Features

Frames and undo

scram: Takes read-only btrfs snapshots of the system and home subvolumes, called frames, and restores, boots or compares them.
Automatic frames: Every package change, restore and flash leaves a frame behind. The autoframe service takes one every hour and keeps the newest 48.
Boot menu: Each frame is an entry in the Limine menu, next to the current system and a rescue shell. A frame boots as a writable copy.
Trial updates: An upgrade runs in a copy of the system and boots on trial. If geiger fails, or the next boot is not confirmed, the system flashes back to the frame taken before the update.
Disposable copies: scram try and scram scratch run a command in a copy of the system and delete the copy afterwards. scram bisect finds the first frame in which a command fails.
Backups: A frame can be written to a stream and received again, in full or as the difference to a parent frame.

rod: The package manager. It installs from the nixpkgs index into one profile and takes a frame before every change, so an install, removal or upgrade can be undone. Holds, package sets, pinning the index, a dry run and an export of the package list are built in. The full list of operations is on the rod page.
Recipes: A Nix expression in /rod/recipes is installed under its name before the index is searched.
Signature checks: Nix checks each downloaded package against the signing key of cache.nixos.org.

hazmat: Runs one command in a bubblewrap sandbox with a read-only system, an empty home and, if you ask for it, no network.
silo: Containers with their own profile, hostname, /etc and home. Frames include them.
Service sandboxes: A sandbox file in a service directory runs the daemon inside hazmat.
blastdoor: Edits the nftables rules. Incoming traffic is dropped except for a short list of exceptions.
doas: The only setuid program.
Hardening: Strict sysctl settings, hardened kernel arguments and restrictive mount options. The kernel is configured the same way.
Encrypted root: The initramfs unlocks a LUKS container with a passphrase or a key file. The manual install can create it; the installer cannot.
Signed releases: The checksum file of each release is signed with signify.
geiger: Checks services, network, disk use, firewall, frames, package index and kernel.

uranium-install: A menu-driven installer on the live medium. It also reads an answer file. It needs UEFI.
Manual install: Unpack the stage tarball into a filesystem you made and configure it by hand.
setup: Sets the hostname, user, passwords, time zone and keymap, and can enable sshd.
Install helpers: uranium-chroot enters a mounted system, genfstab writes an fstab, and uranium-man prints the notice for a manual install with the address of the website.

Services: A directory in /etc/sv with a run script, enabled by a link in /etc/service and controlled with sv.
Network and time: DHCP with udhcpc and busybox ntpd.
cron: A weekly fstrim and a monthly btrfs scrub.
zram swap: A zram device of half the memory.
Keymap: /etc/keymap sets the console keymap.
Kernel: Mainline source with every driver built in and no modules. A recipe of the same name in /rod/recipes replaces it.
Manual pages: Pages for the tools above and bash completion for rod. fastfetch prints a summary at login, with a tip.