01Boot below the app layer
An agentic OS, forged from the kernel up.
FerrumOS boots a Rust x86-64 kernel and a real Ring-3 userland. Intelligence lives above the kernel; scheduling, memory, interrupts, and drivers stay deterministic.
- Rust + x86-64
- Bootable research OS
- Deterministic kernel
Claim boundaryValidated against the documented QEMU/Bochs profile—not broad PC compatibility or a production hardware deployment.
02Intelligence, contained
The brain runs in userspace. Authority does not.
Heliox can observe, plan, act, verify, and reflect, but every system effect crosses FerrumOS’s syscall ABI. Default-deny capabilities remain the kernel’s authority boundary.
- Real Ring 3
- 61 syscalls
- Default deny
Claim boundaryThe model is not kernel-resident and has no unrestricted hardware authority. A predictive allow is never permission to execute.
03A real userland
Not an agent demo. An operating system around it.
FerrumOS runs ELF processes, a graphical desktop, persistent Ext2 storage, networking, audio, notifications, and signed local packages. Heliox uses the same system boundaries as every Ring-3 process.
- ELF processes
- Ext2 + networking
- Signed packages
Claim boundaryThe package catalog is a local signed cache, not a network marketplace; device support remains scoped to the documented emulator profile.
04Capability before command
Every action earns its authority.
Canonical operations cross five permission tiers and one common predictive gate. Modify and destructive paths retain operator confirmation, while unknown actions fail closed.
- 41 operations
- 5 permission tiers
- Confirmation gates
Claim boundaryConfirmation, capability checks, syscall validation, and predictive screening remain separate controls. Catalog membership is not proof of postcondition verification.
05Preview before execution
Think forward before the system acts.
FerrumOS previews bounded OS-state consequences with independent deterministic and learned forecasts. The riskier result wins before any eligible action reaches dispatch.
- H=3 lookahead
- 1.29–1.57 ms preview
- Monotonic safety
Claim boundaryThe learned model complements deterministic policy. It cannot erase a rule-based warning, bypass confirmation, or grant authority.
06Measured, not mythologized
Reproducible evidence. Visible imperfections.
FerrumOS publishes its transition data, evaluation protocol, raw artifacts, comparison baselines, and failure clusters. Misses remain visible instead of disappearing into product language.
- 13,697 transitions
- 81.4% fixture BA
- Failure clusters
Claim boundaryAuthored counterfactual fixtures are not natural-use prevalence, independent human annotation, live destructive execution, or formal safety proof.
07Simulator-backed cyber-physical tier
A complete software boundary. No borrowed hardware claims.
Ferrum now binds deterministic sessions, replay, virtual devices, simulator bridges, watchdogs, ROS 2/MQTT/CAN conformance, actuator-disabled delivery, bounded neural proposals, and host-managed cells into one testable reference vertical.
- 152 / 152 contracts
- 32 / 32 model gates
- Actuator disabled
Claim boundaryThese are local software contracts. There is no installed simulator or transport deployment, live EEG, native hypervisor, real robot, hard-real-time, certification, or independent-replication claim.
08Open research, built to be challenged
Build the OS where intelligence answers to the system.
Boot it. Reproduce the gate. Inspect the failures. Then help push agentic operating systems beyond application-layer automation—without hiding the limits.
- MIT licensed
- Open data + report
- Reproducible in QEMU
Claim boundaryFerrumOS v0.1.1 is the latest tagged release; current main contains newer research work. Neither is a production-ready general-purpose OS or certified safety platform.