AetherOS is a ground-up capability-first personal operating system research project. Privacy is ontological (no ambient network authority), foreign binaries enter via AetherIR, and the human is root of trust across a personal device swarm.

Is AetherOS open source?

No. AetherOS is private proprietary R&D. This site tracks vision, architecture, and live capability status — it is not a public source download.

Is AetherOS a Linux distro?

No. It is a freestanding Rust no_std capability microkernel (Liminal) plus host fabric crates, not a Linux distribution or fork.

QEMU/UEFI boot with ring-3 VSpace isolation, preemptive scheduling and IRQ steal, modern virtio rng/console/block (including multi-sector flush), host AetherIR JIT and CLIF path, VeilNet grants with multi-hop swarm crypto, and timeline fork/discard/merge.

VeilNet is a deny-by-default network fabric: external packets are only born under a live EgressGrant. Cover traffic is bound to grant lifetime so idle domains stay quiet.

What is the Liminal Continuum?

Liminal Continuum is the codename for the full AetherOS stack: microkernel through personal swarm and temporal continuity (layers 0–6).

Liminal Continuum · project hub

The operating system for the sovereign machine.

AetherOS is a capability-first personal computer built from first principles: privacy by construction, universal execution through AetherIR, a formally minded Liminal microkernel, and generative continuity co-piloted by a local twin — never telemetry-first, never ambient authority.

Phase Bootstrap+

Demo gates D1–D5 green

Updated 2026-07-27 · major

License Proprietary

This page is the living map of inception, architecture, and what is proven under QEMU — not an install CD and not a public source dump.

Where we are

Honest status as of the last kernel + host wave. Green means observed under test or QEMU serial, not marketing.

Kernel isolation

UEFI boot, caps, ring-3, private VSpace CR3, timer, preemptive RR, IRQ steal.

Runtime fabric

Hand JIT + CLIF interpret + CLIF→native x86 emit (triple parity on demos).

VeilNet grants

Deny-by-default packet birth, cover bound to live grants, idle = quiet.

Swarm crypto

Triangle AEAD + multi-hop + WAN TCP multi-hop lab with cover on the wire.

Timeline

Fork / discard / merge continuity for experimental grant worlds.

What it can do now

Shipped slices you can exercise on the lab host today.

Liminal microkernel (QEMU/UEFI)

Freestanding Rust no_std boot via bootloader 0.11 + OVMF
Capability table + SerialWrite isolation demo (A ok, B denied)
Per-task VSpace, ring-3 enter, int 0x80 syscalls
Yield-RR across dual VSpaces + timer IRQ frame steal
Virtio modern: rng, multiport console CTRL+TX, blk R/W + MULTI+FLUSH
Legacy virtio fallbacks when modern path unavailable

Host fabric crates

AetherIR → hand JIT + CLIF interpret + CLIF native emit
VeilNet grants + multi-hop path grants + cover scheduler
WAN TCP multi-hop AEAD lab (mesh_wan) with cover frames
Timeline engine + twin shell surface
Verification ladder + Verus-shaped invariant document
Stub compositor / minifb GUI shell

QEMU serial markers (subset)

Liminal freestanding boot OK
ring3+VSpace isolation OK
virtio-rng modern entropy OK
virtio-console multiport CTRL+TX OK
virtio-blk modern WRITE+READ OK
virtio-blk modern MULTI+FLUSH OK
ring3 IRQ steal OK
boot OK

Full architectural plan

Seven layers. Layer 0 is the root of authority; upper layers never invent ambient rights.

Liminal Microkernel

Pure capability authority (seL4 lineage), frames/VSpaces, endpoints, SchedContext. No ambient network or file rights.

Live under QEMU

Aether Agent Swarm

Sandboxed local AI operators: binary archaeologist, API cartographer, security guardian, cognitive companion, UI weaver, driver synthesizer.

Design + early host stubs

Universal Runtime Fabric

Load ELF/PE/Mach-O, lift to AetherIR, NBTE AOT/JIT cache, OS personalities — foreign binaries enter a capability host, not Wine-as-architecture.

