[EPIC] T27 OS: the 27-petal menu from one t27 spec, trios to FPGA #10782

Goal

T27 OS is a minimum viable operating surface written in t27. Its home screen is the 27-petal
999 triangle menu. Pressing a petal opens that petal's menu, a grid of cards for existing widgets.
The same spec drives the trios macOS app today and an FPGA board (AX7203) at the end.

Why it matters

• The triangle is drawn today by Swift in trinity/apps/queen (TriangleLogo.swift), which was ported from Zig (photon_trinity_canvas.zig).
• The rule behind it lives in three hand-kept tables that disagree:
  • Screen.screenForBlock lists 28 screens for 27 petals (its DUKH row has 10), so settings can never be reached.
  • Its screen names do not match the tooltip names in TriangleLogo.worlds.
• One spec means one home for that rule, and the only home that can lower to hardware.

Source of truth

• specs/t27f/petal_menu.t27 (module T27fPetalMenu) holds layers L1-L7: geometry, meaning, look, fit, input, state, menu.
• specs/t27f/frontend.t27 holds SF_PETAL_MENU and the I_OS_HOME intent.
• Widget ids come from trinity: apps/website/specs/widgets/gallery.t27. Cards reference them; they never copy them.
• Repository: https://github.com/gHashTag/t27os (managed by TRI CLAW, see TRI CLAW: all CI gates in one GitHub App (TRI-27 / Trinity S3AI), spec-first, sellable #9271)

Sub-tasks (checkboxes)

• M1. Spec: petal geometry, hit test, fills, open/back state, empty card grid (test-report 10/10 + frontend 8/8)
• M2. The trios/QueenUILib host draws from the spec (generated code), and the 28-vs-27 table is deleted
• M3. Cards: each petal's menu lists real widget cards by widgets_gallery id
• M4. Make petal_menu.t27 icarus-lowerable (today: not_lowerable, string and colour tables)
• M5. A framebuffer spec (HDMI/VGA scan-out) and a rasteriser for the 27 quads, in t27
• M6. gen-verilog for the hit test, fills and state on the AX7203, read back on the die
• M7. Input on the board (buttons, UART or touch) wired to on_tap / on_back
• M8. TRI CLAW gates on gHashTag/t27os (via the App or the pinned claw-v* workflow, TRI CLAW: all CI gates in one GitHub App (TRI-27 / Trinity S3AI), spec-first, sellable #9271)
• M9. Native macOS window from the spec: sidebar QUEEN / SPACES / AGENTS, DOCTOR panel, footer "OPEN SOURCE T27" (PR feat(t27f): T27 OS home -- the 27-petal triangle menu as one spec #10783, stacked feat(t27f): petal_menu.t27 is Icarus-lowerable and simulates 10/10 (M4 of #10782) #10786)
• M10. herdr-style PTY server with crash restore; a live Claude Code pane that survives kill -9 of the server (PR feat(t27os): PTY server that owns the agent terminals and restores them (Refs #10782) #10934; live resize pending, t27#10902)
• M11. Responsive window and terminal: real pane size at spawn and on resize (debounced, no ring replay), idle redraw skip, min window size, backing scale factor, row glyph cache, sidebar truncation. Audit 2026-10-19: P0 items are the 24x80 hard-code in pty_server.t27, the per-frame grid wipe on resize and the 30 fps idle redraw; t27b gaps: variadic calls (t27b: lower @extern calls to libSystem (blocks the T27 OS PTY server) #10902), callbacks, ObjC class creation
• M12. KEYS tab and one key manager in .t27: macOS Keychain storage, masked display, status and rotation, key injection into agent panes (strip CLAUDE_CODE_* at spawn); editors table with "open in editor"; a live check of all 9 agent CLIs. Reuses key_store.t27, queen-contributor-keys.t27, specs/provider/* and the trios SR-00 key model
• M12b. Provider router so a pane never hits "organization has disabled Claude subscription access" (owner screenshot 2026-10-19). Stage 1: per-pane profile (Anthropic API key, or z.ai ANTHROPIC_BASE_URL + glm-4.7-flash), subscription variables stripped, live pre-flight probe. Stage 2: a local Anthropic-compatible router in .t27 (Free Claude Code style) that walks the existing chain in specs/automation/agent-provider-chain.t27 using specs/provider/transform.t27, with failover on 429/529/402; blocked on t27b socket primitives if missing (file a t27c issue, no foreign code)
• M13. T27 OS on the FPGA, stage 1: UART VT100 shell on the AX7203 whose screen is produced by the pure-logic specs (vt, pane_state, spaces list, agent table) lowered to the WASM board cell or Verilog; feasibility note first
• M14. T27 OS on the FPGA, stage 2: VGA text-mode scan-out (timing, font ROM, black-and-white palette) in .t27, simulation-checked first; the owner has a VGA monitor ready; connector or adapter and pin map are not established yet (never guess pins)

