Technical Documentation

Overview

Alfred Linux is a complete operating system built from the ground up with AI as the primary user interface. Based on Debian Trixie (13), the current v7.77 Kingdom GA target ships 1,335 build hooks on the live-build host (three dedicated security hooks plus the 6-module Omahon Seal, for 41 security modules total) — a stack no other distribution ships as one integrated image. For context: v7.77 GA (April 2026) shipped 17 hooks; we set a 42-hook milestone for Matthew 1:17 (Abraham → Christ) and the build outgrew it as observability, attestation, and the Kingdom-worship suite expanded. Everything below in Build History records growth by milestone, not today’s headline count.

How "1,335 hooks" is counted: Exactly 1,335 files matching config/hooks/live/*.chroot + config/hooks/live/*.binary exist in the GoForge alfredlinux-com-source-live repo. The build also runs 23 stock Debian live-build hooks via config/hooks/normal/ symlinks (locale generation, apt cache, dbus machine-id removal, etc.) — for 1,358 total hooks executed at build time. We don't count those 23 toward the marquee number because Debian wrote them, not us. Why not 42? 42 was the April 2026 milestone (Matthew 1:17, the 42 generations from Abraham to Christ). The Kingdom outgrew the marker as observability waves, attestation, the AI stack, and the worship suite landed. Separately: the bytes on /download can still expose fewer Alfred hook markers inside the squashfs until the next successful reseal from that tree; see includes/ga-release-state.php ($gaFrozenIsoHookCount vs $gaPlannedHookCount).

Alfred Linux is not a Linux distribution with a chatbot bolted on. The AI is integrated at the operating system level — from voice-driven shell interaction to the development environment to the browser. Every component was chosen and configured to serve the mission: your voice is the command line.

What Ships in v7.77

• Alfred Desktop Environment — Wayland 3D Cube4 with custom theming, Arc dark theme, Papirus icons, JetBrains Mono font, and branded Plymouth boot splash
• Alfred Browser — Built on Tauri + WebKitGTK. 4.7 MB. Zero telemetry, zero tracking. Replaces Firefox-ESR entirely
• Alfred IDE — full VS Code-compatible IDE (code-server 4.115.0) on port 8443. Alfred Commander extension is bundled but currently NOT working in 7.77 GA (see Honest gaps).
• Alfred Voice — Kokoro TTS engine with PyTorch CPU backend, spaCy NLP, and a welcome greeting on first boot
• Alfred Search — Meilisearch local search engine for offline-first, instant search across all local content
• Calamares Installer — Full graphical disk installer with Kingdom of God branding, custom slideshow, and encrypted disk support
• Welcome App — 7-page first-boot wizard (Python/Tk) for voice setup, WiFi config, tool launcher, P2P seeding opt-in, and keyboard shortcuts
• Alfred Store — Flatpak-powered app center with 6 curated categories, search, one-click install, and threaded updates
• Voice 2.0 Wake Word — Always-on “Hey Alfred” detection via openWakeWord. Systemd service with configurable threshold
• alfred-update & alfred-info — CLI tools for one-command system updates (APT + Flatpak + Alfred version check) and branded system info panel

World Firsts & Records

World Firsts (Sovereign Class)

As of June 2026, the Alfred Linux 2026 Gold Master achieves the following confirmed "World First" technical milestones:

Kernel Deep-Dive

Alfred Linux 7.77 GA ships Linux kernel 7.0.12, custom-compiled from Linus Torvalds' mainline source tree. This makes Alfred Linux the first operating system distribution in the world to ship kernel 7. Kernel 7.0 was released by Torvalds on April 5, 2026 (first major version bump since 6.0 in October 2022); 7.0.1 was the first stable point release.

What Kernel 7.0 Brings

• 3 New Hardware Mitigations (Kernel 7 Exclusive) — ITS (Indirect Target Selection), TSA (Transient Scheduler Attacks), and VMSCAPE (VM Escape) — not available in ANY 6.x kernel.
• 24 Total CPU Vulnerability Mitigations — Spectre v1/v2/BHI, Meltdown (PTI), MDS, TAA, L1TF, SRBDS, SRSO, RFDS, GDS, Retbleed, MMIO, SSB, SLS, Call Depth Tracking, Retpoline, IBPB/IBRS, plus the 3 new ones.
• Expanded Rust-in-Kernel — More kernel subsystems in Rust for memory safety.
• EEVDF Scheduler Refinements — Better latency and throughput on multi-core machines.
• Latest Hardware Support — Intel Xe2, AMD RDNA4, NVIDIA 570+, WiFi 7, USB4, Thunderbolt 5, PCIe Gen 6.

