Moos is the malleable operating system that grows with the user
Moos is radically LLM-based, agentic and extendable. You talk to the system in prompts. You use its apps in plain language. And when an app does not have the feature, the step or the screen you had in mind, it offers to build it.
A dialog opens — the same kind of prompt your phone shows when an app wants the camera. It says what Moos would build, which rights it would need, and what it would not touch. You press yes, type a correction to have the brief rewritten, or decline.
Accepting starts a supervised build run in its own git worktree. It has to prove itself before it is allowed to change anything, it lands as a single commit, and taking it back out is one revert.
Moos has no kitchen timer. It could build one.
A Timer app: set a duration, it counts down, it rings, and it survives a reload. It would appear in the dock.
- rights
- notifications, the audio mixer, its own data folder
- would not
- touch the shell, the host, or another app’s data
- effort
- one build run, minutes, in its own git worktree
What happens when you say yes
A build run is a bounded, watchable unit of work, not a black box. The Builder app shows where it is; a brain icon sits in the dock and the header for as long as something is being built, whether or not a window is open.
- brainstorm
- design
- implement
- test
- auditneeds green tests
- deployneeds a diff scan
- done
The sequence is forward-only. The two filled marks are gates: the run stops there until the host has seen the proof itself.
It runs on evidence, not on its own report
No auditing without a green go test ./.... No deploying
without a security scan over the real diff. Both are things the host
watched exit. A claim in the transcript proves nothing.
Reaching further is not the run’s decision
A build that touches the desktop shell or the host machine drops to guided mode whatever you configured — decided from its own diff, not from its own account of itself.
You choose how close to stand
Autopilot reports when it is done. Guided stops twice: to approve the plan before code exists, and the merge before the system changes. Granular stops at every step.
Undo is one button
The run lands as a single merge commit, so taking it back is one revert and a rescan. If the new app has produced data in the meantime, Moos asks separately whether that should go back too.
The system underneath
moosd serve plus one URL gives you a desktop: header, dock,
window manager. Every app is a supervised Go backend with a plain web UI
and a manifest, so the system stays inspectable and gets faster as it
grows. Close to forty apps ship with it — chat, terminal, editor, finder,
browser, mail, calendar, paint, spreadsheet, a workflow canvas and the
rest — and they are the ground the loop grows on, not the point of it.
Everything is local and everything is git. Data lives in a versioned
partition where every revision is kept, rights are held in a permission
store that asks before it grants, and the claude or
codex CLI runs as you, on your machine. There is no account
and no cloud service to sign up for.
codex login, with no Moos service in between.
Depending on why you’re here
You build operating systems
The interesting part is not the code generation, it is the harness: what a system must prove before it is allowed to change itself. Forward-only phases, evidence the host observed rather than evidence the model reports, reach read from the diff, one merge commit so undo is one revert.
The architecture document is the binding contract.
You care about malleable software
Modification happens in the context of use. The ask can come from a text box inside any app, from the dock, or from chat — you never open a development environment, because there isn’t one to open.
Where it falls short, honestly: a run takes minutes, not milliseconds, so this is not the direct-manipulation immediacy the term usually means. And composition between apps is the weakest part of the design so far.
You work with LLMs
A compiler is deterministic; a model is not. So the system does not bootstrap on trust, it bootstraps on evidence. The question Moos is built around is what a system should refuse to accept as proof — and what it does when the answer turns out to be wrong anyway.
You just want to try it
One go build, one serve, one URL. The desktop
boots without any AI configured — you get the apps, the window manager
and the versioned data partition, and the Builder simply stays off until
you log in to an LLM CLI.
What runs today, and what doesn’t
Moos is being built in the open and this section is kept honest on purpose. As of September 2026.
Runs today
- The host daemon, the desktop shell, the app model and the launcher.
- The versioned data partition and the permission store with its ask flow.
- The base-app colony, SQLite and embeddings, and the header’s system controls reaching the real machine.
