Stained Glass OS

Vision backlog — David's wants

Captured 2026-09-22 from David, verbatim intent preserved, then organised and ordered. This is the running list of desired end-state capabilities beyond the Phase 0 image. Items map onto ROADMAP.md phases where one already exists, and add new ones where none did. Order is a recommendation; David set none.

Each item has: what it is, where it stands, what it depends on, and whether it is a [DAVID] decision (security model, repo creation/hard-fork, hosting spend) that must not be decided unilaterally.

The wants, as stated

PowerShell included Wine-side. Microsoft Edge running within the Wine side. Windows Python installed. Potentially winget installed. Proper theming so all the windows aren't ugly gray bars. RDP both in and out. Proper control panel. Able to apply policies. Potentially even able to host a domain being a domain controller. Elevation — windows, or something needs to be installed as administrator or opened as administrator. I'm thinking we'll have regular users, administrators that run as the system user, and potentially the kernel level would be the Linux root. Not sure if it's a good security model but potentially the system user has sudo access to get to root. Even if that literally means running a sudo su from an elevated shell. We also need an upgrade path, where updates download and then install on a reboot. Similar to how Windows normally does it and how PureOS does it. The live image would also need an install path for the OS. A partitioner etc. We will set up a repository for the .debs, defaulting to Debian and a mirror plus our soon-to-be repo. And the upgrade command can literally just use apt. Plus if we get winget going, upgrades from that direction too. I'm considering using GitHub Pages for the repository, but only if our packages fit within their site maximum. If not, getting a VPS to host the repository.

Status (2026-09-22)

Item State
B1 Theming Done (2026-09-24). White flat title bars and light chrome, 30px captions, flat caption buttons (wine-sg 0013); the Light visual style's blue accents are now recoloured to the project purple (wine-sg 0031 -- SVGs recoloured, build.sh regenerates the theme BMPs). Verified in the image; the installed light.msstyles carries purple and no blue.
A1 PowerShell 7 Done. 7.6.6 in C:\Program Files\PowerShell\7, on PATH, Start menu; sg-apps-check passes in the image. Open: fails with no console and redirected output (unattended use).
A2 Windows Python Done. 3.14.7 with pip/venv, PEP 514, PATH, Start menu; gated in the image.
A3 winget WORKS, 2026-09-24 (wine-sg 10.0-11). The real, user-supplied winget-cli searches both sources, shows manifests, installs MSI and NSIS packages, lists and uninstalls them. The acceptance gate make test-winget runs it end to end in a fresh prefix. Built in Wine: Windows.Web.Http (0028-0029), Uri (0030, 0033), MRT ResourceLoader + PRI reader (0032), appxpackaging.dll (0035), the AppX signature SIP (0037), the Compression API (0036), package name functions (0034), PackageCatalog (0043), PackageManager queries (0044), and the .msi verb fix (0045). Along the way two Authenticode trust holes were closed (0039, 0040), and administrator-added roots now persist (0042). Remaining: MSIX deployment (PackageManager.AddPackageAsync) and the bundle reader, for Store/MSIX packages.
E2 RDP out Done. sg-mstsc (Remote Desktop Connection, mstsc command line and .rdp files, injection-hardened) starts sdl-freerdp3; gated in sg-shell, verified in the image.
A6 .NET Framework & HTML engine Done (new item). Wine Mono 9.4.0 and Gecko 2.47.4 shipped unpacked and shared; the image compiles and runs a .NET Framework program.
F3 Staged updates Done. PackageKit offline updates via sg-update-prepare (daily timer); make update-test proves download-now, install-on-reboot. The image now also carries Debian's apt sources, which it lacked.
F1/F2 Repository Live at https://stained-glass-os.github.io/apt, signed, trusted by the image (package-repository.md). Open: payloads as .debs, rising versions per build.
C1 Principals / C2 Elevation Core implemented (ADR 0012). Administrators = sg-admins (also sudo); the broker sg-brokerd starts a program as the SYSTEM account after consent; sg-elevate + wine-sg 0022 wire "Run as administrator"; standard users cannot self-elevate (0019). Gate make elevate-test. Consent prompt landed 2026-09-24: sg-compositor SECURE mode + sg-consent.exe driven by the broker (Yes/No for administrators, administrator credentials otherwise; gates make test-secure, make test-consent). Remaining: elevated-window input isolation (UIPI).
Security blocker (D14) Fixed. ADR 0013 option D implemented (wine-sg 0014-0016): a user's programs open, create, delete, rename, reopen and chmod files with the user's own Unix rights. sg-file-access-check 4/4 in the image. Follow-ons: user SIDs have names (D12, wine-sg 0017); new users get their own profile and TEMP (D15, wine-sg 0018 + a login-time profile step). Open: device nodes; the shared server cannot signal another user's threads (D16). C1/C2 are unblocked.

