Architecture
Every box above the microkernel is an isolated user-space process. Every arrow between them is a capability-checked IPC message. A buggy filesystem service can't take down the kernel. A compromised network driver can't read another process's memory. Isolation is structural, not policy.
What makes this different
This is not a research prototype and it is not a design document. CambiOS boots, schedules, runs user-space services, signs and verifies binaries, and handles IPC — with a real security model enforced at every boundary. Built by one person, in a few months of coding.
The kernel is honest about what exists and what doesn't. STATUS.md is the single source of truth. Every numeric bound in the codebase is categorized and documented in ASSUMPTIONS.md. Architecture decisions are recorded in ADRs with full rationale and rejected alternatives.
Read the architecture document. Read the manuals — they walk real things through the system. Read the philosophy if you want to know why.
Commitments
No telemetry. No analytics. No phone-home behavior. Ever. Not now, not in future versions. This is a design constraint, not a policy.
No backdoors. No remote access mechanism that bypasses the capability model. No "emergency" channels. No "debug" overrides that work without the user's explicit action.
Your machine is yours. No DRM. No activation. No mandatory accounts. Secure boot protects the owner from unauthorized modifications, not the vendor from the owner.