Spaces OS dispatch #5

Week 8 - Jun 25th

This week is a quieter week. Now that we have a functioning multi-machine harness, it's time to turn our focus deeper in the operating system and tackle more foundational topics.

We had conversations around what it would look like to automate deployment and monitoring of the machines? We could have a stream of events coming from the machines, and allows the agents to react on temperature, firewall, login/logout, disk capacity and other events. Similarly, can we provide narrow administrative access to the agents that doesn't compromise the integrity of our systems?

Sandboxing architecture

Before touching other places of the system, it was time to re-visit our agent sandboxing to provide better security guarantees. Since we control the OS, we can rely on the latest Linux kernel's Landlock API to lock down which Kernel calls can be made. This work is still in progress and expected to land sometime next week.

Something is also something we see useful to execute third-party applications. A friend might share a vibe-coded application, and as much as the friend is trusted, the resulting code not so much.

Better audio support

We are still working on making Speech-to-Text instant and accurate. That includes tuning the model, such as giving context for it to understand "nixos" instead of "nick's OS".

Another aspect is the quality of the microphone. Something on our radar where we might end up adding a setup dialog for the tuning.

Thinking about user consent, the small red recording dot is now a large glowing red bar that goes across the screen:

Changelog

llama-swap hardening (pinpox)

pi-chat polish (pinpox)

Checks / CI (a-kenji, zimbatm)

Release ISO

https://github.com/generational-infrastructure/spaces-os/releases/tag/spaces-2026.06.26