SecAI OS

Bootable local-first AI OS with sealed runtime, model quarantine pipeline, airlock egress controls, encrypted vault, and private Tor-routed search.

Built on uBlue (Fedora Atomic / Silverblue). All AI compute -- inference and generation -- stays on-device. Network egress is denied by default. GPU capability is detected at first boot.

Release status: SecAI OS is under active security hardening. A capability is not considered production-verified until a release-specific evidence bundle completes the production readiness checklist. See the capability matrix for verified, experimental, hardware-dependent, and planned functionality.

+-------------------+ +-------------------+ +-------------------+
| A) Base OS | --> | B) Acquisition | --> | C) Quarantine |
| immutable image | | dirty net / | | 7-stage pipeline |
| signed updates | | allowlist only | | fully automatic |
+-------------------+ +-------------------+ +--------+----------+
|
+-------------------+ +--------v----------+
| E) Airlock | <-- | D) Runtime |
| sanitized egress | | sealed inference |
| (optional) | | no internet |
+-------------------+ +-------------------+

Who This Is For

Privacy-conscious AI users who want LLM and image generation without cloud services
Security researchers evaluating model supply-chain risks
Air-gapped environments that need AI inference with no internet dependency
Organizations requiring auditable, policy-enforced AI workstations

What Makes It Different

Default-deny egress -- The runtime has no internet unless explicitly enabled via the airlock.
Supply-chain distrust -- Models are untrusted until they pass a 7-stage quarantine pipeline (source, format, integrity, provenance, static scan, behavioral test, diffusion scan).
Hands-off security -- All scanning, verification, and promotion happens automatically. Users never run security tools manually.
Deterministic policy -- Promotion to "trusted" is rule-based (signatures, hashes, scans, tests), not ad-hoc.
Short-lived workers -- No swap, tmpfs for temp data, inference workers restart between sessions.
25+ defense layers -- From UEFI Secure Boot and TPM2 to seccomp-BPF, Landlock, runtime attestation, continuous integrity monitoring, automated incident containment, and 3-level emergency wipe.

Quickstart

Install Fedora Silverblue 44, then run the bootstrap script. The script configures cosign signature verification before the first image pull.

# 1. Download and review the bootstrap script
curl -sSfL https://raw.githubusercontent.com/SecAI-Hub/SecAI_OS/main/files/scripts/secai-bootstrap.sh \
-o /tmp/secai-bootstrap.sh
less /tmp/secai-bootstrap.sh
# 2. Bind the release channel to its exact signed digest
sudo bash /tmp/secai-bootstrap.sh \
--tag release-vMAJOR.MINOR.PATCH \
--digest sha256:RELEASE_DIGEST
# 3. Reboot and run the privileged setup ceremony from the local console
sudo systemctl reboot
sudo /usr/libexec/secure-ai/secai-setup-wizard.sh

The console wizard verifies the signed deployment, creates and verifies the encrypted LUKS vault, and optionally enrolls TPM2. Only after that succeeds, open http://127.0.0.1:8480 for the unprivileged UI onboarding flow, privacy profile selection, and model import.

Method	Time	Best For	Details
Bootstrap (Recommended)	~30 min	Real PC or VM	Install Fedora Silverblue, run script, reboot
Portable USB	~10 min	Run directly from a USB stick	Flash the release `*-usb.raw.xz` artifact to removable media
Build VM locally	~45 min	VirtualBox / VMware / KVM	`scripts/vm/build-qcow2.sh` builds a QCOW2 from the OCI image
Sandbox Stack	~10 min	Evaluate on an existing workstation	Compose-based control-plane bundle with explicit lower-assurance limits
Development	~10 min	Service development only	No OS features; see dev guide

See docs/install/quickstart.md for full step-by-step instructions, including the sandbox path, VM build details, and verification commands.