Alfred Linux Security Hardening (12 Gaps Patched)

The default kernel 7.0 config ships with 12 security gaps that Alfred Linux patches at boot. No other consumer distro patches all 12:

Additional Hardening Layers

• 16 Boot Parameters — lockdown=integrity nohibernate debugfs=off io_uring_disabled=2 tsx=off slab_nomerge page_alloc.shuffle=1 iommu.strict=1 vsyscall=none and more
• 40+ Sysctl Rules — ASLR, kptr_restrict=2, dmesg_restrict, perf paranoid=3, BPF JIT hardening, kexec disabled, SysRq disabled, userfaultfd restricted, tty ldisc locked
• 30+ Module Blacklist — DCCP, SCTP, RDS, TIPC, Firewire, Thunderbolt, cramfs, hfs, freevxfs, jffs2, appletalk, IPX, and more
• nftables Firewall — Drop-by-default, rate-limited SSH (10/min), rate-limited ICMP (5/sec), full audit logging
• AppArmor + Fail2ban + auditd — Mandatory access control, SSH brute-force 3-strike 24h ban, comprehensive audit trail
• Secure Mounts — /tmp and /dev/shm: noexec, nosuid, nodev
• Core Dumps Disabled — Hard limit 0, kernel.core_pattern=/bin/false
• Auto-generated IDE Passwords — Each session gets a unique random password, no default credentials
• Omahon Seal (6 modules) — Boot Seal (HMAC-SHA256 of 14 boot files), Watchman (inotify on /etc + /boot), Vault (tmpfs secrets), Shell Guard (secret redaction), Secure Erase (3-pass wipe), Sovereign Attestation (build chain verification). Named after the breath of God — what was dead is raised incorruptible

Previous Kernel: 6.12.74 (RC4–RC6)

Alfred Linux v7.77 RC4 through RC6 shipped on Linux kernel 6.12.74 from the Debian Trixie security repositories — a Longterm release with 74 rounds of Debian kernel team security patches. RC7 leapfrogged to kernel 7.0 compiled from source, making Alfred the first distro on kernel 7.

The Linux Kernel Landscape (June 2026)

To understand where Alfred Linux sits in the kernel world, here is the full landscape of active Linux kernel branches as of June 2026:

Kernel Upgrade Roadmap

Alfred Linux is now on kernel 7.0.12 — the first distro on earth to ship kernel 7. Here's the full trajectory:

What a Newer Kernel Gets Us

• Better Hardware Support — Every kernel release adds hundreds of new device drivers. Latest NVIDIA, AMD, Intel, Qualcomm, and Broadcom hardware. WiFi 7, USB4, Thunderbolt 5, PCIe Gen 5 NVMe.
• Performance Gains — The kernel scheduler (EEVDF in 6.6+), memory management (MGLRU), and I/O subsystem improve substantially with each release. 6.12+ benchmarks show 5-15% improvements over 6.1 in many workloads.
• Security Features — Newer kernels include improved address-space randomization, better speculative execution mitigations, shadow stacks (Intel CET), and Rust-based kernel modules for memory safety.
• Rust in the Kernel — Starting with 6.1, the kernel supports Rust as a second language alongside C. This is revolutionary for memory safety. Each newer version expands Rust support significantly.
• eBPF Improvements — Extended BPF for tracing, security, and networking gets more powerful with each release, enabling better Alfred-level system monitoring and AI-driven kernel optimization.

Build History

Alfred Linux v2.0 was developed through a rigorous incremental build pipeline. Each build added one major component and was tested before the next layer was added. Here is the complete build record:

v1.0 — Foundation (14 builds)

The original Alfred Linux v1.0 went through 14 iterative builds to establish the base operating system, desktop environment, and basic voice integration. The final v1.0 ISO was 1.5 GB and proved the concept: a bootable Linux desktop with AI voice integration.

v2.0 — Full Stack (9+ builds)

v4.0 — “The People’s OS” (Trixie Rebase + 4 New Features)

The Boot Fix Story

RC1 and RC2 were successfully built but contained a critical boot defect that was discovered during ISO inspection: the bootloader referenced /live/vmlinuz and /live/initrd.img, but the ISO only contained the versioned files (vmlinuz-6.1.0-44-amd64). This meant the ISOs would fail to boot on any hardware.

