AI-Native Linux.
A governed OS platform.
Revision 2 locked the constitutional core — 11 architectural layers of typed actions, policy decisions, AIOS-FS objects, verification, and append-only evidence — and it is now implemented: 19 Rust crates, 4,475 tests passing, all cargo gates green. Revision 3 turns that core into a governed, AI-native operating-system platform through five governed planes: explicit security posture, governed app capsules, kernel portability, driver capsules, and a native AI control plane. The constitutional rule, "AI proposes, never executes," still leads.
An iconys Engineering Intelligence Linux distribution project.
Human Goal -> Cognitive Core -> Semantic Runtime -> Policy Kernel -> Capability Runtime -> Linux / Cloud / Devices
One cognitive layer. Many render targets. One shared operational state.
Not a promise.
Working code.
Revision 2 is implemented. The eleven-layer L0–L10 model exists as 19 Rust crates with 4,475 tests passing and all four cargo gates green — the cognitive shell, policy kernel, and append-only evidence log are running code, not a specification.
recovery-safe boot -> mount /aios -> versioned AIOS-FS object -> semantic view -> verified typed action -> append-only evidence chain -> rendered result
The §22 golden path runs end-to-end with no stubs: recovery-safe boot, mount /aios, a versioned AIOS-FS object, a semantic view, one verified typed action, an append-only evidence chain, and a rendered result.
Every layer is REAL with E2+ evidence: cognitive core, policy kernel, capability runtime, AIOS-FS, vault broker, renderers (CLI / KDE / Web), network, hardware, and distribution.
The constitution is enforced in code, not prose — AI proposes-never-executes (INV-002 at six sites), recovery without cognition, secrets-as-capabilities, append-only evidence.
M20 discharged the last deferred surfaces: the L5 cognitive agent / plan / memory RPCs and the 22 Tier-3 verification primitives are now real and tested.
From constitution
to platform.
Rev.2 is the proven foundation. Rev.3 turns that constitutional core into a governed, AI-native operating-system platform — adding five planes that each stay inside the same discipline: typed, policy-checked, evidenced, rollbackable. This is contract-grade specification; the planes are pinned at CONTRACT grade with clean Capella traceability.
Zero forbidden layer inversions, zero consumes cycles, append-only evidence. Ten new invariants (INV-025..034) extend the constitution to cover the platform layer.
Explicit Security Posture
Four profiles — DEV_RELAXED, SECURE_DEFAULT, STIG_ALIGNED, AIRGAP_HIGH — plus a FIPS_STRICT overlay. Measured boot (TPM + firmware dual chain, IMA/EVM, dm-verity), a SELinux MAC plane, a STIG/NIST/CIS control map with scanner, SBOM/provenance/VEX, and GDPR right-to-erasure by crypto-shred.
Governed App Capsules
Every app is a bounded capsule with rollback and evidence. Windows apps and games run through per-app Wine/Proton capsules. Package-agnostic intake (Package Rosetta) does shadow install with a package passport across deb, rpm, flatpak, snap, appimage, nix, oci, and source.
Kernel Personality & Portability
Linux is the gold path. BSD, RTOS, microVM, WASI, and unikernel personalities are admitted only through a signed KernelCapabilityMatrix — never by pretending all kernels are equal. A need-driven adaptive kernel forge builds with canary boot.
Driver & Firmware Capsules
Drivers are high-risk capsules: solved, lab-tested, signed, canary-booted, and rollbackable. Never "run the vendor script as root." Firmware moves through the same disciplined capsule plane.
Native AI Control Plane
Three terminal modes — LX, MIX, AI — over a typed-action fabric, with EU AI Act technical controls and AI evaluation & model governance. "AI proposes, never executes": never root, never self-approves, never mutates evidence.
A distribution,
not an assistant.
AIOS is a real Linux distribution. Linux stays the execution substrate — kernel, drivers, scheduler, syscalls — and AIOS adds a typed distribution layer on top: capability translation, latency routing, AIOS-FS object truth, policy decisions, verification, evidence, and sandbox composition. Rev.2 is the foundation that pins the layer; Rev.3 is the platform layer built on it.
Capability Translator
Maps intent to known typed capabilities through catalog-bound translation, not shell generation.
