is; a brain icon sits in the dock and the header for as long as something is being built, whether or not a window is open.

  1. brainstorm
  2. design
  3. implement
  4. test
  5. auditneeds green tests
  6. deployneeds a diff scan
  7. done

The sequence is forward-only. The two filled marks are gates: the run stops there until the host has seen the proof itself.

It runs on evidence, not on its own report

No auditing without a green go test ./.... No deploying without a security scan over the real diff. Both are things the host watched exit. A claim in the transcript proves nothing.

Reaching further is not the run’s decision

A build that touches the desktop shell or the host machine drops to guided mode whatever you configured — decided from its own diff, not from its own account of itself.

You choose how close to stand

Autopilot reports when it is done. Guided stops twice: to approve the plan before code exists, and the merge before the system changes. Granular stops at every step.

Undo is one button

The run lands as a single merge commit, so taking it back is one revert and a rescan. If the new app has produced data in the meantime, Moos asks separately whether that should go back too.

a recording of one build run goes here /media/build-run.mp4
Roughly thirty seconds: the ask, the brief, the phases moving, the merge, and the new app opening from the dock.

The system underneath

moosd serve plus one URL gives you a desktop: header, dock, window manager. Every app is a supervised Go backend with a plain web UI and a manifest, so the system stays inspectable and gets faster as it grows. Close to forty apps ship with it — chat, terminal, editor, finder, browser, mail, calendar, paint, spreadsheet, a workflow canvas and the rest — and they are the ground the loop grows on, not the point of it.

Everything is local and everything is git. Data lives in a versioned partition where every revision is kept, rights are held in a permission store that asks before it grants, and the claude or codex CLI runs as you, on your machine. There is no account and no cloud service to sign up for.

The Moos desktop in a browser: a header with alarm, timer and clock, a dock along the bottom, and the Workflows canvas, Calendar, Paint and World Clock apps in overlapping windows.
The desktop with the Workflows canvas mid-edit, and the header’s alarm and timer fed by real host scheduler entries.
The same desktop after the transform: Paint’s canvas holds a photorealistic fish, and the status line reads “AI result applied (1537×1023)”. The desktop moments earlier: a hand-drawn fish on Paint’s canvas, “this sketch in photorealism” typed into the AI field, and the status line reading “Asking the AI (whole canvas)”. the sketch what came back
One sentence in Paint’s AI field — “this sketch in photorealism” — run against the whole canvas. Drag the divider: left the drawing, right what came back. The result replaces the canvas, undo restores it, and nothing reaches the disk until you save. The image goes to ChatGPT image generation through your own codex login, with no Moos service in between.

Depending on why you’re here

You build operating systems

The interesting part is not the code generation, it is the harness: what a system must prove before it is allowed to change itself. Forward-only phases, evidence the host observed rather than evidence the model reports, reach read from the diff, one merge commit so undo is one revert.

The architecture document is the binding contract.

You care about malleable software

Modification happens in the context of use. The ask can come from a text box inside any app, from the dock, or from chat — you never open a development environment, because there isn’t one to open.

Where it falls short, honestly: a run takes minutes, not milliseconds, so this is not the direct-manipulation immediacy the term usually means. And composition between apps is the weakest part of the design so far.

You work with LLMs

A compiler is deterministic; a model is not. So the system does not bootstrap on trust, it bootstraps on evidence. The question Moos is built around is what a system should refuse to accept as proof — and what it does when the answer turns out to be wrong anyway.

The requirements it grew from.

You just want to try it

One go build, one serve, one URL. The desktop boots without any AI configured — you get the apps, the window manager and the versioned data partition, and the Builder simply stays off until you log in to an LLM CLI.

The three commands.

What runs today, and what doesn’t

Moos is being built in the open and this section is kept honest on purpose. As of September 2026.

Runs today

  • The host daemon, the desktop shell, the app model and the launcher.
  • The versioned data partition and the permission store with its ask flow.
  • The base-app colony, SQLite and embeddings, and the header’s system controls reaching the real machine.
  • The whole loop above: gap detection, the brief, the proposal dialog, the Builder, the forward-only phase machine with its evidence rules, reach escalation, deploy and undo.
  • Reading its own error log: a crashed backend’s stacktrace, scattered over thirty ring entries, is collected back into one fault and offered to you as a repair through the same gated run.

