The Operating System for the Intelligence Age

New foundations for machines that reason, decide, and act.

ANVAYA is a clean-slate operating system built in the open on RISC-V. It is evidence-first: every release ships with a repeatable QEMU boot log, and nothing is claimed that a boot log cannot show.

FOR DEVELOPERS: a Rust nucleus on RISC-V where nothing has ambient authority — every syscall needs an explicit, revocable capability, every package ships a post-quantum signature checked against NIST's official test vectors, and every release must reproduce its own boot log under QEMU.

CURRENT RELEASE: V1.7.0 "CAPABILITY SOCKETS" — the network is now a capability-scoped userspace service. A socket is a capability carrying kind, resource identity, rights, and generation, and the TCP/UDP/IP/ARP/ICMP/DNS stack runs in a hybrid-signed U-mode task with its own pid, CSpace, and SATP and no device authority. It persists its DNS cache and socket table across dispatches, proves five denials, and survives its own death with a fresh-generation replacement. Frames it composes transit a real device: a task-built ARP request relayed to the signed v1.5 virtio-net driver draws a real ARP reply with polling=0. Mesh object sync crosses those sockets. Product core falls to 20,740 lines and the counted privileged TCB (core + transport extension) to 22,362, with zero network-service names left in the core; the separately Kani-verified nucleus-modelstate machines (3,037 lines) are privileged code measured apart. This is not a delivered network stack: socket payloads do not leave the machine, reaching their reader through the service's own receive queue (transport=service-loopback), so manifesto M8 advances DEBT → PARTIAL, not DELIVERED — and TCP/UDP over the wire, DNS over the wire, congestion control, IPv6, TLS, physical hardware, and external audit all remain open.

Read the Manifesto Implementation Status Live Boot Demo Main Repository

v1.7.0 · Capability SocketsNIST ACVP PQC KAT-verifiedFormally Verified (bounded)TCB 0.48% unsafe

qemu-system-riscv64 · check-qemu-boot.sh

$ ANVAYA SCHEDULER PROCESS RUNTIME HELPER OK pid=0xa313 dispatches=37 returns=37

$ ANVAYA SYSCALL IRQ BIND OK task=0x11 irq=0x21 denials=3

$ ANVAYA SYSCALL IRQ ACK OK task=0x11 irq=0x21 seq1=1 seq2=2 denials=3

$ ANVAYA SYSCALL TRAP RETURN OK task=0x11 cause=0 resolution=0 denials=5

$ ANVAYA PROCESS DISPATCH REGISTRY OK satp=0x8a11... hits=2 denials=3

$ ANVAYA PROCESS DISPATCH SRET CONTINUE OK ecalls=3 continues=2 hits=3

$ ANVAYA VIRTIO BLK PERSISTENCE OK sector=1 pattern_mismatches=0

$ ANVAYA SERVICE LOADER IPC CONTINUITY PERSISTENCE COMPARE OK boots=2 failures=0

$ ANVAYA LIVE STORAGE CRATE OK content_id_prefix=... roundtrip=1

$ ANVAYA LIVE NETWORK SERVICE OK name=live.anvaya.dev address=203.0.113.10

$ ANVAYA LIVE SIGNED SERVICE OK entry=0x40001000 signature_denial=1

$ ANVAYA LIVE PERSISTED PACKAGE OK sector=100 signature_denial=1

$ ANVAYA MULTI FRAME STACK OK pages=2

$ ANVAYA LIVE WASI SERVICE OK app=read-config host_grants=1

$ ANVAYA LIVE SDK LAUNCH OK apps=10 profile_derived=1

$ ANVAYA LIVE CATALOG COMPLETE OK apps=12 non_guest=10 guest=2

$ ANVAYA LIVE NET RX SERVICE OK sender=10.0.2.2 resolved=1

$ ANVAYA LIVE TCP DATA OK sent=15 acked=15 received=15

$ ANVAYA NETWORK SERVICE TASK OK mode=u pid=0xd2c0 served=6 denials=5 wire_tx=1 polling=0 kernel_fallbacks=0

$ ANVAYA LIVE STORAGE CRATE NAMESPACE OK listed=1 object_len=16

$ ANVAYA CONTENT STORAGE SERVICE OK mode=u pid=0xd1c0 hash_policy=sha3-256 crdt=lww-tombstone-total kernel_fallbacks=0

$ ANVAYA CONTENT STORAGE DENIALS OK denials=9 recovery_tamper_denied=1 kernel_fallbacks=0

$ ANVAYA CONTENT STORAGE PERSISTENCE OK header_lba=128 persistence=verified sha3_verified=1 post_recovery_success=1

