Promises, and the ones we've kept.

Every part of the system can be reproduced independently and matched against exactly what we shipped. This is the foundation that makes every other promise something you can verify, not just believe.

We compile and inspect the heart of the system ourselves, and it comes out identical every single time we build it.

The system starts up from beginning to end, and an automatic check makes sure that never quietly breaks as the work continues.

The core is sealed read-only and comes up secure, connected, and pared down to the essentials, with its protective firewall re-checked on every boot, and a built-in recovery mode to fall back on when a machine needs rescuing. Parts the system does not use are left out of the build entirely rather than merely switched off, and an automatic check refuses any build that lets them back in. Every part of it is proven automatically on each build.

The promise above, that everything can be rebuilt and checked byte for byte, is only worth something if you can do it yourself. A public, read-only copy of how KelvaneOS is built is available at codeberg.org/KelvaneOS/KelvaneOS, so anyone can fetch the same verified system core we use and build it on their own machine.

It has been done. That copy was taken to a separate machine running a different operating system, with nothing in common with the machine we build on, and the heart of the system was rebuilt there from scratch. What came out was identical, to the byte, to what we publish. That is the difference between asking you to trust us and handing you the means to check.

For appliance vendors under a support agreement, we will commit to a dated support period rather than the word "long-term". The kernel already comes from a source line maintained for industrial equipment into mid-2035, and the base system can be covered to 30 June 2035. We will publish the exact date and what it covers before asking anyone to build a product on it.

The first complete, installable product built on the core.

Install it hands-off across a fleet, or guided for a single machine, and never able to erase the wrong disk.

Once installed, a machine boots, connects and runs its services without anyone holding its hand.

Encryption so the data on a device stays safe even if the device itself is lost or stolen.

An update either finishes cleanly or quietly returns the machine to its last good state, on its own. No bricked units, no engineer on a plane. This is the big one.

A general-purpose server build, with safe lanes to move updates from testing into production.

Beyond standard servers, including small, low-power devices out at the edge.

Connect directly to industrial equipment, chargers and vehicles over the networks they actually run on, like CAN and Modbus, not just the internet. A device can be the gateway to the machinery, even where there's no internet connection at all.

Machines in cabinets, substations and vehicles start on their own after a power cut, survive an interrupted update, and can be repaired remotely without sending anyone out to them.

A proper kit for partners to build their own appliance on the same dependable base.

The complete security baseline, shipped with the evidence to back every claim.

Installing, updating, rolling back and recovering, all doable from one place and all doable without standing in front of the machine.

A candidate build an outsider can rebuild and verify independently, tested on real hardware.

Published so anyone can confirm it's exactly what we say it is: nothing more, nothing hidden.