Not yet, or not at all

  • Composition between apps. They are components with manifests, but there is no real story yet for wiring one into another.
  • Immediacy. A build run is minutes of work, not a direct-manipulation gesture.
  • Go 1.25 and git have to stay on your PATH at runtime — each app compiles on first launch.
  • Without a logged-in claude or codex CLI the desktop boots, but chat and the Builder are disabled.
  • One machine, one person. Moos binds to localhost and is not built to be exposed to a network.

Everything that is still open

The work is tracked in the repository itself: one Markdown file per issue under board/, moved between columns by a CLI and by the Board app inside Moos. This is that board, drawn the way the app draws it.

Open 24

  • #4featureadded 2026-08-19
    Base system: host skeleton in the VM container
  • #22featureadded 2026-08-19
    Data conversion to open formats
  • #27featureadded 2026-08-19
    Sync pull/restore from IPFS and Nextcloud backends
  • #28featureadded 2026-08-19
    XLSX conversion support in moos-convert
  • #30featureadded 2026-08-19
    Per-app container isolation on the host
  • #31featureadded 2026-08-19
    Native browser engine for the browser app
  • #32featureadded 2026-08-19
    Hardware control wiring in the VM
  • #33featureadded 2026-08-19
    npm package integration beyond vendoring
  • #55featureadded 2026-08-20
    Dock prompt bar drives multi-app flows end-to-end
  • #60ideaadded 2026-08-20
    Explore an MCP server / main CLI exposing host actions to the chat agent
  • #77taskadded 2026-08-20
    Report current local time
  • #85taskadded 2026-08-21
    Standalone delivery: host-isolated container, then empty VM
  • #99bugadded 2026-08-21
    Paint Copy does not reach the Moos clipboard: binary payloads need a blob path
  • #100featureadded 2026-08-21
    Paint: layer model with raster and vector layers
  • #148taskadded 2026-09-01
    Public demo hosting on moos.sala.ch: ephemeral instances behind an LLM gateway
  • #154featureadded 2026-09-01
    Video player app: local files, URLs and streams, YouTube/Vimeo, PiP/fullscreen, SRT subtitles, post-processing filters, timestamp deep links
  • #158featureadded 2026-09-01
    AAC-LC decoder in Go: clean-room from ISO/IEC 14496-3, with MPEG conformance streams as the acceptance test
  • #167bugadded 2026-09-02
    Flaky TestGapAcceptStartsABuildFromTheBrief under full-suite load
  • #172taskadded 2026-09-02
    Music library cannot reach outside the workspace: real music lives in ~/Music, and a symlink is refused as an escape
  • #176bugadded 2026-09-02
    One-shot /ws frames are lost when no shell is listening, or when one is busy
  • #179bugadded 2026-09-02
    Paperclips prompt parser executes a question that contains a known noun
  • #180bugadded 2026-09-02
    renderer3d scene serialiser must HTML-escape attributes, not Go-quote them
  • #185bugadded 2026-09-03
    recordEvidence has the same read-modify-write race, on the build store
  • #188featureadded 2026-09-03
    Git viewer with a commit graph, and a boot loader that starts a chosen revision

Doing 3

  • #25featureadded 2026-08-19
    Moos v0: implement the full protonema scope end-to-end
  • #81taskadded 2026-08-20
    Complete remaining waves without overlapping active worktrees
  • #153featureadded 2026-09-01
    Music player app: local MP3s and tracker modules, Winamp-style visualizations, top-bar mini player, equalizer

Done 161

  • #187featureadded 2026-09-03
    Global search: a shell overlay over apps, windows, files and the web
  • #186featureadded 2026-09-03
    App folders: categorise the apps, breadcrumbs and Details/Icons views in the launcher
  • #184bugadded 2026-09-03
    Transcript appends race each other: two concurrent tool calls can lose a line
  • #183featureadded 2026-09-03
    Watch a build happen: stream the agent's output instead of reading it once at the end
  • #182bugadded 2026-09-03
    A build run that ends without a result is recorded as done: is_error and subtype are never read
  • #163featureadded 2026-09-01
    Molecule viewer: chemistry on top of the 3D renderer
  • #181bugadded 2026-09-02
    LaTeX window shows no PDF: the sandboxed iframe cannot render a blob, and the placeholder never hides
  • #178bugadded 2026-09-02
    Flaky TestMatrixLogsInOnceAndKeepsTheToken: asserts on a sync that has not happened yet
  • #177taskadded 2026-09-02
    Full-parallelism gate flakes across packages, likely suite concurrency exceeding the machine
  • #175bugadded 2026-09-02
    board create hands out ids that are already taken on another branch
  • #174bugadded 2026-09-02
    Quota probe types into a trust dialog that painted in fragments
  • #173taskadded 2026-09-02
    Quota probe: make the trust precondition structural, not conventional
  • and 149 more, all of them in board/
Snapshot of 188 issues taken on 2026-09-03: 24 open, 3 doing, 161 done. Open and doing are complete; done shows the 12 most recent.

