An API here is a contract you can verify, not a black box you call and hope. Four surfaces: the kernel ABI, the Ring schemas services speak, the standard library, and the framework crates. Versioned per edition, content-addressed, with the capability footprint declared up front. Nothing that matters is hidden.
There is no ambient global to call into. Authority arrives as typed capabilities in a Bundle, and everything a Task offers the rest of the system, it offers as a typed message contract over a Ring. So the API surface stacks in four layers — from the narrowest, most stable kernel boundary up to the framework crates — and every one of them is a written contract, not an accident of implementation.
The syscall surface and the capability classes. The narrowest contract in the system, and the one that changes least.
The typed wire contracts services expose to clients and drivers. This is the real "API" of VectraOS.
The small no_std crate surfaces every Task is built on — text, time, crypto, IO, and the rest.
The higher-level Rust crate APIs: GUI, graphics, storage, documents, sync. Opinionated and curated.
The only part of the API that already exists in code. Forty-two syscalls on the wire, grouped by primitive; a fixed set of capability classes validated on every call.
| Surface | What it covers | Status |
|---|---|---|
| Syscall surface | 42 operations — Reticle, capability table, Ring (incl. cap-passing & burst), signal mask, threads + futex, timer, semaphore, surface, spawn | implemented |
| Capability classes | TaskCap, MemCap, RingCap, SignalCap, SemaphoreCap, DeviceCap, IrqCap, DmaCap, BundleCap, SurfaceCap… | implemented |
| Error encoding | The SyscallError enum and its wire representation | implemented |
| Formal ABI reference | A versioned, per-arch document of register conventions and struct layouts | drafting |
The live surface is documented today on the implementation page. See the syscall table →
Each service and each driver class exposes a versioned, typed message schema over a Ring. The schema is the API. These names are committed in the forward design; the field-level reference is what's pending.
BLOCK_DRIVER_V1, NET_DRIVER_V1, USB_HOST_V1, AUDIO_DRIVER_V1, WIFI_DRIVER_V1 — what a driver Task publishes to vfsd / netd / the audio mixer.
The filesystem and block-storage request schemas — open, read, write, stat, and the zero-copy MemCap hand-off.
Socket-equivalent request schemas, DNS resolution, and the plaintext-in / ciphertext-out TLS contract.
Frame submission and the SurfaceCap swap-chain, glyph rasterisation, and typed notifications.
Person / Machine key operations and cross-Machine Fleet coordination schemas.
Login / unlock, the command-shell contract, and the datatype-to-service dispatch registry.
Small on purpose — the foundation one programmer can hold in their head. Each module's API is specified in the forward design corpus; the published Rust rustdoc reference is pending.
No implicit allocator, no ambient async runtime, no global mutable state, no deserialization that can execute code, no path-as-string operations. What the API refuses is part of the spec.
Curated first-party Rust crates. The design intent is committed; the stable public API is the furthest out, and will be versioned per edition like everything else.
.vpkg built against one edition states which, and the toolchain checks it.Everything that matters is in the signature. Nothing that matters is hidden.