Only use a release that publishes a non-placeholder digest and passes the release verifier. Pin that digest with: sudo bash secai-bootstrap.sh --digest sha256:RELEASE_DIGEST

See bare metal | virtual machine | sandbox | development | recovery

Get Your First Model

The default privacy posture keeps Airlock egress disabled. Import a locally obtained, hash-verified model from Models, or explicitly enable the controlled Airlock acquisition path before selecting Download. The model must complete quarantine and atomic promotion before it becomes selectable.

Architecture

Services

Service	Port	Language	Purpose
Registry	8470	Go	Trusted artifact manifest, read-only model store
Tool Firewall	8475	Go	Policy-gated tool invocation gateway
Web UI	8480	Python	Chat, image/video generation, model management
UI Ingress (sandbox only)	8480	Go	Fixed loopback relay with no mounted credential; preserves internal-only UI networking
Airlock	8490	Go	Sanitized egress decision gate (disabled by default)
Inference Worker	8465	llama.cpp	LLM inference (CUDA / ROCm / Vulkan / Metal / CPU)
Diffusion Worker	8455	Python	Image and video generation
Agent	8476	Python	Policy-bound local autopilot (deny-by-default, capability tokens)
Quarantine	--	Python	7-stage verify, scan, and promote pipeline
GPU Integrity Watch	8495	Go	Continuous GPU runtime verification and anomaly detection
MCP Firewall	8496	Go	Model Context Protocol policy gateway (default-deny, taint tracking)
Policy Engine	8500	Go	Unified policy decision point (6 domains, decision evidence, OPA-upgradeable)
Runtime Attestor	8505	Go	Enrolled AK, nonce-bound TPM2 quote/checkquote, authenticated PCR baseline, HMAC-signed state bundles, startup gating
Integrity Monitor	8510	Go	Continuous baseline-verified file watcher (binaries, policies, models, trust material)
Incident Recorder	8515	Go	Security event capture, incident lifecycle, auto-containment
Search Mediator	8485	Python	Tor-routed web search with PII stripping
SearXNG	8888	Python	Self-hosted metasearch (privacy-respecting engines)
Tor	9050	C	Anonymous SOCKS5 proxy

7-Stage Quarantine Pipeline

Every model passes through the same fully automatic pipeline:

Stage	Name	What It Does
1	Source Policy	Verifies origin against allowlist
2	Format Gate	Validates headers, rejects unsafe formats (pickle, .pt, .bin)
3	Integrity Check	SHA-256 hash pinning verification
4	Provenance	Records source-appropriate signature or immutable revision evidence
5	Static Scan	ModelScan + YARA + fickling + modelaudit + entropy analysis + gguf-guard
6	Behavioral Test	41 adversarial prompts across 15 attack categories (GGUF only)
7	Diffusion Scan	Strict config/tensor parsing plus mandatory image-owned per-file manifest (diffusion only)