IR + JIT live on host

VeilNet Privacy Fabric

EgressGrant objects only. Personal mix ring, cover morph, grant-bound cells. Construction property: no external packet without a live grant.

Phase0 + multi-hop swarm

Generative Spatial Compositor

Living UI weaver and spatial compositor; multi-modal input (touch, voice, gesture; BCI deferred).

Stub compositor

Hardware Synthesis

On-demand driver synthesis under formal constraints; device fingerprint; verified Linux driver shim path (later).

Deferred

Personal Swarm & Temporal Continuity

Owned-device mesh, encrypted digital twin, timeline fork engine for experiment and rollback. Hardware is disposable; the man is root of trust.

Mesh + timeline host paths

What it aspires to be

Manifesto constraints — the north star that keeps every cliff honest.

Privacy is ontological — no ambient network path exists to forget to close.
Universal execution — foreign binaries compile into a capability host via AetherIR.
Formal foundations — security climbs a verification ladder; it is not asserted in marketing.
Generative continuity — the UI is alive and local; the twin never phones home by default.
Hardware is disposable — devices are projection surfaces for a personal swarm.
Temporal sovereignty — fork timelines to experiment; discard or merge with grant hygiene.
Cognitive sovereignty — the encrypted twin leaves the swarm only under an explicit grant.

What is coming

True remaining cliffs after the modern MULTI+FLUSH / CLIF / multi-hop / Verus-hooks wave.

cranelift-jit feature

CLIF lower + native emitter API is stable; optional Cargo feature can drop in the real Cranelift JIT crate.

Multi-host WAN daemon

Localhost multi-hop lab is green; next is multi-process / multi-host cover scheduler as a standing daemon.

Verus toolchain port

Invariants documented in verus-cap-invariants.md; next is real proof fn discharge.

Virtio-net + port1 data

Multiport control path proven; extend to virtio-net and non-console serial port data queues.

…

Explicitly deferred

Full Cocoa/Win32 as core UI · seL4-complete Isabelle · neuromorphic / BCI · bare metal without an explicit ask.

Verification ladder

AetherOS does not claim seL4-complete proofs. The ladder is tracked in public language here so expectations stay calibrated.

Tier	Tool	Status
0	`rustc` + `cargo test`	Active
1	Cap property tests	Active
2	Kani model checking	Scaffold
3	Verus-style hooks	Scaffold
4	Verus / Lean full proofs	Planned
5	seL4 substrate option	Design-compatible only

Inception

Why this project exists as its own category.

AetherOS is not a music generator, journal app, wellness tracker, or Linux rice. It is a local-first, privacy-sovereign multi-layer personal computing system — a microkernel plus fabric plus swarm — aimed at people who want authority to be explicit, execution to be hostable, and intelligence to stay on-device.

Design lineage is honest about its teachers: seL4-style capabilities, Zircon-like bulk memory rights, Genode-like recursive worlds, Barrelfish-like explicit messaging later — always remixed into Liminal’s own object model rather than a fork.

Private monorepo (offline git + survival mirrors). This site is the shareable surface for architecture and progress — the source remains proprietary R&D.

FAQ

What is AetherOS?

A ground-up capability-first personal OS research project: Liminal microkernel, VeilNet, AetherIR fabric, personal swarm and timeline continuity.

Is it open source?

No. Proprietary private R&D. This hub tracks vision and status; it is not a public source tree.

Is it a Linux distro?

No. Freestanding Rust no_std kernel plus host crates — not a distro or kernel fork.

What is VeilNet?

Deny-by-default network fabric. Packets require a live EgressGrant; cover is grant-bound so idle stays silent.

What is Liminal Continuum?

Codename for the full stack — layers 0 through 6 — of which AetherOS is the product name.

Can I run it?

Lab builds target QEMU/UEFI on a development host with Rust + QEMU. There is no public consumer installer yet.