axonos.org · AxonOS-org · dy-wcet · Radar · DY Research · Engineering notes

This is the founder surface of AxonOS: the live map of the field, and the demos. The canonical engineering source is the AxonOS-org organisation. Every quantitative claim is governed by one file — CLAIMS.md — which records each figure's evidence level, the artefact it is re-derived from, and the finding that would falsify it.

AxonOS is a hard real-time operating system for brain–computer interfaces: the layer between the silicon and the application, where neither Linux nor a stock RTOS can hold the jitter and latency a closed neural loop demands. Rust, #![no_std], ARM Cortex-M. Its contract is written the way it is enforced — in code.

#![no_std]
#![forbid(unsafe_code)] // in every kernel crate except axonos-spsc, where it is confined

//! AxonOS — a deterministic, hard real-time OS for brain–computer interfaces.
//! The layer between silicon and intent.

/// Deadlines are biological, not arbitrary.
pub enum Schedule {
    EarliestDeadlineFirst,
}

/// Consent is enforced at Layer 2 (Connection), below the coupling engine,
/// so no layer above it can override a withdrawal. `Withdrawn` is terminal.
pub enum Consent {
    Granted,
    Suspended,
    Withdrawn,
}

/// The real-time contract. Every figure below is a row in CLAIMS.md.
pub struct Kernel;

impl Kernel {
    pub const TARGET_CURRENT: &'static str = "thumbv7em-none-eabihf";    // Cortex-M4F · STM32F407 · boots here
    pub const TARGET_NEXT:    &'static str = "thumbv8m.main-none-eabihf"; // Cortex-M33 + TrustZone-M · planned
    pub const SCHEDULE:       Schedule     = Schedule::EarliestDeadlineFirst;
    pub const WCRT_BOUND_NS:  u32          = 1_000_000; // C-1   · L1 · proven upper bound, end to end
    pub const WCRT_SEEN_NS:   u32          =   972_000; // C-1·L2 · worst observed, 12 h soak · trace pending
    pub const JITTER_NS:      u32          =     2_100; // C-2   · L2 · σ · trace pending
    pub const HEAP_ON_PATH:   bool         = false;     // zero-copy DMA into a static slab arena
}

/// The kernel exposes exactly one typed, capability-gated event stream.
pub trait IntentStream {
    fn poll(&mut self) -> Option<Observation>;
    fn consent(&self) -> Consent;
}

_{Evidence levels — L1 formally proven · L2 measured on reference hardware · L3 independently reproduced · analytical derived by hand from a reference — are defined in VALIDATION.md and catalogued in CLAIMS.md. No measured figure is claimed until its raw trace lands in axonos-validation. L3 is claimed for nothing. The peer-readable derivation is the Zenodo preprint: analytical, falsifiable, no measurement claims.}

Timing analysis that refuses rather than rounds. Worst-case response time in integer arithmetic, and a named refusal wherever a bound cannot be justified — the AxonOS timing work as a standalone crate, at DY Research.

0 dependencies, no floating point · 8 Kani proofs, every one closing in CI · 100 tests, fifteen derived by hand · 6 named refusals

Try it live → · Source · The method

The kernel emits a single 32-byte intent record, and the wire format is the contract: the reference codec and the Rust SDK decode it identically, checked on every push, and the C header is checked against it by the compiler — in axonos-conformance, alongside bindings for Java, JavaScript and assembly.

use axonos_sdk::{Capability, IntentKind, IntentStream, Manifest};

let manifest = Manifest::builder()
    .app_id("org.axonos.cursor")?
    .capability(Capability::Navigation)   // kernel caps delivery at 50 Hz
    .max_rate_hz(50)
    .build()?;

let mut stream = IntentStream::connect(&manifest)?; // ABI handshake, then data flows
while let Some(obs) = stream.poll() {
    if let IntentKind::Direction(dir) = obs.kind() {
        cursor.step(dir, obs.confidence_raw());       // u16 Q0.16 — exact, never a float
    }
}

The fastest way to judge any of this is not to read it.

# the whole chain from a seed: electrode -> privacy vault -> the right to act
git clone https://github.com/AxonOS-org/axonos-stack && cd axonos-stack
cargo run --locked --bin session -- --seed 7 --frames 3000 | diff - reference/session-7.txt

Silence means it reproduced byte for byte on your machine. The session is not a happy path: an electrode lifts at 4.8 s and the transcript records the system withdrawing the right to actuate 96 ms later, while continuing to record — because the moments a device stops trusting itself are the ones a clinician needs afterwards. Its last line is an accounting identity, delivered + lost = produced, and if it ever fails, one of the three components is lying about what it saw.

Then check who wrote the automated commits on the live map, and whether GitHub signed them:

gh api repos/AxonOS-BCI/axonos-community-radar/commits \
  --jq '.[0:10][] | "\(.commit.verification.verified)  \(.author.login)"'

That one is here because it once read false. The scanner published through a personal token, and GitHub signs API-created commits only for app identities, so the public map's history was unsigned for six weeks. The fix was to stop the token writing at all: the scanner now hands its payload over as a release asset, which creates no commit, and the repository's own workflow commits it under the identity that is signed. The command stays because a claim that was wrong once is worth leaving checkable.

The founder half of one project: AxonOS-org holds the specification and the running core; this account holds the live map of the field and the playable demos.

_{Earlier iterations — axonos-boundary-run-v9, axonos-boundary-run-v52, neural-boundary-game-play — are kept as historical references.}

AxonOS is open, and it is funded by the work it makes possible.

Commission an engagement. DY Research carries out independent technical due diligence — Snapshot, Focused Audit, Due Diligence — at a fixed price from $5,000, and its revenue funds AxonOS. Engagements and scope →

Contribute voluntarily, in Dogecoin, to DMwHAhqVNWf7dyEznukxCufNS5rjuP5MTp — support page · verify on-chain.

_{Contributions are voluntary: not purchases, not investments, and no product entitlement. Commercial licensing is a separate written agreement, in fiat by default: connect@axonos.org. Terms: CRYPTO_PAYMENT_TERMS.md.}