- The whole loop above: gap detection, the brief, the proposal dialog, the Builder, the forward-only phase machine with its evidence rules, reach escalation, deploy and undo.
- Reading its own error log: a crashed backend’s stacktrace, scattered over thirty ring entries, is collected back into one fault and offered to you as a repair through the same gated run.
Not yet, or not at all
- Composition between apps. They are components with manifests, but there is no real story yet for wiring one into another.
- Immediacy. A build run is minutes of work, not a direct-manipulation gesture.
- Go 1.25 and git have to stay on your
PATHat runtime — each app compiles on first launch. - Without a logged-in
claudeorcodexCLI the desktop boots, but chat and the Builder are disabled. - One machine, one person. Moos binds to localhost and is not built to be exposed to a network.
Everything that is still open
The work is tracked in the repository itself: one Markdown file per issue
under board/, moved between columns by a CLI and by the Board
app inside Moos. This is that board, drawn the way the app draws it.
Open 24
-
Base system: host skeleton in the VM container
-
Data conversion to open formats
-
Sync pull/restore from IPFS and Nextcloud backends
-
XLSX conversion support in moos-convert
-
Per-app container isolation on the host
-
Native browser engine for the browser app
-
Hardware control wiring in the VM
-
npm package integration beyond vendoring
-
Dock prompt bar drives multi-app flows end-to-end
-
Explore an MCP server / main CLI exposing host actions to the chat agent
-
Report current local time
-
Standalone delivery: host-isolated container, then empty VM
-
Paint Copy does not reach the Moos clipboard: binary payloads need a blob path
-
Paint: layer model with raster and vector layers
-
Public demo hosting on moos.sala.ch: ephemeral instances behind an LLM gateway
-
Video player app: local files, URLs and streams, YouTube/Vimeo, PiP/fullscreen, SRT subtitles, post-processing filters, timestamp deep links
-
AAC-LC decoder in Go: clean-room from ISO/IEC 14496-3, with MPEG conformance streams as the acceptance test
-
Flaky TestGapAcceptStartsABuildFromTheBrief under full-suite load
-
Music library cannot reach outside the workspace: real music lives in ~/Music, and a symlink is refused as an escape
-
One-shot /ws frames are lost when no shell is listening, or when one is busy
-
Paperclips prompt parser executes a question that contains a known noun
-
renderer3d scene serialiser must HTML-escape attributes, not Go-quote them
-
recordEvidence has the same read-modify-write race, on the build store
-
Git viewer with a commit graph, and a boot loader that starts a chosen revision
Doing 3
-
Moos v0: implement the full protonema scope end-to-end
-
Complete remaining waves without overlapping active worktrees
-
Music player app: local MP3s and tracker modules, Winamp-style visualizations, top-bar mini player, equalizer
Done 161
-
Global search: a shell overlay over apps, windows, files and the web
-
App folders: categorise the apps, breadcrumbs and Details/Icons views in the launcher
-
Transcript appends race each other: two concurrent tool calls can lose a line
-
Watch a build happen: stream the agent's output instead of reading it once at the end
-
A build run that ends without a result is recorded as done: is_error and subtype are never read
-
Molecule viewer: chemistry on top of the 3D renderer
-
LaTeX window shows no PDF: the sandboxed iframe cannot render a blob, and the placeholder never hides
-
Flaky TestMatrixLogsInOnceAndKeepsTheToken: asserts on a sync that has not happened yet
-
Full-parallelism gate flakes across packages, likely suite concurrency exceeding the machine
-
board create hands out ids that are already taken on another branch
-
Quota probe types into a trust dialog that painted in fragments
-
Quota probe: make the trust precondition structural, not conventional
- and 149 more, all of them in
board/
Run it
You need Go 1.25 or newer and git on your PATH,
a modern browser, and — for chat and anything that builds — a
claude or codex CLI you have installed and
logged in to yourself.
$ git clone https://github.com/salam/moos.git && cd moos
$ go build -o bin/moosd ./cmd/moosd
$ ./bin/moosd doctor # checks Go, git and the LLM CLI
$ ./bin/moosd build # optional: precompile the app backends
$ ./bin/moosd serve
serve prints exactly one line: a one-time bootstrap URL.
