Nishi OS

Constitution and evidence ladder · established 2026-08-04 · SSOT knowledge/nishi_os_constitution.txt

Nishi OS is a clean-slate operating system. It does not use ELF, it does not reproduce the Unix process model, and it treats an AI model as something the machine can run before a userland exists rather than as an application installed on top of one. Everything below is either an axiom the code is held to, or a rung with measured evidence behind it.

The directive

"i want it at least to be minimal linux competitive and i dont want our system formats in elf … i want it to avoid all the historic clutter of unix and linux and all the previous to land on its own two feet sota [as of july 2026]"

"load an ai natively from the first bit up so that it can achieve higher speeds"

Why a clean slate is defensible in 2026

The shapes chosen here are shipping reality elsewhere, so this is extraction of what is already proven rather than novelty for its own sake: capability kernels are in production (seL4's verified kernel, Fuchsia's handle model), asynchronous submission/completion queues beat per-call syscall traffic (the io_uring lesson, adopted as a shape without the retrofitted API), component manifests beat fork inheriting everything, and every current system composites surfaces rather than emulating a 1970s serial terminal. What is inherited is the lesson; what is declined is the debt.

Axioms

A1 — Capabilities only. No root, no uid, no ambient authority. Every resource is reached through a typed unforgeable handle. This is the estate's own live capability-token doctrine turned inward. Delegation attenuates and never amplifies.

A2 — NXE, not ELF. The native executable container is NXE. PE32+ appears exactly once, at the UEFI boundary, because firmware dictates that format and every operating system pays that toll; nothing past the boundary is a foreign format. ELF exists only for host organs running on someone else's Linux. The kernel never loads ELF and there is no ambient dynamic linking.

A3 — A tiny asynchronous syscall surface. Submission and completion queues, map, unmap, spawn, and capability operations. No ioctl zoo.

A4 — No fork. spawn(manifest, explicit capability grant). Nothing is inherited implicitly.

A5 — No signals. Channels and completion notifications.

A6 — No TTY, no termios. The display is surfaces owned by a compositor; text is a surface protocol.

A7 — No global mounted tree, no magic paths. No /proc, /dev or /sys. A process sees exactly its capability table, and services are typed endpoints rather than files pretending to be something else.

A8 — Never brick. The OS writes zero firmware or NVRAM state, and metal stays operator-gated and removable-only until deliberately promoted. This is inherited estate law and is enforced mechanically, not promised.

A9 — Evidence first. Every rung ships with in-process teeth, a gate, and a second-method witness. The bar is measured against a minimal Linux, never asserted.

A10 — Donor logic is ported, not wrapped. The run-proven rv64 kernel work (traps, scheduling, preemption, virtio, heap, paging, usermode) moves into the native lane. No Unix is bolted underneath to make it easier.

A11 — AI is a boot-time citizen, not an application. The model is loadable and runnable before any userland exists: no libc, no dynamic linker, no allocator, no float ABI, no syscall boundary. Inference is a kernel service, not a process asking the kernel for favours.

A12 — No lock-in: the model and the shell are swappable parts. There is a default, never a mandate. The inference engine, the model weights, the compositor and the shell are each a component behind a typed interface, chosen by a manifest row and replaceable without rebuilding the kernel. A11 names a slot, not a vendor. The mechanical test: if swapping the shipped model or GUI for a third-party one requires editing kernel source, A12 is violated.

A13 — Distribution is a capability, and poison pays. Sharing an asset or capability someone else published must work over a hostile link and be discoverable in one step, without letting a well-resourced adversary substitute what you receive. That means content addressing (you ask for a hash, not a host), signed provenance with pinned publisher keys, erasure-coded resumable multi-source transport with no mandatory tracker, and reproducible builds so a poisoned artifact is provable rather than merely suspected.

A14 — Interface stability is what makes A12 and A13 real. Component interfaces are versioned and additive; removing or renaming a field is a new version, never an edit. A swap ecosystem with unstable interfaces is a promise, not a capability.

A15 — No third-party tool in the product path. Foreign engines — QEMU/OVMF, other people's model runtimes, another operating system's filesystem drivers — are permitted only as second-method oracles that independently witness a result we produced ourselves. The moment one is required to run, to demo or to verify, the capability is not ours. The test is mechanical: remove the foreign tool and ask whether the claim still stands. A demo that needs a third-party tool is a demo of the third-party tool.

A16 — The spore: the system adapts itself to whatever hardware it lands on. A spore carries no per-machine code. On unfamiliar iron it must probe what exists, bind a driver if it knows one, synthesise one from a spec if the shape is known, fetch one from the network if another instance has met that device, and refuse honestly if none of those hold. An unbound device is a true statement; a false bind is a lie that can damage hardware.

