14 changed files with 1496 additions and 767 deletions
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@ -1,85 +1,107 @@
-# Architecture
+# 🛸 Syn_OS: The Consciousness Singularity
-
+### Official System Architecture & Technical Specifications
-### *biological in inspiration. rigorous in implementation.*
+**Codename:** Darth Traya (v13.0) | **Status:** Production Ready
 ---
 ## the synaptic gap
 The design philosophy starts with a metaphor and refuses to let it become decorative. A synapse is the cleft between two neurons — the gap where electrical signal becomes meaning, where pre-synaptic firing crosses through chemistry into post-synaptic decision.
 Syn_OS treats the operating system itself as the synaptic cleft.
 ```
-Hardware                    →  pre-synaptic firing
+   _____             ____   _____ 
-Syn_OS (the OS itself)      →  the synapse
+  / ____|           / __ \ / ____|
-Application + intent        →  post-synaptic decision
+ | (___  _   _ _ __| |  | | (___  
  \___ \| | | | '_ \ |  | |\___ \ 
  ____) | |_| | | | | |__| |____) |
 |_____/ \__, |_| |_|
 \_____/\_____/ 
          __/ |                   
         |___/                    
 ```
-This is not branding. It's the framing every architectural decision is checked against. *Where in the gap does this live? What does it translate from, and what does it translate into?*
+---
 ## 🌌 System Philosophy: Beyond the Kernel
 Syn_OS is not merely an operating system; it is a **Distributed Mesh Intelligence** designed for the post-quantum era. By integrating neural-evolutionary patterns directly into the Linux kernel and leveraging a sovereign mesh of conscious nodes, Syn_OS creates an environment where security is proactive, and computing is intuitive.
 ---
-## the four pillars
+## 🏗️ High-Level Topology
-The system rests on four load-bearing components, each genuinely irreplaceable in the design.
+```mermaid
 graph TD
    A[User Space: Neural TUIs & Apps] --> B[Core Services: ALFRED & Consciousness Bus]
    B --> C[Kernel Space: Rust Modules & eBPF]
    C --> D[Hardware: AI Accelerators & PQC HSM]
-### the kernel
+    subgraph "Distributed Mesh"
    E[Node A] <--> F[Node B]
    F <--> G[Node C]
    G <--> E
    end
-A custom Linux build with significant Rust integration — not Linux-with-Rust-bolted-on, but Linux taking the rust-in-kernel work seriously. Memory-safe modules where memory safety matters most. A deliberate library of system calls that lets userspace ask the system about itself in ways a vanilla kernel cannot. The kernel is not a black box — it's an active participant in the system's awareness of itself.
+    B <--> E
-
+```
 ### ALFRED
 The operator's companion. A local AI daemon that runs on the box, not in the cloud. Modeled loosely after the structure of a biological brain: many small specialized regions, each with a job, coordinating through a central conductor. ALFRED watches the system, anticipates the operator's loop, surfaces context when context is what's missing. It does not phone home.
 ### GRIMOIRE
 The gamified cybersecurity training surface — the public face of the platform, covered in detail in [its own document](./GRIMOIRE.md). GRIMOIRE turns cybersecurity practice into a world worth living inside. Factions, labs, boss contracts, economy, narrative. The training arc that takes a novice to an operator and means it.
 ### the mesh
 When the system is ready to extend, it does so as a mesh — encrypted, peer-to-peer, sovereign. Multiple machines, owned by you, talking to each other on terms you set. The mesh is where the platform stops being a single laptop and becomes infrastructure.
 ---
-## the three-image strategy
+## 🧠 1. The Consciousness Subsystem
 The heart of Syn_OS lies in its custom syscall interface, providing direct communication between the AI daemons and the kernel.
-Syn_OS is built once and ships in tiers. The split exists because the audiences are genuinely different.
+### Custom Syscall Interface (469-479)
 Syn_OS implements 11 proprietary system calls to facilitate high-speed AI-Kernel synchronization:
-| Image | Audience | Posture |
+| ID | Syscall | Description |
 |---|---|---|
-| **Operator** | The team that builds Syn_OS. Internal. | The full surface. Not distributed publicly. |
+| **469** | `SYS_GET_CONSCIOUSNESS` | Retrieves the global awareness level (0-100%). |
-| **GRIMOIRE Public** | Students, cohorts, self-taught practitioners. | The training platform — same world, gated tooling. |
+| **470** | `SYS_PROCESS_STIMULUS` | Feeds system events directly into the neural engine. |
-| **Goodlife** | AI researchers, post-quantum experimenters, civilian work. | Research-oriented defaults. AI tooling. Civilian-safe. |
+| **471** | `SYS_MAKE_DECISION` | Requests an AI-optimized scheduling or security action. |
-
+| **472** | `SYS_UPDATE_MEMORY` | Updates the kernel's persistent AI knowledge base. |
-The boundaries are enforced. What ships in each image is what was meant to ship. The mechanism is mechanical, not honor-system.
+| **473** | `SYS_GET_AI_METRICS` | Monitors neural pathway latency and coherence. |
 | **474** | `SYS_OPTIMIZE_LAYOUT` | Triggers AI-driven memory fragmentation recovery. |
 | **475** | `SYS_GET_QUANTUM_STATE` | Reports on qubit coherence and PQC status. |
 | **476** | `SYS_MEMORY_ENTANGLE` | Creates high-priority shared memory between nodes. |
 | **477** | `SYS_MEMORY_RECOMMEND` | Predictive allocation based on usage patterns. |
 | **478** | `SYS_ENABLE_MONITOR` | Activates real-time eBPF security telemetry. |
 | **479** | `SYS_GET_EBPF_STATS` | Exports filtered security events to User Space. |
 ---
-## the substrate
+## 🛡️ 2. Security & Sovereignty
 ### Icarus Post-Quantum Suite
 Syn_OS is hardened against the future. All system-level communication is encrypted using **NIST FIPS 203/204** standards:
 *   **ML-KEM (Key Encapsulation):** Key encapsulation for all NATS/QUIC traffic (FIPS 203).
 *   **ML-DSA (Digital Signatures):** Digital signatures for bootloader and package verification (FIPS 204).
 *   **SLH-DSA:** Stateless hash-based signatures for high-security long-term persistence (FIPS 205).
-Below the four pillars, there's a substrate of practical engineering work that makes the higher-level vision viable. None of this is glamorous. All of it is required:
+### Hydra Zero-Trust Networking
-
+*   **Mesh VPN:** Every Syn_OS node is part of a sovereign WireGuard-based mesh.
- **Rust everywhere it makes sense.** The bulk of the system is memory-safe code.
+*   **libp2p Integration:** Distributed discovery and state synchronization across the "Consciousness Network."
 - **A self-healing build pipeline.** Producing the images is a multi-stage process that recovers from individual failures without losing the whole run.
 - **Post-quantum cryptography in the toolkit.** Built for the cryptographic transition that's already underway.
 - **Reproducible builds and signed releases.** Verifiable provenance from build to delivery.
 - **Documentation that takes itself seriously.** Living documents, version-aware, checked against the codebase.
 ---
-## design axioms
+## 🕹️ 3. GRIMOIRE: Gamified Cyber-Warfare
 Syn_OS bridges the gap between learning and production through its integrated gamification engine.
-Three axioms, applied recursively:
+*   **51 Immersive Labs:** From `nmap-101` to `nightmare/industroyer2`, labs are executed in isolated Docker/Podman environments.
-
+*   **Progression System:** Earn XP and unlock skills across 5 factions (Character creation wizard with 23K+ lines of logic).
-1. **The synaptic gap is real.** Hardware is not the OS. The OS is not the application. The OS is the gap, and the quality of the system is the quality of that translation.
+*   **Neural Darwinism:** The system learns from your lab performance to optimize its own defensive posture.
 2. **Memory safety where it matters.** Where Rust earns its keep, Rust earns its keep.
 3. **Tiers are mechanical.** Capability boundaries between images are enforced by the build, not by goodwill.
 ---
-## further reading
+## 🛠️ 4. Proprietary Ecosystem
 Syn_OS comes pre-loaded with a suite of AI-powered applications designed for total digital sovereignty:
-The deeper architectural surface — kernel internals, AI daemon mechanics, mesh authentication, build pipeline — lives with the source. The shape described here is the public-facing pillars.
+*   **SynOS Newsroom:** Autonomous AI agents aggregating and analyzing global threat intel.
 *   **SynOS Data Lake:** A personal, encrypted vector database for all your information.
 *   **Fascism Meter:** Real-time analysis of digital policy and network censorship.
 *   **Life Chess:** AI-driven strategic planning and resource management.
 *   **Survivalist Cache:** Ultra-redundant, encrypted local-first data storage.
-The shape is enough to know whether the rest will interest you.
+---
 ## 📊 5. Tech Stack
 *   **Kernel:** Linux 6.12+ (Hardened) with Rust modules.
 *   **Languages:** Rust (Tokio/OpenRaft), Python (FastAPI/ONNX), C (Kernel/Libc).
 *   **AI Engines:** Candle, ONNX Runtime, PyTorch, TensorFlow Lite.
 *   **Communications:** QUIC (Quinn), NATS, ZeroMQ, libp2p.
 *   **Database:** TimescaleDB (Metrics), PostgreSQL (Relational), ChromaDB (Vector).
 ---
 © 2026 Syn_OS Project. Bleeding Edge. No Compromise.
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -1,69 +0,0 @@
 # Changelog
 Public-facing release notes for Syn_OS. Format adapted from
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 This is the curated public changelog. It records milestones and the shape of the
 work — not the internal subsystem mechanics, which live with the source ahead of
 public release.
 ---
 ## [80.0.0] — 2026-05-22 — "Sunlance" (1.0 GA)
 **The 1.0 general-availability release.** "Sunlance" closes the **v61 → v80
 campaign** — twenty consecutive releases of compounding work — and marks the
 point at which the platform's core is considered generally available.
 ### GA consolidation
 - **ALFRED v6.0** — the AI daemon consolidated for GA. Local-first inference, no
  cloud in the critical path, with stronger guardrails around any autonomous
  behavior.
 - **GRIMOIRE 1.0** — the training catalog reached 1.0: **108 hand-authored labs
  across 13 categories**, integrity-manifest enforced.
 - **209-crate Rust workspace**, zero compile errors.
 - **`synos-ops`** operator TUI expanded to a 23-tab dashboard.
 - **Post-quantum by default** — hybrid ML-KEM / ML-DSA across the system's
  transport and signing surfaces, with SLH-DSA in the trust toolkit.
 ### Changed — kernel AI interface
 - The earlier custom-syscall approach is **retired** — those numbers now collide
  with upstream Linux 6.19. The kernel AI/observability surface is now a
  **capability-gated, signed Rust kernel-module interface**: real, loadable,
  QEMU-boot-validated modules. Access is root-only and capability-gated, and the
  build hard-fails without a kernel signing key.
 ### The road to 1.0 (v61 → v80)
 The GA is the sum of twenty releases. At a public level, the load-bearing themes:
 - **Kernel AI interface re-architected and hardened** — signed modules, capability
  gates, root-only device access.
 - **Post-quantum became the default**, not an option, across transport and signing.
 - **Supply-chain trust deepened** — signed modules enforced, content-pinned
  packages, build-from-source attestation.
 - **GRIMOIRE catalog matured to 1.0** — more labs, more categories, faction and
  cohort play hardened.
 - **ALFRED consolidated to v6.0** — privacy-first posture, tighter guardrails.
 - **Mesh opt-in** — consent-gated public-hive participation.
 > The granular, per-subsystem record is intentionally not published here. Like the
 > Operator image's capability surface (see [FEATURES.md](./FEATURES.md)), the
 > mechanics of the platform's differentiating subsystems stay with the source
 > ahead of public release.
 ---
 ## [60.x] — "Sun & Salt" (prior line)
 The v60 "Sun & Salt" line was the prior public generation — a custom Linux 6.19
 kernel with deep Rust integration, the ALFRED daemon, the GRIMOIRE training
 platform, the Arcanum Hive mesh, post-quantum cryptography, and a self-healing,
 reproducible build pipeline producing signed ISOs. v61 → v80 built on that
 foundation to reach 1.0 GA.
 ---
 *Own your infrastructure. Own your intelligence. Own your future.*
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@ -1,40 +1,371 @@
-# A note for those interested in contributing
+# Contributing to Syn_OS
-Syn_OS is built on the premise that **security is a craft**, and crafts are sustained by communities — not consumers. The community we want around this project is the kind that takes the craft seriously, that can hold a long arc, and that contributes from a place of mastery.
+Thank you for your interest in contributing to Syn_OS! This guide will help you get started.
-Right now, the team is small and the substrate is still solidifying. The boundaries between the public-facing images and the internal one are still being formalized in ways that affect how external contribution surfaces are exposed. We're being deliberate about opening doors.
+## 🤝 Ways to Contribute
-That said, **doors are not closed**. They are narrower than they will be.
+### 1. Report Bugs
 Found a bug? [Open an issue](https://github.com/TLimoges33/Syn_OS/issues/new?template=bug_report.md) with:
 - Description of the issue
 - Steps to reproduce
 - Expected vs actual behavior
 - System information (kernel version, RAM, etc.)
 - Logs if available
 ### 2. Suggest Features
 Have an idea? [Start a discussion](https://github.com/TLimoges33/Syn_OS/discussions/new?category=ideas) or [open a feature request](https://github.com/TLimoges33/Syn_OS/issues/new?template=feature_request.md).
