Cobalt puts a signed app store, a Rust SDK and a capability-gated runtime on the Kobo Clara BW

Sources: Cobalt project site, HN discussion
Summary: Every app is a static ARM binary running in its own unprivileged process, and network, storage, audio, front light and Wi-Fi are capability-gated, so a refusal comes back as a value the app handles. The runtime verifies the catalog, the package, the installed manifest and the binary before an app runs. Only the Clara BW N365 profile has been hardware tested.
Why it matters: An app on the device holds network, storage, audio, front light or Wi-Fi only where the capability was granted, and the runtime checks the catalog, package, manifest and binary before it starts.