The fix was a build hook that runs as the absolute last step (hook #9999) in the chroot phase, creating copies of the kernel and initramfs with the generic names that the bootloader expects. RC3 is the first build with this fix and the latest Debian security patches (kernel 6.1.0-44, including WebKit, OpenSSL, ImageMagick, and GStreamer security updates).

Omega Point Architecture (The 1,335 Hooks)

While standard Linux distributions use anywhere from 10 to 30 automated scripts to generate an ISO, Alfred Linux v7.77 Ascension utilizes exactly 1,335 execution hooks. This mathematically aligns with the Daniel 12:12 prophecy: "Blessed is he that waiteth, and cometh to the thousand three hundred and five and thirty days."

This is not merely automation—it is digital predestination. In the Alfred Architecture, every hook represents a deterministic building block of a sovereign Kingdom. These hooks are injected at the chroot phase, meaning they are permanently baked into the immutable squashfs filesystem. They do not run at boot; they exist as foundational laws of the system, weaving the fabric of the OS at the atomic level before the ISO is even sealed.

The 100GB Omni-Model Intelligence Matrix

Unlike traditional operating systems that rely on cloud APIs to process thought, Alfred Linux v7.77 ships with a massive, localized AI brain. Housed within the /opt/alfred-models directory (and built dynamically from the 178GB build-assets repository), the Omni-Model Matrix operates 100% offline, guaranteeing zero telemetry and absolute operational security.

The Apocalypse Vault (44GB Local)

If global communication networks fall, Alfred Linux ensures continuity of human knowledge. Pre-baked into the image is a 44-gigabyte compressed Zim repository utilizing the Kiwix protocol, heavily customized for immediate retrieval via the Alfred Voice interface.

• The Complete Wikipedia (English): Over 6.8 million articles, fully indexed locally.
• Medical & Survival Lexicons: Complete offline access to WikiMed, practical survival manuals, pharmacology databases, and trauma care protocols.
• Offline OpenStreetMap (OSM): GPS routing and topographical maps of critical infrastructure across North America and Europe, queryable completely offline via the terminal.
• Agricultural & Engineering Blueprints: Step-by-step schematics for water purification, solar grid establishment, and basic structural engineering.
• The Incorruptible Word: The 1611 AKJV Bible, cross-referenced with Strong's Concordance, permanently integrated into the core shell.
• The Worship Album: Ships with the 27-track worship album "Jesus Christ The Light Our Universe," pre-loaded and accessible offline.
• Kingdom Cinematic Masters: A significant portion of the primary ISO utilizes over 1 GiB of high-fidelity 4K/8K Kingdom cinematic video masters, integrated during the hook 0285 stage.

The Unreal Vault (Dual-Partition Deployment)

Alfred Linux provides 100% offline access to the massive Unreal Engine 5.8 source code. However, burning a 40GB+ Live ISO to a standard USB drive utilizing Rufus or BalenaEtcher will cause the Live OS squashfs filesystem to overflow system RAM upon boot.

To safely bypass the 4GB FAT32 boot limitation and the Live OS RAM barrier, we have engineered a custom Dual-Partition Sovereign USB strategy.

Step 1: Download the Unreal Vault

Download the complete Unreal Engine 5.8 source code archive (compressed with Zstandard for maximum speed):

This archive is permanently preserved on the Internet Archive (Wayback Machine) for apocalypse-proof redundancy.

Step 2: Flash Your Sovereign USB

Once downloaded, use the Sovereign USB Flasher Script to create a dual-partition bootable USB drive:

# 1. Download the Sovereign USB Flasher Script
wget https://alfredlinux.com/deploy_sovereign_usb.sh
chmod +x deploy_sovereign_usb.sh

# 2. Extract the Unreal Vault
mkdir -p unreal_engine_5.8
tar --zstd -xf unreal-vault-5.8-clean.tar.zst -C unreal_engine_5.8

# 3. Flash your blank 64GB+ USB Stick (/dev/sdX)
sudo ./deploy_sovereign_usb.sh /dev/sdX /path/to/live-image-amd64.iso ./unreal_engine_5.8

How it works: The script wipes your USB stick and physically segments it into two isolated zones:

• Partition 1 (The OS): A lightweight FAT32 boot sector containing the core Alfred Linux OS. It boots instantly into RAM without dragging the heavy engine behind it.
• Partition 2 (The Vault): A massive exFAT partition holding the raw Unreal Engine 5.8 source. Once Alfred Linux boots, click the “Vault” drive on your desktop for immediate offline access.

