Skip to main content

LapEE laptop

LapEE is the Laptop Execution Environment. It boots a laptop directly into PermawebOS as its sole operating system, starts a PermawebOS node, and exposes evidence that lets a verifier bind that node to the measured boot.

LapEE is not a general desktop and not a multi-tenant isolation system. The machine is treated as a single-purpose appliance.

Runtime Shape​

A LapEE runtime image contains:

  • a signed UEFI Unified Kernel Image at EFI/Boot/BootX64.efi;
  • Linux, a Buildroot initramfs, Erlang/OTP, and the PermawebOS kernel;
  • measurement, system, TPM, and profile devices;
  • a splash screen that shows the node URL and QR code;
  • optional ESP inputs: config.json and wifi.conf.

At boot, init reads accepted ESP inputs once, copies public config into tmpfs, uses WiFi credentials only for network association, unmounts the boot media, reduces local runtime surfaces, and starts PermawebOS on port 8734.

Evidence​

LapEE uses TPM 2.0 to connect the running node to measured state:

  1. Firmware and the UKI produce boot measurements.
  2. PermawebOS builds a boot measurement subject from system evidence and the public node message.
  3. The runtime extends PCR 15 with that subject.
  4. A TPM AK quotes PCRs including PCR 15.
  5. The verifier checks the quote, PCR replay, AK policy, EK chain, Secure Boot state, and node message.

The result is a measured node identity. It does not prove the kernel or device code will never have a bug, and it does not make all hardware classes equivalent.

Images​

warning

Current PermawebOS builds are alpha. Use a LapEE image only on a spare laptop that can be dedicated to the experiment.

Provisioning a machine for LapEE can leave the laptop unable to boot other operating systems without firmware recovery. Support is limited to docs and source code.

Use the image artifacts and verification material published with the release.

ImageUse
lapee-usb.imgDefault LapEE laptop image. Requires UEFI, TPM 2.0, and the production memory-encryption gate.
lapee-usb-no-tme.imgCompatibility image for hardware that cannot satisfy the memory-encryption gate. Still TPM-attested and visibly records that posture.

Run the LapEE bundler quickstart for the full bundler setup.