ship’s manual · guide
Autonomy without architecture is just ambient authority. 1Helm makes routine action cheap inside a narrow world and makes boundary crossings explicit, attributable, and recoverable.
Resident isolation
Each ordinary channel receives a separate persistent Linux world: an Apple container machine with no Mac home mount, or a durable OCI container. Linux runs OCI natively. Windows hosts containers inside one managed WSL 2 runtime whose Windows-drive mounts and interop are disabled. Exact labels, storage mounts, and owner markers gate lifecycle operations. Other residents and the host home are not exposed.
Authoritative files
OCI workspace storage belongs to the runtime and is authoritative. Files and Cowork receive narrow direct access to that channel's storage; command and terminal paths do not copy the whole workspace. Apple's backend retains its bounded, symlink-contained mirror.
Skipper boundary
Skipper owns native host operations, fleet lifecycle, credential brokering, and cross-channel work. A resident calls Skipper directly with the invoking thread; a Captain-authored request is required for host-authorized operations. Skipper returns the result to the resident automatically.
Credentials and connections
Provider, Gmail, and Photon credentials stay in host-owned storage. Residents receive task-scoped tools and permission records, not raw access tokens or the native Messages database. Photon mappings use sender allowlists and allow replies only in an already-delivered conversation unless Skipper grants broader sending.
Skill supply chain
The external catalog is discovery metadata, not executable trust. 1Helm shows the open registry's results without applying its own browse-time allowlist. A selected GitHub source is resolved to an immutable commit, bounded to 256 KiB, scanned for instruction override, exfiltration, remote-pipe execution, broad destructive commands, security disabling, private-host access, and prompt extraction, then hashed and wrapped beneath runtime authority.
Audit and limits
New activity, tool starts/results, and skill installation decisions enter an append-only SHA-256 chain. The chain is tamper-evident, not a remote transparency log: an administrator with database access can still delete or replace the entire database. Historical rows predating the chain are not backfilled.
Known dependency debt
The pinned Photon SDK currently carries moderate OpenTelemetry advisories upstream. It runs in a supervised loopback-only child process with telemetry disabled. 1Helm tracks the exact pin and will upgrade when the required Photon API remains compatible; this is not represented as a clean dependency audit.
Report a vulnerability
Use GitHub's private vulnerability reporting for the 1Helm repository. Do not open a public issue containing credentials, tokens, or an unpatched exploit.
`); +const security = doc("/manual/security-model", "Security model", "How 1Helm isolates residents, brokers credentials, audits actions, validates skills, and defines the human boundary.", `Autonomy without architecture is just ambient authority. 1Helm makes routine action cheap inside a narrow world and makes boundary crossings explicit, attributable, and recoverable.
Resident isolation
Each ordinary channel receives a separate persistent Linux world: an Apple container machine with no Mac home mount, or a durable OCI container. Linux runs OCI natively. Windows hosts containers inside one managed WSL 2 runtime whose Windows-drive mounts and interop are disabled. Exact labels, storage mounts, and owner markers gate lifecycle operations. Other residents and the host home are not exposed.
Authoritative files
OCI workspace storage belongs to the runtime and is authoritative. Files and Cowork receive narrow direct access to that channel's storage; command and terminal paths do not copy the whole workspace. Apple's backend retains its bounded, symlink-contained mirror.
Skipper boundary
Skipper owns native host operations, fleet lifecycle, credential brokering, and cross-channel work. A resident calls Skipper directly with the invoking thread; a Captain-authored request is required for host-authorized operations. Skipper returns the result to the resident automatically.
Credentials and connections
Provider, Gmail, and Photon credentials stay in host-owned storage. Residents receive task-scoped tools and permission records, not raw access tokens or the native Messages database. Photon accepts only the configured Captain phone and keeps that direct Skipper conversation in the Captain's private #main.
Skill supply chain
The external catalog is discovery metadata, not executable trust. 1Helm shows the open registry's results without applying its own browse-time allowlist. A selected GitHub source is resolved to an immutable commit, bounded to 256 KiB, scanned for instruction override, exfiltration, remote-pipe execution, broad destructive commands, security disabling, private-host access, and prompt extraction, then hashed and wrapped beneath runtime authority.