Security Model

Defense Layers

Layer	Mechanism
Boot	Immutable OS (rpm-ostree), cosign-verified updates, greenboot auto-rollback
Secure Boot	UEFI Secure Boot + MOK signing, TPM2 vault key sealing (PCR 0,2,4,7)
Kernel	IOMMU forced, ASLR, slab_nomerge, init_on_alloc/free, lockdown=confidentiality
Memory	Swap/zswap disabled, core dumps discarded, mlock for secrets, TEE detection
Network	nftables default-deny egress, DNS rate-limited, traffic analysis countermeasures
Filesystem	Encrypted vault (LUKS2/AES-256/Argon2id), restrictive permissions, fs-verity
Models	Credentialless, no-routable-network 7-stage quarantine; immutable file/directory pins; registry-side revalidation
Tools	Default-deny policy, path allowlisting, traversal protection, rate limiting
Egress	Airlock disabled by default, PII/credential scanning, destination allowlist
Search	Tor-routed, privacy-preserving query obfuscation (decoy queries, k-anonymity), injection detection
Audit	Security-critical HMAC-chained logs, explicit format enrollment, keyed checkpoints, and periodic verification
Auth	Scrypt passphrase hashing, rate-limited login, session management
Vault	Auto-lock after 30 min idle, TPM2-sealed keys
Services	Systemd sandboxing: ProtectSystem, PrivateNetwork, seccomp-bpf, Landlock
Agent	Deny-by-default policy engine, HMAC-signed capability tokens, hard budgets, loopback-only IPC
Policy Engine	Unified decision point (6 domains), structured evidence, OPA/Rego-upgradeable
Attestation	Root-only AK/PCR enrollment, fresh nonce-bound TPM2 quote/checkquote, cross-service-verified HMAC bundles, fail-closed startup gating
Integrity	Continuous baseline-verified file watcher (30s scans), signed baselines, auto-degradation
Incident Response	9 incident classes, auto-containment (freeze agent, disable airlock, vault relock, quarantine model)
GPU	Vendor-specific DeviceAllow, PrivateNetwork, driver fingerprinting, device allowlist
HSM/Keys	Pluggable keystore (software/TPM2/PKCS#11), key rotation, PCR-sealed key hierarchy
Clipboard	Verifiable guest controls, explicit host-policy check, per-session 60s auto-clear
Tripwire	Canary files in sensitive dirs, inotify real-time monitoring
Emergency	Verified lock, TPM unlock removal, or LUKS cryptographic erase
Updates	Cosign-verified rpm-ostree, staged workflow, greenboot auto-rollback
Supply Chain	Per-service CycloneDX SBOMs, SLSA v1 provenance attestations, cosign-signed checksums

See docs/threat-model.md for threat classes, residual risks, and security invariants. See docs/security-status.md for implementation status of all 54 milestones.

Verify Image Signatures

Install stable Cosign 3.1.1 or newer to verify the Rekor v2-backed image attestations produced by the release workflow.

cosign verify --key cosign.pub \
ghcr.io/secai-hub/secai_os@sha256:RELEASE_DIGEST

Releases & Packages

Container Image (OCI)

Every push to main builds a signed OCI image via BlueBuild:

ghcr.io/secai-hub/secai_os:latest # rolling latest
ghcr.io/secai-hub/secai_os:44 # Fedora 44 base

Install with mandatory digest pinning:

sudo bash secai-bootstrap.sh \
--tag release-vMAJOR.MINOR.PATCH \
--digest sha256:RELEASE_DIGEST

The image is cosign-signed. Verify before pulling:

cosign verify --key cosign.pub \
ghcr.io/secai-hub/secai_os@sha256:RELEASE_DIGEST

Tagged Releases

Tagged releases (v*) are built by the Release workflow and include:

Artifact	Description
`<service>-linux-amd64`	Static Go binary (x86_64)
`<service>-linux-arm64`	Static Go binary (ARM64)
`<service>-sbom.cdx.json`	Per-service CycloneDX SBOM
`SHA256SUMS`	Checksums for all release artifacts
`SHA256SUMS.sig`	Cosign signature over checksums
`IMAGE_DIGEST`	OCI image digest for this release
`RELEASE_MANIFEST.json`	Machine-readable release manifest (binaries, SBOMs, provenance, build metadata)
`secai-os-*.iso.sig`	Cosign signature for the bootable ISO
`secai-os-*-usb.raw.xz.sig`	Cosign signature for the portable USB image

Go services shipped as release binaries: airlock, registry, tool-firewall, gpu-integrity-watch, mcp-firewall, policy-engine, runtime-attestor, integrity-monitor, incident-recorder.

Python services (ui, agent, quarantine, diffusion-worker, search-mediator) are baked into the OCI image and do not ship as standalone binaries.

Bootable Media

A signed bootable installer ISO is built by every tagged release from the cosign-verified immutable bootc digest. Each release also includes a compressed portable USB image (secai-os-*-usb.raw.xz) built from that same digest so the OS can be flashed directly to a USB stick and run without first installing to the internal disk. Both artifacts are available as workflow artifacts (90-day retention) from the Release workflow runs, and their cosign signatures are published to the GitHub Release for verification.