Opening it sets a session cookie and burns the token. That session auth
is mandatory and cannot be switched off — without it, exposing the port
would be remote code execution.
Questions people ask first
Isn’t this just a code generator with a window manager?
The generating part is not the interesting part. The claude or codex CLI does that on its own. The work went into what happens around it. A run has fixed phases and cannot skip one. It does not start auditing until go test ./... has come back green, and it does not deploy until a security scan has run over the diff. Moos watches both of those commands exit. It does not take the model’s word for it. If the diff touches the shell or the host, the run drops to guided mode and waits for you. Everything lands as one commit, so a bad answer costs one revert.
What stops it from breaking the system it is running on?
Four things. The run works in its own git worktree, so your tree does not change until the merge. It cannot reach audit or deploy without the two results above. A diff that touches the shell or the host machine escalates to guided mode and stops for you. The merge is one commit, so undo is one revert and a rescan. If the new app wrote data in the meantime, Moos asks about that separately.
Does my data or my code go anywhere?
Moos runs on your machine. Local daemon, local browser tab, local git, no account, no server to sign up for. What leaves is what the claude or codex CLI sends to its provider when you use chat or start a build. You installed that CLI, you are logged in to it, it runs as you, and your agreement with that vendor applies. Without it the desktop still boots and nothing leaves.
Which model does it use, and what does it cost?
Moos does not call a model API. It runs the LLM command-line tool you already have, currently claude or codex. The model and the bill are the ones you already have with that vendor. Moos itself costs nothing and is MIT licensed.
What if the app it builds is wrong?
There are four places to stop it. Decline the brief before anything is built. Type a correction and get a new brief. Stop the run at a phase boundary, in guided or granular mode. Or revert the merge commit afterwards. It will be wrong sometimes, so undo had to be cheap.
What does the name Moos mean?
Moos is German for moss. Moss grows over whatever ground it finds, without a plan. The system is meant to work the same way: the desktop is the ground, apps grow on it, and nothing has to be designed up front. The documents in the repository are named after it, from spore.md to protonema.md.
Work this builds on
None of this is new. Software that the person using it can reshape has been argued for, designed and built for sixty years, and the good arguments against the way Moos does it were made before Moos existed. Six of them, and where Moos stands against each.
-
1962
Augmenting Human Intellect: A Conceptual Framework
Douglas C. Engelbart — Stanford Research Institute, Summary Report AFOSR-3223, October 1962
The thing to improve is not the computer, it is the whole system a person works inside: the human together with artifacts, language, methodology and training. Augmentation raises what a person can do; automation takes the person out of the loop, and Engelbart wanted the first. The strategy is bootstrapping — better tools for handling symbols make better thinking possible, which makes better tools possible, and the cycle compounds.
Moos bootstraps in exactly this sense: it uses its own build loop to build its own parts. Where it is thinner than Engelbart is the other three. It improves your artifacts and does nothing for your language, your methodology or your training, and it changes the artifact for you rather than teaching you to change it. Whether that is augmentation or automation in Engelbart’s sense is a fair question to put to it, and the honest answer is that it depends on whether you read the brief before pressing yes.
-
1984
Computer Software
Alan Kay — Scientific American, September 1984
Software is soft, Kay wrote, precisely because it has none of the physical constraints that make hardware expensive to change. Nothing about a program has to stay the way it is. His answer to the complexity that follows was architecture: systems built out of objects that behave like independent computers, and a user illusion that keeps the whole thing comprehensible from the outside.
Moos takes the softness literally — the running system rewrites its own parts. What differs is what stands in for the missing physical constraint. Kay’s answer was architecture. The answer here is evidence: a change gets in only after the host has watched the tests and the scan exit.