The machinery for this already exists here and is gate-proven, which is why the work is porting rather than inventing. A driver specification carries the register map and the protocol step-sequence itself as data — an op-list — and the emitter walks it to synthesise a driver whose control flow is the spec. That is what makes a new device class a new spec row rather than new code. The binder probes, looks the device up by ID, emits the driver bound to the address the probe actually found, then runs it and checks. An earlier per-class emitter was retired precisely because hardcoding one device's ordering diluted that generality.

"Copying from the forest" needs no second network: a driver spec is a content-addressed, signed, reproducible artifact, so meeting unknown hardware is a one-step verified fetch under A13, and a device we bring up that the network lacked is published back. The spore that learns, teaches.

Honest state. The probe and bind stages now run in the x86 lane after ExitBootServices: the kernel enumerates PCI itself, matches each device against a registry carried as data in its own payload, and paints one of three verdicts — verified, mismatched, or unbound. Driver synthesis is still open, and the keyboard is still a hardcoded PS/2 driver, so "runs on any hardware" remains a partial claim and is listed that way below.

What the second witness was for. The first version of a registry row pinned an entire configuration dword, including the revision byte. Our own emulator verified it — because the emulator models the same bus we wrote the row against, so both sides carried the same assumption and agreed. Booted on real firmware, a device the registry owns reported a different revision and correctly came back mismatched. The row now carries a mask saying which bits are identity (class, subclass, programming interface) and which are not (revision); both witnesses then agree. The fix was a data field rather than a new code path, which is the point of keeping the protocol in the spec. The general lesson is worth more than the rung: a second method that shares your assumptions is not a second method.

What "the cost lands on the originator" means

When substitution is attempted, the burden falls on whoever published it rather than on the network: the signature identifies who, revocation propagates in one step so the artifact stops being served and relayed everywhere at once, the publisher key's standing is burned so its future publishes are refused by default, and a portable, independently re-derivable evidence bundle (the artifact, its signature, the honest rebuild, the diff) makes the attack attributable and reportable instead of deniable.

Retaliatory intrusion or denial-of-service against a suspected originator is permanently out of scope, and that is an engineering judgement rather than squeamishness. Such a mechanism is the single most valuable thing for an adversary to capture: one false positive turns it into our attack on an innocent party, and anyone able to forge a complaint gains a weapon aimed through us. Attribution and revocation impose real, compounding cost on an attacker while remaining defensible under scrutiny — which is what makes them durable.

Why A11 is reachable here specifically

An integer-only transformer stack already exists and is gate-proven — 126 nx_nofloat_* sources measured on 2026-08-04, covering GEMM, attention, softmax, layernorm, RoPE, KV cache, BPE tokenisation, sampling and serving, plus a complete encode → forward → decode → fast-generate family. Integer-only arithmetic is not an eccentricity in this context; it is precisely what allows the same math to run in ring 0 at boot, where there is no FPU state to save, no libm, and no floating-point calling convention to honour.

The speed argument is about deleting layers, not cleverness: no syscall per operation, no scheduler preempting the inference loop, weights mapped once with zero copies, and tokens written directly to the framebuffer. That argument stays a hypothesis until rung AI5 produces a row comparing tokens per second against a minimal Linux and a standard runtime on the same silicon, the same weights and the same quantisation. A11 never overrides A8 or A1: an engine running in ring 0 receives exactly the capabilities it is handed and writes no firmware.

The NXE container, version 0

offset  size  field
0x00    4     magic "NXE0"
0x04    4     version
0x08    4     arch (1 = x86_64, 2 = rv64)
0x0C    4     flags (bit0 kernel, bit1 needs-framebuffer)
0x10    8     entry offset into the payload
0x18    8     payload file offset
0x20    8     payload size (8-byte padded)
0x28    8     bss size, zeroed by the loader
0x30    8     stack size
0x38    8     payload checksum -- the loader re-derives it or REFUSES

Loader contract: verify magic, arch and checksum; refuse loudly on any mismatch;
copy the payload, zero bss, build boot-info, jump. rbx = &bootinfo on entry.

Ladder and current state

Rung	What it proves	State
N1 Shim	PE32+ boot shim queries GOP, validates the NXE payload, jumps	GREEN (embedded NXE; ESP file-read still open)
N2 Native GUI	NXE-format code paints the desktop and owns the screen	GREEN
N3 Input	Keyboard reaches the kernel and changes what is on screen	GREEN
N4 Ownership	ExitBootServices — the kernel takes the machine from firmware	GREEN
N4b Own driver	After firmware is gone, the kernel drives the PS/2 controller itself and shows liveness	GREEN
N5 Kernel parity	rv64 kernel logic ported into the native lane — the two lanes meet	OPEN
N6 Userland	NXE components, compositor, spawn with explicit capabilities	OPEN
N7 Storage	A sovereign filesystem beyond the ESP handshake	OPEN
N8 The bar	Boot-to-GUI, input latency, spawn, context switch, memory vs minimal Linux	OPEN
AI1 Primitive	Integer multiply-accumulate runs inside the kernel at boot, known-answer verified	GREEN
AI2 Weights	Weights read from the ESP and integrity-checked; a bad blob is refused	OPEN
AI3 First token	Tokeniser and a full forward pass in-kernel, before any userland	OPEN
AI4 Generation	KV cache and sampling loop; text streaming to the screen	OPEN
AI5 The speed row	Tokens per second vs minimal Linux, same silicon and weights	OPEN

