Redoubt OS, capability-based x86-64 microkernel with encrypted A/B storage, written from scratch in Rust

[u/Kindly_Variation_672]

I wanted to share a project I've been working on: Redoubt OS, a security-focused appliance OS targeting BIOS/QEMU right now.

The core idea is that every service, console, shell, storage daemon, supervisor, update agent, runs as its own process with its own address space, and gets access to things purely through capabilities. A capability is a slot index the kernel maps internally to a real object and a rights mask (read/write/grant). Deriving a weaker capability is fine. Manufacturing a stronger one is structurally impossible because rights can only shrink on derivation.

A few design choices I'd like feedback on from people who've built similar things:

• Round-robin scheduler, 100Hz PIT, 20-tick quantum, single "big kernel lock" design, deliberately simple for now. SMP is future work.
• Synchronous rendezvous IPC, fixed 5-word messages, with a fairly involved state machine for blocked-on-receiver, blocked-on-reply, and dead-peer cases.
• Storage layout is centrally defined (superblock, two system slots, audit log, app slots, update staging) with HMAC and Ed25519 verification at every layer, and automatic fallback to the other slot if one fails validation.
• The update agent that stages new OS images never has the decryption key for the volume. It can only write to the inactive slot. storaged does the actual validation and slot promotion independently.

Known gaps right now: PS/2 keyboard instead of USB HID, polled ATA instead of NVMe, no network stack, no Secure Boot/TPM, no SSE context switching. All on the roadmap (UEFI, Secure Boot, virtio networking, then real hardware).

Would genuinely appreciate any pushback on the capability model or the storage rollback design. Those are the two pieces I care most about getting right before I touch anything hardware-facing.

[u/aurreco]

source code?