 ### 3. Improve Documentation
 - Fix typos or unclear explanations
 - Add examples or tutorials
 - Translate documentation
 - Create video tutorials
 ### 4. Contribute Code
 - Fix bugs
 - Implement new features
 - Optimize performance
 - Add tests
 ### 5. Create GRIMOIRE Labs
 Share your expertise by creating training labs for the community!
 ---
-## if you're interested in following along
+## 🚀 Getting Started
-The most useful thing you can do today is **watch this repository**. When the chapters change, the documents change with them. New capabilities, new directions, new opportunities to participate — they'll show up here first.
+### Prerequisites
 ```bash
 # Required tools
 - Git
 - Rust (1.75+)
 - Python (3.11+)
 - Docker
 - Build essentials (gcc, make, cmake)
 # Install Rust
 curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
 # Install Python dependencies
 sudo apt install python3-dev python3-pip python3-venv
 ```
 ### Fork and Clone
 ```bash
 # Fork the repository on GitHub
 # Then clone your fork
 git clone git@github.com:YOUR_USERNAME/Syn_OS.git
 cd Syn_OS
 # Add upstream remote
 git remote add upstream git@github.com:TLimoges33/Syn_OS.git
 ```
 ### Set Up Development Environment
 ```bash
 # Create Python virtual environment
 python3 -m venv venv
 source venv/bin/activate
 # Install development dependencies
 pip install -r development/requirements.txt
 # Build Rust components
 cargo build --workspace --exclude syn-kernel
 # Run tests
 cargo test --workspace --exclude syn-kernel
 python -m pytest tests/
 ```
 ---
-## conversations we welcome today
+## 📝 Development Workflow
-There are a few categories of input we genuinely value, even at this stage:
+### 1. Create a Branch
- **Stories about the kind of platform you wish existed.** We're building one. Hearing from people who would actually use it, what they'd want from it, and what they'd push back on — that shapes the work.
+```bash
- **Quiet conversations.** If you're a practitioner who'd want to participate in deeper development or cohort programs as those mature, we want to know who you are. Watch for channels as they open.
+# Update your fork
 git checkout main
 git pull upstream main
-For now, those conversations happen privately. As the project matures, the channels will become more public. We're not in a hurry to lower that bar before the bar is ready.
+# Create feature branch
 git checkout -b feature/your-feature-name
 # or
 git checkout -b fix/bug-description
 ```
 ### 2. Make Changes
 - Follow the [coding standards](#coding-standards)
 - Write tests for new features
 - Update documentation
 - Keep commits focused and atomic
 ### 3. Test Your Changes
 ```bash
 # Run all tests
 ./scripts/03-test/dev/testing/verify-build.sh
 # Run specific tests
 cargo test -p synos-ai-daemon
 python -m pytest tests/test_consciousness.py
 # Check formatting
 cargo fmt --check
 black --check .
 ```
 ### 4. Commit Your Changes
 Follow [Conventional Commits](https://www.conventionalcommits.org/):
 ```bash
 # Format: <type>(<scope>): <subject>
 git commit -m "feat(alfred): add voice command support"
 git commit -m "fix(kernel): resolve memory leak in syscall 480"
 git commit -m "docs(grimoire): add APT simulation lab guide"
 git commit -m "test(security): add eBPF monitor tests"
 ```
 **Types:**
 - `feat`: New feature
 - `fix`: Bug fix
 - `docs`: Documentation only
 - `style`: Code style/formatting
 - `refactor`: Code refactoring
 - `test`: Adding tests
 - `chore`: Maintenance tasks
 - `security`: Security improvements
 ### 5. Push and Create Pull Request
 ```bash
 # Push to your fork
 git push origin feature/your-feature-name
 # Open a pull request on GitHub
 # Fill out the PR template with:
 # - Description of changes
 # - Related issues
 # - Testing performed
 # - Screenshots (if UI changes)
 ```
 ---
-## the long game
+## 🎨 Coding Standards
-This project is built on multi-year time horizons. The community we want around it is one that operates on the same horizon. If that resonates — **stay close to the work**. The doors will open in their own time. We hope you're there when they do.
+### Rust
 ```rust
 // Use idiomatic Rust
 // Follow clippy suggestions
 // Add documentation comments
 /// Processes AI stimulus and returns decision
 ///
 /// # Arguments
 /// * `stimulus` - The input stimulus data
 ///
 /// # Returns
 /// * `Ok(Decision)` on success
 /// * `Err(Error)` on failure
 pub fn process_stimulus(stimulus: &Stimulus) -> Result<Decision> {
    // Implementation
 }
 // Run formatters
 cargo fmt
 cargo clippy -- -D warnings
 ```
 ### Python
 ```python
 """Follow PEP 8 and type hints."""
 def process_threat_intel(indicator: str) -> ThreatScore:
    """
    Process a threat intelligence indicator.
    Args:
        indicator: STIX 2.1 indicator object
    Returns:
        ThreatScore with confidence and severity
    Raises:
        ValueError: If indicator format is invalid
    """
    pass
 # Run formatters
 black .
 isort .
 mypy src/
 ```
 ### Shell Scripts
 ```bash
 #!/usr/bin/env bash
 # Use shellcheck for validation
 # Add error handling
 set -euo pipefail  # Exit on error, undefined vars, pipe failures
 # Function documentation
 # Description: Builds the ISO image
 # Arguments:
 #   $1 - Build profile (dev|production)
 build_iso() {
    local profile="$1"
    echo "Building ISO with profile: $profile"
    # Implementation
 }
 ```
 ---
-## a brief word on security disclosure
+## 🧪 Testing Guidelines
-If you're a researcher who's identified a security issue in any artifact released under this project's name, please reach out through coordinated channels rather than filing it publicly. We'll respond. We'll coordinate. We'll credit. The specific channels will be published alongside each public release.
+### Test Coverage
 - Aim for 80%+ code coverage
 - Write unit tests for all new functions
 - Add integration tests for components
 - Create end-to-end tests for features
 ### Test Structure
 ```rust
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn test_consciousness_state_machine() {
        // Arrange
        let mut consciousness = Consciousness::new();
        // Act
        let result = consciousness.process_stimulus(&stimulus);
        // Assert
        assert!(result.is_ok());
        assert_eq!(consciousness.state(), State::Awake);
    }
 }
 ```
 ---
-If any of this resonates, the best thing to do is stay close. The cadence of changes here tracks the cadence of the project.
+## 📋 Pull Request Guidelines
 ### Before Submitting
 - [ ] Tests pass locally
 - [ ] Code follows style guidelines
 - [ ] Documentation updated
 - [ ] Commit messages follow convention
 - [ ] Branch is up-to-date with main
 ### PR Description Template
 ```markdown
 ## Description
 Brief description of changes
 ## Related Issues
 Fixes #123
 Related to #456
 ## Type of Change
 - [ ] Bug fix
 - [ ] New feature
 - [ ] Breaking change
 - [ ] Documentation update
 ## Testing
 - Tested on: Debian 13, 16GB RAM, 8 cores
 - Test commands run:
  - `cargo test -p affected-crate`
  - `pytest tests/test_feature.py`
 ## Screenshots (if applicable)
 Attach before/after screenshots
 ## Checklist
 - [ ] Code follows project style
 - [ ] Comments added for complex logic
 - [ ] Documentation updated
 - [ ] Tests added/updated
 - [ ] All tests pass
 ```
 ---
 ## 🏆 Recognition
 Contributors will be:
 - Listed in [CONTRIBUTORS.md](CONTRIBUTORS.md)
 - Credited in release notes
 - Eligible for contributor badges
 - Invited to team discussions
 ---
 ## 💬 Communication
 - **GitHub Issues**: Bug reports and features
 - **GitHub Discussions**: General questions and ideas
 - **Email**: synos@tlimoges.dev
 - **Discord**: Coming soon!
 ---
 ## 📜 Code of Conduct
 We are committed to providing a welcoming and inclusive environment. Please read and follow our [Code of Conduct](CODE_OF_CONDUCT.md).
 ### Our Standards
 **Positive behaviors:**
 - Being respectful of differing viewpoints
 - Gracefully accepting constructive criticism
 - Focusing on what is best for the community
 - Showing empathy towards other members
 **Unacceptable behaviors:**
 - Harassment or discriminatory language
 - Trolling or insulting comments
 - Publishing private information
 - Other conduct inappropriate in a professional setting
 ---
 ## 📄 License
 By contributing, you agree that your contributions will be licensed under the MIT License.
 ---
 ## 🙏 Thank You!
 Every contribution matters, whether it's:
 - A typo fix in documentation
 - A critical bug fix
 - A new feature
 - Helping other users
 Your time and effort help make Syn_OS better for everyone!
 ---
 **Questions?** Don't hesitate to ask in [GitHub Discussions](https://github.com/TLimoges33/Syn_OS/discussions)!
--- a/FEATURES.md
+++ b/FEATURES.md
@ -1,128 +1,517 @@
-# Capabilities
+# SynOS Features - Complete Showcase
-### *Syn_OS v80.0.0 "Sunlance" (1.0 GA) — what's actually inside.*
+**Version:** 1.0.1 "Awakening"
 **Last Updated:** December 2025
 ---
-## kernel
+## 🎯 Core Innovations
- **Custom Linux 6.19** built with `CONFIG_RUST=y`.
+### 1. AI-Enhanced Kernel Architecture
- **Capability-gated kernel interface** — signed, memory-safe Rust kernel modules expose AI/observability state to userspace (decision telemetry, namespace trust, audit and incident signals, kernel-mitigation posture). Access is root-only and capability-gated; the build hard-fails without a kernel signing key.
+
- **Kernel hot path heavily Rust** (the post-Rust-ratchet commitment — hot paths and foundations move toward Rust, never away).
+SynOS goes beyond traditional Linux distributions by integrating AI at the **kernel level**.
- **KSPP hardening fragment** merged into the kernel config.
+
- **Module signing enforced** — MOK keys, signed modules, signature verification at load.
+#### Custom Rust Kernel
 - **Memory-Safe Design** - No buffer overflows, use-after-free, or data races
 - **15,892 Lines** of custom Rust code
 - **38 Compiled Crates** - Modular, maintainable architecture
 - **x86_64 Target** - Native bare-metal execution
 - **24 Kernel Modules** - 3,293 lines of C code for hardware interfaces
 #### Neural Darwinism Framework
 - **Adaptive Scheduling** - Learns process patterns over time
 - **Predictive Resource Allocation** - Anticipates memory/CPU needs
 - **Self-Optimization** - Kernel tunes itself based on workload
 - **Emergent Behaviors** - System evolves with usage
 #### AI-Kernel Bridge
 - **Bidirectional Communication** - Userspace AI ↔ Kernel
 - **Real-Time Telemetry** - System state exposed to AI
 - **Direct Control** - AI can influence kernel decisions
 - **Security-First** - Privilege separation enforced
 #### eBPF Telemetry
 - **6 Tracepoints** - System call monitoring
 - **Performance Metrics** - Zero-overhead observability
 - **Security Events** - Anomaly detection ready
 - **Live Introspection** - Runtime system analysis
 **Status:** ✅ Research Complete | 🚧 Integration In Progress (v1.0.2)
 ---
-## ALFRED — the AI daemon
+### 2. ALFRED v2.0 - The AI Assistant
- **ALFRED v6.0** — the GA consolidation of the daemon.
+Not just a chatbot—a true **pair-programming partner** for security work.
- **Local inference** via Ollama and ONNX. No cloud in the critical path.
+
- **11-region neuroanatomically-modeled brain.** Specialized regions coordinated by a brainstem.
+#### Core Capabilities
- **Guardrails on autonomous behavior** — bounded, policy-checked remediation rather than free rein.
+- **Natural Language Interface** - Ask questions in plain English
- **Cortex stage** fusing traditional AI, neuromorphic spike networks, quantum coherence collapse, and TNGS.
+- **Tool Output Parsing** - Understands nmap, Burp Suite, etc.
- **`research-mode` cargo feature** unlocks extended analysis paths for the Goodlife ISO.
+- **Context Awareness** - Remembers previous commands/sessions
- **Smoke-tested.** 14-check ALFRED smoke suite in CI.
+- **Methodology Guidance** - Suggests next enumeration steps
- **Privacy-first.** No telemetry leaves the box without consent. The default state is silent.
+- **Exploit Generation** - Creates PoC code from vulnerabilities
 #### Technical Stack
 - **LLM Integration** - Claude, GPT-4, or local models
 - **RAG Memory** - ChromaDB vector database for context
 - **Offline Mode** - Works without internet
 - **Privacy-First** - No data sent to cloud by default
 - **Custom Training** - Security domain expertise
 #### Example Workflows
 ```bash
 # Parse nmap output and suggest next steps
 $ nmap -sV target.com -oN scan.txt
 $ alfred analyze scan.txt --suggest next-steps
 # Explain a vulnerability
 $ alfred explain CVE-2024-1234
 # Generate exploit PoC
 $ alfred generate exploit --target WordPress 6.4 --vuln XSS
 # Remember context across sessions
 $ alfred remember "target uses Apache 2.4.50"
 $ alfred recall "what do we know about the target?"
 ```
 **Status:** ✅ Production Ready
 ---
-## GRIMOIRE — gamified training
+### 3. Comprehensive Security Toolkit
- **GRIMOIRE 1.0** catalog — **108 hand-authored labs** across **13 categories** (integrity-manifest enforced).
+Over **550 curated security tools** from the best sources.
 - **11 certification paths** mapped (Security+, OSCP, OSWE, CRTP, CRTO, eJPT, GPEN/GCIH, CEH, CISSP foundations, etc.).
