Sila — from the Arabic صِلة, a bond, a tie, the connection between two people. The root shows up in ṣilat al-raḥim, the obligation of kinship ties, so the word carries a relationship rather than a wire. That is the whole thesis: a machine you have a relationship with, not a tool you operate.
About
Sila is a personal operating system. Not a desktop theme and not a distribution with a new wallpaper — a fourth download button next to macOS, Windows and Linux, with its own setup, its own updates, its own accounts, its own security model and its own reviewed store.
It runs today on real hardware on my desk. It boots straight into its own interface, has no desktop environment underneath it, updates itself over the internet from signed releases, and falls back to the previous version on its own if a release does not boot.
The mark is two identical brackets, one rotated 180° about the centre. Neither of them contains the square between them — that square only exists in the distance the two brackets hold, and it stays open at two corners. The bond is the gap, not either party.
The idea
Every operating system ships you the same screens as everybody else. The layout was decided by a designer, compiled into a binary, and shipped. If it does not fit how you work, that is your problem.
Sila's bet is that the interface should be a document, not code.
An app does not ship a window layout. It declares what it can do — a list of capabilities, and nothing about where they appear. A screen is a separate document that says which of those capabilities go where, and how much room each one gets. Something in the middle joins the two together and hands the result to a renderer.
The renderer is the part that matters. It has never heard of a temperature. It cannot special-case one, because it is never told which tile is which — it receives shapes and sizes and nothing else. The system enforces that: there is a check in the build that fails if anything outside one single file is allowed to know how to draw.
That constraint is the point. If the interface is a document, then it can be diffed, signed, reviewed, versioned and shipped like any other document — and eventually written per person, in the background, rather than shipped identically to a million machines. Code cannot be reviewed at that scale. Documents can.
What actually runs
A working system first; the interesting part second. Today the machine does all of this on its own:
It is its own session
There is no desktop environment. The interface is what the machine boots into, drawn from those documents, with nothing behind it to fall back to.
Two complete systems on one disk
The disk carries two full copies of the operating system, A and B. An update writes the one that is not running and flips a pointer. The partition holding your files is never touched by an update.
Signed releases, over the air
Nothing installs unless it chains back to a key the device already trusts, and the signing key that reaches the internet is not the key that anchors that trust. The refusal is the feature, and it is tested by trying to install a forgery and watching it fail.
It rolls itself back
A release that does not boot is not a support call. The machine gets a fixed number of attempts, and if none of them reach a healthy system it returns to the version that was known good. This has happened for real: a release shipped with a bad reference, the machine dropped out mid-update, and it put itself back on the previous version with nobody watching and nobody asked.
Updates are small
A whole release is about 330 MB. Because the system image is built deterministically — the same inputs produce the same bytes every time, down to timestamps — a device can work out which parts it already has and fetch only the rest. A one-file change costs 7.9 MB instead of 330 MB, a 41× reduction, verified byte for byte against what the server actually sent.
The name is a build parameter
The name never appears as a literal anywhere in the system. It is set once, in one place, and a check fails the build if it is hardcoded anywhere else. Renaming the entire operating system is a one-line change.
Sila Account
A companion app for iPhone and Apple Vision Pro. You sign in, and your machines are there — what they are doing, how much of them is in use, which version each side of the disk is holding, and eventually your files.
The pitch is simple: this is iCloud, except the cloud is your own computer. No storage tier, no subscription, no monthly negotiation for space you already paid for — it is your SSD, and the app is just a window onto it from wherever you happen to be.
The line it does not cross: an account makes your devices easier to reach, never necessary to use. A Sila machine with no account and no internet is a complete machine.
How it is built
The whole system is assembled from scratch by a pipeline of numbered, idempotent steps — lay down the base, install what is needed, brand it, add the interface, set up updates, then write the disk. Any step can be re-run from any point without repeating the ones before it, which is the difference between a twenty-minute iteration and a two-hour one.
There are 464 tests. They did not catch nineteen of the defects found so far — every one of those built cleanly, passed every static check, and did not work on the actual hardware. Almost all of them were the same shape: a name fixed at build time that is not stable on the device. An identifier the update itself replaces. A path that only exists on one of the two copies. A value belonging to the build machine that got shipped to every device that would ever run it.
The method that works is not more tests. It is getting a known-good control before forming any hypothesis, and showing a check fail before trusting it to pass.
Where it goes
The order is by risk, not by layer, so the unproven idea gets tested before the laborious plumbing is finished.
| Done | Document format and renderer · bootable system · the interface as the session · two-copy updates with signing and automatic rollback · small updates |
| Next | Live data in the interface · windows and multitasking · a developer kit and a reviewed store |
| After | Generation — the interface documents get written in the background, per person |
| Eventually | Dedicated hardware, and a base that is entirely its own |
The generation step is the reason the rest exists, and it is deliberately last. A fourth option beside Windows, macOS and Linux cannot be a fifth Linux distribution — but it also cannot be a research demo that does not boot.
More at sila.sh.