Space

Space is a component-based operating system built on a five-layer architecture:

       .in          ← native language
       ↑
 Inauguration       ← compiler — the real OS contract
       ↑
      SCI           ← component image format (replaces ELF)
       ↑
    Space           ← operating system, component runtime
       ↑
 Nanokernel         ← hardware enforcement layer

The native model is component + capability + object + execution graph — not process + file + syscall + user. Linux, Darwin, and Windows personalities are kernel-linked .in translators in the same boot image (components/linux.in, darwin.in, windows.in, posix.in). They are not isolated processes.

Domains currently clone the 4 GiB identity map and run at CPL0. That is not isolation. See architecture.md.

Status

The nanokernel root, written in .in and compiled by Inauguration, enters x86_64 long mode under QEMU. Desktop works via shell desktop (kernel-linked components/display.in

• PS/2 components/mouse.in). Maintained checks: shell + full runtime display/input (preempt-stop), SCI loader (hello/uecho), execve SCI from FS, Linux demo / ELF personality, VFS, NVMe volume multi-file + deep soak, UDP/TCP data path, DHCP lease, DNS A for dotted names, personalities (Linux/Windows/Darwin). Components are dynamically linked: SCI v2 images carry export/import tables and the loader binds user components against the libspace shared library at load time. The nanokernel is itself a link provider (its boot image carries an export table; 670+ symbols registered at boot), loaded modules register their own exports for later modules, and a dynamic module importing an unknown symbol is denied while boot continues (scripts/check-dynamic-modules.sh).

Space 0.1.0 ships two images (scripts/build-images.sh): a full standard image (network, NVMe/USB, personalities, display) and a minimal image (core dynamic nanokernel + filesystem shell, ~3x smaller). Both carry preinstalled dynamic apps — calc (expression REPL), notes (persistent notes), hd (file hexdump), sysmon (live kernel monitor), bench (deterministic CPU benchmark) — that load on demand into per-app domains via the shell's runapp command (scripts/check-image-variants.sh).

Subsystem status is tracked in architecture.md. Linux/Windows/Darwin personality progress: docs/personalities-roadmap.md.

Benchmarks

Measured on macOS ARM64 (M3 TCG), Inauguration v0.9.3 via scripts/bench-boot.sh (5 iterations, median / min / max).

Metric	Median	Min	Max
Boot image size	542,332 B	—	—
Kernel compile (warm)	132 ms	103 ms	187 ms
Boot to interactive shell	676 ms	611 ms	769 ms
Boot to halt	1,095 ms	955 ms	1,326 ms

Measured via serial output polling on Apple M3 (macOS, QEMU TCG).

Performance notes

• Boot-to-shell is ~700 ms class on M3 TCG; dominated by firmware + serial path.
• The warm compile path is cached by source hash; repeated edits rebuild fast.
• scripts/boot.sh drops into an interactive shell. Type halt to exit.
• scripts/bench-boot.sh runs 5 iterations and reports median/min/max.
• Shell desktop starts the kernel-linked display + PS/2 mouse path.

Target architectures

Arch	Compiler status	Kernel status
x86_64	Native lowering, boot image, ELF object	Boots verified subsystems
ARM64	Native lowering, boot image, ELF object	Platform boot work remains
RISC-V	Planned	—

Build and run

Requirements: clang, nasm, qemu-system-x86_64, and Inauguration — installed from crates.io (cargo install inauguration --locked), a sibling checkout at ../inauguration, or via $INAUGURATION_DIR. There is no vendor submodule.

cargo install inauguration --locked

bash scripts/check-all.sh             # static gates + QEMU boot + audit hardening
bash scripts/check-qemu-boot.sh       # full boot verification
bash scripts/build-multicomponent.sh  # SCI component loading demo
bash scripts/check-sci-contract.sh    # metadata validation
bash scripts/check-architecture-boundaries.sh  # component authority gate
bash scripts/check-kernel-contracts.sh         # syscall/domain/net host contracts
bash scripts/check-image-formats.sh            # SCI packer + SparkFS/SCI headers
bash scripts/check-runtime-honesty.sh          # TCP/PCI/SparkFS/ELF honesty contracts
bash scripts/check-process-vfs.sh              # process table / VFS / DHCP / libc
bash scripts/check-personality-abi.sh          # Linux/Darwin/Windows syscall ABI
bash scripts/check-qemu-smoke.sh               # boot to serial shell + hardening
bash scripts/check-qemu-shell.sh               # help / ps / mem over serial
bash scripts/check-network.sh         # e1000 ARP/UDP test
bash scripts/check-terminal-editor.sh # serial editor save test
bash scripts/check-desktop-visual.sh  # desktop / display visual path
bash scripts/check-desktop-damage.sh  # moving-window compositor bench
bash scripts/check-spdp-composite.sh  # SPDP surface-pipeline proof
bash scripts/check-spdp-protocol.sh    # SPDP wire-format / parser contract
bash scripts/check-audit-fixes.sh     # kernel-audit hardening assertions
bash scripts/check-linux-elf.sh       # Linux ELF personality
bash scripts/check-volume-deep-soak.sh # NVMe volume deep soak
bash scripts/check-fs-dirs.sh         # mkdir/rmdir/mv/rm full coverage
bash scripts/check-personalities.sh   # Linux/Windows/Darwin personalities
bash scripts/check-darwin-macho.sh    # trusted in-place Mach-O fixture

Browser demo (Alpenglow-style v86 shell, built with moonshine): see docs/v86-website.md and website/.

Repository layout

kernel/
  kernel-root.in            nanokernel root component
  guest-service.in          SCI guest component example
  v86-kernel.in             browser/v86 kernel variant
components/
  display.in                kernel-linked display (shell `desktop`)
  display-standalone.in     standalone display SCI component
  libspace.in               shared-library SCI (dynamic-linking provider)
  mouse.in                  PS/2 mouse input
  shell.in                  interactive serial shell
  pci.in                    PCI bus enumeration
  volume-mem.in             memory-backed Volume SCI component
  linux.in / windows.in / darwin.in   OS personality surfaces
boot/
  multiboot.asm             x86_64 CPU bring-up (32-bit → long mode)
scripts/
  check-qemu-boot.sh        full boot verification
  check-desktop-visual.sh   desktop / display visual path
  check-linux-elf.sh        Linux ELF personality
  check-volume-deep-soak.sh NVMe volume deep soak
  check-fs-dirs.sh          mkdir/rmdir/mv/rm full coverage
  check-personalities.sh    Linux/Windows/Darwin personalities
  bench-boot.sh             boot timing (median/min/max)

Relationship to Inauguration

Per AGENTS.md, Space owns the OS contracts, examples, SCI profile, and boot plan. Inauguration owns the generic compiler capabilities:

• freestanding target support (x86_64-unknown-none)
• SCI-compatible component metadata emission
• native x86_64 lowering, instruction encoding, boot image assembly
• Core IR optimization
• multi-frontend support (.in, Rust, Go, V, Tree-sitter polyglot)

Inauguration does not depend on this repository. Space does not add Space-branded targets to Inauguration.

License

Mozilla Public License 2.0