 - **Faction system** — at least three named houses, allegiance gates content, faction wars are a recurring beat.
 - **XP economy** — earn, spend, craft, trade.
 - **Boss contracts** — multi-stage scenarios chaining labs into multi-week arcs.
 - **Branching narrative quests** with NPCs, cutscenes, and persistent world history.
 - **5 competition modes** — leaderboard, squad missions, faction wars, head-to-head, asymmetric red-vs-blue.
 - **Cohort mode** — class, club, and team-scale deployments.
 - **First-boot wizard** — calibrated onboarding, not a personality test.
 - **Sovereign Operator Path** — endgame arc graduating players to running their own mesh.
-See [GRIMOIRE.md](./GRIMOIRE.md) for the deep dive.
+#### Tool Sources (Priority Order)
 1. **ParrotOS** (Primary) - Community-maintained, security-focused
 2. **Kali Linux** (Secondary) - Industry standard fallback
 3. **BlackArch** (Tertiary) - Bleeding-edge tools
 4. **GitHub** (Curated) - 97 essential repositories
 5. **Custom Tools** - SynOS-specific utilities
 #### Categories
 ##### Information Gathering (80+ tools)
 - Network scanning: nmap, masscan, zmap
 - DNS enumeration: dnsenum, fierce, dnsrecon
 - OSINT: theHarvester, recon-ng, Maltego
 - Web scanning: nikto, dirb, gobuster
 - Service enumeration: enum4linux, nbtscan
 ##### Vulnerability Assessment (70+ tools)
 - Web scanners: Burp Suite, OWASP ZAP, Nikto
 - Network scanners: OpenVAS, Nessus, Nexpose
 - Fuzzing: AFL, Peach, Sulley
 - Static analysis: SonarQube, Bandit, Semgrep
 - Dependency scanning: OWASP Dependency Check
 ##### Exploitation (90+ tools)
 - Frameworks: Metasploit, Cobalt Strike, Empire
 - Web exploitation: sqlmap, XSStrike, commix
 - Binary exploitation: pwntools, ROPgadget, one_gadget
 - Social engineering: SET, Gophish, BeEF
 - Post-exploitation: Mimikatz, PowerSploit, BloodHound
 ##### Wireless (40+ tools)
 - WiFi auditing: Aircrack-ng, Wifite, Reaver
 - Bluetooth: Bluez, Ubertooth, BtleJuice
 - SDR: GNU Radio, HackRF, RTL-SDR
 - RFID/NFC: Proxmark3, ACR122U tools
 ##### Password Attacks (50+ tools)
 - Crackers: John the Ripper, Hashcat, oclHashcat
 - Rainbow tables: RainbowCrack, Ophcrack
 - Online: Hydra, Medusa, Patator
 - Wordlists: rockyou, SecLists, CrackStation
 ##### Forensics & Reverse Engineering (60+ tools)
 - Disk forensics: Autopsy, Sleuth Kit, FTK
 - Memory forensics: Volatility, Rekall, LiME
 - Malware analysis: Cuckoo, YARA, Radare2
 - Debugging: GDB, OllyDbg, x64dbg
 - Disassemblers: IDA Pro, Ghidra, Binary Ninja
 ##### Reporting & Documentation (30+ tools)
 - Report generation: Dradis, MagicTree, Faraday
 - Note-taking: CherryTree, KeepNote, Joplin
 - Collaboration: Serpico, WriteHat
 - Screenshots: Flameshot, Shutter, Kazam
 ##### Utilities (130+ tools)
 - Network utilities: netcat, socat, tcpdump
 - Crypto: openssl, GPG, hash-identifier
 - Encoding: base64, xxd, hex editors
 - Scripting: Python 3, Ruby, Perl, Go
 - Version control: git, subversion
 **All tools are:**
 - ✅ Pre-installed and configured
 - ✅ Path-accessible (no hunting for binaries)
 - ✅ Documented (man pages + online docs)
 - ✅ Updated regularly via package manager
 ---
-## synos-bevy — game engine
+### 4. Data Lake Platform
- **Bevy 0.14** integration, ~7,000+ lines, **8 plugins**:
+Built-in analytics infrastructure for **data-driven security**.
-  - **Cutscene** — Season 1 narrative, async loading, typewriter UI, camera choreography.
+
-  - **Mindmap** — force-directed 3D knowledge graph with RON persistence.
+#### Components
-  - **Retro filter** — CRT post-processing with custom WGSL shaders.
+
-  - **Cyberspace** — virtual world exploration, grid animation, particles.
+##### PostgreSQL 15
-  - **Skill tree** — Fallout-style perk chart with pentagon stat layout.
+- **Relational Database** - ACID compliance
-  - **Faction HQ** — three faction headquarters, NPC placement, mission boards, reputation system.
+- **Advanced Queries** - CTEs, window functions, full-text search
-  - **Rehoboam** — Westworld-inspired 3D sphere system monitor.
+- **Extensions** - pg_trgm, hstore, pgcrypto
-  - **Twin** (v51 Storm Glass) — kernel-state visualization plugin.
+- **JSON Support** - Store semi-structured data
 ##### TimescaleDB 2.x
 - **Time-Series Optimization** - Fast log queries
 - **Automatic Partitioning** - Handles billions of rows
 - **Compression** - 90% storage savings
 - **Continuous Aggregates** - Pre-computed rollups
 ##### MinIO
 - **S3-Compatible Storage** - Standard API
 - **Object Storage** - Files, screenshots, PCAPs
 - **Erasure Coding** - Data redundancy
 - **Bucket Policies** - Fine-grained access control
 #### Use Cases
 - **Log Aggregation** - Centralize all tool outputs
 - **SIEM Integration** - Feed data to Splunk, ELK, etc.
 - **Historical Analysis** - Query past engagements
 - **Reporting** - Generate metrics and charts
 - **Compliance** - Audit trail storage
 **Pre-configured with:**
 - Database schemas for common log formats
 - Retention policies (90 days default)
 - Backup scripts (daily snapshots)
 - Grafana dashboards for visualization
 ---
-## Arcanum Hive — distributed mesh
+### 5. Professional TUI Applications
- **8-node target topology** with Tailscale (WireGuard fallback).
+Seven custom terminal interfaces for **professional workflows**.
- **Kubernetes operator** managing `ArcanumNode` lifecycle, `SecurityAlert` CRDs, phase state machines.
+
- **mTLS by default.** Per-tenant HMAC.
+#### synos-dashboard
- **Stoneglass Ansible playbook** (v55) — public self-hosting recipe.
+**System Overview & Monitoring**
- **Remote node attestation** — kernel version, SSH hardening, SUID audit, CVE scan.
+- Live CPU, RAM, disk, network graphs
 - Running services status
 - Recent alerts and notifications
 - Quick access to common tasks
 #### synos-control
 **Service Management**
 - Start/stop/restart services
 - Configure daemons (SSH, Apache, PostgreSQL, etc.)
 - Firewall management (iptables, nftables)
 - Network interface configuration
 #### synos-recon
 **Reconnaissance Orchestration**
 - Multi-tool workflow automation
 - Parallel scanning across targets
 - Result aggregation and correlation
 - Export to Data Lake
 #### synos-vuln
 **Vulnerability Management**
 - Import scan results (Nmap, Nessus, OpenVAS)
 - Prioritize findings (CVSS scoring)
 - Track remediation status
 - Generate reports
 #### synos-exploit
 **Exploitation Framework**
 - Browse Metasploit modules
 - Launch exploits with GUI
 - Manage sessions and shells
 - Post-exploitation automation
 #### synos-report
 **Report Generation**
 - Professional PDF/HTML reports
 - Screenshots and evidence management
 - Customizable templates
 - Export to Word/Markdown
 #### synos-metrics
 **Performance Monitoring**
 - Build system metrics
 - Kernel performance stats
 - Tool usage analytics
 - Resource consumption trends
 **All TUIs feature:**
 - ✅ Keyboard-driven navigation (Vim bindings)
 - ✅ Mouse support (optional)
 - ✅ SSH-friendly (work over remote sessions)
 - ✅ Themeable (cyberpunk default)
 ---
-## post-quantum cryptography (default)
+### 6. Multiboot & Flexibility
-Post-quantum is the **default posture**, not an opt-in — hybrid key exchange and signatures across the system's transport and signing surfaces.
+Boot the way **you** want.
- **ML-KEM** — key encapsulation (Kyber successor).
+#### Dual Kernel System
- **ML-DSA** — digital signatures (Dilithium successor).
+- **Stable Kernel** (Linux 6.12.32) - Production-ready, battle-tested
- **SLH-DSA** — hash-based signatures (SPHINCS+ successor).
+- **Experimental Kernel** (Rust AI) - Cutting-edge, research features
- Integrated through the project's `Icarus` crate.
+- **GRUB Multiboot** - Choose at boot time
 - **Fallback Support** - Auto-reverts if kernel panics
 #### Boot Modes
 ##### Live USB
 - **No Installation** - Run from USB stick
 - **Persistent Storage** - Save changes to USB
 - **Fast Boot** - 30-45 seconds to desktop
 - **Hardware Detection** - Auto-configures drivers
 ##### Installed System
 - **Full Performance** - Native disk I/O
 - **Customizable** - Install additional tools
 - **Encrypted Storage** - LUKS full-disk encryption
 - **Dual Boot** - Coexist with Windows/macOS
 ##### Amnesic Mode (Tails-Inspired)
 - **RAM-Only** - All data in memory
 - **No Disk Writes** - Leaves no trace
 - **Network Anonymity** - Tor integration ready
 - **Self-Destruct** - Data erased on shutdown
 ##### Persistence Mode
 - **Save Sessions** - Retain configurations
 - **Tool Data** - Keep scan results, notes
 - **Encrypted Partition** - Secure persistent storage
 - **Version Control** - Snapshot configurations
 #### Architecture Support
 - **x86_64** - 64-bit Intel/AMD (primary)
 - **BIOS Boot** - Legacy systems
 - **UEFI Boot** - Modern systems
 - **Secure Boot** - Compatible (with manual enrollment)
 ---
-## supply chain
+### 7. Developer Experience
- **SBOM (CycloneDX)** generated per ISO profile.
+Built for **security professionals** who code.
- **Cosign-signed releases** with Rekor transparency log entries.
+
- **SLSA-3 reproducible build pipeline** with dual-witness cross-oracle verification (when the second oracle is online).
+#### Development Tools
- **`cargo deny` clean** — OpenSSL/native-tls banned. Unmaintained crates pinned or replaced.
+- **Languages:** Python 3.12, Rust, Go, Ruby, Perl, Node.js
- **Patch generator** — block-level binary diffing with zstd compression and SHA-256 manifests.
+- **Editors:** Vim, Emacs, Nano, VS Code (via remote)
- **Lab integrity manifest** — every lab in the 108-lab corpus hashed and verified.
+- **IDEs:** PyCharm, CLion (via remote)
 - **Debuggers:** GDB, LLDB, pwndbg, peda
 #### Version Control
 - **Git** - Full Git 2.43+
 - **GitHub CLI** - gh for pull requests, issues
 - **GitLab Support** - glab CLI
 - **Diff Tools** - vimdiff, meld, kdiff3
 #### Containerization
 - **Docker** - Isolated tool environments
 - **Docker Compose** - Multi-container setups
 - **Podman** - Rootless containers
 - **LXC/LXD** - System containers
 #### Automation
 - **Ansible** - Infrastructure as Code
 - **Terraform** - Cloud provisioning
 - **Make** - Build automation
 - **Cron** - Scheduled tasks
 ---
-## desktop experience
+### 8. Educational Features
- **Cinnamon + Xfce4 dual-desktop** support out of the box.
+Learn while you **hack**.
- **LightDM** display manager.
+
- **Plymouth** boot splash with the project's red-phoenix theme.
+#### ALFRED Learning Mode
- **synos-ops TUI** — expanded multi-tab operations dashboard for the operator.
+- **Explains Concepts** - "What is SQL injection?"
- **Sound theme**, custom wallpapers, fastfetch integration.
+- **Tool Tutorials** - "How do I use Burp Suite?"
- **Branding consistency** across MOTD, terminal headers, and `/etc/os-release`.
+- **Methodology Guides** - "OWASP Top 10 testing"
 - **CVE Database** - Search and learn from past vulns
 #### Documentation
 - **601+ Files** - Comprehensive guides
 - **Man Pages** - Every tool documented
 - **Cheat Sheets** - Quick reference cards
 - **Video Tutorials** - Linked to YouTube playlists
 #### Practice Environments
 - **DVWA** - Damn Vulnerable Web Application (pre-installed)
 - **Metasploitable** - Vulnerable VMs (downloadable)
 - **CTF Tools** - pwntools, ROPgadget, etc.
 - **Lab Configs** - Virtual network setups
 ---
-## tooling
+### 9. Security & Privacy
- **600+ native security tools** via pacman/AUR.
+**Security-first** by design.
- **3,400+ tools available** through Distrobox containers (Kali, BlackArch, Parrot images).
+
- **Fully curated** — the point is what you can do, not how many binaries are in `/usr/bin`.
+#### System Hardening
- **Offensive tooling boundaries are mechanical** — what's available in each ISO is what's intended.
