# Lockdown Mode Deft's TUI hosts can run in lockdown mode: a pinned workspace with a fixed layout, no project/workspace switching, and a curated launcher that only offers the apps the vendor allows. It turns a Deft session from a development environment into a deployed application — from a pinned multi-app workspace down to a single full-bleed app (`:chrome :app`). Lockdown is aimed at settings where the interface must not be rearranged or reconfigured: - Point-of-sale terminals — one vendor launcher, a fixed set of apps, no shell escape in the UI. - Kiosks and information displays — pinned app or app set, fullscreen-style chrome, or the `:chrome :app` single-app presentation. - Industrial / medical panels — fixed layout, auditable app list. - Single-purpose appliances — a dedicated app on hardware the user never administers. ## What Lockdown Changes | Area | Normal | Locked down | |---|---|---| | Project menu | Recent projects + Browse | Hidden, switching refused | | Workspace menu | New / Save / Save As / Remove | Hidden, all refused | | Panel resize | Drag borders, `tui/resize`, keyboard | Refused | | Splits / close / drag | Any time | Refused | | Zoom / maximise / collapse | Any time | Refused | | Pop-out windows / docks | Enabled on the GL/ANSI hosts | Disabled | | Launcher | Scans every package root | Vendor launcher only, allowlist enforced | | Initial UI | Launcher | Policy `:app`, then vendor launcher, then blank | | Source apps | `.dft` and `.dftc` | Optionally `.dftc` images only | | Chrome (`:chrome :app`) | Full workspace | One app fills the host; closing it exits | ## Which Hosts Lockdown is implemented in the two workspace hosts: - `retra` (ANSI) — the natural fit for POS terminals and serial/VT kiosks; works over SSH and on the Linux console. - `retro` (OpenGL) — for graphical kiosks and desktops. Both drive the same shared workspace, so a vendor prelude is portable between the GL and ANSI builds — including the `:chrome :app` presentation, which gives the same full-window app on a graphical kiosk and on a VT/SSH terminal. ## Single-App Kiosk (`:chrome :app`) The `:chrome :app` policy level is lockdown's most aggressive chrome setting and the recommended shape for a dedicated appliance: - The workspace taskbar row, workspace tabs, badges, group chrome and the panel-name palette all disappear. - One app fills every row of the window/terminal below its own title/menu strip (app name + app menus), so `[tui/set-menu]` keeps working. - The app comes from the policy `:app` source or a CLI `retra/retro app <ref>`; named workspace configs and the launcher are ignored. - Closing the app (`[tui/close]`, `[surface/quit]`) — or its thread dying — exits the host, so the host process is the app's lifetime for a service manager to supervise. See Configuration for the prelude shape and Behavior for the exact gating and exit rules. ## How It Works The policy is a process-global `HostPolicy` resolved once at startup, before workspace configuration is evaluated and before any app is launched. It is read only from immutable sources: 1. the `--lockdown` / `--kiosk` command-line flag, 2. the `DEFT_LOCKDOWN=1` environment variable, 3. the project prelude `:lockdown` entry. The mutable `config/*` registry is deliberately not a source, so an app cannot call `[config/set "ui/lockdown" false]` to unlock the host. ## A Deployment Path Lockdown is the UI half of Deft as an application deployment platform. The intended stack: 1. Compile apps to AOT `.dftc` images (`deft compile --app <owner/name>`) — see the language docs for the compile workflow. 2. Pin the host with a lockdown prelude and a vendor launcher (or the `:chrome :app` single-app policy). 3. Confine the process with the Landlock sandbox (`DEFT_SANDBOX=1`) and a read-only, image-based root filesystem (the `distro/` appliance build). 4. Harden further with runtime lockdown and signed images — on the roadmap (see Deployment). ## Status Lockdown mode as described here is UI-level enforcement, available today in `retro` and `retra`. It controls what the interface allows; it is not yet a kernel/runtime security boundary. Apps still run on the full Deft runtime, and a user with a shell can start the host without the flag. The Deployment page covers what that means in practice and what is planned next. ## Where To Go Next - Configuration — enable lockdown and reference every policy key. - Behavior — exactly what is gated, and what still runs. - Deployment — a POS/kiosk recipe and the hardening roadmap.