'%20fill='%23EDEDED'%3e%3cg%20id='symbol'%3e%3crect%20x='0'%20y='0'%20width='10.5'%20height='42'%20rx='3.5'/%3e%3crect%20x='16'%20y='0'%20width='10'%20height='28'%20rx='3.5'/%3e%3crect%20x='31'%20y='14'%20width='10.5'%20height='28'%20rx='3.5'/%3e%3c/g%3e%3cg%20transform='translate(-19.88%20-0.33)%20scale(1.08)'%3e%3cg%20id='wordmark'%3e%3cpath%20d='M76%203H82V9H76Z%20M76%2011H82V36H76Z'/%3e%3cpath%20d='M86%2011H91.5V15.4C93.1%2012.3%2095.5%2010.8%2098.6%2010.8H100V16.5H97.9C93.7%2016.5%2092%2019%2092%2023.5V36H86Z'/%3e%3cpath%20fill-rule='evenodd'%20d='M110.8%2010.8C118.1%2010.8%20122.5%2015.8%20122.5%2023.5C122.5%2031.3%20118.1%2036.5%20110.8%2036.5C103.5%2036.5%2099.1%2031.3%2099.1%2023.5C99.1%2015.8%20103.5%2010.8%20110.8%2010.8Z%20M110.8%2015.5C107%2015.5%20105%2018.3%20105%2023.5C105%2028.8%20107%2031.8%20110.8%2031.8C114.6%2031.8%20116.6%2028.8%20116.6%2023.5C116.6%2018.3%20114.6%2015.5%20110.8%2015.5Z'/%3e%3c/g%3e%3cg%20fill='%23767676'%3e%3cpath%20id='period'%20d='M124%2030H130V36H124Z'/%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/svg%3e)
The four presentations
One installed app, four user-facing presentations. Same identity, grants, bindings and data in all of them.
- In-app (embedded) — the default full view inside Iro’s window.
- Separate window — an Iro-owned window. One full document moves embedded ↔ window without reload.
- Compact — Home widgets and quick-access panels, plus optional menu-bar/tray pins. A widget and panel can coexist with the full view; each has its own renderer but the app’s single session, proxy, identity and limits.
- Desktop app — its own macOS bundle with Dock/app-switcher identity (clone of the Electron runtime, ~1 MB per app). A UI host, never a kernel: it connects to the one shared kernel over a private socket with a per-app token. Quitting a host leaves Iro running.
Developers declare ui.layouts (full/compact) and ui.launchTargets (embedded/window/desktop). Users choose presentation and pins; preferences persist across restarts. Closing one document leaves siblings and the kernel alive.
Trust holds in every host: per-app session, iro-app:// handler, per-app egress proxy + WebRTC policy, CSP without unsafe-eval, bounded calls, hang watchdog. Revoking a permission breaks exactly that feature in every presentation.