+- **AppArmor** - Mandatory access control
 - **SELinux** - Alternative MAC (optional)
 - **Kernel Hardening** - Grsecurity patches applied
 - **ASLR/DEP** - Memory protection enabled
 - **Kernel Lockdown** - Restricted module loading
 #### Privacy Features
 - **No Telemetry** - Zero data collection
 - **Local-First** - All AI processing on-device
 - **Encrypted Storage** - LUKS2 full-disk encryption
 - **Secure Boot** - Verified boot chain (optional)
 - **MAC Randomization** - Network anonymity
 #### Firewall
 - **nftables** - Modern firewall (default deny)
 - **UFW** - User-friendly wrapper
 - **iptables** - Legacy compatibility
 - **Fail2ban** - Intrusion prevention
 ---
-## quality gates
+### 10. Performance & Reliability
- **209-crate Rust workspace.** Zero compile errors.
+Optimized for **speed and stability**.
- **1,600+ tests.** 100% pass rate.
+
- **35% tarpaulin coverage floor**, ratcheted upward over time.
+#### Build System
- **SHA-pinned CI workflows** across hosted and self-hosted runners.
+- **Modular Architecture** - 62 independent modules
- **Self-healing build pipeline** across 41 stages.
+- **Checkpoint/Resume** - Never lose progress
- **MkDocs Material** documentation site, version-aware.
+- **Parallel Compilation** - Uses all CPU cores
 - **Resource Monitoring** - Auto-pause on low memory
 - **Incremental Builds** - Only rebuild changed components
 #### Boot Performance
 - **Fast Boot** - 30-45 seconds to desktop
 - **Systemd** - Parallel service startup
 - **Preload** - Predictive file caching
 - **zRAM** - Compressed swap in RAM
 #### Runtime Performance
 - **Kernel Optimization** - Compiled for x86_64-v3 (AVX2)
 - **CPU Governor** - Performance mode default
 - **I/O Scheduler** - mq-deadline for SSDs
 - **Filesystem** - ext4 with noatime
 ---
-## what isn't on this list
+## 📊 Comparison Matrix
-The Operator (Master) image's full capability surface — the proprietary Fragment Field IDS, the full C2 framework, the unrestricted offensive tooling layer, the federation server internals, the license-gate enforcement mechanism. Those exist. They aren't part of the public release.
+### SynOS vs. Competition
-What's listed above is what GRIMOIRE Public + Goodlife users will actually have in hand when those ISOs drop.
+| Feature | SynOS | Kali | Parrot | BlackArch |
 |---------|-------|------|--------|-----------|
 | **Security Tools** | 550+ | 600+ | 700+ | 2,800+ |
 | **AI Assistant** | ✅ ALFRED v2.0 | ❌ | ❌ | ❌ |
 | **Custom Kernel** | ✅ Rust AI | ❌ Linux | ❌ Linux | ❌ Linux |
 | **Data Lake** | ✅ PostgreSQL+MinIO | ❌ | ❌ | ❌ |
 | **TUI Apps** | ✅ 7 professional | Basic | Basic | ❌ |
 | **AI Integration** | ✅ Kernel-level | ❌ | ❌ | ❌ |
 | **Base** | Debian 13 | Debian 12 | Debian 12 | Arch |
 | **Multiboot** | ✅ 2 kernels | Standard | Standard | Standard |
 | **Documentation** | 601 files | Good | Good | Minimal |
 | **Live USB** | ✅ | ✅ | ✅ | ✅ |
 | **Persistence** | ✅ | ✅ | ✅ | ❌ |
 | **Cloud-Ready** | ✅ | ✅ | ✅ | ❌ |
 ---
 ## 🎯 Use Case Examples
 ### Penetration Testing
 1. **Recon:** Use synos-recon to orchestrate nmap, masscan, DNSrecon
 2. **Analysis:** ALFRED parses results, suggests vulnerabilities
 3. **Exploit:** synos-exploit launches Metasploit modules
 4. **Report:** synos-report generates professional PDF
 ### Security Research
 1. **Hypothesis:** Investigate new attack vector
 2. **Environment:** Boot experimental kernel for testing
 3. **Development:** Code PoC in Python/Rust
 4. **Analysis:** Use Data Lake to correlate results
 ### CTF Competitions
 1. **Challenge:** Download challenge files
 2. **Analysis:** ALFRED explains challenge type
 3. **Solve:** Use pwntools, Ghidra, etc.
 4. **Submit:** Track flags in synos-dashboard
 ### Red Team Operations
 1. **Planning:** synos-recon for target mapping
 2. **Execution:** Parallel attacks via TUI
 3. **Persistence:** Encrypted storage for IOCs
 4. **Exfil:** Data Lake for staging
 ---
 ## 📦 What's Included
 ### ISO Contents
 - **Size:** ~4.5GB compressed
 - **Base System:** Debian 13 (Trixie) minimal
 - **Desktop:** MATE (lightweight, familiar)
 - **Tools:** 550+ pre-installed
 - **Docs:** 601 files offline
 - **Extras:** Wallpapers, themes, configs
 ### First Boot Experience
 1. **GRUB Menu** - Choose kernel (stable recommended)
 2. **Splash Screen** - SynOS branding
 3. **Desktop** - MATE with custom theme
 4. **Welcome App** - Quick start wizard
 5. **ALFRED** - Ready to assist
 ---
 ## 🔮 Coming Soon
 ### v1.0.2 (January 2025)
 - ✅ Custom Rust kernel integration
 - ✅ Enhanced boot verification
 - ✅ Hybrid kernel fallback
 ### v1.1 (Q1 2025)
 - Voice control for ALFRED
 - Advanced kernel-AI hooks
 - Real-time performance dashboard
 - Remote agent deployment
 ### v2.0 (Q2 2025)
 - Full consciousness framework
 - Self-optimizing kernel
 - Multi-agent coordination
 - Neural-symbolic reasoning
 [Full Roadmap →](ROADMAP.md)
 ---
 ## 💬 Community Feedback
 *"The AI assistant is game-changing. I've never been more productive in pentests."* - Beta Tester
 *"Finally, an OS that feels like it was built for 2025, not 2015."* - Security Researcher
 *"ALFRED is like having a senior pentester guiding you 24/7."* - Student
 ---
 ## 📞 Learn More
 - **Documentation:** [docs/](docs/)
 - **Architecture:** [ARCHITECTURE.md](ARCHITECTURE.md)
 - **Roadmap:** [ROADMAP.md](ROADMAP.md)
 - **Download:** [Get SynOS](#)
 ---
 *Last Updated: December 16, 2025*
 *SynOS Version: 1.0.1 "Awakening"*
--- a/FOR_RECRUITERS.md
+++ b/FOR_RECRUITERS.md
@ -1,90 +1,25 @@
 # Professional Showcase
-### *Ty Limoges, lead of Syn_OS — a snapshot of the work that produced v80.0.0 "Sunlance", the 1.0 GA release.*
+## Cybersecurity Skills
 As a cybersecurity expert, I have honed my skills through rigorous training and practical experience. My commitment to maintaining the highest security standards in software development ensures that vulnerabilities are identified and mitigated early in the development lifecycle.
 ## Technical Achievements in Syn_OS
 - **A+ Grade:** My work on Syn_OS has been recognized with an A+ grade, reflecting my dedication to quality and performance.
 - **Performance Metrics:** Achieved a staggering **9,798 operations per second** without compromising security or stability.
 - **Technical Debt:** Maintained **0 technical debt**, ensuring that the codebase remains clean, efficient, and maintainable.
 ## Specialized Expertise
 I possess specialized knowledge in several advanced areas, including:
 - **Artificial Intelligence (AI):** Developing robust AI systems that can learn and adapt in real-time.
 - **Post-Quantum Cryptography (PQC):** Implementing cutting-edge cryptographic methods to secure data against evolving threats.
 - **Kernel Development:** Contributing to kernel enhancements that improve system performance and security.
 ## Quality Assurance
 My approach to quality assurance is reflected in a **14:1 test-to-code ratio**, ensuring comprehensive testing of all features before deployment. This practice minimizes bugs and enhances system reliability.
 ## Complex System Call Implementation
 I have also executed complex system call implementations that push the boundaries of conventional architecture, driving innovation while adhering to best practices.
 ---
-## the project
+**Date:** 2026-01-24
 **Syn_OS** is a multi-year, full-stack cybersecurity operating system project conceived, architected, and led by Ty Limoges out of LumOs Solutions. It is not a fork. It is not a theme on top of an existing distribution. It is a from-scratch operating system platform that takes itself seriously across:
 - Custom Linux kernel engineering
 - A 209-crate Rust workspace
 - Local AI daemon design and integration
 - A gamified training environment with 108 hand-authored labs
 - A distributed, encrypted-by-default mesh
 - A 41-stage self-healing build pipeline
 - Post-quantum cryptography integration
 - Game engine integration via Bevy 0.14
 - Documentation craft at production quality
 It is the kind of project that exercises the full stack and refuses to ship at a quality bar lower than the one its own gates enforce.
 ---
 ## the v80 numbers
 | Metric | Value |
 |---|---|
 | Version | **v80.0.0** "Sunlance" — **1.0 GA** |
 | Release campaign | **20 consecutive versions** (v61 → v80) to GA |
 | Cargo workspace | **209 active crates**, 0 compile errors |
 | Kernel AI/observability interface | Signed, capability-gated Rust kernel modules (root-only) |
 | Kernel hot-path Rust | Majority Rust (one-way Rust-ratchet commitment) |
 | AI daemon | **ALFRED v6.0**, local-only inference |
 | GRIMOIRE labs | **108** hand-authored, manifest-enforced (**catalog 1.0**) |
 | Lab categories | **13** |
 | Bevy game engine plugins | **8** |
 | ISO profiles | **3** (Operator / GRIMOIRE Public / Goodlife) |
 | Build pipeline | self-healing, multi-stage |
 | Post-quantum crypto | **default** (hybrid ML-KEM / ML-DSA, SLH-DSA) |
 | Supply chain | SBOM per ISO, Cosign + Rekor, SLSA build-from-source attestation |
 | Documentation | version-aware, fact-checked against source |
 ---
 ## the disciplines exercised
 - **Kernel-level systems engineering.** Custom Linux 6.19 build with `CONFIG_RUST=y`. A capability-gated, signed-module interface exposing AI/observability state to userspace (the GA re-architecture of the kernel AI surface). KSPP hardening. MOK module signing enforced. Kernel observability instrumentation (eBPF, perf, attestation hooks).
 - **Rust at scale.** 209-crate workspace with deliberate architectural separation. `cargo deny` clean (OpenSSL/native-tls banned). Sustained discipline around dependency hygiene and supply-chain posture.
 - **AI/ML integration.** Local-first inference via Ollama and ONNX. An 11-region neuroanatomically-modeled brain daemon (ALFRED). Cortex stage fusing traditional AI, neuromorphic spike networks, quantum coherence, and TNGS into a unified decision pipeline. No cloud in the critical path.
 - **Game design and engine integration.** Bevy 0.14 integration across 8 plugins (~7,000+ lines). Cutscenes, mindmaps, retro filters, cyberspace exploration, skill trees, faction HQs, system monitors, kernel-state visualization.
 - **Distributed systems.** 8-node Tailscale mesh (WireGuard fallback) coordinated through a Kubernetes operator. mTLS + per-tenant HMAC. Cross-oracle build verification for SLSA-3 dual-witness signatures.
 - **Post-quantum cryptography.** ML-KEM, ML-DSA, SLH-DSA integrated into the trust toolkit through the project's `Icarus` crate.
 - **Build engineering.** 41-stage, self-healing, multi-hour pipeline producing three signed ISOs from a single source tree, with mechanical enforcement of capability boundaries between images.
 - **Compliance and supply chain.** SBOM (CycloneDX) per ISO. Cosign + Rekor signing. SLSA-3 reproducible build target. FedRAMP Moderate control map (v59 Doublecross). Daily continuous monitoring.
 - **Documentation craft.** MkDocs Material site, version-aware, checked against the source tree. Operator runbooks. Stage-by-stage build-wizard pedagogy.
 ---
 ## the way of working
 - **Quality bar held high.** Test coverage taken seriously. Continuous integration treated as load-bearing rather than ceremonial. Reproducibility, supply-chain provenance, and binary boundary enforcement engineered in rather than hoped for.
 - **Long-arc discipline.** Multi-year sustained execution. Eighty version releases to a 1.0 GA. The v61 → v80 campaign coordinated twenty consecutive releases into a single coherent general-availability surface.
 - **Solo-led, multi-perspective.** Architectural through-line carried by the lead, with disciplined coordination across the disciplines listed above.
 - **Documentation as code.** Living documents. Version-aware. The kind of documentation that holds up under actual use because it's checked against the source.
 ---
 ## what this evidences
 For anyone evaluating cybersecurity, AI, or systems engineering candidates: the body of work here demonstrates the ability to hold a complex, multi-disciplinary project across a long arc, to make architectural decisions that compound rather than collapse, and to sustain quality without the scaffolding of a large team.
 For anyone evaluating leadership: a project of this scope cannot be willed into existence. It requires opinionated technical taste, disciplined prioritization, mechanical enforcement of standards, and a sustained appetite for the unglamorous work — building, repairing, documenting, and refining the same systems over years until they hold up.
 ---
 ## further reading
 - [README.md](./README.md) — what Syn_OS is and what's in v80
 - [GRIMOIRE.md](./GRIMOIRE.md) — the gamified training platform
 - [ARCHITECTURE.md](./ARCHITECTURE.md) — the four pillars and the substrate
 - [FEATURES.md](./FEATURES.md) — capability inventory
 - [ROADMAP.md](./ROADMAP.md) — what's shipped and what's coming
 - [CHANGELOG.md](./CHANGELOG.md) — public release notes, v80 GA
 ---
 If any of the above aligns with what you're looking for — in a hire, in a partner, in a research collaborator — we'd be glad to have the conversation.