Run it

You need Go 1.25 or newer and git on your PATH, a modern browser, and — for chat and anything that builds — a claude or codex CLI you have installed and logged in to yourself.

$ git clone https://github.com/salam/moos.git && cd moos
$ go build -o bin/moosd ./cmd/moosd
$ ./bin/moosd doctor        # checks Go, git and the LLM CLI
$ ./bin/moosd build         # optional: precompile the app backends
$ ./bin/moosd serve

serve prints exactly one line: a one-time bootstrap URL. Opening it sets a session cookie and burns the token. That session auth is mandatory and cannot be switched off — without it, exposing the port would be remote code execution.

Questions people ask first

Isn’t this just a code generator with a window manager?

The generating part is not the interesting part. The claude or codex CLI does that on its own. The work went into what happens around it. A run has fixed phases and cannot skip one. It does not start auditing until go test ./... has come back green, and it does not deploy until a security scan has run over the diff. Moos watches both of those commands exit. It does not take the model’s word for it. If the diff touches the shell or the host, the run drops to guided mode and waits for you. Everything lands as one commit, so a bad answer costs one revert.

What stops it from breaking the system it is running on?

Four things. The run works in its own git worktree, so your tree does not change until the merge. It cannot reach audit or deploy without the two results above. A diff that touches the shell or the host machine escalates to guided mode and stops for you. The merge is one commit, so undo is one revert and a rescan. If the new app wrote data in the meantime, Moos asks about that separately.

Does my data or my code go anywhere?

Moos runs on your machine. Local daemon, local browser tab, local git, no account, no server to sign up for. What leaves is what the claude or codex CLI sends to its provider when you use chat or start a build. You installed that CLI, you are logged in to it, it runs as you, and your agreement with that vendor applies. Without it the desktop still boots and nothing leaves.

Which model does it use, and what does it cost?

Moos does not call a model API. It runs the LLM command-line tool you already have, currently claude or codex. The model and the bill are the ones you already have with that vendor. Moos itself costs nothing and is MIT licensed.

What if the app it builds is wrong?

There are four places to stop it. Decline the brief before anything is built. Type a correction and get a new brief. Stop the run at a phase boundary, in guided or granular mode. Or revert the merge commit afterwards. It will be wrong sometimes, so undo had to be cheap.

What does the name Moos mean?

Moos is German for moss. Moss grows over whatever ground it finds, without a plan. The system is meant to work the same way: the desktop is the ground, apps grow on it, and nothing has to be designed up front. The documents in the repository are named after it, from spore.md to protonema.md.

Work this builds on

None of this is new. Software that the person using it can reshape has been argued for, designed and built for sixty years, and the good arguments against the way Moos does it were made before Moos existed. Six of them, and where Moos stands against each.

  1. 1962

    Augmenting Human Intellect: A Conceptual Framework

    Douglas C. Engelbart — Stanford Research Institute, Summary Report AFOSR-3223, October 1962

    The thing to improve is not the computer, it is the whole system a person works inside: the human together with artifacts, language, methodology and training. Augmentation raises what a person can do; automation takes the person out of the loop, and Engelbart wanted the first. The strategy is bootstrapping — better tools for handling symbols make better thinking possible, which makes better tools possible, and the cycle compounds.

    Moos bootstraps in exactly this sense: it uses its own build loop to build its own parts. Where it is thinner than Engelbart is the other three. It improves your artifacts and does nothing for your language, your methodology or your training, and it changes the artifact for you rather than teaching you to change it. Whether that is augmentation or automation in Engelbart’s sense is a fair question to put to it, and the honest answer is that it depends on whether you read the brief before pressing yes.

  2. 1984

    Computer Software

    Alan Kay — Scientific American, September 1984

    Software is soft, Kay wrote, precisely because it has none of the physical constraints that make hardware expensive to change. Nothing about a program has to stay the way it is. His answer to the complexity that follows was architecture: systems built out of objects that behave like independent computers, and a user illusion that keeps the whole thing comprehensible from the outside.