$ ANVAYA LIVE AUDIT CONTINUITY OK total=6 failures=0

$ ANVAYA LIVE IPC DENIAL OK total=7 failures=1

$ ANVAYA LIVE MEM SYSCALL OK bytes=4096

$ ANVAYA PRODUCTION ALLOCATOR OK reused=2 denials=3

$ ANVAYA FRAME REFCOUNT OK shared=3 reclaimed=1 reused=1

$ ANVAYA LIVE TIMER RETRANSMIT OK timer_sourced=1 attempts=1

$ ANVAYA WASM RICHER OPS OK arith=42 compare=2 div=42 ops=19

$ ANVAYA WASM I64 OK wide_add=1 wide_div=1 ops=23

$ ANVAYA WASM F32 OK add_eq=1 ieee754=1

$ ANVAYA WASM F64 OK add_eq=1 ieee754=1

$ ANVAYA WASM CONVERT OK chain=42 uext=9 ops=8

$ ANVAYA WASM MEM WIDE OK i64=42 float=2 ops=6

$ ANVAYA WASM MEM NARROW OK a=4914 b=-1 ops=6

$ ANVAYA WASM EXTERNAL TOOLCHAIN OK compute=63 source=rustc-wasm32

$ ANVAYA WASM EXTERNAL CALL OK compute=63 funcs=2

$ ANVAYA WASM EXTERNAL LARGE OK compute=154 bytes=261 funcs=3

$ ANVAYA WASM EXTERNAL WASI OK wrote=11 fd=1

$ ANVAYA IP ROUTING OK routes=3 specific_lpm=28

$ ANVAYA IP FORWARDING OK neighbors=2 gateway_hop=10.0.2.2

$ ANVAYA IP ICMP ECHO OK id=0xa15e seq=9 reply_type=0

$ ANVAYA STORAGE SHA256 OK vectors=2 id_bytes=32

$ ANVAYA STARTUP APP LOADER EXEC OK

$ ANVAYA VIRTIO DRIVER SERVICE OK mode=u polling=0 kernel_fallbacks=0

$ ANVAYA VIRTIO DRIVER RECOVERY OK polling=0 kernel_fallbacks=0

$ QEMU boot smoke checks passed.

Real markers from the repeatable boot evidence. Reproduce with ./scripts/check-qemu-boot.sh.

1.7.0

Capability Sockets

signed network service in U-mode; product core 20,740 lines

0.48%

Unsafe-Rust TCB

391 lines; vs Asterinas 14%, Tock 43.8%

NIST

PQC KAT-verified

ML-KEM/ML-DSA/SLH-DSA vs official ACVP vectors

Signed WASM proof apps

deny-by-default capability profiles

Release gates

workspace, formal, QEMU, driver, storage, network, persistence, platform & monitor