Audit and limits
New activity, tool starts/results, and skill installation decisions enter an append-only SHA-256 chain. The chain is tamper-evident, not a remote transparency log: an administrator with database access can still delete or replace the entire database. Historical rows predating the chain are not backfilled.
Known dependency debt
The pinned Photon SDK currently carries moderate OpenTelemetry advisories upstream. It runs in a supervised loopback-only child process with telemetry disabled. 1Helm tracks the exact pin and will upgrade when the required Photon API remains compatible; this is not represented as a clean dependency audit.
Report a vulnerability
Use GitHub's private vulnerability reporting for the 1Helm repository. Do not open a public issue containing credentials, tokens, or an unpatched exploit.
`); -const gettingStarted = doc("/manual/getting-started", "Getting started", "Install 1Helm, connect providers, create the workspace, and give the first resident a real outcome.", `The normal setup is three product decisions. 1Helm handles the infrastructure around them.
1. Install
On Apple Silicon, download the signed, notarized, and stapled DMG. On Windows 11 x64, download the signed Setup executable. Ubuntu/Debian hosts use the verified Linux systemd installer. Each platform may request one host-level approval for its isolated Linux runtime.
2. Captain
Create the first account. This is the Captain: owner, final authority, and administrator. Public registration closes after the Captain exists.
3. Providers
Connect one or more subscription accounts or API keys. You can add more later, pool accounts, select exact models, and build fallback or round-robin routes. There is no required single “AI brain.”
4. Workspace
Name the workspace. Terminals default on. 1Helm creates #main with the one Skipper, then you create ordinary channels with plain-language purposes. Every ordinary channel gets a private Linux computer.
5. Give an outcome
Try: “Audit this launch folder, turn the notes into a decision brief, resolve obvious gaps yourself, and give me the finished PDF with evidence.” The resident should inspect, execute, create the artifact, and call Skipper itself if it crosses the channel boundary.
`); +const gettingStarted = doc("/manual/getting-started", "Getting started", "Install 1Helm, connect providers, create the workspace, and give the first resident a real outcome.", `The normal setup is three product decisions. 1Helm handles the infrastructure around them.
1. Install or connect
On Apple Silicon, download the signed, notarized, and stapled DMG. On Windows 11 x64, download the Setup executable; its Authenticode status is disclosed in the release notes and v0.0.30 is NotSigned. Ubuntu/Debian hosts use the digest-verified Linux systemd installer. A new desktop installation can host its own workspace or connect to an existing HTTPS 1Helm host. Native mobile apps connect only to an existing configured host. Starting a new host may request one administrator approval for its isolated Linux runtime.
2. Captain
Create the first account. This is the Captain: owner, final authority, and administrator. Public registration closes after the Captain exists.
3. Providers
Connect one or more subscription accounts or API keys. You can add more later, pool accounts, select exact models, and build fallback or round-robin routes. There is no required single “AI brain.”
4. Workspace
Name the workspace. Terminals default on. 1Helm creates #main with the one Skipper, then you create ordinary channels with plain-language purposes. Every ordinary channel gets a private Linux computer.
5. Give an outcome
Try: “Audit this launch folder, turn the notes into a decision brief, resolve obvious gaps yourself, and give me the finished PDF with evidence.” The resident should inspect, execute, create the artifact, and call Skipper itself if it crosses the channel boundary.
`); const architecture = doc("/manual/architecture", "Architecture", "The 1Helm control plane, resident computers, Skipper, model fabric, memory, obligations, connections, and audit chain.", `1Helm is a compact local control plane around many persistent employee worlds.
Captain └─ #main / Skipper ── host · credentials · fleet · cross-channel - ├─ #product / resident ── private Linux VM ── /workspace - ├─ #finance / resident ── private Linux VM ── /workspace - └─ #home / resident ───── private Linux VM ── /workspace + ├─ #product / resident ── private Linux computer ── /workspace + ├─ #finance / resident ── private Linux computer ── /workspace + └─ #home / resident ───── private Linux computer ── /workspace Shared host services: model router · connection brokers · audit chain Per resident: identity · threads · curated memory · Mnemosyne · skills · obligations
Control plane
A Node/TypeScript server owns authentication, SQLite state, REST/WebSocket APIs, model routing, resident execution, channel-computer lifecycle, connection brokers, and background reconciliation. Electron hosts this server on an ephemeral loopback port in the native macOS and Windows apps.