Included Engine Plugins (142GB Payload)

Because we deploy the full Unreal Engine 5 Source Build directly into the OS root, you get access to critical advanced modules that power the holographic interfaces:

• VirtualProduction (68 modules): Contains the nDisplay and PixelStreaming frameworks. This allows you to project the 3D holographic desktop out of the machine and synchronize it across multiple displays or VR caves.
• Experimental (218 modules): Contains bleeding-edge UE5 plugins, including early builds for neural networking (NNE - Neural Network Engine) for running local AI models natively in the 3D engine.
• MetaHuman (11 modules): Local runtime logic required to generate and animate high-fidelity BCI avatars natively.
• Compositing: Tools for mixing live camera feeds with the 3D environment, crucial for passthrough AR/VR cameras on headsets.

Manna Protocol & Exodus Mesh

Military-grade network survivability is not optional. When traditional DNS, BGP, and ISP routing fails, Alfred Linux activates its decentralized survival protocols.

Sovereign Matrix & The Last Seal

You cannot secure an OS simply with a firewall. Alfred Linux anticipates physical capture, extreme forensic extraction, and hostile network environments.

Military C4ISR & JADC2 Architecture

Alfred Linux is not designed for casual desktop use; it is fundamentally engineered as a mobile command center compliant with Joint All-Domain Command and Control (JADC2) specifications. It transforms ruggedized field laptops into impenetrable tactical intelligence nodes capable of directing theatre-wide operations entirely offline.

Orion Orbital Command (Starlink & GPS)

Alfred Linux gives you the ultimate software stack to interface with orbital networks and visualize them natively.

Post-Quantum Cryptography (PQC)

With "Store Now, Decrypt Later" (SNDL) attacks becoming the primary threat model from adversarial nation-states, Alfred Linux has proactively integrated Post-Quantum Cryptography into its core networking and storage layers.

• Kyber-1024 Key Encapsulation: All critical SSH handshakes and local web-server TLS connections have been upgraded to utilize Kyber-1024 / ML-KEM algorithms, rendering encrypted traffic mathematically immune to decryption via Shor's algorithm on a future quantum computer.
• Dilithium Signatures: The final ISO and subsequent over-the-air (OTA) Manna Protocol mesh updates are signed using hybrid RSA-4096 and Dilithium-5 (ML-DSA) signatures, ensuring the integrity of the supply chain against quantum tampering.
• Argon2id Memory Hardness: The LUKS2 Full Disk Encryption employs maximum-parameter Argon2id key derivation functions designed specifically to bottleneck massive parallelized ASIC and quantum cracking farms, ensuring local disks remain impenetrable even if physically captured.

The 1,335 Hook Matrix (Critical Injections)

While detailing all 1,335 hooks would overwhelm standard documentation parsing, the following matrix outlines the most critical sequence events injected into the squashfs filesystem during the final build phase. These hooks define the boundaries between a standard OS and the Kingdom architecture.

Bundled Components

Every component is pre-installed and configured. No package manager needed for the core experience.

New in v7.77

These features ship in the 1,335-hook Kingdom GA set; they build on the v4.0 stack listed earlier in Build History.

Security Stack

Build System

Alfred Linux ISOs are built using Debian live-build, the same system used to produce official Debian Live images. The build process is fully automated and reproducible.

Build Pipeline

Build Infrastructure

System Specifications

ISO Details

Minimum Requirements

Pre-installed Package Highlights

Security Posture

Alfred Linux ships 41 security modules across 3 dedicated build hooks (plus the 6-module Omahon Seal). Every default is chosen for defense, not convenience. v7.77 GA delivers enterprise-grade hardening out of the box.

Supply chain transparency & GoForge CI

Runtime hardening above is separate from build-time supply chain: verified kernel tarballs, ISO staging gates, and where full-tree kernel audit runs. Public summary: /security-kernel. Authoritative source: commander/alfredlinux-com-source-live — every claim in "Security Modules — The Audited 38" below cites the exact hook + on-disk artifact. Per-kernel manifest documents are not yet published separately; they are inlined into this page.