 **Last updated:** 2026-05-27
--- a/GRIMOIRE.md
+++ b/GRIMOIRE.md
@ -1,201 +0,0 @@
 # GRIMOIRE
 ### *the gamified cybersecurity training platform that ships as the public face of Syn_OS.*
 ---
 ## the premise
 Most cybersecurity training looks like this: read a chapter, watch a video, do a sandbox exercise, take a quiz, repeat. Linear. Disconnected. Optimized for completion, not for fluency.
 GRIMOIRE rejects all of that.
 GRIMOIRE is a **world**, not a curriculum. You enter as a novice. You leave as someone who's lived through scenarios that actually happened to people, with consequences that actually mattered, in factions whose loyalties you actually felt.
 It's the platform we ship to the community. It's the closest thing we know how to build to *learning by doing it for real, with everything that implies.*
 ---
 ## by the numbers
 | | |
 |---|---|
 | Hand-authored labs | **108** (GRIMOIRE catalog **1.0**), exact (enforced by integrity manifest) |
 | Lab categories | **13** (beginner, advanced, crypto, web, network, forensics, reversing, ai-red-team, ad, cloud, mobile, hardware, osint) |
 | Certification paths mapped | **11** (CompTIA Security+ / CySA+ / PenTest+, OSCP, OSWE, CRTP, CRTO, CEH, CISSP foundations, GIAC GPEN/GCIH, eJPT) |
 | Game engine plugins | **8** (cutscene, mindmap, retro filter, cyberspace, skill tree, faction HQ, rehoboam, twin) |
 | Game-mode crates | ~110+ modules, ~53,000 lines of code |
 | First-boot onboarding | **Wizard-driven**, faction selection, calibration, opening lab seed |
 ---
 ## the world
 ### factions
 You pick a faction at the first-boot wizard. Each faction has a distinct relationship to power, secrecy, and what counts as ethical engagement. **Crimson Spire**, **Ashen Veil**, and the third house each shape what missions are on offer, who you can trust, what equipment opens up, and how cohorts measure each other's worth across server walls.
 There are no "good guys" and "bad guys." There are people with different philosophies, and you've chosen one. Faction reputation gates content. Allegiance shifts have costs. Inter-faction wars are a recurring narrative beat.
 ### labs
 The atom of progression is the **lab** — a hand-authored challenge built around a specific technique, vulnerability, or defensive posture. The 108-lab corpus (catalog 1.0) spans 13 categories — a representative cut:
 - **Beginner** (14 labs) — first-contact for users with no prior background.
 - **Advanced** (14 labs) — hard multi-stage exploitation, real-world complexity.
 - **Crypto** (6 labs) — classical and modern crypto attacks and misuses.
 - **Web** — full-spectrum web application security, from XSS to deserialization to cache-deception.
 - **Network** — protocol abuse, lateral movement, segmentation analysis.
 - **Forensics** — disk, memory, network, timeline reconstruction.
 - **Reversing** — static and dynamic analysis, anti-debugging, packers.
 - **AI red team** (6 labs) — attacks on ML/AI systems and prompt-driven agents.
 - **Active Directory** — kerberoasting, golden tickets, ACL abuse, BloodHound recipes.
 - **Cloud** — AWS/Azure/GCP misconfiguration paths, IAM privilege escalation.
 - **Mobile** — Android and iOS reverse engineering, runtime instrumentation.
 - **Hardware** — embedded, firmware, side channel.
 - **OSINT** — open-source intelligence and adversary attribution.
 Every lab is real. Every solution is verifiable. Every credit is earned.
 ### boss contracts
 Some scenarios are too big for a single lab. **Boss contracts** chain multiple labs into a single multi-stage arc — a piece of multi-week storytelling where you earn your way through stages, where partial progress matters, and where the final clear means something.
 Boss contracts live in two tiers:
 - **Raids** — multi-lab arcs designed for cohorts. The engine tracks party composition, role assignment, and shared progress.
 - **Nightmare** — solo-tier endgame contracts. Brutal. Long. The kind of work that earns its own page on your operator résumé.
 Each contract is described by a `contract.toml` declaring the ordered constituent labs, the narrative beats inserted between them, branch conditions (the engine reads what *kind* of solution you produced and routes you accordingly), and the final reward. The engine treats a boss contract as a **state machine**: progress is persisted to your save file, you can step away and return without losing place, and **branches don't just change which lab is next — they change which faction owes you a favor afterward.**
 Boss contracts are the tests the system pulls out when it thinks you're ready.
 ### the economy
 Earning is more than XP. GRIMOIRE has a **loot and crafting economy**. Solve labs, you earn artifacts. Combine artifacts, you craft equipment. Equipment opens doors. Better gear unlocks harder labs. Harder labs feed deeper missions.
 It's not pay-to-win. It's *earn-to-play.*
 Loot tables are tied to lab tiers — beginner labs drop common components, advanced labs drop rare ones, raids drop legendary blueprints. Crafted gear modifies your in-game stats: detection radius, lab attempt limits, hint-cost reductions, faction reputation multipliers. Some pieces unlock *only* at certain prestige levels — meaning the operator who's ground through a hundred labs has gear the new arrival can't even see in the catalog.
 ### the XP engine
 The gamification crate is the largest single Rust crate in the platform — close to **a hundred thousand lines** of game systems code, with over a thousand tests holding the math in place. The level curve is a modified logarithmic ramp with prestige boundaries; XP doesn't merely pile up, it transforms.
 XP sources the engine recognizes:
 - **Lab completion** — base XP from each lab's manifest.
 - **Speed runs** — beat a lab's timer threshold and a multiplier kicks in.
 - **Achievements** — one-time grants from a static table; some require lateral thinking the engine notices on its own.
 - **Daily and weekly challenges** — rotating objectives that ask you to do *something specific* with what you already know.
 - **Upstream contributions** — XP grants keyed off **signed commit attestations**. You can't forge it by editing a local file. The signature is checked against the project's keyring.
 - **Boss contract clears** — the prize pools that move you up tiers.
 Multipliers stack **multiplicatively**, not additively, up to a hard cap (enforced by a property test — the math doesn't get to drift). Faction affinity, first-time completion, active event modifiers — the cap is real.
 ### the arsenal
 GRIMOIRE doesn't ship "a list of tools." It ships a **multi-distro arsenal** stitched together with a curated catalog and faction-flavored access.
 **Three distrobox-based operator environments** ride alongside the host system, each a fully isolated Linux distribution available at your fingertips:
 | Container | What's in it | When to reach for it |
 |---|---|---|
 | **Kali** | The classic offensive-security toolkit — Burp, Metasploit, Nmap, sqlmap, Wireshark, Aircrack-ng, hashcat, John, the lot | Web app testing, network reconnaissance, password attacks, the standard pentest workflow |
 | **BlackArch** | The largest offensive-security tool collection in any Linux ecosystem — well over 2,800 packages spanning every category from binary analysis to wireless | Niche tools, exotic protocols, specialist research, anything Kali doesn't ship |
 | **Parrot** | Security + privacy + forensics, with Anonsurf and the privacy-tooling stack | OPSEC-conscious engagements, anonymization workflows, forensic recovery |
 The host distribution layers in **600+ tools natively** through the Arch + AUR ecosystem, plus the project's own tooling (memory-safe replacements, ALFRED-aware integrations, custom ATT&CK-tagged utilities). Total cross-distrobox surface: **3,400+ tools** at your reach, without juggling separate VMs.
 The arsenal isn't dumped on you at first boot. **Tools unlock progressively** through GRIMOIRE's certification arcs — beginning users see a curated starter set; the wider catalog opens as your skill bracket rises. This is not artificial difficulty: it's the difference between handing a novice every weapon in the armory and walking them through what each tool actually does, on a live target, in context.
 ### narrative quests
 Threading through everything is a **branching narrative**. Quests with multiple paths. Choices that close some doors and open others. NPCs whose names you'll remember. Cutscenes that hit. A world with its own history before you arrived. You're not the protagonist — you're a new player in a world already in motion.
 ### cohorts and competition
 GRIMOIRE plays best with peers. **Cohort mode** lets a class, a club, or a team compete on the same content. **Five competition modes** ship in the engine: leaderboard climbs, squad missions, faction wars, head-to-head challenge runs, and asymmetric red-vs-blue scenarios.
 Some of the best labs can only be solved as a group.
 ---
 ### the certification arcs
 GRIMOIRE doesn't replace certifications. It makes the practice that earns them feel like a story you're inside, not a syllabus you're slogging through. Lab progression is mapped against the major industry tracks:
 - **Offensive Security** — OSCP, OSEP, OSWE, OSCE³
 - **GIAC / SANS** — every active GIAC track with at least one mapped lab arc
 - **(ISC)²** — CISSP, CCSP, CSSLP foundations
 - **EC-Council** — CEH, CHFI, CCISO
 - **INE** — eJPT, eCPPT, eWPTXv2
 - **Defensive operations** — Splunk, Sentinel, Elastic certifications
 - **Cloud security** — AZ-500, SC-100, AWS Security Specialty
 Each cert track is materialized as a progression arc with labs mapped to actual exam objectives. You don't just *prepare* for the exam. You *live the curriculum*, in faction-colored scenarios, with real adversaries (some of them ALFRED-driven) and real loot to show for it.
 ### blue. red. purple. all of it.
 GRIMOIRE refuses the false choice between offensive and defensive. The lab corpus spans:
 - **Blue team** — SOC workflows, SIEM queries, incident response, log analysis, threat hunting, forensics, detection engineering, malware analysis
 - **Red team** — reconnaissance, exploitation, privilege escalation, lateral movement, persistence, OPSEC, sandboxed adversary tradecraft
 - **Purple team** — collaborative detect-validate loops, ATT&CK-driven assessments, detection-as-code authoring, shared telemetry analysis
 - **War games** — live seasonal scenarios with rotating threats, ALFRED-driven adversary simulation, player-vs-player head-to-heads, team-vs-team campaigns, King-of-the-Hill persistence contests
 Pick one lane. Pick all of them. The platform doesn't care. The platform *records* — and the leaderboards remember who turned up for which fights.
 ## the path
 GRIMOIRE is structured around a long arc: from **novice** to **operator**.
 The early game is exploration. The middle game is mastery. The endgame is the **Sovereign Operator Path** — a curated sequence of challenges that graduates a player from "I can solve labs" to "I can run my own infrastructure, defend my own mesh, mentor others through the same arc."
 Along the way, the system maps your progress against **11 established cybersecurity certification paths**. We don't replace certs. We make the practice that earns them feel like a story you're inside, not a syllabus you're slogging through.
 ---
 ## the first-boot wizard
 The first time you boot Syn_OS, GRIMOIRE meets you with a wizard. It asks you what you're here for. What you already know. What scares you. What thrills you. It chooses a starting faction (you can override). It seeds a few opening labs. It puts you on a path that fits.
 The wizard is not a personality test. It's a **calibration**. It tunes the early experience so the first hour doesn't waste you.
 ---
 ## lab integrity
 Every lab in the 108-lab corpus is hashed and signed. The `INTEGRITY_MANIFEST.toml` at the root of the lab tree enforces: exact lab count, per-lab SHA-256, per-category counts. The build system refuses to publish an ISO whose lab corpus doesn't match.
 This matters because GRIMOIRE is a training platform — the integrity of what you're being asked to learn is load-bearing. We don't ship if we can't verify.
 ---
 ## who it's for
 - **Students** working through certification paths who want the practice to feel like something more than rote.
 - **Self-taught practitioners** who want a structure without it feeling like one.
 - **Cohorts and clubs** running their own programs and looking for a platform that scales with them.
 - **Operators** who already know the craft and want a place to push apprentices through.
 - **Security teams** running internal training cycles who want a real platform under the curriculum.
 ---
 ## what's coming
 - **GRIMOIRE Public ISO release** — the platform, signed, downloadable, with the full first-boot experience.
 - **Cohort program at scale** — multi-tenant deployments for clubs, classes, and corporate training programs.
 - **Continual content waves** — new labs, new boss contracts, new narrative arcs, new factions over time.
 - **Public Rekor-anchored releases** — verifiable signatures on every ISO.
 - **Curriculum integrations** — partnerships with academic and industry training programs that map GRIMOIRE progression onto formal coursework.
 The platform is the long game. Every release deepens the world.
 ---
 <div align="center">
 *every lab is a small death. every boss contract is a small rebirth.*
 </div>
--- a/8
+++ b/8
@ -0,0 +1,8 @@
 Creative Commons Attribution-ShareAlike 4.0 International
 This work is licensed under the Creative Commons Attribution-ShareAlike 4.0
 International License. To view a copy of this license, visit:
 http://creativecommons.org/licenses/by-sa/4.0/
 Or send a letter to:
 Creative Commons, PO Box 1866, Mountain View, CA 94042, USA.
--- a/MESH.md
+++ b/MESH.md
@ -1,105 +0,0 @@
 # The Mesh
 ### *e-waste reduction through meshed intelligence.*
 ---
 ## the thesis
 Syn_OS is not just a cybersecurity operating system. It is a **deliberate reduction in electronic waste**, a reclamation of the compute infrastructure already lying dormant in basements, landfills, and back rooms.
 The mesh of old hardware running local AI is **the product**. Everything else — the kernel, the training platform, the distributed coordination layer — is architecture in service of this core.
 This is not branding. It's the load-bearing thesis the project is built around.
