// every change, newest first
A curated history of what has shipped in MayteraOS, newest first: real, verified capabilities and improvements. Recent work is grouped by day; earlier batches of work are grouped by date range so the page stays readable. This page is a highlight reel, not the full commit log; the complete, unfiltered development history is in the source repository.
Added a hardening & mitigations page that states, mitigation by mitigation, what is enforced today, what is partially done, and what is only planned, each with the evidence behind it: binary counts, syscall counts, and the exact commands to check it yourself against a downloaded image. See the Security page.
Pointer validation for system calls moved to a single checkpoint that every system call passes through before it runs, closing a gap where most pointer-taking calls had no validation at all. A build check now refuses to compile if a new pointer-taking system call omits how its pointer should be validated, so the gap cannot silently reopen.
The TLS client's certificate verification was hardened: the server's proof-of-possession signature is now actually checked rather than parsed and left unverified, the negotiated cipher suite is checked against what the server actually offered, and several other validation gaps were closed. A handshake with a forged or incomplete certificate now fails instead of completing.
Every shipped application and game now loads at a randomized address instead of a fixed one, and the loader enforces that no page in a running app can be writable and executable at the same time. A build check fails if any shipped app has a writable-and-executable segment, so this cannot quietly regress.
The stack canaries that catch buffer overflows, and the randomized load address every app gets, both now draw their entropy from the kernel's cryptographic random number generator mixed with per-boot and per-process variation, instead of a predictable timer-based source alone.
The DOS and Windows 3.1 (Win16) compatibility layers used to share a single interrupt-handler slot, so starting the second one broke the first. Each guest now gets its own interpreter environment, and both can run and be used side by side in the same session.
A focused cleanup pass removed unreachable code across the kernel and re-encoded the boot splash image, cutting the compiled kernel from about 4.3 MB to 3.2 MB, a 26% reduction, with no loss of functionality: every path removed was proven dead first by rebuilding and re-testing, including re-verifying that the built-in text-mode recovery desktop (a fallback if the graphical shell can't start) still works. The boot splash image itself shrank from about 750 KB to 140 KB, pixel-for-pixel identical to before and simply compressed.
A read-only filesystem checker now runs automatically at boot and reports whether the root filesystem is clean, and the same check is available as a Terminal command. It catches corruption before it can turn into lost files.
A typical 100+ MB application now installs in about a minute. Every downloaded package is checked against its signature before installation, and a tampered or corrupted download is refused rather than silently accepted.
OpenArena, an open-source multiplayer arena shooter, now runs with working 3D rendering, mouse look, movement and weapon fire, verified through live gameplay testing. It installs straight from the App Store.
A systematic pass through the desktop's shared style system fixed contrast issues, inconsistent borders and missing focus indicators across window title bars, buttons, form controls and all three built-in colour themes (a light theme, a dark theme, and a retro Unix-styled theme), making the interface more consistent and easier to read.
More of the kernel's untrusted-input parsing (filesystem directory records, partition-table parsing, USB descriptor parsing and more) now runs through memory-safe Rust behind a build flag, each one checked against its old C implementation on hundreds of thousands of real and malformed inputs before shipping. See the Security page for what that work has found.
MayteraOS gained a complete, standards-compatible vi text editor as a built-in app. Alongside it, the Terminal app can now run full-screen, interactive text programs like vi, not just simple line commands.
The original BSD Rogue dungeon-crawler now builds and plays correctly. AssaultCube, an open-source first-person shooter, reached a stable, crash-free in-level experience with real WASD movement and weapon fire, verified through sustained live sessions.
MayteraOS's original side-scrolling space shooter replaced its placeholder backdrop with genuine layered pixel-art parallax scenery: multiple depth layers of stars, planets and nebulae that scroll at different speeds behind the action.
MayteraOS no longer ships with a default administrator account. The first boot now walks you through creating your own user account and password, and a matching lock screen protects the desktop whenever you step away.
The Start Menu gained search, favorites, recent apps and a proper context menu. Separately, standard editing shortcuts (Ctrl+A/C/X/V/Z/Y and click-drag selection) now work the same way in every built-in app, backed by a real system-wide clipboard.
Installing a theme from the App Store now applies a live colour palette across the desktop and every built-in app immediately, instead of only changing the wallpaper.
Fonts used to load eagerly at boot; they now load lazily, on first use. Measured effect: the font-related portion of boot time dropped from about 26 seconds to under 2.
MayteraOS's built-in image editor gained a zoomable, pannable preview for filters and colour adjustments, a proper tool-options panel, and a real loading progress bar in place of a canned animation.
The built-in text Editor's File and Edit menus, and Settings' dropdown controls, now run on the same shared, reusable menu and list components used across the desktop, for a more consistent feel and less duplicated code underneath.
Brought the public site up to date with the last few weeks of development: improved text contrast against the dark desktop background, added the MayteraOS wordmark and icon in place of a placeholder mark, and added a dedicated section on the AI/LLM integration layer.
Hardened the USB stack so the keyboard/mouse driver and the Mass-Storage driver coexist cleanly when both live on the same USB controller. Keyboard, mouse and a USB boot drive now share one controller with no PS/2 fallback required.
The AI chat assistant can now generate a small application from a plain-English description, compile it, and launch it as a running window on the desktop, with no code shown to the user unless they ask to see it. In a verified run, the request "build me a tip calculator" produced a small, correctly-computing app in a single pass. Every step is gated by the capability-token and consent system described below. Asking the assistant to revise an app it already built, conversationally, is designed for but not yet proven end to end.