For Windows users writing the portable USB image:

Prefer USBImager for *.raw.xz because it can write compressed disk images directly.
In Rufus, keep Boot selection set to Disk or ISO image, click SELECT, and choose the portable USB image. If Rufus does not accept *.raw.xz, extract it to *.raw first with 7-Zip and select the extracted file instead.
Do not choose MS-DOS, FreeDOS, or Non bootable for the portable USB image.
Boot the USB in UEFI mode with Legacy/CSM disabled. If firmware still refuses the media, temporarily disable Secure Boot for troubleshooting.

To build portable USB or VM media locally from the OCI image:

bash scripts/build-usb-image.sh \
--image-ref ghcr.io/secai-hub/secai_os@sha256:RELEASE_DIGEST \
--output-dir output
bash scripts/vm/build-qcow2.sh \
--image-ref ghcr.io/secai-hub/secai_os@sha256:RELEASE_DIGEST
bash scripts/vm/build-ova.sh # converts output/secai-os.qcow2 to output/secai-os.ova

The media builders verify the exact source image with cosign.pub before use and use a digest-pinned bootc-image-builder image. VM builds require a Linux host with cosign, virt-install, virsh, qemu-img, and libvirt. QCOW2 and OVA images are intentionally local-only: their encrypted-boot credentials are unique to the operator and are never published as generic release artifacts. CI builds ephemeral VM images for qualification and destroys them.

Verify a Release

Full release verification requires stable Cosign 3.1.1 or newer.

# Download and verify checksums
curl -sSfL https://github.com/SecAI-Hub/SecAI_OS/releases/latest/download/SHA256SUMS -o SHA256SUMS
curl -sSfL https://github.com/SecAI-Hub/SecAI_OS/releases/latest/download/SHA256SUMS.sig -o SHA256SUMS.sig
cosign verify-blob --key cosign.pub --signature SHA256SUMS.sig SHA256SUMS
sha256sum -c SHA256SUMS
# Or use the Makefile from this repository with the published image digest
make verify-release IMAGE=ghcr.io/secai-hub/secai_os@sha256:RELEASE_DIGEST

See docs/sample-release-bundle.md for the full artifact structure and docs/release-policy.md for release channels (stable/candidate/dev).

Diffusion Runtime (On-Demand)

The ~2–5 GB diffusion runtime (PyTorch, diffusers, transformers) is not included in the base image. It is acquired on-demand when a user first visits the Generate page:

Backend auto-detected (CUDA / ROCm / CPU)
Wheels downloaded from PyTorch/PyPI with full hash verification against committed manifests
Installed into an isolated venv, smoke tested, and enabled

Trust anchors: diffusion-runtime-manifest.yaml + per-backend lockfiles (diffusion-{cpu,cuda,rocm}.lock). Air-gapped installs supported via --from-local.

Hardware Support

GPU capability is detected at first boot. Production support is granted only for hardware combinations recorded in a release-specific qualification report.

Vendor	GPUs	Backend	LLM	Diffusion
NVIDIA	RTX 30/40/50-series	CUDA	Hardware-dependent	Hardware-dependent
AMD	RDNA/CDNA	ROCm (HIP)	Experimental	Experimental
Intel	Arc A/B-series	XPU / Vulkan	Experimental	Experimental
Apple	M1–M4	Metal / MPS	Sandbox/dev only	Sandbox/dev only
CPU	x86_64 (AVX2/AVX-512)	CPU	Supported fallback	Functional, slow

Minimum: 16 GB RAM, 8 GB VRAM, 64 GB storage. See docs/compatibility-matrix.md for detailed specs.