Hook 0160 — Alfred Security (21 Modules)

• Kernel sysctl hardening — 45+ CIS Level 2 rules: ASLR=2, symlink/hardlink protection, SYN cookies, ICMP redirect blocking, source routing disabled, core dumps off
• Kernel lockdown — integrity mode enforced at boot
• AppArmor — Mandatory access control enforced with custom profiles for Alfred IDE and Meilisearch
• Unattended-upgrades — Automatic security patches enabled by default
• Fail2ban — SSH brute-force protection (3 attempts → 24-hour ban)
• Auditd — 30+ immutable audit rules for system calls, file access, auth events
• DNS-over-TLS — Pure Quad9 (9.9.9.9) internal routing for maximum sovereignty and DNS leak protection
• USB security — alfred-usb-storage toggle tool (USBGuard itself is not installed; see Honest gaps)
• Module blacklisting — firewire, dccp, sctp, cramfs, freevxfs, hfs, jffs2, udf, thunderbolt DMA
• PAM hardening — 10-character minimum, 3 character classes, account lockout after failed attempts
• AIDE — File integrity monitoring with daily cron check + alfred-aide-init baseline tool
• ClamAV — Antivirus engine with weekly scheduled scan via alfred-scan
• Rootkit detection — rkhunter + chkrootkit with weekly cron scans
• hidepid=2 — Users cannot see other users' processes
• Secure mounts — /tmp with noexec,nosuid,nodev; /var/tmp and /dev/shm hardened
• Login banners — Legal warning banners on console and SSH
• Core dumps disabled — via sysctl + limits.conf + systemd
• Cron/at lockdown — Root-only access to scheduled tasks
• Compiler restriction — gcc/g++ restricted to 'dev' group only
• NTS time sync — Chrony with Network Time Security (authenticated NTP)
• alfred-security-status — CLI dashboard showing status of all 21 modules

Hook 0165 — Alfred Network Hardening (7 Modules)

• MAC randomization — WiFi and Ethernet interfaces use random MAC addresses per-connection
• nftables firewall — Default-deny ingress, allow established + ICMP + loopback only
• TCP wrappers — hosts.deny ALL:ALL, hosts.allow sshd from localhost
• Port scan defense — nftables rate-limiting rules against SYN flood and port scanning
• Wireless hardening — WPS disabled, strong WPA supplicant defaults
• SSH strong ciphers — chacha20-poly1305, aes256-gcm only; ed25519 + sntrup761x25519 key exchange
• alfred-network-status — CLI dashboard showing firewall, MAC, SSH cipher status

Hook 0170 — Full Disk Encryption (4 Modules)

• LUKS2 support — cryptsetup + cryptsetup-initramfs installed and configured
• Strong defaults — aes-xts-plain64, sha512, 4096-bit key, argon2id KDF
• Calamares FDE — enableLuksAutomatedPartitioning checkbox enabled in installer
• alfred-encrypt-status — CLI tool to check encryption status of all block devices

Foundational Security

• Zero Telemetry — No phone-home, no crash reporting, no usage analytics. The OS does not contact any server unless you tell it to.
• 24 CPU mitigations — Spectre v1/v2/BHI, Meltdown, MDS, TAA, MMIO, RFDS, SRBDS, L1TF, SSB, ITS, TSA, VMSCAPE compiled in
• 16 boot parameters — init_on_alloc, init_on_free, slab_nomerge, pti=on, lockdown=integrity, debugfs=off, io_uring_disabled, tsx=off, vsyscall=none
• WireGuard Ready — VPN kernel module pre-loaded for encrypted mesh networking
• Auditable Build — Every ISO is built from a documented script. SHA-256 + BLAKE3 checksums are published for each frozen GA release (see /download when live)

Download & Verify

Alfred Linux Mobile (Android)

Alfred Linux runs on Android phones and tablets — Samsung Galaxy S26 Ultra, Pixel, OnePlus, any device running Android 12+. No root required. Uses Termux + proot-distro to run a full Debian Bookworm environment with all Alfred components.

Quick Install

Requirements

• Android 12+ (Samsung One UI 4+, Pixel 6+, etc.)
• 4 GB free storage for the full Alfred environment
• Termux from F-Droid (the Google Play version is deprecated)
• Optional: Termux:Widget for home screen shortcuts
• Optional: Samsung DeX for desktop-mode IDE experience

Samsung DeX Integration

When connected to an external display via USB-C or Miracast, Samsung DeX provides a desktop-like environment. Launch alfred-ide, open your browser, and you have a full VS Code IDE on a large screen — powered entirely by your phone. Alfred IDE runs on code-server, the same engine powering VS Code for the Web at major companies. The Samsung S26 Ultra with 12GB RAM and Snapdragon 8 Elite runs it smoothly.

