# Moos

> Moos is a malleable operating system that grows with the user: radically LLM-based,
> agentic and extendable. It boots to a browser desktop. You talk to the system in prompts
> and use its apps in plain language, and when an app does not have the feature, step or
> screen you had in mind, a dialog opens — the same kind of prompt a phone shows when an
> app wants the camera — with a short brief of what Moos would build, which rights it
> would need and what it would not touch. Accepting starts a supervised build run in its
> own git worktree that must prove itself before the system is allowed to change, lands as
> a single merge commit, and undoes with one revert. Built by Matthias Sala in Zurich.
> Free, source public, runs locally.

## What it is

- **Kind of thing:** an operating system, written in Go, that serves a desktop into a
  browser tab from a single local daemon (`moosd serve`). Header, dock, window manager.
  Apps are supervised Go backends with plain web UIs and a manifest.
- **The loop it exists for:** the edge of the system is a question, not an error. The ask
  can come from a text box inside any app, from the dock, or from chat.
- **What is unusual about it:** not the code generation — the harness around it. What the
  system must *prove* before it is allowed to rewrite itself.

## How a build run is constrained

- **Forward-only phases:** brainstorm, design, implement, test, audit, deploy, done. The
  sequence cannot be skipped or reordered.
- **Evidence gates:** no auditing without a green `go test ./...`; no deploying without a
  security scan over the real diff. Both are exits the host watched itself. A claim in the
  model's transcript proves nothing.
- **Reach escalation:** a diff that touches the desktop shell or the host machine drops the
  run to guided mode whatever the user configured — decided from the diff, not from the
  run's own account of itself.
- **Supervision levels:** autopilot (reports when done), guided (stops to approve the plan
  and the merge), granular (stops at every step).
- **Undo:** one merge commit per run, so reverting is one revert plus a rescan. If the new
  app produced data, Moos asks separately whether that goes back too.
- **Isolation:** each run works in its own git worktree; nothing is touched before a merge.

## The board

<!-- board:start — generated by tools/make-board.py -->
The board is 185 issues in the repository under `board/`, one Markdown file each: 23 open, 3 doing, 159 done (as of 2026-09-03). Open and doing are listed in full on the site.
<!-- board:end -->

## Status as of September 2026

Running: the host daemon, desktop shell, app model and launcher; the versioned data
partition and the permission store; roughly thirty base apps; SQLite and embeddings; the
complete capability-gap loop (gap detection, brief, proposal dialog, Builder app, phase
machine with its evidence rules, reach escalation, deploy, undo); and self-repair from its
own error log, where a crashed backend's stacktrace scattered over thirty ring entries is
collected into one fault and offered back as a gated repair.

Not yet: composition between apps; immediacy (a run is minutes, not a gesture). Go 1.25 and
git must stay on `PATH` at runtime because each app compiles on first launch. Without a
logged-in `claude` or `codex` CLI the desktop boots but chat and the Builder are disabled.
Moos binds to localhost and is not designed to be exposed to a network.

## Privacy and cost

Moos runs entirely on the user's machine: local daemon, local browser, local git, no
account, no cloud service. It does not call a model API itself — it drives a `claude` or
`codex` CLI that the user installs and logs in to, running as that user, so the model, the
plan and the bill belong to the user's own agreement with that vendor. Moos is free.

## Quickstart

```
git clone https://github.com/salam/moos.git && cd moos
go build -o bin/moosd ./cmd/moosd
./bin/moosd doctor        # checks Go, git and the LLM CLI
./bin/moosd build         # optional: precompile the app backends
./bin/moosd serve
```

`serve` prints one line: a single-use bootstrap URL. Opening it sets a session cookie and
burns the token. Session auth is mandatory and cannot be disabled.

## Links

- [Site](https://moos.sala.ch/): this page.
- [Source](https://github.com/salam/moos): the repository.
- [Architecture](https://github.com/salam/moos/blob/main/docs/architecture.md): the binding
  technical contract, including the build-run rules.
- [protonema.md](https://github.com/salam/moos/blob/main/protonema.md): the requirements
  document the system grew from.
- [Matthias Sala](https://matthias.sala.ch/): the author. Started on QBasic and Visual
  Basic as a teenager. Studied computer science at ETH Zurich with an exchange semester at
  the University of Stellenbosch, and was a teaching assistant at ETH with Jürg Gutknecht
  (Oberon, Bluebottle), Thomas Gross (compilers) and Bertrand Meyer (Eiffel). Semester
  project: [Kulula](https://matthias.sala.ch/kulula/), a component-oriented compiler for
  Bluebottle. Later embedded smart systems at Siemens Corporate Technology and
  context-aware information targeting at Xerox PARC; a regular at SuperHappyDevHouse in
  the Bay Area, and ran SuperHappyDevFlat in Switzerland.