The Setonix microkernel — hand-written in Rust, providing mechanism and never policy.
(\_/)
( •_•)
/ ></
Setonix — /ˈsɛtənɪks/, SET-oh-niks — is the genus of the quokka, Setonix brachyurus: Latin seta "bristle" and Greek ónyx "claw", for the bristles around the claws of its hind feet.
Kaya — /ˈkaja/, KAH-ya, stress on the first syllable, never ka-YA — is Noongar for both "hello" and "yes", and is answered with Kaya in return. It is the first word this kernel says.
Both notes are summarised from the constitution §8, which holds the full derivation and records that the pronunciation is offered in good faith pending confirmation with Noongar language custodians.
Capabilities are the only authority: unforgeable, kernel-validated, explicitly passed, and reducible in rights. IPC is the product — a register-based fast path for small messages with a direct sender-to-receiver switch, and bulk data moving through shared-memory regions established out of band, never through the message itself (RFC-0004). Drivers live in userspace, so a crashing driver restarts without taking the system down. The kernel is minimal by construction, because everything above it is reached through broker-mediated schemes rather than ambient authority.
The reasoning behind all of that, and the lineage of each borrowed idea, is in the constitution.
The paper trail lives in this repository, beside the code it governs:
- CONSTITUTION.md — the founding document. Binding on every contributor, human or AI. Start here.
- docs/rfcs/ — one document per design decision, with its rationale and the alternatives rejected.
- docs/CHANGELOG.md — the amendment log for the constitution and the design documents.
- docs/threat-model.md — what Setonix defends and the numbered obligations its design must discharge; expands the constitution's §9 seed.
- docs/research/ — the prior-art reviews the RFCs cite.
Phase 1. The kernel boots on QEMU aarch64 virt, greets you on the PL011 UART and
reports its own faults. That proves the chain everything else rests on: link
script, boot stub, stack, .bss, the hardware-abstraction boundary, and the
console. Beside it, the capability table (RFC-0003) is built and tested on the
host, but the kernel does not use it yet: there is still no scheduler, no IPC and
no MMU. Their designs are the RFCs under docs/rfcs/.
x86_64 compiles and links against the same architecture-independent kernel, which
is what keeps the hardware-abstraction boundary honest, but it does not boot yet:
the image carries neither the Xen PVH note QEMU's -kernel needs nor a UEFI stub.
The canonical environment is the devcontainer — see .devcontainer/.
cargo xtask build --arch aarch64 # cross-compile
cargo xtask run-qemu --arch aarch64 # boot, serial on this terminal
cargo xtask run-qemu --arch aarch64 --debug # halt at reset, gdb on :1234
cargo xtask boot-test --arch aarch64 --expect "Kaya!"boot-test is what CI gates on. See CONTRIBUTING.md for the
full development setup and CLAUDE.md for the rules that apply to
kernel code.
Setonix borrows words from the Noongar language with acknowledgement, and commissions rather than imitates visual language. We acknowledge the Noongar people as the traditional custodians of the country whose language and seasons give this project its names, and pay our respects to their elders past and present.
GPLv3 for original Setonix code — see LICENCE. Vendored MIT-licensed components retain their notices and are incorporated under GPLv3 as the MIT licence permits.