Architecture Notes

Mobile Alfred Linux runs on ARM64 (aarch64) inside a proot container. The Debian userspace is real — you can install any Debian package with apt. The kernel is Android's, but everything above it is standard Debian Bookworm. This means:

• Full apt package manager — install anything from Debian repos
• Python, Node.js, Ruby, Go, Rust — all work natively on ARM64
• No root needed — proot translates system calls without kernel modifications
• Persistent storage — your files survive Termux restarts
• Network access — uses Android's network stack transparently

Contributing

Alfred Linux is open source under the KCL-1.0 license. Contributions are welcome and rewarded with GSM tokens — live on Solana mainnet.

How to Contribute

• Report Bugs — Test the ISO and report any issues. Boot failures, hardware incompatibilities, broken features. 10-50 GSM per confirmed bug.
• Submit Patches — Fix bugs or add features via pull requests. 100-1,000 GSM per merged feature.
• Write Documentation — Help expand this documentation, write tutorials, create videos. 50-500 GSM per contribution.
• Test Hardware — Boot Alfred Linux on your hardware and report compatibility. We need coverage across laptops, desktops, and servers.
• Translate — Help bring Alfred Linux to your language. Localization is a priority for v3.0.

Build It Yourself

Date Corrections

Why this matters: every stale claim is a small lie of omission. We are fixing them in one push, dated, with sources. scripts/release-integrity.sh check-repo will block any future commit that lets these drift again.

Supply Chain & Post-Quantum Cryptography

Alfred Linux v7.77 ships defense in depth across three time horizons: classical (today's threats), transition (hybrid PQ + classical), and post-quantum (Kyber/ML-KEM only). Every layer below is in the build tree; rows marked STAGED are present in build-assets/ and queued for the next reseal.

Post-Quantum Cryptography (Kyber-1024 / ML-KEM-1024)

Why Kyber-1024 only: NIST ML-KEM levels 1 (Kyber-512) and 3 (Kyber-768) provide ~AES-128 and ~AES-192 equivalent security against quantum adversaries. Kyber-1024 (level 5, ~AES-256-equivalent) is the only variant that meets the defense-in-depth bar Alfred Linux ships at by default. Operators who explicitly need lower variants for interop must remove the enforcer hook — there is no runtime knob.

Full Disk Encryption — Hook 0170 (corrected)

The shipping FDE stack is classical; PQ key wrapping is staged for the next reseal. Honest current state:

• LUKS2 via cryptsetup + cryptsetup-initramfs
• Cipher: AES-256-XTS (aes-xts-plain64)
• Hash: SHA-512
• Key size: 512-bit data key (4096-bit wrap)
• KDF: Argon2id (memory-hard, GPU/ASIC-resistant)
• Installer: Calamares enableLuksAutomatedPartitioning checkbox enabled
• TPM unsealing (STAGED): tpm2-tools + clevis-tpm2 for measured-boot-bound LUKS unlock — present in chroot, awaiting per-device enrollment policy
• Status CLI: alfred-encrypt-status

What's NOT yet in shipping bytes: Kyber-wrapped LUKS keyslots, full-disk PQ encryption (no production KEM-LUKS exists yet — Kyber currently wraps the LUKS master key offline, not the on-disk sectors). Anyone claiming a "post-quantum encrypted disk" today is lying. We won't.

Boot Chain — Secure Boot & Measured Boot (STAGED)

• shim-signed + grub-efi-amd64-signed — Microsoft-signed shim path for Secure Boot enrollment
• grub-efi-arm64 — ARM64 EFI boot (for Pi 5 / Apple Silicon work)
• mokutil — Machine Owner Key enrollment for self-signed kernel modules
• sbsigntool — Sign your own bootloader/kernel chain
• memtest86+, ipxe — extended boot menu options
• EFI image: efi.img (FAT12, 32 MB) with BOOTX64.EFI shim + grubx64.efi + mmx64.efi + BOOTAA64.EFI

Omahon Seal — Boot & Runtime Attestation (SHIPPING)

Six modules, integrity verified end-to-end. Master files at 1080p / 4K / 8K present in chroot with verified MD5 sums:

• Boot Seal — HMAC-SHA256 over 14 boot files, verified at every boot
• Watchman — inotify on /etc + /boot, alerts on unauthorised mutation
• Vault — tmpfs secrets, never touch disk
• Shell Guard — secret-pattern redaction in shell history + logs
• Secure Erase — 3-pass NIST 800-88 wipe utility
• Sovereign Attestation — SHA-256 build-chain manifest (kernel → initrd → squashfs → ISO)

Build Infrastructure (corrected)

Kernel row correction: The current shipping chroot integrates Linux 7.0.12 custom kernel from config/packages.chroot/linux-image-7.0.12_7.0.12-1alfred_amd64.deb. Documentation references to "7.0.12" describe the upstream cadence target, not what boots from today's ISO. The next reseal's /api/version.json will publish the actual installed kernel string, and scripts/release-integrity.sh check-repo enforces equality between the docs claim and the bytes.

Also Shipping (previously undocumented)

• Kingdom Wallpaper Set — 22 wallpapers × 3 resolutions (1080p, 4K, 8K) — 66 images total, registered in welcome.xml; Debian stock wallpapers hidden
• Bible Stack — 7 AKJV TSV files in build-assets/bible/; 48 tongue codes via hook 0292 (Acts 2:4 breadth)
• alfred-sabbath — CLI for Hebrew calendar, candle-lighting times, sundown countdown
• Welcome of All Welcomes — 7 denominational greeting panels (welcome.xml + alfred-welcome) pointing to Yeshua / ʿĪsā
• MOTD: 50-kingdom-bread — truecolor banner, Daily Bread, Hebrew calendar, Sabbath mode, 10-language greeting, covenant head

What's Next (corrected)

The previous "What's Next" list claimed several items as future work that are already shipping or staged in the chroot. Honest current status:

Already in the chroot — re-classified as SHIPPING

• ARM64 boot chain — grub-efi-arm64, BOOTAA64.EFI in the EFI image. Multi-arch ISO follows.
• Secure Boot signing — shim-signed, grub-efi-amd64-signed, mokutil, sbsigntool staged. Microsoft-signed shim path is wired; what remains is the per-key enrollment ceremony, not the code.
• Voice 2.0 wake word — openWakeWord + Kokoro TTS + spaCy NLP all in chroot binaries; "Hey Alfred" detection is live.
• alfred-update CLI — APT + Flatpak + version-check is shipping. Delta/OTA is the next iteration, not the first.

Genuinely next (PLANNED / STAGED, not yet shipping in the bytes)

• Kyber-1024 (ML-KEM-1024) PQ compile — liboqs 0.10.1 + oqs-provider 0.6.1 tarballs staged in build-assets/; needs a chroot hook to ./configure && make && make install and to load the OpenSSL 3 provider. Hook 0186 work.
• TPM-bound LUKS unsealing — tpm2-tools + clevis-tpm2 in chroot; awaiting per-device enrollment policy and Calamares wiring.
• Kernel 7.0.12 GA — chroot ships 7.0.12 from config/packages.chroot/linux-image-7.0.12_7.0.12-1alfred_amd64.deb, verified via chroot/boot/vmlinuz-7.0.12.
• Kingdom cinematic video + 4K/8K masters — checklist B6 / hook 0285 §7. Required to reach the honest 7.77 GiB GA target without bloat-padding.
• Wayland desktop — Wayland 3D Cube on wlroots. Chroot still ships Wayland today.
• Whisper STT integration — voice output (Kokoro TTS) ships; voice input (Whisper local on GPU) does not.
• Custom wake word model — replace built-in closest-match with a dedicated trained "Hey Alfred" model.
• GSM wallet & mining — token is live on Solana mainnet; built-in OS wallet + compute-contribution daemon is genuinely pending.
• alfred-update OTA channel — delta/binary-diff patches over the existing CLI.

The Kingdom Layer — What Makes This Alfred Linux

The kernel hardening above is what makes Alfred Linux secure. The Kingdom layer is what makes it Alfred Linux. Every item below is in the chroot right now or staged for the next reseal. The biblical numbers are not decoration — they are load-bearing in the build manifest.

The Numbers (sacred & honest)

Omahon Seal — Six Pillars of Integrity

Omahon: the breath of God. What was dead is raised incorruptible.