Computers
The Apple backend uses defensive argv-only calls to Apple's container runtime. Linux uses a narrow root-owned Podman helper. Windows enters the same helper inside one installation-scoped managed WSL runtime. Every ordinary channel still owns one distinct persistent container, filesystem, process tree, hostname/network identity, and resource limits. OCI Files/Cowork access runtime-owned storage directly.
Execution and return
Agent turns are serialized per resident identity. Tools run in the resident's computer unless they belong to the host-brokered capability surface. A resident-origin Skipper escalation records an open escalation; Skipper acts and call_agent returns the thread. The runtime supplies the return when a model omits it.
Memory
Thread summaries remain session records. Curated facts, decisions, preferences, and artifact references retain provenance. Each identity also owns a separate Mnemosyne SQLite store for long-term semantic recall.
Obligations
Follow-ups and machine timers become durable rows. The reconciler wakes due computers and prevents unsafe sleep when services, cron, timers, terminals, active turns, or uncertain state exists.
Providers and connections
The embedded router pools model accounts and exposes one internal gateway. Gmail and Photon are host brokers: residents receive only task-scoped operations and never raw OAuth or project credentials.
`); @@ -27,12 +27,12 @@ const verification = doc("/manual/verification", "Verification and limits", "How const skills = doc("/manual/skills", "Skills and growth", "How 1Helm ships substantive playbooks, selects them per task, learns procedures, and safely imports external skills.", `A durable agent needs more than ten generic prompt snippets. 1Helm ships complete operational playbooks and a supply chain for adding more without turning the user into a plugin administrator.
Focused assignments
Every resident starts with a seven-skill operational core plus playbooks selected by its channel template. The complete shared catalog covers outcome ownership, Skipper handoff, obligations, skill discovery, memory, research, email, calendar, contacts, messaging, documents, spreadsheets, PDFs, meetings, projects, personal operations, travel, finance, support, software delivery, GitHub, data, media, infrastructure, security, and self-hosting.
Each defines activation cues, execution, boundaries, retained state, and verification. A resident sees a compact inventory of its assigned skills, loads a full procedure on demand, and can ask Skipper for another catalog skill when a task expands.
Crystallize proven procedures
After a repeatable workflow succeeds, a resident can supply its complete activation cues, ordered action, authority boundaries, recovery, retained state, and verification procedure plus concrete completion evidence. Generic one-paragraph skills and unverified guesses are rejected. Skipper can also learn from a local file/folder, URL, or notes in a visible thread. Corrections and durable behavior guidance remain separate from raw chat.
External catalog
1Helm searches SkillsMD's public API directly and displays every result it returns. SkillsMD currently describes its records as GitHub repositories; 1Helm does not inflate that count into individual procedures or call the registry curated.
Inspection at install time
Choosing a result starts source inspection rather than browse-time censorship. 1Helm resolves an immutable GitHub revision, finds a bounded skill document, scans it, records its hash and provenance, and wraps clean content beneath runtime authority. Content that fails inspection is not silently activated.
`); const providerDocs = doc("/manual/providers", "Providers and routing", "Connect multiple model accounts and keys, enable models, create routes, and keep resident identity provider-neutral.", `Providers form one shared multi-account fabric. 1Helm does not force the workspace to choose one brain.
Connections
Connect supported OAuth accounts for ChatGPT, Claude, Gemini/Antigravity, and xAI, or keys for OpenRouter, NVIDIA NIM, Cloudflare, GLM, and custom OpenAI-compatible endpoints. Multiple accounts from one family are pooled.
Routes
Enable exact models and build named ordered fallback or round-robin routes. A standard provider-model route tries eligible accounts in that family before moving to the next route member.
Resident continuity
Changing the selected model or route never replaces the resident, computer, memory namespace, skills, files, or thread history. Provider credentials stay in host-owned routing state.
External endpoint
The same fabric exposes authenticated OpenAI- and Anthropic-compatible endpoints for model discovery, Chat Completions, Responses, Messages, and token counting. Gateway keys are independent of login sessions and revocable.
`); const computerDocs = doc("/manual/channel-computers", "Channel computers", "How 1Helm provisions, isolates, sizes, wakes, repairs, updates, archives, and deletes resident computers.", `The computer is not a metaphor. Every ordinary channel owns one persistent isolated Linux world.