The AI ladder runs beside N1–N8 rather than after it. Shaping the system around inference from the beginning is the entire content of "from the first bit up"; retrofitting it later would be the thing this constitution exists to avoid.

Swap ladder (A12)

Rung	What it proves	State
SW1 Slots	Model, engine, compositor and shell become typed component interfaces; the shipped ones are default rows, not hardcoded calls	OPEN
SW2 Substitution	A second model and a second shell load from a manifest with zero kernel edits — and the build still boots with the default removed	OPEN
SW3 Third-party parity	A component we did not author passes the same admission gate as the shipped one	OPEN

The negative control carries the weight here: booting after the default is deleted is what proves nothing was quietly hardcoded, in a way that adding a second option never can.

Distribution ladder (A13)

Rung	What it proves	State
PK1 Package	Content-addressed NXP: manifest, payloads, publisher signature, provenance chain, reproducible recipe	OPEN
PK2 Verify or refuse	Hash, signature and pinned publisher checked before anything is unpacked; unsigned or mismatched is refused, never warned	OPEN
PK3 Poor-link transport	Erasure-coded, resumable, multi-source, no mandatory tracker — measured on a deliberately bad link	OPEN
PK4 One-step discovery	One identifier resolves artifact, signature, provenance and verification recipe, with no seizable central index	OPEN
PK5 Poison accountability	Reproducible rebuild detects substitution; revocation propagates in one step; publisher standing burned; portable evidence bundle	OPEN
PK6 Adversary gate	A fixture that attempts substitution, downgrade, revoked-artifact replay and index poisoning — each refused with a distinct code	OPEN

PK3 is measured on a bad link on purpose: a transport only ever tested on good internet is untested for the thing it exists to do. And until PK6's attack fixture exists, PK2 and PK5 are claims rather than properties.

Spore ladder (A16) — each rung measured on hardware that was never special-cased

Rung	What it proves	State
HW1 Probe	Enumerate PCI from our own kernel after ExitBootServices — no host OS, the spore reads the bus	DONE
HW2 Bind from spec	A probed device ID resolves to a registry row that carries a program — an op-list (read a config register, mask it, require a value, end) which the kernel interprets. One row runs four steps, another runs seven, and the interpreter is unchanged between them, so a new device class is a new row rather than new code. An unknown opcode is refused rather than skipped, an unterminated program is rejected at build time, and unknown device IDs stay unbound. Still open: the program verifies a device, it does not yet bring one up, and the keyboard remains a hardcoded PS/2 driver.	DONE (verify)
HW3 Fetch	Unknown device triggers a one-step signed capsule fetch, verified before it goes near the device	OPEN
HW4 Give back	A device we bring up that the network lacked is published back as a spec capsule	OPEN
HW5 The bar	Boot and bind on N distinct physical machines with zero per-machine code; publish the bound/unbound matrix	OPEN

Evidence behind the green rungs

All of the following is re-derivable rather than a screenshot of a good day.