-
1997
The Educated Mind: How Cognitive Tools Shape Our Understanding
Kieran Egan — University of Chicago Press, 1997
Education pulls in three directions at once — Plato’s transmission of a true picture of reality, Rousseau’s unfolding of the individual, and plain socialisation — and Egan argues the three are incompatible, which is why the whole enterprise keeps failing. His alternative describes understanding by the cognitive tools that carry it: somatic, mythic, romantic, philosophic and ironic, each acquired in turn, each changing what a mind is able to think.
Moos says in its own headline that it grows with the user, and Egan is the reason that claim is worth both taking seriously and doubting. An operating system is a cognitive tool, and one that reshapes itself around a person could develop with them instead of holding them at the level it shipped with. But a system that builds the thing for you can stand in for understanding just as easily as it can build it. Moos does not teach, and nothing in it makes you better at the work. Whether the tool grows the user or only itself is not settled by the design; it is settled by use.
-
2015
Webstrates
Clemens N. Klokmose, James R. Eagan, Siemen Baader, Wendy Mackay and Michel Beaudouin-Lafon — UIST 2015, Aarhus University and Télécom Paris
A webstrate is a web page whose DOM is the document. The HTML, the CSS and the JavaScript that runs it all live inside one persistent, shared structure, and every change is synchronised to every other client as it happens. The line between a document you edit and an application you use stops existing.
Moos wants the same collapse and stands on the same substrate — its apps are plain web UIs. The difference is where the malleability comes from. Webstrates gets it from immediacy: you change the running thing directly and it is changed. Moos gets it from a build run — minutes rather than keystrokes, and the change has to pass a gate first. That is slower and far less direct, and what it buys is a brief you can read beforehand and an undo afterwards. Webstrates was also built for several people at once; Moos runs for one.
-
2019
Designing and Programming Malleable Software
Philip Tchernavskij — PhD thesis, Université Paris-Saclay
The application is the thing in the way. Functionality gets trapped inside app boundaries, so anything you want to combine across two programs is out of reach. The thesis argues for interfaces built from objects and interaction instruments that recombine freely, contributes entanglers as a composable way to specify interaction, and demonstrates them in a prototype called Tangler.
Moos has no answer here, and this is the sharpest criticism of it. You can have a new app in minutes and change an existing one by asking, but they stay apps — components with manifests, not instruments you can pull out of one and drop into another. Composition between apps is the open problem, and this thesis named it precisely.
-
2025
Malleable Software: Restoring User Agency in a World of Locked-Down Apps
Geoffrey Litt, Josh Horowitz, Peter van Hardenberg and Todd Matthews — Ink & Switch, June 2025
A gentle slope from user to creator: adapting your tools should get gradually harder instead of hitting a cliff where you suddenly have to be a programmer. The essay is also explicit that LLM code generation on its own does not deliver this — without open, composable infrastructure it just produces more isolated apps — and that the modifying is usually communal, done by someone nearby for the people around them.
Moos is the move this essay warns about, so it is the test Moos has to pass. The claim is that the gentle slope is the dialog: the brief is readable without being a programmer, correcting it is one sentence, and refusing it costs nothing. The two things Moos does not answer are the essay’s own — composability, as above, and community, because it runs for one person on one machine.
Who is behind Moos
Moos is built by Matthias Sala, a software engineer in Zurich.
He started on QBasic and Visual Basic as a teenager. He studied computer science at ETH Zurich, with an exchange semester at the University of Stellenbosch, and worked at ETH as a teaching assistant: with Jürg Gutknecht, whose group built the Oberon language and the Bluebottle operating system, with Thomas Gross on compilers, and with Bertrand Meyer on Eiffel and design by contract. His semester project was Kulula, a component-oriented compiler for Bluebottle.
Then embedded smart systems at Siemens Corporate Technology, and research on context-aware information targeting at Xerox PARC. In the Bay Area he was a regular at the SuperHappyDevHouse hack nights, and he later ran SuperHappyDevFlat in Switzerland.
Moos comes from a question those places kept asking: how much of itself may a system rewrite, and what does it have to prove first?
More of his work: matthias.sala.ch.