The future we were promised took a wrong turn somewhere around 1992. We went back for it.
A capability microkernel OS for edge hardware: maker boards, desktop PCs, and the GPUs and NPUs attached to them. The clarity of Plan 9 and BeOS, written in Embedded Swift with strict memory safety.
The edge got powerful and stayed fragmented. A Raspberry Pi, an SC8280XP board and a desktop PC each carry silicon that would once have filled a machine room. Each comes with its own vendor toolchain for its NPU, and its own pile of kernel layers between your code and the hardware.
Frames, packets and tensors get copied across boundaries they never needed to cross. The people who pay for it are indie game developers, makers and systems hackers who just want the hardware to do what it says on the box.
A ring-buffer microkernel that sets up address spaces, capabilities and shared memory, then gets out of the way. A namespace userland where every resource is a node, exported to other machines over 9P2000.L. One compute artifact, lowered on the host, that runs on whichever CPU, GPU or NPU it lands on.
Small enough to hold in your head. Fast enough to keep a frame deadline.
The kernel creates address spaces, threads, capabilities and shared memory, then gets out of the way. Bulk data never passes through it. Drivers are ordinary user processes that receive their DMA memory as capabilities.
Every service is a node you can browse, script and reach over the network. When a path gets hot, the node hands you a lock-free shared-memory ring. One ring format for input, audio, frames, packets, blocks and tensors; one wire format for everything structured.
mount tcp!pi5!564 /n/pi5 and a board's GPIO is a directory on your PC. A Q8B's NPU
appears under /dev/accel beside your own GPU. Linux mounts it with stock
v9fs.
Models are lowered on the host to one artifact and run on the CPU, GPU or NPU of whichever node they land on. A camera ring feeds the accelerator, the accelerator feeds the renderer, and the CPU never touches the frames.
Taisce, the file system, carries typed attributes and answers live queries, as BeOS did. Window positions and folder layouts are attributes, not preference files.
Every workspace is either tiled or spatial, and you can flip it at any time. Both arrangements persist, so switching is a projection, not a loss.
A thread waits on one port for everything: doorbells, IRQs, timers, child exits, window events. Time is
an absolute deadline with a leeway. Threads declare what they are for (frame,
interactive, realtime), never a priority.
Boot time, IPC latency, syscall count and line count are numbers with checks running against them. A budget is never loosened in the change that would fail it.
No ambient authority. A process can name only what it was handed. Nothing leaves your machine, or your own swarm, unless you say so.
First-party Swift and C23, with C only where Swift can't reach. Heavy compilers stay on the developer's host and produce our formats. Vendor firmware blobs are the only exception, each listed with its provenance.
A UEFI loader boots the kernel through UEFI and ACPI alone, on amd64, arm64 and rv64. In QEMU, amd64
and arm64 pass the kernel's self-tests and the user-space suites on every vx ci, up to the
desktop. On the Orange Pi 6 Plus, the same desktop runs over HDMI, with Ethernet, NVMe and USB, and
reaches the network 5.4 s after power-on.
Every boot prints its budgets, and vx bench judges them against the
machine's own history.
$ .build/debug/vx test arm64 # every boot reports its budgets budget name=edf.deadline_misses value=0 unit=count limit=1 budget name=sched.fair_ratio_x10 value=19 unit=count target=19 # … 3/35 Test #3: boot-lean .......... Passed 12/35 Test #12: boot-cpu ........... Passed 18/35 Test #18: boot-rio ........... Passed 35/35 Test #35: boot-smoke-el2 ..... Passed 100% tests passed, 0 tests failed out of 35
If one person cannot understand the first-party base system, it is too big.
— Principle 2