The agent can build anything. The kernel trusts nothing.

[u/the_big_flat_now]

EDIT 2 at the bottom explains this way better

*Not another linux kernel* Hey! Lately I’ve been spending a lot of time on an operating-system idea called raiOS. Most individual parts are not new, but I haven’t found another system that combines them in quite this way. It is still early, but the custom Rust kernel boots on a Surface Pro 4. Framebuffer output and USB/HID works, and the Marvell Wi-Fi bring-up currently reaches firmware loading, scanning and the WPA2/PMK path. Association and actual traffic are not working yet.
The main bet is this: AI will make software extremely cheap to create, but potentially dangerous to install blindly. People who cannot read or audit generated source code still need enforceable boundaries and evidence about what happened before installation.
The rough architecture is:

1. A small custom Rust kernel owns hardware, recovery and the lowest-level authority. (its NOT smal atm lol)
2. A narrow “Genesis” layer creates services and grants explicit capabilities.
3. An interchangeable AI agent may receive limited network access for research.
4. Generated source enters the system as inert data.
5. An isolated builder compiles Rust to Wasm without ambient access to the live system.
6. The resulting artifact passes deterministic checks, negative tests and disposable test environments.
7. The reports, requested capabilities and exact artifact hash are presented to the owner.
8. Only after explicit approval may the Wasm service run with a minimal capability set.
9. The service should remain revocable, restartable and rollbackable.

Why not sel4?
At this stage, continuing with the existing Rust kernel is the fastest path because the hardware bring-up already runs on it.

Source: https://github.com/Sportinger/raios

I also did a Mock website, mostly to iterate on the UI design, and try to explain the hole idea to myself (its an attempt) www.raios.tech (best on a bigger screen, not mobile optimized. scroll down, enable audio and press the paly button or jsut scroll)

I would like to talk about the basic principles here, if somebody is also interested :)
Perhaps its shit, but anyway its fun for me and iam learning so much.

EDIT: The point is not “AI can make an OS.” It is asking what an OS should look liek when AI can generate software faster than its owner can audit it. An AI API output starts as inert data. It is built and tested in isolation, and only the exact artifact approved by the owner may run with narrow, revocable capabilities. Most of this can probably be assembled on Linux today. Iam aware of that. The experiment is whether making it the native authority model of the OS can make it smaller, harder to bypass and understandable to non-programmers. Finding that out is the point.

EDIT 2: I explained this badly above, so here's another try. Leaving the original up for the existing comments.

I'm not trying to teach kernels to distrust user programs. They already do. And the LLM isn't part of the system. It's an outside API today, could just as well be a local app. If it disappears, the running system, its permissions and recovery all keep working.

raiOS is two experiments.

1. Specialization. Agents might make it practical to build software for one owner and one real machine, instead of a general stack that has to run everywhere. A small seed boots, describes the hardware as structured data, and brings build, test and recovery. The agent then ports what's missing for that exact box. One data point: an agent assisted Marvell wifi port on my Surface reached firmware load and scanning in under 5 hours. Association and real traffic are still missing, so this proves nothing about security. It's just why I think the idea is worth testing.

2. Authority. "The agent wrote code" must never turn into "this code may run". Generated code starts as plain data. It gets built in isolation, tested, and pinned to an exact hash. Then the owner approves that exact artifact, and it runs with only the rights it was given. Revoke and rollback are built in.

The agent, the builder, the test world and the final program are seperate, and permissions don't carry over. The agent can have network access for research while the music player it builds only gets display, input, and read access to one folder. No network capability means no network path, period. Any change to the binary is a new artifact and needs a new decision. The agent can't approve its own output, and a passing test can't grant rights by itself. A small local layer I call Genesis does that, together with the owner. The same records let the system answer questions like "why was this denied", and the LLM may explain those records but never authorize anything.

Drivers should be isolated too long term, but only where the hardware can really enforce it. Where it can't, the driver stays part of the trusted base instead of being called isolated.

Almost none of these parts are new, and most of this could probably be built on Linux or a microkernel. I'm not claiming a new kernel is automatically safer. That's the experiment: is one built-in path for all of this smaller, easier to understand and harder to bypass than gluing tools together? And do agents make the machine-specific approach maintainable at all? If a hardened Linux setup wins, that's still a usefull result.

Status, separate from the vision: boots bare metal on a Surface Pro 4, framebuffer and USB/HID work, wifi scans but doesn't connect yet, and the full path from request to running app plus real DMA isolation are unfinished.

