Userland

Goals

  • minimal but practical base system
  • service-oriented architecture aligned with the kernel model
  • strong tooling for bring-up, diagnostics, and automation

Core userland components

Init and service manager

  • boots essential services
  • enforces dependency ordering
  • restarts supervised services
  • exposes health and status APIs

Early phases should keep init and the long-lived service manager separate so that bootstrap concerns do not hard-code later supervision policy into the first process.

System services

  • device manager
  • filesystem manager
  • network manager
  • security policy service
  • session manager
  • logging and tracing services
  • compatibility subsystem hosts

Command-line environment

  • native shell
  • standard utilities
  • process inspection tools
  • filesystem and networking tools
  • tracing and crash-debug tools

Library strategy

  • small native C runtime and system library
  • C++ support for selected user-space components
  • stable userspace API layered over the native syscall ABI

Desktop and GUI direction

GUI is not part of the earliest milestones, but the architecture should anticipate:

  • compositor service
  • display server or protocol layer
  • sandbox-friendly application model
  • remote and virtual display support

The detailed desktop architecture, interaction/visual specification, security boundaries and staged implementation plan are in ui-design/. The current framebuffer desktop is a bring-up surface, not the production window-system target; see graphics.md for its verified scope.

Developer experience priorities

  • cross-toolchain support
  • deterministic builds
  • emulator-friendly boot flows
  • serial and structured logs
  • conformance and regression test harnesses

Current implementation snapshot

  • service lifecycle now includes start and stop paths across init, devmgr, vfs, and net services.
  • service manager exposes a health aggregation helper that reports currently running critical services.
  • runtime supervision counters are exercised by host tests to keep orchestration behavior regression-safe.
  • compatibility runtime core now includes per-target enablement and early syscall translation probes for Linux, Windows, and macOS layers.
  • user API now includes wrappers for process security label get/set and interaction checks over native syscall ABI helpers.
  • service manager now exposes restart-budget controls and failure reporting hooks to support stricter supervision policy behavior.
  • service IPC runtime now validates service identifiers/message types and supports reply correlation/status fields for ACK/ERROR flows.