Two independent engines agree byte-for-byte. The sovereign x86 emulator and TianoCore/OVMF render the same authored image identically — sampled pixels match the authored constants exactly (RGB(170,136,68) is 0xAA8844; the top bar is 0x2E3B4E).
Input is measured, not observed. Keystrokes produce exactly 40 pixel transitions each (2619 → 2739 at three keys → 2899 at seven), derived from 20 rows with two edges apiece. Under OVMF, four injected keystrokes give zero tally blocks before and exactly four after.
The loader refuses rather than trusting. A payload whose checksum does not re-derive gets NXE! on the console and a halt — never a blind jump.
Never-brick is a decode result. The kernel payload is walked instruction by instruction over a closed allow-set, proving it makes exactly three audited firmware calls — ReadKeyStroke, GetMemoryMap and ExitBootServices, none of which write firmware state — and no port I/O and no other service. A fourth call cannot appear without failing the check. An earlier byte-frequency version of this test was unsound and was replaced by an instruction decoder.
AI arithmetic survives the boot environment (AI1). The kernel performs 32 signed multiply-accumulates — the inner loop of every GEMM in the integer stack — with no libc, no allocator and no floating point, then paints the 32-bit accumulator as a pixel so the screen carries the result. Expected value -26 (0xFFFFFFE6) is derived by a separate summation path from the emitted machine code; the sovereign emulator's pixel probe reads exactly 0xFFFFFFE6, and OVMF renders the same swatch as RGB(255,255,230), which is that dword in BGRX. Two engines, two derivations, one answer. The vectors deliberately include negative values, so a sign-extension bug would change the sum.
The kernel owns the machine (N4). Pressing a key leaves the input loop and runs the real UEFI handoff: GetMemoryMap under its genuine two-call protocol, then ExitBootServices with the fresh map key — a stale key is the classic mistake and firmware rejects it. The kernel survives losing the firmware and paints an ownership swatch, which is why the swatch existing at all is the proof. The sovereign emulator reports firmware_exited=1 with the swatch at 0x00CC44AA; the same image under OVMF shows top-bar colour before the key and RGB(204,68,170) after it. The negative control lives in the same binary: without the key, no swatch and firmware_exited=0. After this point there is no ConIn — further input needs a real PS/2 or USB HID driver, which is an honest open rung rather than a footnote.
The machine stays ours, and stays interactive (N4b). Losing the firmware also loses its keyboard service, so a demo that stopped there would freeze on a picture. Instead the kernel drives the 8042 directly — polling status port 0x64, reading scancodes from 0x60 — and advances a heartbeat column every iteration, so motion on screen is the liveness proof. Under OVMF with QEMU's real keyboard controller: two keystrokes and no ownership swatch before, then the swatch and a running heartbeat after the handoff, then the tally count rising again as more keys are typed with no firmware present. That last increase is something only our own driver can produce. The never-brick rule stays exact: the decoder permits port reads of 0x60 and 0x64 and nothing else — every other port and every write is refused, and the emulator refuses an unmodeled port rather than inventing a value, because a harness that fabricates hardware teaches the kernel that fabricated hardware works.
The stick is real, and our own tools read it (A15). The image was written to a physical USB drive and verified by reading it back and hashing: 35,144,704 bytes, 133ce514…, matching exactly. Then the sovereign check: raw sectors read straight off the device were parsed by our own FAT32 reader — MBR, boot parameter block, FAT chain walk to /EFI/BOOT/BOOTX64.EFI, five tamper teeth — and the payload it extracted hashes identically to what the host operating system's own driver reports for the same file. Our own emulator then boots that extracted payload through to taking the machine. No foreign filesystem driver and no third-party utility appears anywhere in that chain.
Hardware probing, and a spec that is a program (HW1/HW2). After the firmware handoff the kernel enumerates PCI configuration space itself and, for each device it recognises, runs the program carried in that device's registry row: read a register, mask or shift it, require a value, end. One row is four steps and identifies its device by masking; another is ten and does it by shifting, then goes on to require that the device's first base address register describes memory rather than I/O ports — the first thing any real bring-up must establish before mapping anything. The two rows express the same kind of check with different instruction sequences on one unchanged interpreter, which is what "a new device class is a new row" has to mean to be worth saying. An unknown opcode is refused rather than skipped, and a program with no end marker is rejected at build time rather than discovered by walking off the row on real hardware.
Witnessed on real firmware, with the control run there too. Booted under TianoCore/OVMF against a real chipset and a real Intel network controller: the host bridge passes its four-step program, the controller passes its ten-step program against a real base address register, and the two devices in neither row report unbound, which is the correct answer rather than a failure. The controls carry the weight. Corrupting only the first step of the ten-step program flips that device to mismatched while the four-step device is untouched, which distinguishes running the whole program from running only its last check. Changing the base-address requirement to demand I/O ports makes the real controller report mismatched, and that particular control only means something on real silicon: on our own emulator that register reads zero, so the check would pass there for the wrong reason. And the same binary on a machine with no network card produces no fourth block at all, so the block appears because the device is present and passes because its program passed.
Artifact: nishi-os.img, 35,144,704 bytes, sha256 946bb0dbbdfb5d9331c56b2cfee8a4334ad1fef9398a386cb1d454e2382a75fc, writable to a USB stick and bootable on any x86-64 UEFI machine. The build is reproducible: reverting the deliberate non-vacuity bite rebuilt this image bit-identically. The physical stick described above carries the earlier 133ce514… build and predates the spore rungs.

Explicit non-goals for version 0

POSIX compatibility — declined deliberately, not deferred.
Multi-user timesharing semantics.
X11 or Wayland compatibility.
Loading ELF in any form.

Source of truth: knowledge/nishi_os_constitution.txt. This page is generated from it and published through the publishing house rather than written into the docroot by hand. Rungs flip state only when a gate, a second-method witness and a log row all agree.