TrustZone

Enclave

TPM

Boot

L1Microkernel + HW

Rust + ARM TrustZone root of trust.

Baseband

Modem

Antenna

Signal

L2Radio (RIL)

Isolated user-space radio interface.

SIM

eSIM

VoIP

Policy

L3MVNO Stack

Mobile network ops, CITADEL-gated.

MARSHAL

VIGIL

SIM-Gov

Roaming

L4CITADEL Layer

SIM & roaming governance engine.

WASM-A

WASM-B

WASM-C

Permit

L5App Runtime

WebAssembly MARSHAL-gated cells.

Dialer

Messages

Launcher

Settings

L6User Interface

Secure UI in sandboxed cells.

SIMG1

SIM activation via MARSHAL Gate 1

eSIMG1+G4

eSIM provisioning with audit trail

VoIPAll 5

Encrypted + hashed voice trunk

RoamingG1+G3

SoD-enforced roaming config

PolicyG2+G4

Data policy with regulatory ref

Phase 5 · Mobile Alpha 2027 Q2

Runix Mobile

ARM TrustZone · SIM Governance · MVNO-Native

A Rust + WebAssembly mobile OS where MVNO operations run natively on the microkernel stack. Every SIM activation, data policy change, and roaming agreement is a CITADEL governance event — auditable, immutable, NIS2-compliant.

Mobile Layers

MVNO Events

ARM

TrustZone

eSIM

Native

Runix Desktop

Mobile OS — 6 Layers + MVNO

From ARM TrustZone hardware to the secure dialer — every layer enforces isolation. MVNO operations run at L3 inside the microkernel stack.

User Interface

Secure dialer, messaging, app launcher — all sandboxed cells.

App Runtime

WebAssembly sandbox cells — each MARSHAL-gated. Apps compiled to WASM.

CITADEL Layer

MARSHAL + VIGIL — SIM governance, roaming control, policy enforcement.

MVNO Stack

Rust + WebAssembly. SIM provisioning, data policies, VoIP, eSIM lifecycle.

Radio Abstraction

RIL (Radio Interface Layer) — isolated user-space process. No kernel access.

Microkernel + HW

Rust microkernel + ARM TrustZone. Secure Enclave, TPM. Hardware-backed root of trust.

MVNO Integration

Mobile Virtual Network Operator: provides mobile services without owning spectrum. Every operation is a governance event — auditable under NIS2 Article 21.

SIM Provisioning

Full SIM lifecycle management with cryptographic Kerkese submission, MARSHAL evaluation, and immutable WORM audit trail.

MARSHALWORMTier 1

eSIM Management

Remote eSIM provisioning and profile switching. Every profile change governed by CITADEL with full audit trail.

eSIMRemoteAudit

Data Policies

Per-user and per-service data allowances. Policy changes require regulatory evidence reference through Gate 4.

Gate 4EvidenceNIS2

VoIP Integration

Voice over IP through MVNO network. Calls encrypted end-to-end with hash integrity verification.

EncryptedHashedVIGIL

Roaming Agreements

Roaming configuration enforces Separation of Duties. CDR hashes stored in WORM chain for regulatory proof.

SoDCDRWORM

Network Slicing

Isolated network slices per service tier. Each slice operates within a dedicated CITADEL-governed sandbox.

IsolationTier 1Sandbox

Governance Operations Flow

Every MVNO operation passes through CITADEL MARSHAL gates. All outcomes are written to the immutable WORM chain.

SIM Activation

Gate 1

Kerkese submitted → MARSHAL Gate 1 (SoD: activator ≠ approver)

→ EXECUTE → WORM entry → eSIM provisioned

Data Policy

Gate 2 + 4

Policy change → Gate 2 (scope: contract type) → Gate 4 (evidence: regulatory ref)

→ EXECUTE → WORM logged → policy applied

Roaming Config

Gate 1 + 3

Roaming enable → Gate 1 (authority) + Gate 3 (change ID required)

→ EXECUTE → WORM → CDR hash stored

VoIP Trunk

All 5 Gates

Trunk config → all 5 gates evaluated

→ EXECUTE + WORM → Real-time VIGIL health check on trunk status

Emergency Block

HARD_STOP

SoD violation detected → HARD_STOP immediately

→ WORM logged unconditionally → AUG-008 raised → ops alerted

Hardware Security Foundation

Security starts at silicon. ARM TrustZone provides the hardware root of trust.

ARM TrustZone

Hardware isolation between secure and non-secure worlds. Cryptographic keys never leave the Secure Enclave. CITADEL runtime operates in the secure world.

Secure WorldHW Isolation

Secure Enclave

Dedicated security processor for key storage, biometric validation, and attestation. Ed25519 signing keys hardware-bound.

Ed25519Biometric

TPM Integration

Trusted Platform Module for measured boot, platform integrity verification, and sealed storage. Boot chain hashed into WORM log.

Measured BootWORM

RIL Isolation

Radio Interface Layer runs as an isolated user-space process. Baseband has zero access to application memory or CITADEL governance data.

User-spaceNo Kernel

Mobile Roadmap

Alpha2027 Q2Next

Rust + ARM TrustZone bootRIL isolationWASM runtimeBasic SIM provisioningCITADEL runtime stub

Beta2027 Q4

MVNO stack coreeSIM lifecycleData policy engineMARSHAL integration

RC2028 Q2

Secure dialerVoIP trunkRoaming governanceVIGIL health monitoring

v1.02028 Q4

Full MVNO operationsNIS2 compliance suiteNetwork slicingEU regulatory alignment

EU Regulatory Compliance

MVNO operations touch critical infrastructure — NIS2 Article 21 applies fully.

NIS2 Directive

Every SIM activation and data policy change is a governance event. Article 21 measures enforced at OS level through CITADEL controls.

GDPR

User data isolation via grid sandboxes. CDR records hashed and stored in WORM chain. PII cannot leak between operator and application cells.

Cyber Resilience Act

Secure-by-default mobile configuration. Hardware-attested boot chain. OTA updates governed by MARSHAL gates.

ePrivacy Regulation

Communications metadata protected at OS level. VoIP encrypted end-to-end with hash integrity verification in WORM log.

EECC (EU Telecom Code)

Regulatory proof of policy enforcement for national telecom authorities. WORM chain provides immutable compliance evidence.

eIDAS 2.0

Digital identity wallets secured in ARM TrustZone Secure Enclave. CITADEL MARSHAL governs identity lifecycle operations.