A single Zion OS is a personal desktop. os-hub is what turns it into something you can hand to other people: choose a sandbox backend, click create, and a fresh isolated desktop appears at its own address a minute later. It exists so desktops can be many, disposable, and isolated from each other, while the hub itself stays small and boring.
It is a web console and API in front of four parts. A provisioning pipeline turns requests into background jobs that talk to one of four interchangeable sandbox backends (local Docker for development; Modal, Vercel Sandbox, and E2B in the cloud) through a single provider contract, so adding a backend touches nothing else. A gateway maps each desktop's hostname to wherever its sandbox currently lives. A monitor samples health and resource usage into a small fleet database. And Bastion, a read-only security posture view, grades each sandbox and says "not assessed" for anything the hub cannot actually see.