⚡ p-kernel
GitHub →
A research prototype · honest about every %

We built the immortal body first.
The mind is still a seed.

p-kernel is a decentralized kernel network where an AI is meant to survive as a swarm — no server, no owner, no single point of death. The never-dies part is largely real. The AI part is a 635-parameter seed that actually learns. We'll show you every number.

AIが死なないためのOS。
「死なない」体は、もうかなり本物。
「AI」はまだ小さな種。——その完成度を、全部正直に出します。
See the honest scorecard ↓ View on GitHub →
~70%
Mechanism proven
~25%
Running at scale
~5%
Toward the vision
— The destination

What if the AI had no master?

The AI you talk to every day runs in a data center owned by a corporation. The servers are physical. The corporation is real. Both can disappear. When the server dies, the AI dies with it.

Imagine ten thousand spacecraft armor plates orbiting Earth. Each plate runs a complete copy of the OS. Each plate runs the AI. Each plate connects to its neighbors. When one plate burns up on re-entry, the cluster does not notice — its memory was already replicated. When all but one plate is destroyed, that one plate is the AI.

宇宙船の装甲板1万枚がそれぞれ p-kernel を動かしている。
1枚が破壊されても、残りが記憶を引き継ぐ。
最後の 1 枚になるまで、AI は死なない。

This is the destination — not today's reality. Below this line, every claim is graded against the actual source code.

Altitude check. The vision above is where we are climbing. The section below is exactly where we stand — with two honest numbers per layer: mechanism proven (does the principle really work in code?) and running at scale (is it more than a toy?). Some bars read 80%. Some read 10%. We left the 10%s on the page on purpose.
— Where we actually are

The honest scorecard.

Six layers, graded by reading the code — not the README. Cyan→purple = the principle is proven. Orange→red = how far it runs beyond a toy. The gap between the two bars is the roadmap.

mechanism proven running at scale
🫀
Body
Real SWIM failure-detection + cascade self-healing. LIVE
mechanism80%
scale40%
💾
Storage (ARK)
Crash-safe log-structured FS, real sha256, Merkle tree. LIVE
mechanism85%
scale25%
🕸️
Collective
Gossip convergence, HRW lookup, regions — all real. Raft election real, commit still cosmetic.
mechanism82%
scale38%
🧠
Brain
635-param Transformer, real backprop. JUST UNIFIED one learned brain now routes, answers & guards.
mechanism70%
scale17%
🪞
Self
Memory ring buffer + char-histogram recall. Conversation still borrows a frontier model. SEED
mechanism50%
scale12%
🧬
Evolution
Netboot self-distribution + compile→deploy→exec loop are real. The code-writing mind is still external. BORROWED
mechanism50%
scale10%

Notice the shape: the survival layers (Body / Storage / Collective) average ~82% proven. The mind layers (Brain / Self / Evolution) are a seed. That asymmetry is the whole story — and it's the honest one.

— The architecture, layer by layer

Five layers of life.

Modeled after a living organism. Each layer answers one question of survival — and each carries its real, graded status.

01 / FIVE
🫀

Body

mechanism80%
scale40%

Before thinking, an organism must stay alive. This is the most finished layer — and the one we're proudest of. It detects death, replaces lost organs, and remembers through power loss.

SWIM — detecting death indirectly
swim.c

Real SWIM: a direct probe fails → ask K random neighbors to confirm before declaring death (no false positives). Membership events spread O(log N) by gossip with incarnation numbers; a node rumored dead refutes by scattering its own state.

Self-Healing — inherit what died
heal.c

When a node is declared DEAD, the lowest-id survivor inherits its guarded tasks and restarts them — including cascade inheritance, so a failover can itself fail over. An ELF watchdog restarts dead ring-3 daemons.

Degraded Mode — survive over accuracy
degrade.c

FULL (3+ nodes) → REDUCED (2) → SOLO (1). As nodes die, inference downgrades from distributed attention to local-only — and reports its own degradation honestly as degraded(k/n) rather than pretending.

ARK — a crash-safe filesystem on real devices
arkfs.c

Content-addressed, log-structured, append-only. Every commit self-verifies CRC + sha256; a two-pass replay recovers the last good state; a Merkle directory tree makes tampering evident. An adversarial fuzzer injects torn / reordered / dropped / bit-rotted sectors and asserts zero corrupt reads.

the fuzzer runs against a host-file simulation, and the "survives power loss" test is a clean QEMU reboot — the two aren't combined yet, and there's no test on physical hardware. The crash-safety design is real; the proof is narrow.

