BenthOS

Firmware authenticates the BenthOS loader, and the loader checks everything after it. The loader is a Cutlass program built for the UEFI loader target at firmware privilege. It verifies the signed boot manifest with the root key compiled into it and refuses any generation below the TPM rollback floor.

# The BenthOS loader: a COFF image the firmware runs under the UEFI convention.
text arch = "x64"
text[] features = ["invtsc"]
u32 word = 64
text endian = "little"
text memoryModel = "x86tso"
text entryAbi = "uefi"
text objectFormat = "coff"
text os = "none"
text privilege = "firmware"
bool redZone = false
u32 stackAlign = 16
text entry = "efiMain"
text coreId = "x64.apicId"
text clock = "x64.tsc"
u32 separationBytes = 128
text profile = "release"
text optimize = "size"

The kernel climbs a fixed ladder: memory and protection, then queues and interrupts, then drivers, storage providers, the first supervisor, and finally the MerFS root. Each step rests only on the steps below it. Memory and cores come from the loader's handoff, never from probing.

memory ram from handoff.map with { reserve = [kernelImage, bootStack] }

cores from handoff.topology with { max = 64 }

traps idt with { target = x64.idt, section = ".text.vectors" } {
    divideError = onDivide,
    pageFault = onPageFault,
    timer = onTimer,
}

interrupt void onTimer(ref<Frame> f) {
    raw { cutarch.x64.out8(0x20, 0x20) }
}

The probe port is a declared device. Its register block, address, interrupt and handler are fixed when the kernel is compiled, so no driver finds hardware by guessing. The handler records the byte and returns; what a reading means is decided above the kernel.

struct ProbePort with { endian = little, layout = declared } {
    u32 data,
    u32 status,
}

static atomic<u8> lastByte = 0

device ProbePort probe0 with { space = mmio, address = 0x09000000, irq = 33, handler = onProbe }

interrupt void onProbe(ref<Frame> f) {
    u8 b = u8(probe0.data & 0xFF)
    cut.atomic.store(lastByte, b, order = release)
}

Programs reach the kernel through one declared syscall table. Every row that touches a device, a shared segment or a file scope takes a slot from the caller's own capability table. The kernel checks the holder, rights, delegation chain and expiry before it looks the resource up.

syscall authority with { target = x64.systemCall } {
    grantReceipt = onGrantReceipt,
    launch = onLaunch,
    principal = onPrincipal,
    capability = onCapability,
    capNarrow = onCapNarrow,
    capDelegate = onCapDelegate,
    capMove = onCapMove,
    capReceive = onCapReceive,
    capDrop = onCapDrop,
    capRevoke = onCapRevoke,
}

The Trident application on the gateway handles each reading as an event and writes it through its readings anchor. On BenthOS the host backs that anchor with a MerFS scope the authority service granted. The same source runs unchanged on a hosted server.

chest main() {
    chest state = {}
    return state
}

on event("probeReading", const chest reading) {
    u32 station = reading.station
    u64 sequence = reading.sequence
    f64 chlorine = reading.chlorine
    text name = "station-" + text(station) + "/" + text(sequence) + ".txt"
    u64 written = t.io.writeText("readings", name, text(chlorine))
    if (chlorine < 0.2) {
        t.log.warn("low chlorine at station " + text(station))
    }
}