How many processes can rewrite this machine?

The premise

Ownership of a computer should include ownership of the control plane that explains, updates, and authorizes what runs on it.

That sentence is the whole product. Everything below is an argument that it is currently false on most machines, and a description of the part RedFlag Desktop does something about.

The green checkmark problem

There was a period when diagnostic tools assumed the person at the keyboard was entitled to see the whole list. HijackThis did not diagnose anything — it enumerated. Every autostart hook, browser helper object, layered service provider and hosts entry, dumped raw. ComboFix was heavier, scarier and demanded near-total trust, but it still operated on a machine its user owned rather than a machine they had been issued.

Those tools were not better software. They were more legible software. What replaced them is a green checkmark: You’re protected, and no list. The control plane did not disappear — it moved into a vendor console the owner does not hold, and what came back was a reassuring glyph.

The environment around ordinary users became adversarial in the same window. Fake system alerts. Browser chrome impersonation. Notification abuse. Update prompts that are not updates. Every one of those attacks is a forgery of an interface element, and a green checkmark is the cheapest interface element in the world to forge. An enumerated, provenance-bearing account of what actually runs is not.

This is not a nostalgia argument. It is a structural one: a machine that cannot show its owner what runs on it has already conceded the only ground on which the owner could win.

What it can actually follow

RedFlag Desktop is a native console for the machine in front of you. On Linux it descends from a running process into the facts that explain it.

The whole inventory is read from /proc directly. It spawns no subprocesses to find out what is running, which is the same refusal the authority section below describes, applied to observation rather than to change.

Capability bits the tool does not recognise are preserved and shown rather than silently dropped — an unknown privilege is still a privilege. The agent’s local API also returns environment variable names without their values; the console does not render them yet.

The sharp edges, named

Desktop flags the capabilities that let a process rewrite the host it runs on, rather than presenting every process as equivalent. All 11 of them, not a representative sample:

The question in the title of this page is not rhetorical. It is a query the interface can run.

Three groups, and the reason for them

The console separates reading the machine from changing it, and both from the record of what was allowed. That split is the product’s argument, so it is the navigation rather than a diagram in a document.

Who is allowed to change it

The interface does not inherit machine authority simply because it can ask for a change. Desktop talks to the local Agent over a Unix socket or a Windows named pipe. It does not shell out, and it does not perform privileged package operations itself.

Every command the server issues is Ed25519-signed, nonce-bound and replay-checked. Verification runs on the agent and fails closed. There is no remote path that turns it off; disabling it means editing config on the host as root, which is access that already ends the argument.

Current limits

A page about legibility that hid its own boundaries would be self-refuting. These are the real ones today, for a person holding one machine. The architecture framework carries the complete list, fleet gaps included.

• RedFlag is alpha software. v0.3.0 is the planned first stable release.
• Deep process inspection is Linux-first. Linux amd64 is the only native Desktop release artifact; Windows transport exists in source without a proved Desktop build.
• Kernel eBPF enforcement is not wired. The scaffold exists and does not reach the capability model.
• Docker, Winget and Windows Update are not on the supply-chain gate at all. They remain direct-mutation.
• Dependency closure is best-effort. DNF and APT require the top-level hash, unresolved dependency entries can be omitted, and npm and PyPI pin a single entry.
• Pacman has no OSV mapping, so every pacman approval requires a typed operator reason.
• The privileged helper is not network-isolated. Its systemd-run unit retains host network access.
• Desktop asserts its operator label from the session environment. Socket peer identity and fresh step-up are unfinished.
• Desktop cannot browse the root journal, though the helper journals its decisions.
• Standalone-to-fleet graduation is refused until local-key retirement and trust replacement are one tested transaction.

Where to go next