Cicada.OS — private laptop OS

About BALTHASAR-2 Cicada.OS is a privacy and security focused laptop operating system, developed as an open source project. It hardens defaults, owns the launcher, and ships Graphene-shaped permissions — without making you fight the machine for Wi‑Fi, files, or a browser. Official releases land on the download page. Installation instructions are on the install page. Claims stay honest about silicon — see the table below. Status — read this before you trust itPRE-ALPHA Cicada boots to a Hyprland desktop on an Intel MacBook Air. Most of the hardening on this site is verified structurally — the configuration says the thing — and a growing part of it is now verified against a real Linux kernel. Little of it has been exercised on hardware end to end. Do not rely on this for anything that matters yet. On a real kernelFirewall + VPN kill switch, NTS time, Tor bootstrap, onion namespace, session duress wipe In simulationUSB gate and its restore path, watchdog arming, escape hatches, beacon signing and alarm Needs the hardwarehardened_malloc under Helium, chipset watchdog reset, kernel USB refusal, LoRa beacon Splitting “unverified” into those three lists is not bookkeeping — it is what exposed the last five defects, including a session duress credential that had never fired. Full list: Status in the README. Claims — do not collapse themTHREAT MODEL ClaimWhen true Trackers / school filter / cold disk thief Strong passphrase + Helium policy + LUKS — mostly now LEO with AFU (on or just locked) Never “can’t.” Shorten the window. Still userspace. Firmware / evil maid on Apple EFI Air Never. Heads/PureBoot is a different laptop. Cicada is its own OS No unsandboxed dock path; scopes; Work UID; signed channel. Identity, not uncrackability.