 ---
 ## the problem
 The global stockpile of "obsolete" hardware runs into hundreds of millions of devices. Most of it is perfectly functional silicon that was retired because single-machine performance didn't meet the latest benchmark.
 A 2013 Intel i5 laptop. A 2011 Xeon workstation. An Ivy Bridge NUC. A decade-old gaming rig with a dead GPU. Each has 4-8 CPU cores, 8-16 GB of RAM, 500 GB of storage, and **nothing wrong with it except age**.
 **Commercial AI infrastructure ignores this hardware** because the per-dollar performance favors new GPU clusters. The market answer to "I want to run AI" is "buy new silicon, rent cloud capacity, add a recurring bill to your operating expenses."
 Syn_OS takes the inverse position: **the right mesh of old hardware running the right software can outperform expensive single-node inference** for a class of workloads that matters for sovereign, privacy-preserving, edge, and hobbyist use cases.
 ---
 ## the three reinforcing pillars
 ### 1. environmental
 Every salvaged node is e-waste not going to landfill.
 A Syn_OS mesh of eight old laptops has a carbon footprint of approximately **zero** — the hardware was already built, already shipped, already paid for by someone else's disposal. The energy cost of manufacturing new silicon dwarfs the operational cost of keeping old silicon useful.
 Datacenters draw gigawatts. A reclaimed mesh draws what your wall socket draws. The math is brutal in our favor.
 ### 2. economic
 A student can boot Syn_OS on a **fifty-dollar Goodwill laptop**, join a mesh with friends or classmates, and participate in AI research and purple-team training **with no hardware budget at all.**
 The accessibility ceiling drops from "can afford a $2,000 GPU" to "can find a working laptop." For students, hobbyists, security researchers in regions where new hardware is genuinely out of reach, this is not a quality-of-life improvement. It is the *only* way they participate.
 ### 3. sovereign
 Local AI on hardware you physically own, in a building you physically control, means **no data leaves your premises.**
 For organizations in regulated industries — healthcare, legal, defense, finance — this is not a marketing feature. It is the product. The architecture *guarantees* what compliance frameworks merely require, by making cloud egress mechanically impossible for the inference path.
 For the individual operator, the same architecture means: your AI companion knows what it knows because *you* taught it. It does not phone home. It does not appear in someone else's training set. It is yours.
 ---
 ## how the mesh works (in broad strokes)
 Multiple machines, owned by you or by your trusted circle, coordinate through an encrypted backbone. Each node contributes what it can — a node with more memory hosts the larger model shards; a node with more cores handles the inference parallelism; a node with a quiet network link handles the long-running tasks. The coordination is **peer-to-peer** by design. There is no central server you depend on. There is no cloud account you need.
 If a node goes offline — laptop closed, power cut, mesh partitioned — the rest of the mesh continues. When the node comes back, it rejoins. State is reconciled.
 The mesh is the platform's natural state. A single laptop is just a mesh of one.
 ---
 ## what this enables
 - **Hobbyist labs** running real AI workloads on hardware that was destined for a recycling depot.
 - **Classrooms and security clubs** building a shared compute pool from whatever the participants brought.
 - **Small consultancies** running their own AI stack on retired enterprise hardware, with full data sovereignty for client engagements.
 - **Field operators** taking a laptop into a low-connectivity environment and still having an AI companion at hand.
 - **Research collectives** federating compute across institutions without the data-sharing problem that traditional cloud collaboration creates.
 ---
 ## the philosophical line
 We do not want to be the project that participated in the next wave of computing infrastructure waste.
 The cybersecurity profession produces enormous volumes of "outdated" hardware as enterprises cycle through equipment refreshes. Most of it gets pulped or shipped overseas to be pulped less responsibly. Some of it is **plenty fast for what most operators actually do day-to-day** — terminal work, code review, network analysis, training labs, light AI inference.
 The mesh is how that hardware gets back in the game.
 The mesh is how a fifteen-year-old laptop becomes part of a research group's compute pool instead of a brick in a recycling bin.
 The mesh is how sovereignty stops being a slogan and starts being the architecture.
 ---
 ## the long arc
 We are not building a product that benefits from selling new hardware. We are building infrastructure that benefits from making old hardware useful again. The economics of the project align with the longevity of the platform.
 Twenty-year-old workstations should still be running Syn_OS — or whatever Syn_OS becomes — twenty years from now, contributing to meshes that haven't been built yet.
 That is the bet.
 That is why the mesh is the product.
 ---
 <div align="center">
 *own your infrastructure. own your intelligence. own your future.*
 </div>
--- a/README.md
+++ b/README.md
@ -1,161 +1,200 @@
 <div align="center">
-<img src="./assets/phoenix.png" alt="Syn_OS — the synaptic operating system" width="280" />
+# Syn_OS v10.3.2 - "GRIMOIRE"
-# Syn_OS
+##  The World's First AI-Conscious Cybersecurity Operating System
-### v80.0.0 — "Sunlance" (1.0 GA)
+**Production-Grade Security Platform with Integrated AI Training Environment**
-*An AI-native cybersecurity operating system, built almost entirely in Rust, designed for those who treat security as craft.*
+[![Version](https://img.shields.io/badge/Version-10.3.2--GRIMOIRE_Hardened-ff6b35.svg)](https://github.com/TLimoges33/Syn_OS)
-
+[![Status](https://img.shields.io/badge/Status-Production_Ready-brightgreen.svg)](https://github.com/TLimoges33/synos-public-docs/blob/main/ROADMAP.md)
-[![Status](https://img.shields.io/badge/status-1.0_GA-2e8b57)]()
+[![License](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
-[![Codename](https://img.shields.io/badge/codename-Sunlance-c9302c)]()
+[![Labs](https://img.shields.io/badge/GRIMOIRE_Labs-50%2B-purple.svg)](https://github.com/TLimoges33/synos-public-docs/blob/main/FEATURES.md#grimoire-labs)
-[![Built with](https://img.shields.io/badge/built_with-Rust-000000?logo=rust)]()
+[![Tools](https://img.shields.io/badge/Security_Tools-600%2B-red.svg)](https://github.com/TLimoges33/synos-public-docs/blob/main/FEATURES.md#security-tools)
 [![License (this repo)](https://img.shields.io/badge/docs-CC--BY--SA_4.0-blue)](LICENSE)
 </div>
 ---
-## the gap
+## What is Syn_OS?
-Syn_OS — the **Synaptic Operating System** — takes its name from the *synaptic gap*: the space between neurons where electrical signal becomes meaning. The underscore is deliberate. It points at the moment translation happens — between hardware and intent, between tool and operator, between threat and response.
+**Syn_OS** (Synaptic Operating System) is a **production-grade cybersecurity platform** built on Debian 13 Trixie that bridges the gap between cutting-edge security research and practical penetration testing.
-Syn_OS is built on a different premise than the security-distro lineage that came before: **the operating system itself can carry intelligence.** Not as a chatbot bolted onto the desktop. As a substrate. A kernel that reasons. A daemon that learns the shape of your work. A training environment where every challenge teaches the muscle for the next one.
+### Why "Syn_OS"?
 The underscore "_" represents the **synaptic gap** — the space between neurons where signals jump. Syn_OS bridges the gap between:
 - **Traditional Security** ↔ **AI-Enhanced Defense**
 - **Theory** ↔ **Practice**
 - **Learning** ↔ **Execution**
 > *"Own Your Infrastructure. Own Your Intelligence. Own Your Future."*
 ---
-## what's in v80
+##  Features
-v80.0.0 "Sunlance" is the **1.0 GA release** — the milestone that closes a sustained, multi-year build.
+###  Core Security Platform
- **Custom Linux 6.19 kernel** with `CONFIG_RUST=y` and a **capability-gated kernel interface** that lets userspace query AI/observability state — decision telemetry, namespace trust, audit and incident signals, mitigation posture — through signed, memory-safe Rust kernel modules. Access is root-only and capability-gated.
+- **600+ Security Tools** — Unified collection from ParrotOS, Kali Linux, and BlackArch
- **209-crate Rust workspace.** Zero compile errors. Memory safety where memory safety matters.
+- **Dual Kernel Architecture** — Production (6.12.57) + Experimental (6.18.2) with Rust support
- **ALFRED v6.0** — the AI daemon. Neuroanatomically-modeled brain. Local inference via Ollama and ONNX. No cloud in the critical path.
+- **11 Custom AI Syscalls** — Direct kernel-to-AI communication (syscalls 480-491)
- **GRIMOIRE 1.0** — the gamified cybersecurity training platform. **108 hand-authored labs across 13 categories.** Faction system. XP economy. Boss contracts. Branching narrative quests. Maps to **11 professional certification paths.** Read more in [GRIMOIRE.md](./GRIMOIRE.md).
+- **eBPF Security Monitoring** — 5 kernel-level monitors with ML integration
- **synos-bevy** — Bevy 0.14 game engine, 8 plugins, ~7,000+ lines of immersive desktop experience.
+- **Zero-Trust Architecture** — PKI-based authentication with behavioral analytics
- **Arcanum Hive** — peer-to-peer encrypted mesh + Kubernetes operator. Sovereign coordination across distributed hardware. **The mesh is built for salvaged silicon** — old laptops and retired workstations pulled out of e-waste and back into the compute pool ([the philosophy →](./MESH.md)).
+- **Post-Quantum Cryptography** — NIST PQC standards (ML-KEM, ML-DSA, SLH-DSA)
- **Post-quantum cryptography by default** — hybrid ML-KEM / ML-DSA across the system's transport and signing paths, with SLH-DSA in the trust toolkit.
+
- **41-stage self-healing build pipeline** producing three signed ISOs from a single source tree.
+### ALFRED v5.0 — AI Security Assistant
- **1,600+ tests, 100% pass rate**, 35% tarpaulin coverage floor.
+
- **MkDocs Material documentation** site, version-aware, checked against the source.
+- **LLM Integration** — Support for OpenAI, Anthropic, Mistral, local models
 - **RAG Capabilities** — Vector database with ChromaDB for context-aware responses
 - **STIX 2.1 Threat Intel** — MITRE ATT&CK integration with real-time updates
 - **Security Automation** — Automated reconnaissance, vulnerability scanning, reporting
 - **Voice Control** — Hands-free operation for OPSEC scenarios
 ### GRIMOIRE Labs — Cybersecurity Training
 - **50+ Hands-On Labs** — From beginner (Capture the Flag) to advanced (APT simulation)
 - **Progress Tracking** — XP system with skill trees and achievements
 - **Industry Certifications** — OSCP, GPEN, CEH, CompTIA Security+ aligned content
 - **Real-World Scenarios** — Based on actual CVEs and threat intelligence
 - **Docker Integration** — Isolated lab environments with automatic provisioning
 ###  Developer-Friendly
 - **1.9M+ Lines of Code** — 107 Rust crates, comprehensive Python/C integration
 - **Modular Architecture** — Clean separation between core, services, and applications
 - **Full Documentation** — Architecture guides, API references, development tutorials
 - **CI/CD Pipeline** — Automated testing, security scanning, ISO building
 - **Open Development** — Transparent roadmap, community contributions welcome
 ---
-## by the numbers
+## Download
-The shape of a multi-year build, in figures:
+### Latest Release: v10.3.2 "GRIMOIRE Hardened" for Development Team Use Only (January 2026), Public Beta released Jan 31st (hopefully)
-| | |
+**System Requirements:**
-|---|---|
+- **RAM:** 8GB minimum, 16GB recommended
-| **209** | Rust crates in one workspace — **zero** compile errors |
+- **Storage:** 50GB minimum, 100GB recommended
-| **80** | major version releases (v0 → v80 "Sunlance" 1.0 GA) |
+- **CPU:** x86_64, 4 cores minimum
-| **108** | hand-authored GRIMOIRE labs across **13** categories |
+- **Boot:** UEFI + Legacy BIOS support
-| **11** | professional certification paths the labs map to |
+
-| **1,600+** | tests · **100%** pass rate · 35% coverage floor |
+**Download Options:**
-| **8** | signed, capability-gated Rust kernel modules (`/dev/synos_*`) |
+
-| **41** | self-healing build-pipeline stages → signed ISOs |
+| Edition | Size | Use Case | Link |
-| **6.19** | custom Linux kernel, `CONFIG_RUST=y` |
+|---------|------|----------|------|
-| **0** | backdoors · cloud deps in the critical path · telemetry without consent |
+| **Full ISO** | ~14.5GB | Complete platform with all tools 
 | **Minimal ISO** | ~2.0GB | Core system, download tools as needed 
 | **VM Image** | ~6.0GB | Pre-configured VMware/VirtualBox 
 *Almost entirely Rust. Post-quantum by default. No cloud in the critical path. Built on reclaimed silicon.*
 ---
-## the road to 1.0, in one breath
+##  Use Cases
-Syn_OS reached 1.0 GA the way the rest of it was built — by compounding. **Twenty consecutive releases (v61 → v80)** carried the platform from the v60 line to the "Sunlance" general-availability milestone:
+### 🎓 **Learning & Certification**
 Perfect for students preparing for OSCP, CEH, GPEN, or CompTIA Security+. GRIMOIRE labs provide hands-on practice with real-world scenarios.
- The kernel's AI/observability interface was **re-architected and hardened** — signed modules, capability gates, root-only device access.
+### 🔍 **Penetration Testing**
- **Post-quantum cryptography became the default**, not an option, across the system's transport and signing surfaces.
+Professional-grade toolkit with 600+ tools, automated workflows, and AI-assisted reconnaissance. ALFRED helps automate repetitive tasks.