2026-09-24: shell, theme, Control Panel, installer, networking

Item State
Text and chrome Done. ClearType text that the Windows setting controls (wine-sg 0064); Segoe UI 9 pt as Inter, metric-compatible Liberation/Carlito/Caladea/Cascadia for Arial, Times, Courier, Calibri, Cambria, Consolas (sg-shell); flat Windows-10 scroll bars (0065); the theme's own accents purple (0066).
Virtual desktops Done. Cloaked windows (0067: DWMWA_CLOAK, DWMWA_CLOAKED); desktops, Task View (Win+Tab, taskbar button, thumbnails, drag a window onto a desktop), Alt+Tab, IVirtualDesktopManager, state in Windows' registry location (0068).
Shell keys and snapping Done. The Windows key opens Start; Win+D/M/E/R/I/X/Pause, Win+arrows (0071); drag to an edge snaps, with a preview (0073, 0075); the work area is the taskbar's for every program (0074). control.exe run directly opens our Control Panel (0072).
Wallpaper Done. Any picture format, Windows' styles, no paint-over (0069); our own generated stained-glass wallpapers, the default (sg-shell).
Control Panel Done. Windows-10 category Control Panel with System (rename, join domain), Programs and Features, User Accounts, Date and Time, Personalization, Windows Update, Network and Sharing Center, hosted .cpl applets; admin changes through sg-admind (ADR 0012 amended, approved by David).
Networking Done. NetworkManager with Wi-Fi and firmware; sg-netctl; Network Connections with the TCP/IPv4 dialog; the taskbar Wi-Fi flyout; administrators set static addresses, users join Wi-Fi; VM gate with a simulated radio.
Installer Done. Windows-Setup-style Setup with a partitioner (installs beside Windows without touching it), a live "Try Stained Glass OS" desktop, automatic drivers (non-free, NVIDIA via nvidia-detect, Secure Boot MOK enrolment); install gates on a blank and a dual-boot disk.
Shell folders Fixed. A standard user's Desktop was cached empty (shortcuts did not open, no desktop icons) (0070).
CI Green on every repo (sg-image builds the packages on trixie).
Open Cross-process window capture (real thumbnails for never-active windows); dark mode; netsh/ipconfig on sg-netctl; OOBE after install; a signed boot chain (shim); Windows interop tests (needs a Windows licence).

Found along the way: the session disabled .NET system-wide (fixed); wine-sg's build did not apply patches added after first unpack (fixed); sg-session CI tested against the wrong Wine (fixed, pending a green run).

Themes and items

A. Windows software parity (Wine-side apps & runtimes)

Update 2026-09-24: the Windows.Web.Http stack is implemented (wine-sg 0028-0029) and iertutil gained IUriEscapeStatics (0030); with these winget search returns real Microsoft Store results over the Store REST API. The three remaining pieces (MRT strings, community/MSIX source, install) are each a large Windows subsystem; search via the msstore REST source is fully working today.

Update 2026-09-24 (later): install/list/uninstall of MSI and NSIS packages work (wine-sg 0043-0045), and MSIX deployment is in (0060-0063). PackageManager installs signed packages and bundles: the signature must be trusted, and the block map is checked. It registers them, gives them Start menu shortcuts, lists and removes them, and a packaged app gets its package identity. Open: dependency (framework) and resource packages, app execution aliases. - A4. Microsoft Edge (Wine-side). ROADMAP P4. Working, sandbox on (2026-09-24): Edge, supplied by the user, installs silently from its MSI and shows, scripts and paints pages with its own sandbox. Its renderers run in an AppContainer at low integrity with restricted tokens (wine-sg 0049-0055). Gate: wine-sg make test-edge. - A5. Proper Control Panel. First pass done, 2026-09-23. sg-control (sg-shell) is a Control Panel window showing the machine's real state -- edition, computer name, system type, the signed-in user and their session administrator status, Windows Update management, and the count of machine policies in force -- read from the live token, registry and system. control opens it (App Paths); the Start menu lists it. Gate: sg-shell test/ control-check.sh. Open: navigable categories/applets, and settings the user can change (needs the elevation broker for machine settings).

C. Security & privilege model [DAVID]

D. Domain

E. Remote access

F. Lifecycle & distribution

Unblocked now (no [DAVID] gate) — do in this order: 1. B1 Theming — visible, continues the shell work just shipped. 2. A1 PowerShell and A2 Windows Python — self-contained prefix installs, each with a gate. High utility, low risk. 3. F1/F2 Repo + hosting decision — measure .deb sizes, stand up the repo tooling (works the same whichever host); bring David the size numbers so the GitHub-Pages-vs-VPS call is informed. 4. E2 RDP out — ship a client + launcher; small.

Needs a [DAVID] decision first, then build: 5. C1 Principal/security model — write the ADR (regular / admin=system / root=Linux, and whether system→root via sudo). Get sign-off. 6. C2 Elevation and C3 policies (P3 gpo-agent) — build on the signed-off model. A5 Control Panel rides on B1 + C. 7. F3 Staged upgrades — once the repo exists. 8. A3 winget — spike feasibility; then F4.

Larger / later (existing roadmap phases, sequence as there): 9. F5 Live installer — a milestone of its own; can proceed in parallel once the image is stable. 10. D1 Domain member (P2) → E1 RDP-in streaming (needs sg-compositor) → A4 Edge (P4) → D2 DC role (P9).

Decisions parked for David