Configuration

All config lives in /etc/secure-ai/ (baked into the image, read-only at runtime):

File	Purpose
`config/appliance.yaml`	Mode, paths, inference/diffusion settings, service binds
`policy/policy.yaml`	Tool firewall, airlock, quarantine stages, search settings
`policy/agent.yaml`	Agent mode: operating modes, budgets, workspace scopes, allow/deny matrix
`policy/models.lock.yaml`	Pinned model hashes (supply-chain verification)
`policy/sources.allowlist.yaml`	Trusted model sources

See docs/policy-schema.md for full schema reference. See examples/sample-policy.yaml for annotated example.

Verification & Audit

Workflow Files

Security Documentation

CI Verification Evidence

All CI jobs are defined in .github/workflows/ci.yml. View the latest CI run.

Job	Workflow Link	What It Proves
`go-build-and-test`	View job	All Go modules with `-race` (build, test, vet); enforced floor in test-counts.json
`python-test`	View job	Unit/integration + adversarial/acceptance tests, ruff, bandit, and mypy; enforced floor in test-counts.json
`appsec-lint`	View job	Hadolint for container build files and Semgrep project security rules
`security-regression`	View job	Adversarial test suite: prompt injection, policy bypass, containment, recovery
`supply-chain-verify`	View job	SBOM generation via Syft, cosign availability, provenance keywords in release/build workflows
`test-count-check`	View job	Prevents documented test counts from drifting below actual (source of truth: test-counts.json)
`dependency-audit`	View job	Enforced Go vulnerability scanning (govulncheck) + Python dependency audit (pip-audit) with waiver mechanism
`shellcheck`	View job	Static analysis of production shell entrypoints (first-boot, service build, MOK generation, verify-release, etc.)
`policy-validate`	View job	YAML schema validation for all policy and recipe files
`check-pins`	View job	Verifies all GitHub Actions are pinned to specific commit SHAs (not tags)
`docs-validation`	View job	Broken link detection, required docs presence, test-counts.json format validation

Documentation

Document	Description
Architecture	System design, zones, data flow, service dependencies
Threat Model	Threat classes, invariants, residual risks
API Reference	HTTP API for all services
Policy Schema	Full policy.yaml schema reference
Security Status	Implementation status of all 54 milestones
Test Matrix	Current test areas and enforced count floors
Compatibility Matrix	GPU, VM, and hardware support
Security Test Matrix	Security feature test coverage
FAQ	Common questions
Glossary	Key terms and concepts
Non-Goals	What SecAI OS does NOT try to do
Why is this safe?	Plain-language security explanation
Telemetry Policy	No-telemetry guarantee

Component Docs

Component	Description
Registry	Trusted artifact manifest and model store
Tool Firewall	Policy-gated tool invocation
Airlock	Sanitized egress decision gate
Quarantine	7-stage scanning pipeline
Agent	Policy-bound local autopilot with verified supervisor
Search Mediator	Tor-routed web search
GPU Integrity Watch	Continuous GPU runtime verification
MCP Firewall	Model Context Protocol policy gateway
Policy Engine	Unified policy decision point
Runtime Attestor	TPM2 attestation and startup gating
Integrity Monitor	Continuous file integrity verification
Incident Recorder	Security event capture and auto-containment
M5 Control Matrix	M5 acceptance criteria, enforcement paths, operator verification
Supply Chain Provenance	Provenance pipeline, SBOM coverage, key material
Audit Quick Path	External auditor step-by-step verification guide
Recovery Runbook	Operator procedures for degradation, containment, and recovery
Sample Release Bundle	Release artifact structure and verification commands
Production Operations	First-boot checks, upgrades, key rotation, monitoring, capacity
Production Readiness Checklist	Formal release gate checklist for production deployments
SLOs	Service level objectives: availability, latency, correctness targets
Release Policy	Release channels (stable/candidate/dev), versioning, upgrade paths
Support Lifecycle	Hardware matrix, driver versions, support windows, deprecation policy