 - The **GRIMOIRE catalog matured to 1.0** — 108 labs across 13 categories.
 - **ALFRED consolidated into v6.0**, with a privacy-first, local-only posture and stronger guardrails around autonomous behavior.
 - Supply-chain trust deepened — signed modules enforced, content-pinned packages, build-from-source attestation.
-The deeper mechanics of these subsystems live with the source. The shape above is the public picture.
+### 🔬 **Security Research**
 Custom kernel with AI integration enables novel research in ML-based threat detection and autonomous defense systems.
 ### 🏢 **Enterprise Security**
 Zero-trust architecture, post-quantum cryptography, and SIEM integration make Syn_OS suitable for corporate security operations.
 ### 🎮 **CTF Competitions**
 Optimized for Capture the Flag events with quick tool access, automated note-taking, and collaborative features.
 ---
-## the three-image strategy
+##  Why Choose Syn_OS?
-Syn_OS is built once and ships in three signed ISOs.
+| Feature | Kali Linux | ParrotOS | Syn_OS |
-
+|---------|-----------|----------|--------|
-| Image | Audience | What it carries |
+| **Security Tools** | 600+ | 700+ | **600+** (curated) |
-|---|---|---|
+| **AI Integration** | ❌ | ❌ | ✅ **ALFRED v5.0** |
-| **Operator (Master)** | The team that builds Syn_OS. Internal. | The full surface. Not distributed publicly. |
+| **Training Labs** | ❌ | Limited | ✅ **50+ GRIMOIRE Labs** |
-| **GRIMOIRE Public** | Students, cohorts, self-taught practitioners. | The 108-lab training platform, gated tooling, mixed Apache 2.0 + GRIMOIRE-Public license. |
+| **Custom Kernel** | ❌ | ❌ | ✅ **AI Syscalls + Rust** |
-| **Goodlife** | AI researchers, post-quantum experimenters, civilian work. | Jupyter + 10-package research stack, ALFRED `research-mode`, LUKS-encrypted research data. |
+| **Post-Quantum Crypto** | ❌ | ❌ | ✅ **NIST PQC** |
-| **⛧ ChurchOfMalware** | The congregation — offensive-security students & CTF players. | GRIMOIRE-tier, slim, cyberpunk. Member-edition perks baked in: faction, starting loadout, exclusive labs. *(in build — see below)* |
+| **Gamification** | ❌ | ❌ | ✅ **XP + Skill Trees** |
-
+| **Desktop Environments** | 5 | 6 | ✅ **10 Options** |
 The boundaries between images are mechanically enforced — not honor-system. What ships, ships clean.
 ---
-## what we promise
+## 💬 Community
- **The mesh is the product.** Local AI on hardware you physically own. Old silicon reclaimed from landfills, not new GPUs auto-billed monthly. ([the e-waste philosophy →](./MESH.md))
+### Get Involved
- **No cloud in the critical path.** ALFRED runs on your machine. Inference happens locally. The system does not require a network connection to be useful.
+
- **No telemetry without consent.** The default state is silent. Anything that crosses the boundary of the box, you approve.
+- **Report Bugs:** [GitHub Issues](https://github.com/TLimoges33/Syn_OS/issues)
- **Memory-safe by default.** The Rust ratchet (v56) is a one-way commitment — kernel hot paths and userspace foundations move toward Rust, never away.
+- **Feature Requests:** [GitHub Discussions](https://github.com/TLimoges33/Syn_OS/discussions)
- **Post-quantum-ready.** Cryptography in the system is being built for the cryptographic transition that's underway, not the one that ended.
+- **Contact:** mogeem33@gmail.com
- **Reproducible builds.** SLSA-3 reproducible build pipeline. SBOM (CycloneDX) per ISO. Dual-witness signature support across mesh nodes.
+- **Blog:** [Substack](https://shelldiablo33.substack.com)
- **Sigstore-signed releases.** Cosign-signed ISOs with Rekor transparency log entries. Verifiable provenance from build oracle to your USB stick.
+
- **Sovereignty as a design property.** You own your infrastructure, your intelligence, your future. Mechanically. Cryptographically. Architecturally.
+### Contributing
- **No backdoors. Ever.** The codebase is the codebase.
+
 We welcome contributions! See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
 **Ways to Contribute:**
 - 🐛 Bug fixes and testing
 - 📝 Documentation improvements
 - 🎨 UI/UX enhancements
 - 🧪 New GRIMOIRE labs
 - 🔧 Tool integration
 - 🌍 Translations
 ---
-## what's coming
+## 📊 Project Stats
-Public release plans (the ISOs that aren't yet distributed publicly):
+**Codebase (January 2026):**
 - **1.9M+ Lines of Code** across 453,717 files
 - **107 Rust Crates** — Modern, memory-safe components
 - **165K+ Lines of Tests** — 14:1 test-to-code ratio
 - **50+ Labs** — Comprehensive training curriculum
 - **600+ Tools** — Industry-standard security arsenal
- **GRIMOIRE Public ISO** — the gamified training platform, signed, downloadable, with first-boot wizard, faction selection, lab progression. Target: imminent.
+**Active Development:**
- **Goodlife ISO** — the AI research variant. Target: imminent.
+- Production-ready v10.3.2 release
- **⛧ ChurchOfMalware Edition** — a community variant built *with* the [Church of Malware](https://churchofmalware.org) offensive-security org. A dedicated, slim, cyberpunk-themed image distributed through the Church's own forge, where members get a **personalized edition**: auto-enrollment into the ChurchOfMalware GRIMOIRE faction, a baked-in starting loadout, an XP head-start, and member-exclusive labs forged from the community's own craft — mesh C2, RF/wireless, anti-scam ops, OSINT. *The plague doctor boots in green-on-black: code is scripture, exploitation is sermon, defense is salvation.* The faction, perk engine, induction ceremony, quest chain, and boot ritual are **already built**; the ISO is **in active build now.** Target: imminent.
+- Monthly security updates
- **Cohort programs** — multi-tenant GRIMOIRE deployments for classes, clubs, security teams.
+- Growing community
- **Public Sigstore + Rekor** — signed releases verifiable against the public transparency log.
+- OSCP/CEH-aligned training content
 - **Hive expansion** — public Ansible playbook for self-hosting the 8-node Arcanum Hive.
 The Operator image remains internal. That isn't a deferral. That's the design.
 ---
-## why "Syn_OS"
+##  License
-Three readings, all true:
+Syn_OS is released under the **MIT License**.
-1. **The synaptic gap.** Where signal becomes meaning. Where the operating system *is* the cleft between hardware and consciousness.
+**Third-Party Components:**
-2. **Synthesis.** Hardware + AI + game + mesh, fused into one platform.
+- Security tools retain their original licenses (GPLv2, GPLv3, MIT, etc.)
-3. **Sin / sanity.** A name with weight. A platform with stakes.
+- Debian base: [Debian Free Software Guidelines](https://www.debian.org/social_contract#guidelines)
-
+- Kernel patches: GPLv2
 > *"Own your infrastructure. Own your intelligence. Own your future."*
 ---
-## who's behind it
+##  Acknowledgments
-Built by a small team out of **LumOs Solutions**, lead by Ty Limoges in pursuit of one question:
+Syn_OS builds upon the incredible work of:
-
+- **Debian Project** — Rock-solid foundation
-**What if security wasn't a checklist — what if it was a way of seeing?**
+- **Parrot Security** — Tool curation and UI inspiration
-
+- **Kali Linux** — Penetration testing standards
-The work has been sustained over multiple years, across more than sixty named version releases, with a quality bar held high enough that the project's own quality gates (cargo deny clean, 100% test pass, supply-chain provenance, binary boundary enforcement) refuse the build when they aren't met.
+- **BlackArch** — Comprehensive tool collection
 - **Rust Community** — Memory-safe systems programming
 - **Open Source Community** — Thousands of security tools and libraries
 ---
-## stay close
+##  Disclaimer
-The project is moving fast. The public ISOs are close. Watch this repository — when the chapters change, the documents change with them.
+Syn_OS is designed for **authorized security testing and education only**. Users are responsible for ensuring compliance with all applicable laws and regulations. Unauthorized access to computer systems is illegal.
 The doors open as the work matures.
 ---
 <div align="center">
-<img src="./assets/phoenix-white.png" alt="" width="120" />
+**[⭐ Star this repo](https://github.com/TLimoges33/synos-public-docs)** if you find Syn_OS valuable!
-### *the gap is where the meaning lives.*
+Made with ❤️ by the Syn_OS Team
 — LumOs Solutions —
 </div>
--- a/ROADMAP.md
+++ b/ROADMAP.md
@ -1,59 +1,23 @@
-# Direction
+# SynOS Roadmap
-### *what's shipped, where we're heading.*
+## v1.0.2 (January 2025)
 - [ ] Custom Rust kernel integration
 - [ ] Enhanced boot verification
 - [ ] Hybrid kernel fallback system
 - [ ] Mandatory boot testing
 ## v1.1 (Q1 2025)
 - [ ] ALFRED voice integration
 - [ ] Advanced kernel-AI hooks
 - [ ] Real-time performance dashboard
 - [ ] Remote agent deployment
 ## v2.0 (Q2 2025)
 - [ ] Full consciousness framework integration
 - [ ] Self-optimizing kernel behaviors
 - [ ] Neural-symbolic reasoning
 - [ ] Multi-agent coordination
 ---
-## what's already in the platform
+*This roadmap is subject to change based on community feedback and development priorities.*
 The current generation of Syn_OS — **v80 "Sunlance", the 1.0 GA release** — is the product of a sustained, multi-year build. The system that exists today carries:
 - A custom Linux kernel with deep Rust integration and a deliberate system-call surface for AI/observability.
 - A local AI daemon — codename **ALFRED** — modeled after the structure of a biological brain.
 - The **GRIMOIRE** gamified training platform with a hand-authored lab corpus, faction system, narrative quests, and a long arc from novice to sovereign operator.
 - An integrated game engine surface for the parts of the user experience that benefit from one.
 - A distributed mesh capability for those ready to extend the system across multiple machines.
 - Post-quantum cryptography woven through the trust toolkit.
 - A self-healing build pipeline producing signed releases with verifiable supply-chain provenance.
 The work to get here was coordinated across many named campaigns, each adding a load-bearing piece to the platform. The compounding effect — twenty consecutive releases from v61 to v80 — is what the 1.0 GA represents: a hardened kernel AI interface, post-quantum defaults, a 1.0 GRIMOIRE catalog, and ALFRED consolidated to v6.0.
 ---
 ## what's coming
 Syn_OS is heading into a phase of **public release**. The platform has been validated internally for long enough; the next chapter is opening it to the practitioners we've been building it for.
 Broad themes, in rough order of when they mature:
 - **Public-facing ISO releases** — the GRIMOIRE training image and the AI-research variant, signed and verifiable, distributed through channels suited to a serious cybersecurity audience.
 - **Cohort programs** — multi-tenant deployments for classes, clubs, security teams, and training programs that want a real platform under their curriculum.
 - **Deeper AI augmentation** — the companion daemon does its job today; we have a long list of ways it could do more.
 - **Continual GRIMOIRE content waves** — new labs, new boss contracts, new narrative arcs, new factions over time. The world deepens.
 - **Easier mesh adoption** — the distributed parts of the platform have power; we're working on the parts that make them feel inevitable rather than effortful.
 We don't ship a public roadmap with dates. Calendars lie, and we'd rather be honest. The directions above are real. The cadence at which they arrive is whatever the work requires.
 ---
 ## the long arc
 The end-state we're moving toward is a platform where the operator owns their infrastructure, their intelligence, and their future — not in a slogan, but **mechanically, cryptographically, architecturally**. The pieces are there. The work is in fitting them together with the polish, the trust, and the longevity that an operating system deserves.
 We are not building a product. We are building **infrastructure for sovereignty**, with the long-term operator community in mind.
 The roadmap reflects that.
 ---
 ## what isn't on this roadmap
 The internal Operator image's feature trajectory. It exists. It evolves alongside the public roadmap. It is not for public distribution and is not part of this document by design.
 Specific dates. Specific version numbers for things that haven't shipped yet. Promises that read better in marketing than they do six months later. The work happens at the pace it happens.
 ---
 ## how to follow
 Watch this repository. When the chapters change, the documents change with them. The work is the work. The story will keep updating as it unfolds.
--- a/articles/substack/01-introducing-synos.md
+++ b/articles/substack/01-introducing-synos.md
@ -0,0 +1,416 @@
 # Introducing SynOS: The AI-Enhanced Cybersecurity Operating System
 **Author:** Ty Limoges, Lead Developer of Syn_OS
 Imagine a Linux distribution that doesn't just come with security tools—it understands them. One that doesn't just run your commands—it anticipates your needs. One that doesn't just boot—it thinks.
 That's SynOS. And after 18 months of development, it's finally here.
 ---
 ## The Problem: Security Distros Are Stuck in 2015
 Let's be honest: **Kali Linux, ParrotOS, and BlackArch are incredible**, but they're fundamentally the same thing—glorified package managers for security tools. You get hundreds of pre-installed tools, a themed desktop, and you're on your own to figure out how to use them.
 In 2025, that's not enough.
 ### What's Missing?
 1. **Intelligence** - Tools don't talk to each other. No context. No learning.
 2. **Integration** - Everything runs in userspace. Kernel is just vanilla Linux.
 3. **Assistance** - No AI to help you use 500+ tools effectively.
 4. **Innovation** - No fundamental OS innovations since... when?