Done when (acceptance)

• A tap on any of the 27 petals on the AX7203 opens that petal's card menu.
• Back returns to the triangle.
• trios renders the same spec with no hand-kept petal table left.

How to verify

• test-report on specs/t27f/petal_menu.t27 and specs/t27f/frontend.t27
• icarus-lowerable on petal_menu.t27, then silicon for M6

Risks / blockers

• The TRI CLAW GitHub App is v0.2 (TRI CLAW: all CI gates in one GitHub App (TRI-27 / Trinity S3AI), spec-first, sellable #9271).
• No HDMI or framebuffer spec exists yet.
• Board time is needed for M6 and M7.

Status update — 2026-10-19 (end of day, handed to the Queen)

Landed or green:

• PR feat(t27f): T27 OS home -- the 27-petal triangle menu as one spec #10783 (window, base branch feat/t27os-petal-menu): CI green on 4c451b9cf (Spec Guards, Seal Coverage). Carries the M11 glyph cache and sidebar truncation, window-state and model restore (304836bc3), and the refreshed t27f seal. The branch was rebased twice; old tips 0db6bdfee, 8f67a31f1, new tip 4c451b9cf (stacked branches use git rebase --onto).
• PR feat(t27os): PTY server that owns the agent terminals and restores them (Refs #10782) #10934 (PTY server, herdr-style crash restore): merged. PR feat(t27f): petal_menu.t27 is Icarus-lowerable and simulates 10/10 (M4 of #10782) #10786 (M4 icarus-lowerable): merged.
• The Mac app runs: /tmp/hx/gw/T27OS.app, launched with open; re-link after a lab build with ld (see the feat(t27f): T27 OS home -- the 27-petal triangle menu as one spec #10783 conversation).
  Open PRs:
• feat(t27os): key manager, KEYS tab, per-pane profile, router decisions (Refs #10782) #10977 (KEYS tab, key manager, editors, agent check, M12; label no-auto-merge). It replaces feat(t27os): KEYS tab, Keychain key manager, open-in-editor, agent check #10959 and feat(t27os): key manager, KEYS tab, per-pane profile, router decisions (Refs #10782) #10972, both closed. A second session also opened fix(t27os): CTL verbs match whole words; escaped keys and expect; agent check table #11015 for the same work; keep one of them.
• fpga: T27 OS over UART on the AX7203 (feasibility + shell spec) (Refs #10782) #10949 (draft, FPGA feasibility note for M13/M14): trinity-fpga lessons in section 6, SiI9134 init read as text from ALINX demo 11_1_hdmi_out. Not done: I2C FSM, board top, bitstream, silicon readback. The IDCODE difference is only the silicon-revision nibble of the same XC7A200T.
  Red on the base, not caused by the stacked PRs: t27b-native-ratchet (UNLISTED 25, STALE 4 for specs/t27os/* in docs/reports/t27b_expectations.json), duplicate-bodies (11 bodies: chan, clamp01, digits_val, flag_bit, scale, six ws_*), Verilog widths (glass_window.t27: 1535999, pty_server.t27: 9175039).
  Not started: M12b stage 2 (local provider router), HDMI capture tool, TMDS and pin table for the AX7203, real logos (needs owner confirmation of file name, source and size).
  Delegated to the Queen: the three red gates, M11 resize work, M13/M14 next step (see the Refs comments on this issue).
  Constraints: only .t27 (no hand-written code in other languages); builds, tests and synthesis run on the Railway lab, never on the Mac; key values are never printed, committed or read by agents.