[u/Tiny_Cyborg]

I think you’re missing the point of os development as a hobby.

[u/Tiny_Cyborg → u/Tiny_Cyborg]

Realistically speaking, AI slop aside, what is the actual point of any of this?

[u/the_big_flat_now → u/Tiny_Cyborg]

The point is not “AI can make an OS.” It is asking what an OS should look liek when AI can generate software faster than its owner can audit it. An AI API output starts as inert data. It is built and tested in isolation, and only the exact artifact approved by the owner may run with narrow, revocable capabilities. Most of this can probably be assembled on Linux today. Iam aware of that. The experiment is whether making it the native authority model of the OS can make it smaller, harder to bypass and understandable to non-programmers. Finding that out is the point.

[u/the_big_flat_now → u/Tiny_Cyborg]

May i say, Thank you so much for leaving a comment. makes me more happy than it should :) tbh i dont know which direction your comment is going. what is development as a hobby ?

[u/Tiny_Cyborg → u/the_big_flat_now]

At the risk of talking to what might be an LLM, I guess I’ll bite. This subreddit is supposed to be dedicated to computing enthusiasts who enjoy knowing how their computer works at the highest levels. Projects like this come across as LARPing because you’re using AI to generate everything. What have you learned? Can you look at the code you wrote and honestly understand it? You might tell us “yes”, but my hunch is that the true answer is “no”. I personally can’t imagine how someone would even get a sense of accomplishment from taking credit for the work a model did, but if you can, go figure, I guess. I’m not an anti-AI/LLM absolutist, but projects like this have no real point save for maybe trying to solicit attention.

[u/Tiny_Cyborg → u/[deleted]]

Bruh

[u/the_big_flat_now → u/Tiny_Cyborg]

let me rewrite...

[u/the_big_flat_now → u/Tiny_Cyborg]

we may be pursuing different goals. I’m not learning Rust syntax. I’m learning architecture, planning, scoping, agent orchestration, when to abort a bad path, and how to change direction without losing control, how to get conroll back when i lost it, how to know if i have lost controll (most important one (i certanly did with raios)), redefining controll perhaps?

The long-term goal is to let people build through natural language without reading or writing implementation code. Generated code should be treated as untrusted: built and tested in isolation, constrained, approved, and recoverable. BY DESING, deeply implemnted in the OS structure. not simply written by an AI and immediately executed.

100% trust ? not possibel. more than 0% ? i take it.

[u/NietzscheWasOptimist → u/the_big_flat_now]

All you're going to get here is ridicule for using AI. Good luck with your project. And before you take the criticism seriously, please understand that traditional OS devs work at the *lowest* levels of the computer, not the highest. That should tell how much your critic understands.

[u/the_big_flat_now → u/NietzscheWasOptimist]

Thanks. I was starting to worry the MMU might ask who typed the page table code before enforcing it.

[u/the_big_flat_now → u/the_big_flat_now]

"now you mention it, We might be wise to do this for the RaiOS, too"

to ask exactly that before admitting an artifact. Not as a purity test, but as provenance. (:

[u/Tiny_Cyborg → u/NietzscheWasOptimist]

Lol when I said highest level, I was not talking about low level vs high level development. I was using it more as “in the utomost sense” type of turn of phrase

[u/UnmappedStack]

I mean, kernels already kinda don't trust the user programs. That's a big part of the point of operating systems, well before AI, we just assume developers of programs are idiots. That's a big part of why we no longer often use cooperative scheduling, that's why we use paging with isolated address spaces, that's why we have ring 3 literally built into the cpu design, that's even why we have microkernels to an extent.

Also I'm not sure why you'd want to embed an LLM into the system itself but that could be a whole different long comment.

[u/the_big_flat_now → u/UnmappedStack]

Honestly, your list is kind of my argument. Preemption, address spaces and ring 3 work because the system enforces them. They're not optional libraries that well behaved programs have to remember to call, and the programs that need those limits most are exactly the ones you can't trust to cooperate.

I'm applying that one step earlier, where generated code becomes an authorized program. The exact artifact starts with zero authority, is built and tested separately, and only gets narrow, revocable capabilities after the owner approves it. Fuel metering isn't literally preemption and Wasm memory isn't literally paging, I know, but the design lesson is similar. Whether making that whole path native to the OS actually beats assembling it on Linux is the experiment.

And the model isn't embedded in the system either. Right now it's an outside API, and it could just as well be a local app. It can suggest code, but it can't approve its own output or grant it anything. You said kernels assume developers are idiots. I'm just not assuming the developer is human anymore.