Isolation
On Apple Silicon, 1Helm uses an Apple container machine with no Mac home mount. Linux uses one durable Podman OCI container per channel. Windows hosts all channel containers inside one installation-scoped managed WSL 2 runtime with Windows-drive automount and interop disabled. The resident command tool and channel Terminal enter the same channel container and start in the same /workspace.
Authoritative storage
OCI workspace, Files, home, and channel state live under runtime-owned storage. Files and Cowork access that storage directly, so human and agent edits are immediately visible without a whole-workspace copy step. Installed tools, background processes, filesystem state, hostname, and network identity persist across stop/start.
Managed resources
Skipper chooses CPU and memory using pressure, obligations, and recent demand. Podman applies live CPU and memory changes.
Lifecycle and recovery
Archive cancels active turns and terminals, stops the world, and creates a digest-qualified backup. Restore reuses the same world; missing OCI storage may be rebuilt only from an exact ownership-checked backup whose SHA-256 matches. Deletion and app-removal cleanup require exact installation/channel labels, mounts, and owner markers.
Clean start
This OCI generation does not bridge, migrate, copy, import, or delete retired channel runtimes or data.
Wake and repair
Follow-ups, services, systemd timers, cron, terminals, and active work prevent unsafe sleep. Reconciliation detects drift, wakes due obligations, updates guests, and repairs recoverable failures.
Platform truth
Apple Silicon macOS 26 uses Apple's pinned runtime; Ubuntu/Debian systemd hosts use native Podman; Windows 11 x64 uses one shared managed WSL 2/Podman runtime. The native compatibility backend remains an explicit development/test seam and is not the production default.
`); -const connections = doc("/manual/connections", "Connections", "How Gmail, Photon/iMessage, and future host brokers expose narrow capabilities without leaking credentials or personal data.", `A connection is a host-owned broker, not a secret copied into every resident's shell.
Gmail
When Gmail OAuth accounts exist on the 1Helm host, Captain-authorized Skipper can grant a resident access to named accounts. Current resident operations are account listing, search, message retrieval, and draft creation. Sending is disabled by default.
Photon and iMessage
The connector uses Photon's device-code login and Dashboard/Spectrum APIs to create or reuse a 1Helm project, rotate its one-time secret, register the operator, discover the assigned line, and start a long-lived spectrum-ts gRPC stream in a supervised loopback sidecar.
Inbound senders must match a channel mapping allowlist. Messages become real resident threads. The resident can reply in that already-authorized conversation; new outbound destinations require Skipper's explicit capability grant. Credentials never enter the resident computer.
Current limitation: the reliable contract is text. Attachment events are represented conservatively and full attachment fidelity is still being verified.
Connector standard
New native connections must provide least-privilege scoping, secret isolation, reconnect/recovery, deduplication, an audit trail, deterministic tests, and honest capability status. A prompt saying “use Slack” is not a connector.
`); +const connections = doc("/manual/connections", "Connections", "How Gmail, Photon/iMessage, and future host brokers expose narrow capabilities without leaking credentials or personal data.", `A connection is a host-owned broker, not a secret copied into every resident's shell.
Gmail
When Gmail OAuth accounts exist on the 1Helm host, Captain-authorized Skipper can grant a resident access to named accounts. Current resident operations are account listing, search, message retrieval, and draft creation. Sending is disabled by default.
Photon and iMessage
The connector uses Photon's device-code login and Dashboard/Spectrum APIs to create or reuse a 1Helm project, rotate its one-time secret, register the operator, discover the assigned line, and start a long-lived spectrum-ts gRPC stream in a supervised loopback sidecar.
Only the configured Captain phone is accepted. Its first inbound text opens a durable conversation with Skipper in the Captain's private #main Texts tab; replies return to that same phone conversation. The context survives connector restarts and Photon space-ID changes until the Captain sends /new. The Captain can continue any saved Texts thread on desktop, and desktop-only turns are not replayed as iMessages. Credentials never enter a resident computer.
Current limitation: the reliable contract is text. Attachment events are represented conservatively and full attachment fidelity is still being verified.
