Phase 5 · OS Alpha 2027

Runix

The Secure Operating System

A Rust microkernel + WebAssembly OS built for security from the ground up — not bolted on after the fact. CITADEL governance runs natively inside the OS. Drivers, filesystems, and apps run as isolated Rust processes or WebAssembly modules.

~50K
LOC in kernel
6
Security Layers
3
Sandbox Tiers
0
Drivers in Kernel

Why Build a Secure OS From Scratch?

The Problem

Modern operating systems have millions of lines running in privileged kernel space. A single driver vulnerability compromises the entire system. Security is patched on top, not built in.

Runix Approach

Rust microkernel: only IPC, memory management, and thread scheduling in kernel space (~50K LOC). Everything else — drivers, filesystems, network — runs as isolated Rust user-space processes or WebAssembly modules.

Desktop OS — 6 Security Layers

From bare metal to application — every layer enforces isolation and governance.

L1
Microkernel
Written in Rust. IPC, memory management, thread scheduling. ~50K LOC in privileged space.
L2
Capability Manager
Capability-based access control. Every resource access requires a signed, time-bounded capability token.
L3
OS Services
Rust user-space daemons + WebAssembly sandboxed plugins. Filesystems, network, audio — all isolated.
L4
Grid Sandbox
WebAssembly runtime for app isolation. Cryptographic cells with MARSHAL-issued channel permits.
L5
CITADEL Runtime
MARSHAL 5-gate evaluation, WORM audit chain, VIGIL health monitoring — governance as infrastructure.
L6
Application Layer
Apps compiled to WebAssembly run in sandboxed cells. Zero trust — all privileged ops go through MARSHAL.

Grid Sandboxes — Cryptographic Isolation

Applications live in cryptographically isolated cells. All inter-cell communication requires CITADEL MARSHAL-issued channel permits — signed, time-bounded, and audited in the WORM log.

T1

Critical

System daemons, crypto, key management. MARSHAL second-hand evaluation (<300ms).

Real-time
T2

Trusted

First-party applications. Cell-to-cell communication with signed channel permits.

Standard
T3

Untrusted

Third-party apps, web content. MARSHAL with evidence requirement (minute-hand).

Evidence-gated

CITADEL Native Integration

Governance is infrastructure, not application. CITADEL runs at the OS level.

MARSHAL at Boot

5-Gate

Every kernel module and driver validated through MARSHAL gates before loading. Unsigned code never executes.

WORM Boot Chain

SHA-256

Immutable hash chain from firmware to desktop shell. Any tampering detected and reported before user login.

VIGIL System Health

Real-time

Real-time monitoring of all security layers. Degraded state triggers automatic isolation of affected subsystems.

AUGUR Advisories

Proactive

Threat intelligence feeds integrated at OS level. Known CVEs auto-matched against installed capabilities.

OS Roadmap

Alpha2027 Q1Next
Rust microkernel bootCapability managerBasic IPCWASM runtimeCITADEL runtime stub
Beta2027 Q3
Grid sandbox isolationNetwork stack (user-space)Filesystem driverMARSHAL integration
RC2028 Q1
Desktop shellApplication frameworkWORM chain boot verificationHardware attestation
v1.02028 Q3
NIS2/GDPR compliance suiteSecure update channelFull MARSHAL governanceEU Cyber Resilience Act alignment

Runix Mobile

ARM TrustZone, SIM governance, MVNO-native operations. The same microkernel security — built for mobile.

ARM TrustZoneeSIMMVNO StackVoIPSIM Governance
Explore Mobile Edition →

EU Compliance by Design

NIS2 Directive

Article 21 security measures enforced at OS level through CITADEL controls.

GDPR

Data isolation via grid sandboxes. PII cannot leak between application cells.

Cyber Resilience Act

Secure-by-default configuration. Vulnerability management through AUGUR advisories.