Lisa OS, for the people building on it.
An AI-native, self-updating Linux distribution: local models as a system service, per-app durable context, an append-only Ledger, and an OpenAI-compatible endpoint right on the machine. Flash it, boot it, build against it.
What shipped this week.
From docs/STATUS.md — verified on real hardware, not aspirational.
- Aug 5v20260805.81 shipped and is running on the reference hardware: the image now records its own package manifest at
/usr/lib/lisa/packages.manifest, so "which packages are in this image?" is answerable from the disk rather than the build log - Aug 5The ports lane (ADR-0051): llama.cpp, whisper.cpp, piper, Zen and the Settings fork are built when their PKGBUILD changes and consumed from
os/packages/ports.lockby sha256 — a release assembles, it no longer compiles pinned third-party code that has not changed - Aug 5The fork family is
lisa-desktop-*, and each package now replaces stock byprovides/conflictsrather than taking its name and winning onpkgrel— a race that silently loses the day Arch ships a higher version, which it did - Aug 5A CI review across all four repos: ~30 findings, the mechanical ones fixed the same day. The dominant class was gates that stayed green while asserting nothing — a skipped branch printing nothing, a fallback examining the wrong artifact, a pipeline whose exit status belonged to the wrong command
- Aug 3The
[lisa]pacman repo is live and signed — add oneServer=line and installlisa-desktop,lisa-apps,lisa-clion any Arch machine - Aug 3v20260802.63: the browser left the image (−363 MiB) — Zen now updates from the apps channel in minutes, no reboot; real semantic search shipped (
nomic-embed-text-v1.5behindlisa context, named in every Ledger row) - Aug 2The split: lisa-desktop (Shell surfaces + IME, becoming a hard fork of GNOME Shell — ADR-0038), lisa-apps (Mail, Surfer, Preview), lisa-packages (the index) — full history preserved, each building its own package (ADR-0039)
- Aug 2Design tokens:
branding/tokens.jsonis the one source for every surface color, enforced by a lint gate — the fourth violet is now a red build, not a review comment - Aug 1Preview app: images + PDF, Space-to-Quick-Look in Files (
NautilusPreviewer2), MCP agent surface; Mail renders HTML, groups multi-account folders, and composes replies/forwards (RFC-correct threading) - Aug 2Google OAuth brand verification approved — no more "unverified app" screen on Google sign-in
The system, in parts.
Each part is a way in. The numbering is the sheet's, not a ranking.
Local models as a system service
lisa-inferenced supervises a llama.cpp child and speaks an OpenAI-compatible API on the machine. Guided generation, a QoS scheduler that preempts background work, and embeddings — all behind one socket, and none of it reachable from the network.
An append-only Ledger
Every model call is written before it runs: no entry, no action. UPDATE and DELETE are refused by trigger, not by convention.
One audited door
lisa-remoted is the only daemon with network access. The rest cannot reach it — enforced by the unit sandbox, verified in CI.
Per-app durable memory
lisa-contextd holds namespace-isolated context with provenance on every chunk, hybrid search over it, and a wipe that leaves no residue.
Apps as agent surfaces
Apps declare MCP tools; the Agent Bus tiers every call by blast radius and escalates on untrusted provenance — deterministic code, not prompt text.
A/B image, signed index
Atomic updates with boot-counted rollback, plus [lisa] — a signed pacman repo you can point any Arch machine at.
Docs
Install, architecture, building apps, the lisa CLI.
API reference
The HTTP endpoint, D-Bus interfaces and tool manifests — generated from source.
Sheet CDownloads
Every release and its assets, with checksums.
Sheet DDesign
The token source every surface reads, enforced by a lint gate.
Start contributing.
Good first issues, straight from the repo. Pick one, comment to claim it, and open a PR.
Learn
The design is the source of truth, and every non-obvious decision is written down.