Philosophy

Aegis is a capability-based, POSIX-compatible x86-64 operating system written from scratch — its own kernel, its own GUI stack, its own network stack, its own userspace. Building an OS from nothing is a deliberately unreasonable goal, and the only way it gets done is by being honest about what “done” means at each step. This page is about how we think and how we build.

The development cycle

Just make it exist first. You can make it good later.

This is not an excuse for sloppiness — it is a strategy for finishing. A feature that exists, boots, and is exercised by real workloads teaches you more in a day than a perfect design teaches you in a month on paper. The first version of nearly every subsystem in Aegis was the minimum thing that worked: a scheduler that just round-robins, a network send that truncated at 8KB, a single-core SMP bring-up where the APs come up and halt. Each one shipped, got used, exposed its real limits — and then got made good.

The shape of the cycle:

1. Make it exist. Get the simplest version that actually runs end to end. Resist the urge to design for problems you have not hit yet.
2. Run it for real. Boot it on QEMU and on bare metal. Drive it under the integration tests. Use it. Real hardware and real workloads find the bugs that whiteboards hide.
3. Make it good. Now that it exists and you have seen how it actually fails, harden it — at the root cause, not the symptom.
4. Be honest about where it is. Ship it, document exactly what works and what does not, and move on.

The release history is this cycle. v1.0.0 was a first public release that booted and ran a userspace. The point releases that followed — security-audit fixes, a network send that no longer truncates, blocking segmented sends, SMP TLB coherence, AHCI and HD-audio and virtio-gpu landing one at a time — are “make it good later” playing out in public, one increment at a time.

Principles

Capabilities are not a feature, they are the foundation. Every process carries a capability table, and every privileged syscall validates against it before doing anything. Security is not a layer bolted on after the fact — it is checked at the boundary, every time. The validation core is Rust, linked into the C kernel via FFI, because the one place we are least willing to be wrong is the place that decides what a process is allowed to do.

Own the whole stack. No X11. No Wayland. No borrowed network stack. Aegis builds its own compositor (Lumen), its own widget toolkit (Glyph), its own desktop (Citadel), its own TCP/IP. Owning the stack is more work, but it means there is no part of the system that is a black box to the people maintaining it — and no part we cannot fix or rethink.

Rust where it counts. The kernel is mostly C, and we are honest about what that means: every C kernel ever shipped has had memory-safety bugs found in it eventually. The capability core is already Rust, and the security-critical paths are moving that way. We are not rewriting for ideology — we are moving the highest-stakes code to the language that makes whole bug classes impossible.

Scope honestly, then say so. A full AMDGPU-equivalent driver is half a million lines chasing a moving firmware ABI; Aegis will not attempt feature parity, and the roadmap says exactly that. We would rather ship a narrow thing that works and is documented as narrow than promise a broad thing that does not. “v1 software, not yet production-hardened” is on the front page on purpose.

Root cause, not symptom. A bug report names a symptom. The fix goes where every caller routes through — one guard in the shared path, not a patch on the one path someone happened to notice.

Build in the open. The roadmap is public, the limitations are public, and the best way to change the direction of Aegis is to contribute. File issues or propose changes at exec/aegis.

Why this works

An operating system is too large to build correctly on the first pass — nobody has the foresight, and the parts interact in ways you cannot predict until they are running together. “Make it exist first” is how you buy that information: you trade a perfect first version for a real one, and a real one tells you the truth. Then you make it good. Aegis is the accumulation of many turns through that loop, and it will keep turning.