Clasply
The default state is Locked: a secure desktop that opens only when every check passes, in order.
- Self-initiated
- Product design, Engineering
- Desktop (Linux)
- Secure devices
A self-initiated project, with no client, deployment or users. Clasply is built and tested in software. The golden image hasn’t been built end to end, it hasn’t booted on real hardware, and it hasn’t been used with a physical security key.
Is this device safe to use, right now?
A kiosk that handles sensitive work has one job before any other: tell the person in front of it, instantly, whether this device is safe to use, and if it isn’t, exactly what’s wrong and what to do.
Clasply is a hardened Linux system that runs one app, and that app stays closed until a USB security key, the device’s own state and a private mesh network all check out. A key or device failure, or a crash, goes to Lockdown. A mesh failure goes to Degraded, which recovers by itself if the session is still valid. The workspace behind the door is deliberately small: a signed message board shared between Clasply devices. The work is the lock around it.
- Fail closed, everywhere.
Unknown states, crashes, hangs, stale data and results arriving out of order all count as failures, never as passes.
- Offline and self-contained.
Nothing is fetched while it runs: no remote scripts, fonts or content.
- Untrusted networks.
The device trusts no peer, no update mirror, and nothing the interface sends.
- Kiosk use.
Operators under time pressure, sometimes on touchscreens, reading a fixed panel.
One way in, in one order.
Security key, then the device, then the mesh. A check that passes out of turn is ignored, and a result from an abandoned attempt can’t move the door.
Security key
Verified
The app talks to the key directly and verifies its signature itself, never through the browser. A count that goes backwards, the mark of a cloned key, is rejected.
Rejectedgoes to Lockdown
Secure Boot
Enabled
Secure Boot must be switched on and out of setup mode.
Disabledgoes to Lockdown
Disk encryption
Encrypted
The system must be running from the encrypted disk.
Not encryptedgoes to Lockdown
Integrity
Intact
The app and its key settings must match a signed list written when the device was set up. That catches tampering while the device is off, not an attacker who already controls a running system.
Modifiedgoes to Lockdown
Mesh
3 of 3 peers
The private mesh must be healthy and enough peers must answer in time. Results that are too old count as failures.
Below thresholdgoes to Degraded
Try the door.
Pick what the device finds and watch it decide. Then pull the key, lose the mesh or walk away, and see where it goes next.
What does the device find?
Locked
Press Unlock with key, then tap your key when it blinks.
- Security keyWaiting
- Secure BootWaiting
- Disk encryptionWaiting
- IntegrityWaiting
- MeshWaiting
- Locked
- Key
- Device
- Mesh
- Unlocked
- Degraded
- Lockdown
Locked
Every failure has somewhere to go.
Lockdown
- What sends it here
- The key, Secure Boot, the disk or integrity fails, or anything crashes.
- How it comes back
- Only a new key tap, and every check runs again.
Degraded
- What sends it here
- The mesh falls below its threshold.
- How it comes back
- On its own, if the mesh recovers and the session is still valid.
Locked
- What sends it here
- The key is pulled, 5 minutes pass idle, or the 8-hour session limit is reached.
- How it comes back
- A new key tap.
Seven states, five faces.
The door has seven states: Locked, three checking stages, Unlocked, Degraded and Lockdown. These are the five someone at the panel sees.
Locked
The door is closed and the workspace is shut. One instruction, one action: insert the security key and tap it when it blinks.
Checking
Five checks run in strict order, and lamps rise one at a time as real results arrive. A result from an abandoned attempt can’t move the door, and a check that passes out of turn is ignored.
Unlocked
All five lamps green, and the plate parts onto the workspace: a signed message board, mesh health and the update channel. Pull the key and it locks within a second. The device checks repeat every minute.
Degraded
Too few peers answered. The mesh lamp turns amber and the screen stays calm, because this one recovers on its own if the mesh comes back and the session is still valid.
Lockdown
A key or device check failed, or something crashed. One solid red lamp, a reason code, what happened and what to do. The only way back is a new key tap, and every check runs again.
Locked
The door is closed and the workspace is shut. One instruction, one action: insert the security key and tap it when it blinks.
Checking
Five checks run in strict order, and lamps rise one at a time as real results arrive. A result from an abandoned attempt can’t move the door, and a check that passes out of turn is ignored.