Latency Tiering
Routes simple commands through deterministic paths and escalates only when cognition is needed.
AIOS-FS Contracts
Defines immutable objects, versions, chunks, pointer promotion, semantic views, and conflicts.
Policy Kernel
Default-deny decision engine with hard denies, request-bound approvals, and simulation.
Goals become verified
typed actions.
AI never directly executes shell commands. It proposes semantic operations. The Policy Kernel checks them. The Capability Runtime performs them through typed adapters. Verification proves the result.
AI proposes,
never executes.
INV-002 is the headline rule. Six independent enforcement sites turn it from aspirational language into a measurable runtime property. Every bypass attempt produces permanent forensic evidence — bounded AI agency becomes auditable, not just promised.
Tier 5 audit cycle 2: zero findings on the six-site enforcement map. The constitutional core is mechanically intact.
The proven foundation. Eleven layers pinned at contract grade — the constitutional core that Rev.3's five governed planes build on.
Constitutional Core
24 invariants, evidence grades E0–E5, status taxonomy, signed bundle loaded at boot.
Boot & Recovery
First-boot stages, recovery boundary, dedicated kernel pipeline, fail-closed installer.
AIOS-FS
Object model, query/view language, namespace layout, conflict resolution.
Service Graph Runtime
Unit manifests, A/B promotion FSM, capability runtime gRPC, adapter model.
Policy + Identity + Vault
Default-deny kernel, identity model, vault broker (use-without-reveal), approvals, override.
Cognitive Core
Intent / planning / proposing FSM, capability translator, latency tiering, model router.
Apps + Compatibility
Cross-ecosystem runtime, package object model, compatibility knowledge, sandbox composition.
Renderers
Surface composition, shared UI schema, visual language, KDE Plasma + Web + CLI.
Network + Hardware
Hardware graph, network policy, DNS/VPN, firmware trust, GPU resource model.
Observability
Evidence log (FOREVER hash chain), verification grammar, failure handling, telemetry.
Distribution
Repository model, marketplace, external bridges (Flathub/OCI/distro repos).
Cross-Cutting
Action envelope, MVP golden path, constitutional meta-principles, ProxGuard reference.
Independent convergence
on the same disciplines.
ProxGuard is a deterministic, auditable application control plane built independently from AIOS. Its constitution reaches the same architectural rules from the opposite direction — sim/prod separation, append-only evidence, typed-not-shell, AI-as-proposer.
Two systems converging on the same constitution without coordination is positive validation of the architecture. ProxGuard becomes the first sandboxed AIOS system app at /aios/apps/proxguard, exposing typed capabilities while AIOS holds authority in policy, vault, sandbox, verification, and evidence.
Architectural alignment matrix
Generic boot.
Dedicated host.
The base system starts with a stable generic Linux kernel. After installation, AI-OS builds a machine-specific hardened kernel in a sandbox, validates it, and switches only after evidence passes.
Install a minimal Linux base with a generic kernel.
Map the exact hardware, firmware, buses, devices, drivers, and threat surface.
Fetch trusted kernel sources and prepare a host-specific configuration.
Build a hardened kernel in a sandbox with reproducible evidence.
Boot the new kernel atomically and keep a recovery path through the base system.
Recovery stays boring.
The new system lives in /aios.
AIOS-FS is a semantic filesystem direction: read-only base, isolated app cells, persistent evidence, typed metadata, and human-readable recovery outside the cognitive layer.
Recovery island. Small, protected, boring, always bootable.
Semantic filesystem root for apps, memory, state, evidence, and user work.
Every application gets an isolated read/write work area and declared capabilities.
System image is immutable by default. Changes are layered, audited, and reversible.
KDE Desktop
Native Plasma shell, KRunner workflows, widgets, panels, tray, Wayland.
Web Interface
Remote and tablet access to the same state, same workflows, same cognitive core.
CLI + Voice
Low-friction text and voice surfaces over the same semantic runtime.
Not commands.
A governed platform.
Revision 2 is the proven constitutional core: action envelopes, capability translation, latency tiers, AIOS-FS, policy, verification, evidence, and sandbox composition. Revision 3 builds on it with five governed planes — security posture, app capsules, kernel portability, driver capsules, and a native AI control plane.