Connector standard
New native connections must provide least-privilege scoping, secret isolation, reconnect/recovery, deduplication, an audit trail, deterministic tests, and honest capability status. A prompt saying “use Slack” is not a connector.
`); const installMac = doc("/manual/install-macos", "Install on macOS", "Install the signed, notarized Apple Silicon 1Helm app and initialize per-channel Linux computers.", `The native consumer product currently targets Apple Silicon Macs.
Requirements
- Apple Silicon Mac (
arm64). - macOS 26 for Apple's container runtime.
- Administrator approval once during verified runtime installation.
Install
- Download the current DMG.
- Open it and drag 1Helm to Applications.
- Open 1Helm. Gatekeeper verifies the Developer ID signature and notarization ticket.
- Complete Captain → Providers → Workspace. Approve Apple's signed runtime inline if requested.
Data and upgrades
This generation stores application state under ~/Library/Application Support/1Helm-OCI-v1. Profile → Check for updates asks the Mac hosting 1Helm to download and verify the signed, notarized update. When the host reports it ready, Restart & install quiesces the local service and replaces the app. The browser is never given a DMG as the update action, and Application Support remains in place.
Removal
Use Settings → Admin → Prepare to remove 1Helm before trashing the app. This removes only verified 1Helm-owned channel machines while preserving the application state for a future reinstall.
`); const installLinux = doc("/manual/install-linux", "Install on Linux", "Install 1Helm as a durable systemd service with one OCI container per resident.", `Linux is a supported headless host product. It persists the control plane under systemd and gives every ordinary channel its own durable Podman container.
Supported baseline
Ubuntu or Debian with systemd and apt, cgroup v2, an x86-64 or arm64 CPU, 4 GiB RAM minimum (8 GiB recommended), and 20 GiB free disk. Each real workload needs additional storage. Nested deployments must permit Podman and delegated cgroups.
${code("linux-install", "curl -fsSLo /tmp/1helm-install.sh https://1helm.com/install.sh\nless /tmp/1helm-install.sh\nsudo bash /tmp/1helm-install.sh", "bash")}The installer verifies architecture, installs an exact official Node runtime after checking its published SHA-256 manifest, installs Podman and the fixed root-owned OCI helper, creates a restricted 1helm service account, stores control-plane and runtime state in /var/lib/1helm-oci-v1, and atomically switches /opt/1helm/current.
Host-owned updates
A Captain update action creates one private request file. The host—not the browser—downloads the exact stable Linux release artifact, requires GitHub's SHA-256 asset digest, applies the fixed application and OCI contract, restarts, health-checks, and restores the prior release and runtime files on failure.
Open the UI
By default the service listens on port 8123. Use a firewall and an HTTPS reverse proxy before exposing it to the public internet. First boot opens Captain creation.
Back up and remove
Stop the service, then copy /var/lib/1helm-oci-v1 as one coherent unit. The installed /opt/1helm/uninstall-host.sh deletes only exact ownership-checked channel containers and preserves durable recovery state.
Windows 11 hosts one installation-scoped WSL 2 runtime. Every ordinary channel owns a distinct durable OCI container inside it.
Implemented host contract
- Native x64 Electron host with Squirrel update packaging.
- Administrator approval once to enable and verify Microsoft's pinned WSL 2 runtime.
- One SHA-256-pinned Canonical Ubuntu root filesystem owned by the signed-in Windows account.
- One separately labeled, mounted, and ownership-checked container per resident.
- Windows-drive automount and Windows process interop disabled.
- Exact installation/channel ownership checks for stop, deletion, and app removal.
The resident runs as UID/GID 1000 in /workspace. App state lives under %APPDATA%\\1Helm-OCI-v1, and the shared runtime disk lives under %LOCALAPPDATA%\\1Helm-Runtime.
Install
- Download the current Setup executable.
- Run the installer on Windows 11 x64.
- Open 1Helm and complete Captain → Providers → Workspace. Approve Microsoft’s pinned WSL 2 host setup once if requested.
Updates arrive through the app’s native update feed on the machine hosting 1Helm. The release notes record the installer’s Authenticode status.
`); -const selfHosting = doc("/manual/self-hosting", "Self-hosting", "Ports, state, backups, HTTPS, upgrades, health checks, and platform boundaries for self-hosted 1Helm.", `1Helm is the server. The public 1helm.com website and demo.1helm.com sandbox are not dependencies of your installed workspace.