Install Guides

Guide	Description
Quickstart	Choose your path: ISO, OVA, QCOW2, or rebase
Bare Metal	Fresh install on dedicated hardware
Virtual Machine	VirtualBox, VMware, KVM/QEMU
Development	Local dev without OS rebase

Examples

Example	Description
Import a GGUF Model	Safe model import walkthrough
Quarantine Promotion	Full pipeline walkthrough
Run Fully Offline	Air-gapped operation
Enable Web Search	Tor-routed search setup
Vault Management	Lock, unlock, keepalive
Recover from Failed Update	Rollback and recovery
VM vs Bare Metal	Comparison and tradeoffs
Add Model Source	Allowlist a new source

Machine-Readable

Resource	Description
OpenAPI Spec	OpenAPI 3.0 for all HTTP APIs
Policy Schema	JSON Schema for policy.yaml
Appliance Schema	JSON Schema for appliance.yaml
Service Diagram	Mermaid dependency diagram
llms.txt	LLM-friendly project summary
llms-full.txt	Extended LLM-friendly reference

Using the Appliance

Web Interface

Open http://127.0.0.1:8480:

Chat -- LLM interaction with optional Tor-routed web search
Models -- Browse catalog, one-click download, import, verify hashes
Generate -- Text-to-image, image-to-image, text-to-video with diffusion models
Security -- Service health, Secure Boot/TPM2 status, audit chain, emergency panic
Updates -- Staged update workflow (check / stage / apply / rollback)
Settings -- Vault status and local-console instructions, profile settings, session management

Emergency Panic

sudo securectl panic 1 # Reversible runtime lock
sudo securectl panic 2 # Prompts locally; removes TPM/hardware unlock
sudo securectl panic 3 # Prompts locally; destroys all vault LUKS keyslots

The Security page shows status and local-console instructions; it never owns root authority. Passphrases are not accepted in an HTTP body or command-line argument. Level 3 cryptographically erases the encrypted vault; unlinking unencrypted metadata does not claim physical overwrite on flash or copy-on-write media.

Vault Management

curl http://127.0.0.1:8480/api/vault/status # Check status
sudo /usr/bin/python3 /usr/libexec/secure-ai/vault-watchdog.py \
--lock-once --reason operator_request # Lock
sudo /usr/bin/python3 /usr/libexec/secure-ai/vault-watchdog.py \
--unlock-once # Local passphrase prompt

The HTTP lock/unlock routes intentionally return 501; the web process never receives a LUKS passphrase or root service-control authority.

Web Search (Tor-Routed, Optional)

# Enable in policy, then start the search stack
sudo systemctl start secure-ai-tor secure-ai-searxng secure-ai-search-mediator

Privacy: Tor-routed, PII stripped, injection detection, privacy-preserving query obfuscation (decoy queries, k-anonymity), audit logged. See examples/enable-web-search.md.

Running Tests

# Go tests across all service modulesforsvcin airlock registry tool-firewall gpu-integrity-watch mcp-firewall \
policy-engine runtime-attestor integrity-monitor incident-recorder;do
(cd services/$svc&& go test -v -race ./...)
done# Python tests
python -m pip install --require-hashes -r requirements-ci.lock
PYTHONPATH=services python -m pytest tests/ -v
# Shell script linting
make shellcheck

See docs/test-matrix.md for full breakdown.

Roadmap

All 54 project milestones (implementation status; click to expand)

Checked milestones mean that the associated source implementation exists. They are not release certification, production sign-off, or hardware qualification. The capability matrix and the evidence produced for a specific release are authoritative.

