Apps and capsules
In Home, you see Apps: Assistant, Chat, Library, Wallet and the others. Underneath, each App is a Digital Capsule: a complete, portable, signed package.
Three things kept separate
ElastOS keeps three ideas apart:
- Objects are your things: documents, photos, identities, sites.
- Digital Capsules are signed packages of software or content. An App is a capsule. An AI model is a capsule too.
- Spaces are the places where objects live, such as your own
localhost://Users/...area.
An App can work with your objects only when you grant it. Installing an App does not give it your files.
Named by what they contain
Every capsule in a release has a CID (content identifier) and a SHA-256 hash. Both come from the bytes of the package. If one byte changes, the name changes.
- A web address can point to different content tomorrow. A CID cannot.
- The release lists each capsule with its name, version, SHA-256, size, CID and the publisher who signed it.
- Before your Home installs or updates a capsule, it checks the signature and then checks that the downloaded bytes match the hash.
A hash proves the content is the same. It does not prove who made it. That is why each record is also signed by the publisher. See Signed releases and updates.
No ambient authority
“Ambient authority” means software can do things just because it is running, such as reading any file or opening any network connection. ElastOS is built so that Apps do not get it: an App gets nothing just by being installed.
- Each App gets a signed launch token when it opens.
- When an App acts, the Runtime checks the token, the person and the permission first.
- Permissions are narrow, logged and can be taken back.
- If a permission is missing, the action fails closed and says what is missing.
How Apps run today
- First-party Apps (the ones in Home) are web apps. Each runs in its own sandboxed browser frame, separate from the others.
- Providers do the heavy work: storage, AI models, wallet, chain reads. Today they run as normal programs with your account’s rights. Only the model provider is partly confined.
- Home itself can still use every App’s permissions today. Limiting Home to passing on only what you approve is the next step.
- WASM capsules run in Wasmtime with limits on memory and processing time. Developers can build them today, but the Apps in Home are not WASM capsules yet.
- Installed Homes accept only capsules from the signed release. Third-party Apps come later, after they can run in a separate, confined process.
Today in v2: signed Apps in sandboxed frames. The Runtime checks each App’s signed token before it acts.
Where it is headed (v3): every App and AI agent is a sealed capsule that holds only the access you give it, on any computer you own. Home can only pass permissions on, and cannot use an App’s permissions itself. See the roadmap.
Getting more
Today, Marketplace shows the Apps in your release and lets you get signed AI models. Getting more apps, games and data from Marketplace is planned. See Marketplace.
Developers: see Developers.