Ports
The source runtime defaults to 8123. The native Mac app chooses an ephemeral loopback port. The public sandbox uses 8124; the standalone product website uses 8130. These are separate processes and data trees.
State
Set CTRL_DATA_DIR to a persistent, restricted directory. Never place it in a public web root. Back it up only while the service is stopped or with a filesystem/database-consistent snapshot.
HTTPS
Use Settings → Domains for a workspace-managed Cloudflare tunnel on the native app, or put a conventional HTTPS reverse proxy in front of a headless host. Preserve WebSocket upgrades and do not strip Authorization headers.
Health
${code("health", "curl -fsS http://127.0.0.1:8123/api/setup/status\nsystemctl is-active 1helm\njournalctl -u 1helm --since '15 minutes ago'", "bash")}Upgrades
Use a unique released version. Stop the service, take a state backup, install the tagged source, run npm ci and npm run build, then restart and verify health. Database migrations are additive, but rollback still requires the pre-upgrade data backup.
Resource guidance
A minimal control plane can run in 4 GiB RAM; 8 GiB is a more practical baseline. Model inference usually remains at connected providers, but browser automation, builds, media processing, and several concurrent residents increase CPU, RAM, and storage demand.
`); +const selfHosting = doc("/manual/self-hosting", "Self-hosting", "Ports, state, backups, HTTPS, upgrades, health checks, and platform boundaries for self-hosted 1Helm.", `1Helm is the server. The public 1helm.com website is not a dependency of your installed workspace. The retired pre-OCI demo sandbox is no longer running; demo.1helm.com redirects here until a new isolated sandbox is deliberately provisioned.
Ports
The source runtime defaults to 8123. Native desktop apps choose an ephemeral loopback port. The standalone product website uses 8130. These are separate processes and data trees.
State
Set CTRL_DATA_DIR to a persistent, restricted directory. Never place it in a public web root. Back it up only while the service is stopped or with a filesystem/database-consistent snapshot.
HTTPS
Use Settings → Domains for a workspace-managed Cloudflare tunnel, or put a conventional HTTPS reverse proxy in front of a headless host. Preserve WebSocket upgrades and do not strip Authorization headers.
Health
${code("health", "curl -fsS http://127.0.0.1:8123/api/setup/status\nsystemctl is-active 1helm\njournalctl -u 1helm --since '15 minutes ago'", "bash")}Upgrades
Use a unique released version. Stop the service, take a state backup, install the tagged source, run npm ci and npm run build, then restart and verify health. Database migrations are additive, but rollback still requires the pre-upgrade data backup.
Resource guidance
A minimal control plane can run in 4 GiB RAM; 8 GiB is a more practical baseline. Model inference usually remains at connected providers, but browser automation, builds, media processing, and several concurrent residents increase CPU, RAM, and storage demand.
`); export const pages = { "/manual/getting-started": gettingStarted, "/manual/architecture": architecture, "/manual/outcome-ownership": outcomeOwnership, diff --git a/site/manual.html b/site/manual.html index 30eb116..f9a1742 100644 --- a/site/manual.html +++ b/site/manual.html @@ -167,7 +167,7 @@Connections
Gmail
Settings → Connections → Gmail owns the connection on the helm computer — or just ask @skipper can we set up Gmail. Gmail supports account inventory, search, read, and draft creation. Sending remains disabled. OAuth tokens live in host-owned storage and never enter chat or a resident's computer.
Photon / iMessage
-Connections walks you through Photon device authorization and conversation mapping. An allowlisted inbound text creates a real thread, invokes the mapped agent, and sends the reply back to that exact conversation. New outbound destinations stay blocked unless you explicitly grant them.
+Connections walks the Captain through Photon device authorization and phone registration. The configured Captain phone talks directly to Skipper: the first inbound text creates a private thread in #main → Texts, replies return to that conversation, and the context persists across connector restarts until the Captain sends /new. The same saved conversation can continue on desktop without replaying desktop-only turns to iMessage.
Workflows & follow-ups
Updates & your data
-Mac releases are signed, notarized, and verified before install — Profile → Check for updates downloads on the helm machine and offers Restart & install only when ready. Linux installs use a root-owned updater that verifies a release digest, installs into a versioned directory, switches atomically, health-checks, and rolls back if needed.
