An operating system built from scratch for AI-native development
The kernel that never restarts.
Terminus is an operating system designed from the ground up for AI agents. Instead of bolting AI onto an existing OS, Terminus makes AI the primary citizen. The kernel supports hot-swap updates without restart, processes drain naturally when a new kernel version deploys, and the entire system is written in a language designed for AI to read, write, and reason about.
Named after the planet in Isaac Asimov's Foundation — the place civilization gets rebuilt from scratch.
Deploy a new kernel version while the old one keeps running. Old processes drain naturally. Zero downtime, ever.
A programming language where every file is an object, every function fits in a context window, and AI agents can navigate the code without wasting tokens.
A Conductor makes strategy decisions. Section Leads translate plans into tasks. Agents execute — write code, build drivers, repair systems.
TFS, separate initrd resources, Manager controls, and device-broker operations are capability-gated by the scheduler's process identity. On x86, TFS paths and direct-child directory listings cross a per-process namespace-aware VFS whose views follow Manager process lifecycle. Initrd namespaces, implicit ancestors for deeper bindings, ring 3, and complete syscall isolation remain pending.
| Component | Status |
|---|---|
| Foundation Language Spec | complete |
| Bootstrap Compiler (C) | complete |
| Bootstrap Regression Suite | 13/13 tests |
| Self-Hosting Compiler | 3 generations proven |
| Kernel Source (51 unique Foundation build inputs) | x86_64 ring-0 timer preemption proven |
| ARM64 QEMU Kernel | PMM+heap+Manager+TFS proven |
| Persistent Storage (VirtIO) | five injected faults + three-boot persistence proven |
| TCP/IP + HTTP | remote shell + web server |
| Display Stack | bounded GUI compositor/input/lifecycle + allocation unwind proven |
| USB + NVMe | xHCI scan + Manager NVMe read/write/restore proven; HID pending |
| Manager | 64-slot lifecycle map + owned-image restart/release proven |
| In-Kernel JIT/FCC | independent concurrent images + exact release proven |
| Capability/Namespace Security | TFS paths + direct-child listing overlays proven; initrd namespaces/deeper ancestors/ring 3 pending |
The current x86 scheduler has 64 slots and gives each created process a 64 KiB kernel stack. Early boot retains cooperative handoff, while managed services run under timer-ISR preemption. These processes still share the ring-0 kernel address space.
HTTP and the TCP shell share one token-guarded IP/TCP/VirtIO stack. make test-network-static checks exact guarded call nesting plus fail-closed queue invariants; the Manager QEMU proof correlates fresh handshakes, exercises partial TCP reads and multi-segment HTTP after peer half-close, restarts both services, and requires stable PMM/live-heap counters. The plaintext fixed-IP stack remains a local-development interface, not production Internet TCP.
cd kernel && make test-shell-runtime boots a fresh headless, no-network ISO and emits 12 exact PASS lines; the final target passed three independent fresh boots (36/36 markers) plus one post-forced-build 12/12 run. The original eleven JIT, initrd, text/binary transfer, literal/overlap, managed-return, sysmon, and warmed-memory checks remain. The added lifetime proof keeps two gated FCC programs live on distinct PMM pages, restarts one at the same entry, runs an intervening compilation, and then releases each image separately. The warmed restart returns the old scheduler resources (PMM +16 pages, heap live allocations -1, live bytes lower); the image exits then add exactly one PMM page each. Its exact marker is PASS independent FCC images survived concurrent spawn, intervening compile, restart, and exact lifecycle release.
Each compile owns a page with 4080 bytes for upward-growing code and downward-growing literals plus a trusted 16-byte magic/exact-entry trailer. Synchronous callers release after return; asynchronous spawn transfers ownership to the Manager's scheduler-aligned 64-slot map, which passed its separate target 11/11 after alignment, transfers ownership on restart, and releases after final exit. These trusted handoff/release APIs are not callable from generated FCC code. The first concurrency boot historically found an imm8 sign-extension bug that moved RSP above its stack and corrupted the adjacent image; the corrected 48 81 EC 80 00 00 00 imm32 prologue passed after a forced rebuild. Generated pages remain RWX ring-0 memory without W^X; the trailer is not isolation; release assumes PMM physical base zero; signed disp8 local addressing currently makes 16 u64 locals safe despite a declared 32-variable table; and more than 64 break statements in one loop can overrun the fixed patch table. A future TCP shell with CAP_EXEC would need transient-image cleanup on external termination. Binary framing retains its documented 4096-byte, under-delivery, recovery, legacy-text, and valid-new-file limits. This is Unix-socket QEMU evidence, not physical UART/keyboard or physical-machine BIOS/UEFI proof.
cd kernel && make test-gui-mouse builds the real ISO and boots fresh no-NIC BIOS x86_64 QEMU with Unix serial, VNC, QMP-injected PS/2 input, and framebuffer dumps. Each no-retry boot launches the GUI twice. Ten exact PASS markers cover IRQ12 movement; exact exposed-desktop restoration under a moved cursor; 36 no-retry focus cycles plus overlap clicks with attributed, pixel-exact stacking; title-bar close repaint and compact-state reopen; selected=2 cursor=3 text=abXcd after Refresh; UART Tab focus moving to Quit; text-field cursor placement/insertion; list highlighting from row 0 to row 2; two Quit returns; and warmed-memory restoration. The final harness passed 10/10 in three independent real-QEMU boots with no retries (30/30 markers). Each launch also requires the exact [gui] compositor self-test PASS compact-z focus-hit-close-reopen marker: the compositor keeps a compact bounded eight-window z order and rebuilds the full scene bottom-to-top for scene-wide cursor, focus, close, and reopen changes. Its serial-only guioom matrix injects a tagged null at each of nine stable GUI/TUI/widget/application allocation sites, requires exact request/fire/PASS and expected component-error attribution, returns to the shell without entering the event loop, and verifies exact warmed PMM free pages plus heap live allocations/bytes after every site. Wrong or unconsumed tags, extra errors, and event-loop false positives are rejected. The added marker is exactly PASS all 9 tagged GUI allocation failures unwound to the warm memory baseline. These deterministic tagged failures cover the current single GUI call chain, not physical exhaustion or future concurrent GUI callers. The bounded proof covers 1280x800, short text, and four visible unscrolled rows—not UEFI, physical hardware, long-text clipping, or list scrolling. It has no dedicated black-box trigger that dirties only a fully hidden lower window while the clean upper window remains in place.
make test-security first runs a static guard against raw TFS path calls outside trusted layers; its QEMU harness then emits 11 PASS markers and verifies five targeted TFS fault injections. The TCP demo has TFS-directory LOOKUP|READ plus wildcard TFS-file READ, then adds hide and alias bindings; it demonstrates namespace behavior, not a least-privilege allowlist. Its request-attributed ls must return exactly exec.f (9 bytes) and one synthesized visible alias (8 bytes) before and after TCP-shell restart. Physical guard.txt and the shadowed 5-byte visible decoy stay absent, repeated-slash paths stay hidden, and repeated listings leave PMM/live-heap state unchanged. Directory overlays cover explicit direct children only, do not synthesize an absent ancestor for a deeper binding, and retain the 511-byte total VFS path limit. Initrd remains outside this namespace layer. make test-precedence scans all 52 top-level kernel Foundation files, including the unlinked 194-line scheduler_arm64_tmp.f scratch file; the shipped kernel inventory has 51 unique linked build inputs.
These documents are designed for direct consumption by language models:
Language spec: foundation.md