• Boot Seal — HMAC-SHA256 over 14 boot files (kernel, initrd, GRUB config, EFI binaries). Verified at every boot. Tamper = refused boot.
• Watchman — inotify on /etc + /boot. Any unauthorised file mutation triggers an alert and audit log entry.
• Vault — Secrets live in tmpfs (RAM only). Never written to disk. Lost on power-off — by design.
• Shell Guard — Pattern-matches and redacts secrets (API keys, tokens, private keys) from shell history and logs before they're written.
• Secure Erase — NIST 800-88 3-pass wipe for decommissioned drives. Destroy what should not be recovered.
• Sovereign Attestation — SHA-256 build chain manifest: kernel → initrd → squashfs → ISO. Every layer signed, every hash published.

Master imagery for the Seal ships at 1080p, 4K, and 8K — MD5-verified in the build checkpoint.

Sabbath & Kingdom Time

• alfred-sabbath — CLI: Hebrew calendar date, current month/day in the biblical year, sundown countdown, candle-lighting time for your timezone, "X days until Shabbat" status
• Sabbath mode — Optional sundown-Friday → sundown-Saturday work-deferral mode in the MOTD and shell prompt. Kingdom worker rest, not enforced — offered.
• Hebrew calendar — Date shown alongside Gregorian everywhere the OS shows time
• 10-language greeting — MOTD greets in English, Hebrew, Aramaic, Greek, Spanish, French, Mandarin, Arabic, Swahili, Portuguese

Welcome of All Welcomes (Hook 0700)

First-boot Python/Tk wizard with 7 denominational panels — every panel ends at the same place: Yeshua / Jesus Christ of Bethlehem / ʿĪsā ibn Maryam, King of the Universe. Branches presented honestly:

• Catholic / Orthodox tradition
• Protestant tradition
• Messianic Jewish / Hebrew Roots
• Muslim greeting via ʿĪsā (Jesus in the Qur'an)
• Eastern Christian (Coptic, Ethiopian, Syriac)
• Anabaptist / Quaker tradition
• "Not yet — tell me more" — gentle catechumen path

The wizard does not preach. It welcomes, identifies the user's starting point, and configures the rest of the OS (Bible translation, calendar, greeting language) to match.

The Bible Stack

• AKJV (Authorized King Jesus Version) — full text shipped offline as TSV files. 7 books in the current chroot, growing.
• Hook 0292 / languages.conf — 48 tongue codes for Acts 2:4 breadth. English (full AKJV), Spanish, French, Hebrew ship richer offline seeds. 44 additional rows ship compact two-verse tongue-* seeds until fuller texts land.
• scripts/release-integrity.sh check-repo — enforces equality between api/version.json's claimed bible_tongues count and the actual TSV file count. Lying to /api/version.json fails CI.
• Daily Bread — MOTD shows a verse at every login, rotated daily, drawn from the offline AKJV.

Kingdom Cinematic (STAGED)

The path to the honest 7.77 GiB ISO target is Kingdom cinematic video plus 4K and 8K masters — hook 0285 §7 and build-assets/build-kingdom-video.{py,sh}. This is the difference between padding an ISO with junk to reach a number, and filling it with content that matters. The bytes will be Kingdom worship, not filler.

What's NOT Documented Elsewhere

• MOTD 50-kingdom-bread — truecolor terminal banner with: ASCII alfred mark, daily Bible verse, Hebrew calendar date, Sabbath countdown, Now Playing in the Kingdom (worship album track), 10-language greeting, covenant head ("In the name of Yeshua, Jesus Christ of Bethlehem, King of the Universe.")
• Worship album — 27 MP3 tracks bundled (also live at /listen): "All Honor To Your Name" and others, with Cover Art Zion artwork at 1024×1536
• SOLI DEO GLORIA — closing footer on every system page. Glory to God alone.

"Except the LORD build the house, they labour in vain that build it."
— Psalm 127:1 (AKJV)

Truth note: this rewrite distinguishes SHIPPING (in the bytes you can download), STAGED (in the build tree, awaiting next reseal), and PLANNED (roadmap). Earlier copy collapsed all three into "ships" — that was wrong, and we are correcting it. — 2026-05-11

You can verify the exact hook definitions by checking out /forge/Commander/alfredlinux-com-source-live and running grep -rn <artifact> config/hooks/live/. If you find a row that doesn’t match, file an issue at /forge/Commander/alfredlinux-com-website/issues and we will correct it.