PolymerOS trust decorations for COSMIC

The desktop is achromatic; trust is the only color. Every window ring and chip below is drawn by the compositor from host metadata — guest pixels are inset and can never imitate them. Every state is encoded twice: hue, plus a border weight, pattern, or glyph that survives grayscale.

Desktop scene · six live states

polymerOSworkspace 1 ◆ system14:32

● dev·⋯·⊘ foot — ~/polymer

$ nix build .#spectrum-live
building 16k host kernel…
$ ▌

⬡ agent-runtime·T 12m·⊘ job 7c41 — refactor sweep

Temporary bond active: write access to dev-vm:~/polymer/scripts, expires 14:44. Revoke from the chip at any time — expiry never silently vanishes.

▲ browser·→ 1 Brave — spectrum-os.org

Policy-routed egress via one approved transport. Storage amnesiac: this VM forgets everything on close. Clipboard is brokered — nothing leaves without a host-mediated grant.

◫ media-docs·⊘ invoice-Q3.pdf (imported)

Quarantine is violet, not red — inspection of untrusted material is the system working as intended. No clipboard, no portal, no network; dashed ring reads in grayscale.

✕ job-runner attestation mismatch — halted

Compromised: measurement failed at launch. Double red ring and barred titlebar are static — the state must survive a screenshot, not blink between frames. Input affordances are withdrawn.

● observability·⟳ update event log — append-only

Update-required pulses the chip only (static badge under reduced motion). Update decisions happen in the host flow — the compositor displays state, it never grants.

The scene keeps its own dark ground in both page themes: it depicts the OS default, where a quiet graphite field makes one violet ring the loudest object on screen.

Chip anatomy

⬡ agent-runtime·⋯·T 12m·⊘

⬡ Tier glyph + VM roleHex-cornered capsule — the polymer monomer motif. Role text comes from the host, never the guest.

⋯ Runtime-tier dotsOne dot linux-full, two hermit-middle, three micromer/tamago-minimal: more dots, smaller TCB.

Bond segmentClass letter C/T; temporary bonds carry a countdown ring that empties toward expiry. Broken-chain strikethrough for expired or revoked.

Network segment⊘ deny-external (the safe default, still explicit) · → policy-routed + transport count · ⬢ private overlay · red ⊘ blocked.

Tier tokens

trust.tier	Color	Ring	Glyph	Reads as
system	slate	1px solid	◆	the OS itself; panel and chrome share this neutral
trusted	steel blue	2px solid	●	your working compartments
scoped	teal	2px solid + bond chip	⬡	bounded cooperation under a live bond
untrusted	amber	3px solid	▲	outside material; handle through brokers
quarantine	violet	3px dashed	◫	deliberate containment — not an error
blocked / compromised	red	3px double + hatch	✕	failure; red appears nowhere else

Rules the system never breaks

Two channels minimumHue plus weight, pattern, or glyph — legible in grayscale and under every common color-vision deficiency.

Compositor-owned pixelsRing and chip are drawn from host metadata; guest content is inset and cannot spoof them. Missing metadata renders unknown, never trusted.

Red = failure onlyDanger states are static and maximum-contrast; nothing else on the desktop is red, ever.

Focus ≠ trustFocus changes ring brightness, never hue. An unfocused quarantine window is exactly as violet as a focused one.

No user accentAccent personalization is disabled: on this OS, saturation is a security channel.

Display, never grantThe chip opens a security panel; revocation routes to the host broker. COSMIC is not a permission oracle.