Introducing Citadel: Secure Computing for a Hostile Internet

Most operating systems run on a quiet assumption: that your computer is on your side. The kernel trusts the applications it runs. The firmware trusts the kernel. Every component assumes that nothing was swapped out from under it. That assumption holds for most people, most of the time. For a specific group of people, it never holds.

Journalists, activists, human-rights defenders, security researchers, and the employees of organizations under targeted attack live with a different threat model. Their adversaries are patient, well-funded, and technically skilled. For them, an OS that merely reduces the attack surface is not enough. The base system itself has to be structured so that persistent compromise becomes structurally difficult.

What Citadel changes

The core operating system is mounted read-only and protected by dm-verity. If a single bit changes, the system refuses to boot. Every restart is a return to a state that is cryptographically verified.

Between your work and the outside world sit the realms. Each realm is an isolated computing environment with its own applications, network, and data, created per project, client, or security context. A compromise in one realm does not reach another.

Everything is verifiable. The OS updates as a single signed binary blob, and every binary builds reproducibly from public sources. If you do not want to trust our binaries, you do not have to. Verify them yourself, or wait for an independent researcher to do it and publish the result.

A lineage, not a rewrite

Citadel is not a separate operating system. It is the read-only computing base at the heart of Subgraph OS, the immutable layer that realms run on. The lineage continues, the same kind of usable desktop OS for people facing real adversaries, but rebuilt around an immutable core and modern isolation primitives.

The original Subgraph OS was one of the first desktop operating systems to treat the Linux desktop as an attack surface that could be contained. Citadel goes further: containment becomes the ground the operating system itself is built on.

Later posts will look at the architecture layers and the hypervisor design, and at what reproducible builds actually buy you. For now, if the phrase “security debt” bothers you, that is the problem Citadel is aiming at.