    Moos takes the softness literally — the running system rewrites its own parts. What differs is what stands in for the missing physical constraint. Kay’s answer was architecture. The answer here is evidence: a change gets in only after the host has watched the tests and the scan exit.

  3. 1997

    The Educated Mind: How Cognitive Tools Shape Our Understanding

    Kieran Egan — University of Chicago Press, 1997

    Education pulls in three directions at once — Plato’s transmission of a true picture of reality, Rousseau’s unfolding of the individual, and plain socialisation — and Egan argues the three are incompatible, which is why the whole enterprise keeps failing. His alternative describes understanding by the cognitive tools that carry it: somatic, mythic, romantic, philosophic and ironic, each acquired in turn, each changing what a mind is able to think.

    Moos says in its own headline that it grows with the user, and Egan is the reason that claim is worth both taking seriously and doubting. An operating system is a cognitive tool, and one that reshapes itself around a person could develop with them instead of holding them at the level it shipped with. But a system that builds the thing for you can stand in for understanding just as easily as it can build it. Moos does not teach, and nothing in it makes you better at the work. Whether the tool grows the user or only itself is not settled by the design; it is settled by use.

  4. 2015

    Webstrates

    Clemens N. Klokmose, James R. Eagan, Siemen Baader, Wendy Mackay and Michel Beaudouin-Lafon — UIST 2015, Aarhus University and Télécom Paris

    A webstrate is a web page whose DOM is the document. The HTML, the CSS and the JavaScript that runs it all live inside one persistent, shared structure, and every change is synchronised to every other client as it happens. The line between a document you edit and an application you use stops existing.

    Moos wants the same collapse and stands on the same substrate — its apps are plain web UIs. The difference is where the malleability comes from. Webstrates gets it from immediacy: you change the running thing directly and it is changed. Moos gets it from a build run — minutes rather than keystrokes, and the change has to pass a gate first. That is slower and far less direct, and what it buys is a brief you can read beforehand and an undo afterwards. Webstrates was also built for several people at once; Moos runs for one.

  5. 2019

    Designing and Programming Malleable Software

    Philip Tchernavskij — PhD thesis, Université Paris-Saclay

    The application is the thing in the way. Functionality gets trapped inside app boundaries, so anything you want to combine across two programs is out of reach. The thesis argues for interfaces built from objects and interaction instruments that recombine freely, contributes entanglers as a composable way to specify interaction, and demonstrates them in a prototype called Tangler.

    Moos has no answer here, and this is the sharpest criticism of it. You can have a new app in minutes and change an existing one by asking, but they stay apps — components with manifests, not instruments you can pull out of one and drop into another. Composition between apps is the open problem, and this thesis named it precisely.

  6. 2025

    Malleable Software: Restoring User Agency in a World of Locked-Down Apps

    Geoffrey Litt, Josh Horowitz, Peter van Hardenberg and Todd Matthews — Ink & Switch, June 2025

    A gentle slope from user to creator: adapting your tools should get gradually harder instead of hitting a cliff where you suddenly have to be a programmer. The essay is also explicit that LLM code generation on its own does not deliver this — without open, composable infrastructure it just produces more isolated apps — and that the modifying is usually communal, done by someone nearby for the people around them.

    Moos is the move this essay warns about, so it is the test Moos has to pass. The claim is that the gentle slope is the dialog: the brief is readable without being a programmer, correcting it is one sentence, and refusing it costs nothing. The two things Moos does not answer are the essay’s own — composability, as above, and community, because it runs for one person on one machine.

Who is behind Moos

Moos is built by Matthias Sala, a software engineer in Zurich.

He started on QBasic and Visual Basic as a teenager. He studied computer science at ETH Zurich, with an exchange semester at the University of Stellenbosch, and worked at ETH as a teaching assistant: with Jürg Gutknecht, whose group built the Oberon language and the Bluebottle operating system, with Thomas Gross on compilers, and with Bertrand Meyer on Eiffel and design by contract. His semester project was Kulula, a component-oriented compiler for Bluebottle.

Then embedded smart systems at Siemens Corporate Technology, and research on context-aware information targeting at Xerox PARC. In the Bay Area he was a regular at the SuperHappyDevHouse hack nights, and he later ran SuperHappyDevFlat in Switzerland.

Moos comes from a question those places kept asking: how much of itself may a system rewrite, and what does it have to prove first?

More of his work: matthias.sala.ch.