milestones on the trajectory

from the 2026-01-01 manifesto to v1.7.0's capability sockets

Trajectory

v0.0.0 · 2026-01-01
The Manifesto
The founding document, published before any code: an operating system designed for the age of AI agents, with security, transparency, and sustainability as first principles.
v0.1.0 · 2026-04-20
First Light
The kernel boots for the first time — a minimal Rust scaffold coming alive over serial on emulated RISC-V hardware.
v0.2.0 · 2026-05-01
Permission Is Everything
Memory isolation goes capability-based — no task touches a page without an explicit, revocable grant — opening a months-long proof train that hardened the model piece by piece.
v0.3.0 · 2026-07-10
Developer Preview
The first public cut: signed programs, isolated processes, and working network and storage drivers, every claim asserted by a scripted QEMU boot.
v0.4.0 · 2026-07-11
Production Substrate
The kernel becomes dependable: a production program loader, live TCP/IP, disk persistence with cryptographic integrity checks, and a tamper-evident audit trail.
v0.5.0 · 2026-07-13
AI Agents Move In
AI agents become native citizens, each running in its own execution context with an identity, explicit goals, granted powers, and a full audit trail.
v0.5.5 · 2026-07-13
First Silicon in Sight
Release candidates for real hardware — a reproducible build and strict firmware handoff for the DC-ROMA FML13V01 laptop, with no physical boot claimed until a board proves it.
v0.6.0 · 2026-07-14
A Constitution for Machines
Hard rules the system itself must obey: three tiers of constitutional constraints and a human override that software cannot argue with.
v0.7.0 · 2026-07-16
Quantum-Proof Crypto
Every trust surface is re-keyed with NIST's post-quantum algorithms, each implementation verified bit-for-bit against the official test vectors.
v0.8.0 · 2026-07-16
Devices Form a Mesh
Paired devices share data and delegate powers across machines — every grant cryptographically proven, revocable, and impossible to widen in transit.
v0.9.0 · 2026-07-16
Made for Humans
The system meets people: an intent-driven interface, a package manager for signed apps, and an energy broker that meters work in joules and carbon.
v1.0.0 · 2026-07-16
The QEMU-Proven Milestone
Feature-complete and formally verified within stated bounds — every claim backed by a reproducible boot log, and everything not yet true said out loud.
v1.1.0 · 2026-07-18
Back to the North Star
The code is put back under the manifesto's authority: a machine-checked ledger scores every promise, and a ratchet stops the kernel from quietly growing.
v1.2.0 · 2026-07-19
Many Cores, Real Time
The kernel goes multicore with real-time scheduling and asynchronous messaging, retiring the single-processor assumption its proofs had rested on.
v1.3.0 · 2026-08-02
100× the Monolith
The 76,824-line main file is distilled to 539 lines as proof code moves behind a compiler-enforced boundary — and the size limit starts tightening itself.
v1.3.1 · 2026-08-02
100× the Proof Harness
The proofs get the same treatment, compressing 109-fold into declarative tables while a new oracle demands the boot transcript stay byte-for-byte identical.
v1.3.2 · 2026-08-03
Proof Bodies Dissolve
The last hand-written proof code becomes data — 119 proof routines turn into rows run by shared interpreters — and an unreachable stretch target is amended honestly instead of gamed.
v1.3.3 · 2026-08-07
Truth-Parity Restoration
A hygiene release: the changelog, status page, and public mirrors are caught up so the published record matches the shipped code again.
v1.3.4 · 2026-08-07
Version Banner Fix
A one-line honesty fix: the boot banner stops wearing v1.0.0's old release title beside newer version numbers.
v1.3.5 · 2026-08-07
The Verifier, Verified
The self-improvement discipline turns on the proof scripts themselves: 566+ hand-written checks become declarative rows, and the rewrite catches a real bug in the old checks.
v1.3.6 · 2026-08-07
Honest Accounting
An audit finds 5,363 kernel lines the size checker never counted; every one is traced, classified, and relocated so nothing sits outside the measurement.
v1.4.0 · 2026-08-07
The Real Launcher
Programs can now ask the kernel to launch other programs through a real, permission-checked system call, and every app package carries a post-quantum signature — one size target was missed, and said so.
v1.4.1 · 2026-08-07
Verify-Only Kernel
The kernel keeps the power to check signatures but gives up the code to create them, as three subsystems move out — landing below the size target v1.4.0 missed.
v1.5.0 · 2026-08-09
Driver Domains
Hybrid-signed virtio-block and virtio-net drivers run as distinct U-mode services with exact device, DMA, IRQ, and IPC authority; QEMU proves persistence, recovery, and opaque-frame reuse without polling or kernel fallbacks.
v1.5.1 · 2026-08-10
Post-Review Fixes
Correctness and enforcement fixes from a full post-release review: an IRQ PLIC-source wedge on stale-endpoint interrupts, a dead device-unsafe ratchet, a driver buffer_offset overflow, and a weak-memory used-ring fence. Product core stays 21,834 lines; combined privileged TCB is 23,456.
v1.5.2 · 2026-08-15
Durable Block Client
The kernel-private virtio-block client becomes a reusable, capability-scoped adapter. AEC journal/effect/audit and the installer package archive persist through it onto one exclusive proof-disk map; QEMU proves two-boot survival with polling=0 and kernel_fallbacks=0. Product core is 21,870 lines; counted privileged TCB is 23,492.
v1.7.0 · 2026-08-27
Capability Sockets
A socket becomes a capability with kind, resource identity, rights and generation; the network stack runs as a signed U-mode task that persists its own state, proves five denials and survives death with a fresh generation. Task-composed frames transit a real device interrupt-driven; product core compiles zero network-service names. Socket payloads do not yet leave the machine, so M8 advances DEBT to PARTIAL.
v1.6.0 · 2026-08-21
Content-Addressed Storage
Durable content becomes a userspace service: a signed storage task with its own address space and no device authority owns algorithm-tagged SHA3-256 content addressing, a Kani-proven namespace CRDT, and AVCS A/B recovery through the frozen block client. Product core falls to 20,757 lines and counted privileged TCB to 22,379, with zero storage-service names left in the core. QEMU-proven, and not a production filesystem.

Proof-Driven Engineering

METHOD

No roadmap slideware. Each increment lands with focused code, unit tests, and QEMU boot markers that CI re-asserts on every push — from capability attenuation to two-boot storage persistence.

Capability Boundaries

SECURITY

Every kernel object is reached through explicit, attenuable, revocable capabilities with lineage tracking. Denial paths are proved with the same rigor as success paths.

AI-Native Target

DIRECTION

The target state is an OS built for agentic workloads: bounded execution, explicit authority, human override, and audit-ready transparency from the nucleus up.

Manifesto

DOC-001

The ANVAYA Manifesto lays out the first principles of the Intelligence Age operating system: AI-native execution, capability security, post-quantum cryptography, and sustainable computing at planetary scale.

Open Manifesto View on GitHub

Implementation Status

STATUS

Honest, area-by-area maturity: what is evidence-backed prototype, what is accepted specification, and what remains future work.

Open Status

Changelog

UPDATES

Every verified release, from first light to the sret-continue dispatcher slice, with the exact proof markers each one added.

View Updates

Docs Index

DOCS

Canonical references, policies, methodology, and machine-readable assets for ANVAYA OS.

Open Docs

Get Involved

JOIN

ANVAYA is built in the open. We are looking for funders and contributors — kernel and microkernel engineers, AI-systems and alignment researchers, cryptographers preparing for the post-quantum world, and RISC-V hardware partners — to help build the operating system for the intelligence age.

To fund the work or contribute, write to Alphin Tom at dev@mycel-ai.de.

Email Alphin Tom Contribute on GitHub