Authority is a capability you hold.
Horus is an x86-64 microkernel. A program starts with nothing. Reading a file, driving a device or creating a kernel object needs a capability that was handed to it, and that capability can only be narrowed from there.
Research kernel, written in C and Rust. Thoroughly automatically verified. Not independently reviewed, and not something to trust with data you cannot lose.
- Checked at the point of useThe kernel does not trust a user id, a login, or the name of the program.
- Delegation only narrowsA capability handed on has a subset of the rights. Revocation reaches the copies derived from it.
- The open limits are publishedA machine with no TPM is not measured, and it says so. Execute is advisory if you can read the file. The cryptography is unaudited.
What an install is, today
Horus installs onto legacy IDE disks and onto SD or eMMC, including a laptop's soldered eMMC. It has booted from its own disk under UEFI. A machine whose only disk is NVMe or SATA can run a live image. It cannot install onto that disk: SATA is identified and not read or written, and the ring-3 NVMe driver runs in a self-test build only.
The encryption, the Merkle tree and the journal sit above a small block interface. A new kind of disk is one driver. Those drivers are leaving the kernel. sdhcid, atad and nvmed already run in ring 3, each holding one device capability, and the installed system still uses the kernel's own IDE and eMMC drivers.
Where to go next
Why Horus exists states the rule. Architecture is the syscall path and the trusted computing base. Limitations is the honest list. The session queue is the work later sessions should take, one pull request at a time.