+Mac releases are signed, notarized, and verified before install — Profile → Check for updates downloads on the helm machine and offers Restart & install only when ready. Windows uses its native Squirrel feed and discloses Authenticode status in each release. Linux installs use a root-owned updater that verifies a release digest, installs into a versioned directory, switches atomically, health-checks, and rolls back if needed.
Every update preserves your data root:
macOS: ~/Library/Application Support/1Helm-OCI-v1
Linux: /var/lib/1helm-oci-v1
@@ -194,7 +194,7 @@ Security
Channel membership gates files, terminals, messages, and live events. Private coworker channels aren't Captain-readable without invitation.
External skills are revision-pinned, bounded, scanned, hashed, and wrapped.
Operational history enters a SHA-256 hash chain — Settings → Audit verifies it and pinpoints tampering.
- Releases are Developer ID signed, notarized, stapled, and Gatekeeper-verified before publication.
+ Mac artifacts are Developer ID signed, notarized, stapled, and Gatekeeper-verified; Linux assets are digest-verified, and every Windows release discloses its Authenticode status.
FAQ
Can agents see my files?
-No. Each resident lives on its own virtual machine with no view into your real computer. It makes folders, saves files, and runs commands entirely inside its own world. Anything it needs beyond that is brokered explicitly, by you or by Skipper, with the narrowest possible grant.
+No. Each resident lives in its own isolated Linux computer with no view into your real computer. On macOS that is an Apple container machine; on Linux and Windows it is a dedicated OCI container. It makes folders, saves files, and runs commands entirely inside its own world. Anything it needs beyond that is brokered explicitly, by you or by Skipper, with the narrowest possible grant.
@@ -262,7 +262,7 @@
FAQ
Is demo.1helm.com the product?
-No — it's a public sandbox so you can poke around. The real product is the downloadable, self-hosted 1Helm runtime, and your installation's state stays on your machine.
+No. The retired pre-OCI sandbox is no longer running, and demo.1helm.com now redirects to the product site. A future demo must be provisioned explicitly with isolated non-production state. The real product is the downloadable, self-hosted 1Helm runtime, and your installation's state stays on your machine.
diff --git a/site/server.mjs b/site/server.mjs
index 6656eb9..dfddd95 100644
--- a/site/server.mjs
+++ b/site/server.mjs
@@ -272,6 +272,11 @@ function serveFile(req, res, file, cache = "public, max-age=86400") {
const server = createServer(async (req, res) => {
const url = new URL(req.url || "/", `http://${req.headers.host || "localhost"}`);
const path = url.pathname.length > 1 ? url.pathname.replace(/\/+$/, "") : "/";
+ const hostname = String(req.headers.host || "").split(":")[0].toLowerCase();
+ if (hostname === "demo.1helm.com") {
+ redirect(res, `${ORIGIN}${path === "/" ? "" : path}${url.search}`, 301);
+ return;
+ }
if (path === "/api/feedback" && req.method === "POST") {
if (feedbackRateLimited(req)) {
answer(res, 429, JSON.stringify({ error: "Too many feedback reports. Try again shortly." }), {
diff --git a/site/story.html b/site/story.html
index 0dc6ef9..fb7dae4 100644
--- a/site/story.html
+++ b/site/story.html
@@ -123,12 +123,12 @@
- 
+
- Email Tracker's virtual machine
+ Email Tracker's private computer
-
A ship of their own.
-
+
Skipper builds it a virtual machine — a full computer with its own storage, RAM, and CPU, living inside yours, fully isolated from the real machine. Its own files. Its own memory. Real memory.
+Skipper builds it a private Linux computer — an Apple container machine on Mac, or its own OCI container on Linux and Windows — with its own storage, RAM, and CPU, fully isolated from the real machine. Its own files. Its own memory. Real memory.
NotSigned<\/code>/i);
+ assert.match(gettingStarted, /connect to an existing HTTPS 1Helm host/i);
+ assert.doesNotMatch(gettingStarted, /signed Setup executable/i);
assert.doesNotMatch(gettingStarted, /withheld/i);
assert.equal((await fetch(`${base}/assets/site.css`)).status, 200);
const windowsIcon = await fetch(`${base}/icons/icon-sailboat.ico`);