The Win16 compatibility layer can now host genuine Windows 3.1-era .SCR screensavers written for that platform's screensaver API, running fullscreen and tearing down cleanly on any input, alongside MayteraOS's own native screensaver system (Starfield, Flux, digital rain, plasma, and a couple of OpenGL-style 3D demos). Both are wired into the same idle-timeout and Settings-driven picker.
MayteraOS can now mount its own root filesystem from a USB Mass Storage device and boot to a fully working desktop with no internal disk present at all, no ATA/IDE and no SATA controller. This was verified with a disk image attached purely as USB storage: the kernel enumerated it, mounted root from it, and booted straight through to the desktop with live widgets. It is a real step toward running MayteraOS on plain, disk-less hardware from a single USB drive.
Building on USB-root boot, MayteraOS can now be packaged as a single bootable USB image carrying the full current desktop: compositor, widgets, and the built-in apps. Verified booting end to end in a virtual machine with the image attached as USB storage only.
Added generic, spec-driven USB drivers for Mass Storage (the BBB/SCSI class used by USB drives) and HID (the class used by USB keyboards and mice), both running over xHCI. "Generic" matters here: the drivers read each device's own descriptors rather than hardcoding one product, so ordinary USB storage, keyboards and mice are expected to work rather than only a specific tested device.
MayteraOS can now print to a real network printer. Text documents go out over IPP; images are sent either directly (for printers that accept JPEG natively) or converted to PostScript for others. This was verified against a real consumer network printer on the project's own network, producing an actual printed page for both a text job and a photo.
Added a full music player in the style of the skinnable MP3 "jukebox" software of the late 1990s and early 2000s: a scrolling track display, a multi-band graphic equalizer wired to real output gain, playlist support, embedded and online album-art lookup, and a real-time, audio-reactive 3D visualizer. It imports third-party skin files for the classic skin format that era's players made popular, and decodes MP3, FLAC, Ogg Vorbis, WAV, Opus and AAC, all with fixed-point math since the kernel has no floating-point unit dependency in that path. Verified playing real audio files through the USB DAC driver above.
The network stack got more reliable under sustained load: HTTP/2 client reads now time out cleanly and predictably, DNS timeout and cache timing is accurate, and large transfers (like a big file read over the network) complete reliably instead of aborting partway through. Verified against multiple live hosts.
Added an installer that partitions a target disk, writes a real GPT partition table and EFI System Partition, and clones the live filesystem onto it, so MayteraOS can install itself onto a blank disk. Verified: a live instance installed itself onto an unformatted disk, and that disk then booted independently to the desktop with no help from the source install media.
Completed a pass across the entire classic Windows 3.x KERNEL, USER, GDI and SHELL API surface used by 16-bit ("Win16") applications: essentially the full ordinal set is now recognized, with real implementations for the commonly used calls and safe fallback stubs for the long tail, making the whole Win16 compatibility layer robust against an unfamiliar API call from a hosted program. Verified across a broad range of real Windows 3.1-era software supplied for testing (card games, puzzle games, a golf simulation, a full-featured word processor, and other period software).
Added a USB Audio Class driver for external DACs (USB sound devices), written against the USB Audio Class specification rather than one product. It was verified working, unmodified, against two different physical USB DAC devices from different manufacturers, negotiating each one's own sample rate and endpoint configuration automatically. This is the foundation the music player (below) plays audio through.
Every app and widget on MayteraOS now publishes a machine-readable tool contract describing what it does and what it can be asked to do. The AI assistant reads these contracts and calls into them through scoped, time-bounded capability tokens: reading a file, writing a setting, or compiling and deploying code are all separately gated. Higher-risk actions require an explicit on-screen consent prompt naming exactly what is being requested, and every grant, denial and action is written to an append-only audit log. Unrecognized requests are denied by default rather than allowed.
Added a Device Manager application that inventories the system the way a desktop OS control panel would: CPU and memory summary, the PCI device list with vendor/device IDs and IRQs, attached USB devices, and the interrupt table, styled to match the rest of the built-in apps.
MayteraOS can now browse, read from, and write to SMB network shares directly from the Files app, the terminal, and other apps, using the same file APIs as local files. Files gained a "Network" view for saved network locations, with a dialog to add a new one. Verified end to end against a real SMB server, including uploading a file and confirming it landed correctly on the server.
Added a toast-and-notification-center system used across the desktop: apps can post a notification with a severity level, it appears as a themed toast and is retained in a notification history reachable from the system tray, with per-severity muting and a do-not-disturb mode in Settings.
The wallpaper picker in Settings became a live thumbnail grid instead of a dropdown list, and the Files app's right-click menu gained working Copy, Cut, Paste and a Properties dialog.
The SMP (multi-core) path was hardened and re-verified stable at 1, 2, 4, 8 and 16 cores, including distributing real parallel kernel work evenly across every core. That testing included runs on a host with as many as 80 physical cores available, though each individual core count was not separately re-verified all the way up to that ceiling. User-application scheduling across cores (beyond the boot CPU) remains an open area of work; kernel-side work already runs in parallel across every online core today.
The AI chat assistant became a real dockable panel on the desktop instead of a one-off window, and mouse wheel scrolling was wired through to every app rather than a handful of special cases.
The built-in web browser gained an HTTP/2 client (HPACK header compression, stream flow control, ALPN negotiation) on top of the existing TLS 1.3 stack, so large modern sites load fully instead of being capped by an HTTP/1.1-only connection.
Added support for the TLS 1.3 cipher suite most real-world CDNs actually negotiate (AES-256-GCM with SHA-384). Alongside it, the browser's rendering pipeline (an adapted open-source HTML/CSS engine) went live for the first time, rendering real pages with correct backgrounds and layout rather than plain text.
Added desktop sticky notes and several additional desktop widgets alongside the existing clock, calendar and weather widgets, all persisted across reboots.