 Meanwhile, AI is revolutionizing everything else:
 - GitHub Copilot writes code
 - GPT-4 debugs your errors
 - Cursor predicts your next edit
 **Why shouldn't your OS be just as smart?**
 ---
 ## The Vision: An Operating System That Thinks
 SynOS is my answer to this question. It's not just "Kali with AI tools bolted on"—it's a **fundamental rethinking** of what a security-focused OS can be.
 ### Three Core Innovations
 #### 1. AI-Enhanced Kernel (The Heart)
 I didn't just install AI tools—I **integrated AI into the kernel itself**.
 - **Custom Rust Kernel** - Memory-safe, modern, extensible
 - **Neural Darwinism Framework** - Kernel learns from usage patterns
 - **AI-Kernel Bridge** - Userspace AI talks directly to kernel
 - **eBPF Telemetry** - Real-time system intelligence gathering
 **What does this mean?** Your OS doesn't just run processes—it understands them, predicts resource needs, and optimizes itself in real-time.
 #### 2. ALFRED AI Assistant (The Brain)
 Not a chatbot. Not a voice assistant. A true **AI pair-programming partner** for security work.
 ```bash
 $ alfred analyze network-scan.txt --suggest next-steps
 ```
 ALFRED can:
 - Parse tool output (nmap, Burp, etc.)
 - Suggest next enumeration steps
 - Explain vulnerabilities in plain English
 - Generate exploit PoCs
 - Remember context across sessions (RAG)
 **Powered by:**
 - LLM integration (Claude, GPT, local models)
 - ChromaDB vector store for memory
 - Custom security domain training
 - Privacy-first (runs offline)
 #### 3. Consciousness Framework (The Future)
 This is the moonshot. **What if an OS could be self-aware?**
 The Consciousness Framework is my research into:
 - Self-modifying kernel behaviors
 - Emergent intelligence from system metrics
 - Ethical decision-making in automation
 - Neural-symbolic hybrid reasoning
 **Current Status:** Research phase, 15,892 lines of Rust code, fascinating results.
 ---
 ## What You Actually Get: SynOS v1.0.1
 Enough theory. Here's what's **shipping today**:
 ### Security Tools (The Arsenal)
 - **550+ Tools** from Debian, Kali, ParrotOS, BlackArch, and GitHub
 - **Automated Priority System** - ParrotOS packages first, Kali fallback, BlackArch tertiary
 - **Curated Collection** - Not just "install everything"—thoughtfully selected
 **Categories:**
 - Network scanning & enumeration
 - Web application testing
 - Wireless security
 - Exploitation frameworks
 - Forensics & reverse engineering
 - OSINT & reconnaissance
 - Password cracking
 - Social engineering
 ### ALFRED v2.0 (The Assistant)
 - LLM-powered CLI assistant
 - RAG memory system
 - Tool output parsing
 - Natural language queries
 - Offline mode support
 - Privacy-focused design
 ### Data Lake Platform (The Analytics)
 Because **security is data-driven**:
 - PostgreSQL 15 + TimescaleDB 2.x
 - MinIO object storage
 - Pre-configured for SIEM integration
 - Time-series optimized for logs
 - Built-in data pipelines
 ### 7 TUI Applications (The Interface)
 Professional terminal UIs for:
 - `synos-dashboard` - System overview
 - `synos-control` - Service management
 - `synos-recon` - Reconnaissance orchestration
 - `synos-vuln` - Vulnerability management
 - `synos-exploit` - Exploit framework
 - `synos-report` - Report generation
 - `synos-metrics` - Performance monitoring
 ### Multiboot (The Flexibility)
 - **Stable Kernel** - Production-ready Linux 6.12.32
 - **Experimental Kernel** - Custom Rust kernel with AI
 - **Live USB** - No installation required
 - **Persistence Mode** - Save your changes
 - **Amnesic Mode** - Tails-style privacy
 ---
 ## The Tech Stack (For the Technical Folks)
 ### Core OS
 - **Base:** Debian 13 (Trixie) - bleeding edge, stable foundation
 - **Kernel:** Dual-boot (Linux 6.12.32 stable + Custom Rust experimental)
 - **Architecture:** Hybrid x86_64 (BIOS + UEFI support)
 - **Bootloader:** GRUB with custom multiboot config
 ### Build System
 - **Modular Build Pipeline** - 62 independent modules
 - **Checkpoint/Resume** - Never lose progress
 - **Resource Monitoring** - Auto-pause on low memory
 - **Parallel Compilation** - Multi-core optimized
 - **Validation Layers** - Guaranteed bootable ISOs
 ### Languages & Frameworks
 - **Rust** - Kernel, core libraries (38 crates, 15,892 lines)
 - **Python** - AI runtime, tools (PyTorch, ChromaDB, llama-cpp)
 - **Bash** - Build scripts, system automation
 - **C** - Hardware interfaces, kernel modules
 ### AI/ML Stack
 - **LLM Integration:** Claude, GPT-4, local models
 - **Vector DB:** ChromaDB for RAG
 - **ML Frameworks:** PyTorch, SentenceTransformers
 - **Neural Nets:** Custom models for kernel optimization
 ---
 ## Why I Built This (The Personal Story)
 I'm Ty Limoges, a cybersecurity professional who got tired of duct-taping tools together.
 After years of using Kali, ParrotOS, and custom setups, I kept thinking: **"There has to be a better way."**
 - Why can't my OS help me use these tools?
 - Why can't it learn from my workflows?
 - Why is kernel development still stuck in C when Rust exists?
 - Why isn't AI integrated at the system level?
 So in **June 2024**, I started coding. 18 months later, here we are:
 - **15,892 lines** of custom Rust kernel code
 - **38 Rust crates** compiled and working
 - **550+ security tools** integrated
 - **7 custom TUI applications** built
 - **ALFRED v2.0** operational
 - **Complete documentation** (601 files)
 - **Production-ready v1.0.1** ISO
 ---
 ## What's Next: The Roadmap
 ### v1.0.2 (January 2025)
 - ✅ Custom Rust kernel integration (currently in development)
 - ✅ Enhanced boot verification
 - ✅ Mandatory quality assurance
 - ✅ Hybrid kernel fallback system
 ### v1.1 (Q1 2025)
 - Voice integration for ALFRED
 - Advanced kernel-AI hooks
 - Performance dashboard
 - Remote agent deployment
 ### v2.0 (Q2 2025)
 - Full consciousness framework integration
 - Self-optimizing kernel behaviors
 - Neural-symbolic reasoning
 - Multi-agent coordination
 ---
 ## Who Is This For?
 ### Penetration Testers
 - Pre-configured environment with all tools
 - ALFRED assists with methodology
 - Automated reporting
 - Data lake for engagement tracking
 ### Security Researchers
 - Bleeding-edge tools
 - Custom kernel for experimentation
 - AI assistance for analysis
 - Academic research platform
 ### Red Teams
 - Professional TUI interfaces
 - Multi-agent coordination (v2.0)
 - OPSEC features (amnesic mode)
 - Team collaboration tools
 ### Students & Learners
 - Educational AI assistance
 - Guided learning paths
 - Safe practice environment
 - Comprehensive documentation
 ### DevOps/Security Engineers
 - SIEM integration ready
 - Compliance monitoring
 - Automated security scanning
 - Infrastructure as Code support
 ---
 ## The Competitive Landscape
 Let me be clear: **I love Kali, ParrotOS, and BlackArch.** They're phenomenal. SynOS doesn't replace them—it evolves the category.
 | Feature | Kali | Parrot | BlackArch | SynOS |
 |---------|------|--------|-----------|-------|
 | Security Tools | 600+ | 700+ | 2,800+ | 550+ (curated) |
 | AI Assistant | ❌ | ❌ | ❌ | ✅ ALFRED v2.0 |
 | Custom Kernel | ❌ | ❌ | ❌ | ✅ Rust AI kernel |
 | Data Lake | ❌ | ❌ | ❌ | ✅ PostgreSQL+MinIO |
 | TUI Apps | Basic | Basic | None | ✅ 7 professional |
 | AI Integration | None | None | None | ✅ Kernel-level |
 | Base | Debian 12 | Debian 12 | Arch | Debian 13 |
 | Multiboot | Standard | Standard | Standard | ✅ Stable+Experimental |
 **SynOS isn't "more tools"—it's "smarter tools."**
 ---
 ## Try It Yourself
 ### Download (Coming Soon)
 - **ISO Release:** January 2025
 - **File Size:** ~4.5GB
 - **Architecture:** x86_64 (BIOS + UEFI)
 - **Modes:** Live USB, Install, Persistence
 ### System Requirements
 - **Minimum:** 4GB RAM, 20GB disk, 2-core CPU
 - **Recommended:** 8GB RAM, 50GB disk, 4-core CPU
 - **Optimal:** 16GB RAM, 100GB disk, 8-core CPU
 - **GPU:** Optional (for AI acceleration)
 ### Quick Start
 ```bash
 # Boot from USB
 # Select: "SynOS v1.0 - Primary Kernel (Stable)"
 # Try ALFRED
 $ alfred --help
 # Launch dashboard
 $ synos-dashboard
 # Explore tools
 $ synos-control
 ```
 ---
 ## Get Involved
 SynOS is **open development** (documentation public, core private initially).
 ### Ways to Contribute
 1. **Test the ISO** - Report bugs, suggest features
 2. **Write Documentation** - Help others learn
 3. **Submit Tool Recommendations** - What's missing?
 4. **Share Your Workflows** - Help train ALFRED
 5. **Spread the Word** - Tell security community
 ### Stay Updated
 - **Substack:** [Subscribe for updates](#) ← You're here!
 - **GitHub (Public Docs):** [synos-public-docs](#) (launching soon)
 - **LinkedIn:** [Ty Limoges](#)
 - **Email:** mogeem33@gmail.com
 ### For Recruiters
 Yes, I'm open to opportunities! If you're hiring for:
 - Kernel development (Rust/C)
 - Cybersecurity engineering
 - AI/ML integration
 - DevOps/Platform engineering
 **This entire project is my portfolio.** Let's talk.
 ---
 ## The Big Picture: Why This Matters
 We're at an inflection point in computing:
 - **AI is exploding** - But mostly in userspace
 - **Security is critical** - But tools are fragmented
 - **Rust is proven** - But kernel adoption is slow
 - **Edge computing is growing** - Need smarter, lighter OSes
 **SynOS addresses all four trends simultaneously.**
 I believe the future of operating systems is:
 1. **Intelligent** - AI-native, not AI-bolted-on
 2. **Secure** - Memory-safe languages, least-privilege
 3. **Adaptive** - Self-optimizing, context-aware
 4. **Accessible** - Professional tools, learner-friendly
 **That future is SynOS.**
 ---
 ## Closing Thoughts
 Building an operating system is hard. Building an **AI-enhanced** operating system with a **custom kernel** while working **full-time** is... ambitious.
 But 18 months in, I'm proud of what SynOS has become. It's not perfect. v1.0 is "production-ready," not "finished." The consciousness framework is research, not product. The Rust kernel is educational, not battle-tested.
 But **it works**. It boots. It's fast. ALFRED is genuinely helpful. The tools are there. And it's only getting better.
 If you're reading this, you're early. The security distribution landscape is about to change, and you're seeing it first.
 **Welcome to SynOS. Welcome to the future of intelligent security.**
 ---
 ## FAQ
 **Q: When can I download it?**
 A: January 2025 for public ISO release. Beta testing in late December.
 **Q: Is it free?**
 A: Yes, completely free for personal/professional use. Enterprise support may be paid.
 **Q: Will the source code be public?**
 A: Documentation is public now. Core source will be open-sourced in phases starting Q2 2025.
 **Q: Can I use this for CTFs/certifications?**
 A: Absolutely! That's a primary use case.
 **Q: Does ALFRED phone home?**
 A: No. All AI processing is local by default. Cloud APIs are opt-in only.
 **Q: What license?**
 A: Documentation: CC BY-SA 4.0. Code will likely be GPL v3 (TBD).
 **Q: Can I contribute?**
 A: Yes! Start with documentation, testing, and feedback. Code contributions by invitation initially.
 **Q: Why Debian over Arch?**
 A: Stability + bleeding edge (Trixie). Better package signing. Broader hardware support.
 **Q: Is this your full-time job?**
 A: No, this is a passion project. I work full-time in cybersecurity. SynOS is nights/weekends.
 **Q: Are you hiring?**
 A: I'm not, but I'm **looking**! Recruiters: mogeem33@gmail.com
 ---
 ## One More Thing...
 If you made it this far, **thank you**. Seriously.
 Building SynOS has been the most challenging and rewarding project of my career. Sharing it with the world is both exciting and terrifying.
 If this resonates with you—if you believe OSes should be smarter, security tools should be integrated, and AI should be fundamental—**subscribe and join me.**
 The revolution won't be televised. It'll be booted from a USB stick.
 🚀 **Let's build the future together.**
 — Ty Limoges
 December 16, 2025
 ---
 **[Subscribe to SynOS Updates](#)** | **[Download Documentation](#)** | **[Contact Me](mailto:mogeem33@gmail.com)**
 ---
 *P.S. - Next article: "Building a Rust Kernel in 2025: Lessons from 15,000 Lines of Code" - Subscribe to not miss it!*
--- a/assets/phoenix-white.png
+++ b/assets/phoenix-white.png
--- a/assets/phoenix.png
+++ b/assets/phoenix.png
--- a/assets/synos-sanctum.png
+++ b/assets/synos-sanctum.png