Unlocked
All five lamps green, and the plate parts onto the workspace: a signed message board, mesh health and the update channel. Pull the key and it locks within a second. The device checks repeat every minute.
Degraded
Too few peers answered. The mesh lamp turns amber and the screen stays calm, because this one recovers on its own if the mesh comes back and the session is still valid.
Lockdown
A key or device check failed, or something crashed. One solid red lamp, a reason code, what happened and what to do. The only way back is a new key tap, and every check runs again.
Behind the door, deliberately little.
The workspace is a signed message board shared between Clasply devices. Every message is signed by the device that wrote it. Invalid ones are dropped by the node and again by the app.
The work isn’t the board. The work is the lock around it.
Message board
nd-81c04e9aSigned · 08:45Stable channel is on 0.1.0 everywhere. No update pending.
nd-5be210d4Signed · 08:37Reminder: pull your key when you leave the desk. The panel locks after 5 minutes anyway.
nd-81c04e9aSigned · 08:18Factory batch 14 enrolled; report signed and filed.
nd-3f9a21c7Signed · 07:49Node 2 online. Mesh rebuilt after the uplink swap.
It has to get past the node, then the app.
Why it works this way.
- The door only advances in order
- A check that passes out of turn is ignored, and a result from an earlier, abandoned attempt can’t move the door. The only path to Unlocked is security key, then the device checks, then the mesh, every time.
- The key is checked by the app, not the browser
- Browser-based security-key checks are unreliable on Linux, so the app reads the key directly and verifies its signature itself. The interface is treated as untrusted: it can show a result but never produce one.
- The app can’t install its own updates
- The app can only set a signed update aside. A separate system service checks the signature again before installing it, and each signature names the exact file it covers. Downgrades and wrong-channel updates are rejected.
- Almost everything is blocked
- Every direction is closed by default. Only the mesh may reach the internet, apart from the address, name and time lookups a network needs, each held to one system user and one port.
Try to slip an update past it
Artifact signature did not verify; update rejected and logged.UPDATE_BAD_SIGNATURE
- Surface#E0E3E7
- Well#D6D9DE
- Pass#C5E9CB
- Caution#F3DBA9
- Pass text#006129
- Caution text#7B4C00
- Secondary#4F565E
- Text#21272E
- Fail#C2181D
One surface, from the key to the workspace.
Clasply is one grey surface, lit from the top left and shaped into everything on it. It stays quiet so the state of the device is the only thing to read, and only a failure gets a solid block of colour.
ClasplySecure desktop
The default
state is
Locked.
Colour, shape and a word on every lamp
- KeyVerified
- BootEnabled
- DiskEncrypted
- FilesIntact
- Mesh3 of 3 peers
7
commands the interface may call. Everything else is refused.
One loud thing
Lockdown
The only solid block of saturated colour on the screen.
Calm on purpose
0 of 3 peers
Degraded stays amber, because it recovers on its own.
92 of 100
- node-21.8 s22 s ago
- node-32.5 s42 s ago
- node-43.1 s1 min ago
The one big movement
Aa
Atkinson Hyperlegible, built to be read at a glance. Every text colour pair meets WCAG AA.
13 of 13
The factory test prints pass or fail for every item, and won’t pass a unit without a live key tap.
do not ship this unit
Stay shut. Say exactly why. Let only a failure shout.
Where it stands.
Clasply is self-initiated, so there’s no client, no deployment and no users. It’s built and tested in software. The hardening is a design, not an audit.
What hasn’t happened yet
- The golden image, the complete system a device ships with, hasn’t been built end to end, and it hasn’t booted on real hardware. Its configuration is written and checked.
- It hasn’t been used with a physical security key. Testing uses a software key that makes real signatures.
- The check that a build can be reproduced exactly hasn’t been run.
What has been shown
- On the public network, three devices passed every health check between them and completed a signed message round trip in 267 seconds.
- The factory test passes 13 of 13 on a healthy test unit, and stops with “do not ship this unit” when Secure Boot is off and a program has been modified.
- In testing, one valid update was set aside for install, and every bad one was rejected.
JMERC
A website for an education NGO in Uganda, kept current by its own team.
Tell us what you’re building.
A 30-minute call is the quickest way to see if we’re the right fit. Or send us a message, whichever suits you.