Rust + RISC-V first
Modern, secure, and futureproof foundations for systems that need control, auditability, and long-term adaptability.
open nexus An open source RISC-V operating system, written in Rust
One OS. Many devices. NEURON, our capability-based RISC-V microkernel, keeps the trusted computing base small enough to audit — and drives a GPU-composited desktop that already runs real apps.
Built for the future.
A complete reimagining of what an operating system can be.
neuron Microkernel
A capability-based microkernel that enforces security at the architecture level, not in policy layers.
Security by architecture
Capability-based isolation and a low-trust design keep the trusted computing base small and explicit.
Focused first deployments
We start where these properties matter most: industrial HMIs, kiosks, and specialized connected devices.
Built for Developers
Modular, hackable, and open by design, with a long-term path toward broader device classes.
Open Collaboration
Shape the future with a global community. Join us!
What runs today.
All of it boots — in QEMU, on emulated RISC-V, not yet on a board on your desk. That is the honest scope, and it is real code you can clone and run.
- A capability microkernel
- NEURON boots with capability-based IPC, process isolation and W^X memory, over a 14-syscall baseline ABI. Capabilities are task-local, rights are derived by intersection and can never escalate, and anything without an explicit grant is rejected at the syscall boundary.
- Core services, as separate processes
- A service manager, a policy engine, a bundle manager, a virtual filesystem, a keystore and a logging authority — each its own userspace process. The kernel moves handles and memory between them without ever parsing a message.
- A desktop on the GPU
- Rendering runs over virtio-gpu, accelerated with virgl, with opacity, blur and shadow, driven by a full input-to-output loop on real interrupts. Dragging a window is a transform, not a redraw.
- Applications that are programs
- The shell, the launcher, the greeter, Settings, the file manager and the on-screen keyboard are each written in NeX — our own interface language — then compiled and run as separate processes.
- Text input across scripts
- Japanese romaji→kana→kanji, Korean 2-set jamo composition and Chinese pinyin, on an identity-gated input path where the kernel says who sent a keystroke. Switching the system language re-renders running apps in place.
What does not exist yet is worth stating just as plainly: there is no power service, no audio service and no notification service. Parts of the shell in our screenshots are deliberately a mockup — we go through exactly which parts on the RISC-V desktop page.
Why RISC-V only
Most systems treat RISC-V as a port target: a third architecture added after x86 and ARM, inheriting assumptions made for hardware that works differently. Open Nexus starts at the other end. There is no compatibility layer to preserve, so the memory model, the trap path and the boot sequence are designed for the architecture rather than adapted to it.
That costs us an existing driver ecosystem. It buys something we think matters more: on an open instruction set, what a device is allowed to do can be decided by its hardware and its owner.
Why Rust
In a microkernel system most code lives outside the kernel — drivers, filesystems, networking and the graphics stack all run as ordinary userspace processes. Rust's compile-time guarantees apply to exactly that majority, and the userspace libraries holding the domain logic are marked #![forbid(unsafe_code)].
This is a position, not a proof. The security posture is capability-based and microkernel-hard in the seL4 tradition, but we are not betting the project on formal verification as a first milestone — and NEURON is not formally verified.
Start anywhere.
The operating systemHow the three tiers fit together, and what we hold ourselves to.The microkernelCapabilities, the 14-syscall baseline, Sv39 and W^X, and the messages the kernel never reads.The desktopGPU-composited windows, apps written in NeX — and an honest line between what is real and what is a mockup.Build it yourselfClone it, build it, and boot the whole system in QEMU.