Project Structure

recipes/ BlueBuild recipe (image definition)
files/
system/
etc/secure-ai/ Policy and config files baked into image
etc/nftables/ Firewall rules (default-deny egress)
usr/lib/systemd/ Systemd service units (sandboxed)
usr/libexec/ Helper scripts (firstboot, vault, securectl, canary)
services/
registry/ Go -- Trusted Registry (:8470)
tool-firewall/ Go -- Policy-gated tool gateway (:8475)
airlock/ Go -- Online egress decision gate (:8490)
gpu-integrity-watch/ Go -- GPU runtime verification (:8495)
mcp-firewall/ Go -- MCP policy gateway (:8496)
policy-engine/ Go -- Unified policy decisions (:8500)
runtime-attestor/ Go -- TPM2 attestation + startup gating (:8505)
integrity-monitor/ Go -- Continuous file integrity watcher (:8510)
incident-recorder/ Go -- Incident capture + containment (:8515)
agent/ Python/Flask -- Verified supervisor autopilot (:8476)
quarantine/ Python -- 7-stage verification + scanning pipeline
diffusion-worker/ Python -- Image/video generation (:8455)
search-mediator/ Python -- Tor-routed web search (:8485)
ui/ Python/Flask -- Web UI (:8480)
ui-ingress/ Go -- Uncredentialed fixed sandbox relay (:8480)
common/ Python -- Shared utilities (audit, auth, mlock)
tests/ Python, integration, adversarial, and acceptance tests
docs/ Architecture, API, threat model, install guides
schemas/ OpenAPI spec, JSON Schema for config files
examples/ Task-oriented walkthroughs
.github/workflows/ CI (test/lint), build (image), release (SLSA v1/SBOM)

Contributing

See CONTRIBUTING.md for local dev setup, coding standards, and PR rules.

Security

See SECURITY.md for vulnerability reporting and threat boundaries.

Telemetry

SecAI OS does not collect telemetry. No usage analytics, crash reports, or phone-home. See docs/telemetry-policy.md.

License

Apache License 2.0

Name		Name	Last commit message	Last commit date
.github		.github
build		build
deploy/sandbox		deploy/sandbox
docs		docs
examples		examples
files		files
modules		modules
recipes		recipes
release-keys		release-keys
schemas		schemas
scripts		scripts
services		services
tests		tests
upstreams		upstreams
vendor		vendor
.dockerignore		.dockerignore
.gitattributes		.gitattributes
.gitignore		.gitignore
.gitleaksignore		.gitleaksignore
.hadolint.yaml		.hadolint.yaml
.semgrep.yml		.semgrep.yml
.upstreams.lock.yaml		.upstreams.lock.yaml
CHANGELOG.md		CHANGELOG.md
CITATION.cff		CITATION.cff
CODE_OF_CONDUCT.md		CODE_OF_CONDUCT.md
CONTRIBUTING.md		CONTRIBUTING.md
LICENSE		LICENSE
Makefile		Makefile
README.md		README.md
SECURITY.md		SECURITY.md
SUPPORT.md		SUPPORT.md
cosign.pub		cosign.pub
llms-full.txt		llms-full.txt
llms.txt		llms.txt
requirements-ci.lock		requirements-ci.lock
requirements-ci.txt		requirements-ci.txt
secai-sandbox.cmd		secai-sandbox.cmd

Latest commit

History

Folders and files

Repository files navigation

SecAI OS

Who This Is For

What Makes It Different

Quickstart

Get Your First Model

Architecture

Services

7-Stage Quarantine Pipeline

Security Model

Defense Layers

Verify Image Signatures

Releases & Packages

Container Image (OCI)

Tagged Releases

Bootable Media

Verify a Release

Diffusion Runtime (On-Demand)

Hardware Support

Configuration

Verification & Audit

Workflow Files

Security Documentation

CI Verification Evidence

Documentation

Component Docs

Install Guides

Examples

Machine-Readable

Using the Appliance

Web Interface

Emergency Panic

Vault Management

Web Search (Tor-Routed, Optional)

Running Tests

Roadmap

Project Structure

Contributing

Security

Telemetry

License

About

Topics

Resources

Code of conduct

Contributing

Security policy

Stars

Watchers

Forks

Releases

Packages

Used by

Contributors

Languages