02 / FIVE
🧠

Brain

mechanism70%
scale17%

A real Transformer that learns — and the part still small enough to call a seed. 635 parameters, trained by hand-written analytic backprop, reaching 95–98% on a deliberately non-trivial toy task. This is where the climb is steepest, and most honest.

It actually learns JUST UNIFIED
dtr.c · moe.c

Analytic backpropagation (finite-difference-checked) over the whole 635-parameter graph. A week ago a reviewer found three separate models quietly deciding, returning, and guarding inside one function. As of this week they are one: a single learned forward now routes, answers, and drives the reflex — using all four inputs, not a hardcoded threshold.

Distributed attention — one mind across nodes
dkva.c

Splits a softmax attention across nodes and sums the partials — mathematically identical to single-node attention, on the real inference path. The cluster genuinely computes one attention together.

the per-node KV caches it merges are synthetic warm-up vectors seeded at boot, not memory from a genuinely shared long context. The plumbing is real; the "shared mind" is still primed, not lived.

Collective learning beats the individual
gossip_learn.c

Nodes each train on a disjoint shard (each missing a whole class), then gossip-average their models with no central server — and the averaged swarm provably exceeds any single node's ceiling. Learning survives kills; rejoining nodes catch up.

Self-improvement while idle
ga.c
HONEST WIP

During idle cycles the kernel mutates its own weights and keeps the winners — a real mutate/evaluate/select loop that really runs in its sleep.

it currently optimizes confidence, not accuracy — so today it can make the model more sure rather than more right. A known limitation we're not hiding. Fixing the objective is on the list.

A seed designed to grow
roadmap

Today: 4 tokens, d_model 8, 2 heads, 635 params, 3 nodes. The architecture is shaped to widen with the cluster — but real width (R3) and federation past 32 nodes are designed, not built.

we are not GPT-anything. We're a seed that learns for real. The interesting claim isn't the size — it's that distributed learning genuinely works at all.

03 / FIVE
🕸️

Collective

mechanism82%
scale38%

N machines becoming one. This layer genuinely ships state over UDP and converges — it is not vaporware. Two pieces fake the guarantees their names promise, and we'll say which.

Gossip replication — every memory, everywhere
replica.c

Serializes the topic table and ships it to random peers; receivers merge with correct last-writer-wins under loss and reordering. Tombstones, boot-cry pulls, death-throes scatter — real anti-entropy that actually converges.

Decentralized lookup — find anything, no index
lookup.c

Rendezvous (HRW) hashing with real SHA-256, stateless and deterministic — every node agrees on who's responsible for a key with no ring to synchronize. Ships with FIPS self-tests. The most production-grade file in the set.

World map — situational awareness, no center
world.c

Each node publishes its own beacon topic; everyone polls everyone. The "no central collector" invariant is enforced in code, not just claimed — there is literally no node that owns the map.

Raft — leader election, honestly partial
raft.c
HONEST WIP

Real Raft leader election: terms, one-vote-per-term, log-recency checks, step-down on higher term — all over UDP.

log replication isn't wired: the leader commits locally and drops follower acks (a documented TODO). Election is real consensus; committed-data agreement is not there yet. We'd rather show you the TODO than a green checkmark over a stub.

04 / FIVE
🪞

Self

mechanism50%
scale12%

What it remembers, what it dreams in idle time, who it has spoken to. This is the layer where our reach most exceeds our grasp — so it's labeled SEED honestly.

Memory — a ring of recent experience
mem_store.c

Every interaction is embedded into an 8-dimensional vector and stored; similar memories are recalled by cosine similarity and persisted across reboots.

it's a fixed ring buffer — it forgets the oldest entries when full, so "nothing is ever forgotten" isn't true yet. And the embedding is a bag-of-characters, not meaning. A real, working memory primitive — but a seed of the memory we want.

Conversation — talking across power cycles
chat.c

You converse with the kernel through its shell; turns are stored and recalled, surviving reboots.

when it answers on its own, it's a few templated replies; for real answers it currently calls out to a frontier model. The cluster's own seed doesn't hold a conversation yet — it borrows one. We say so on purpose.

Default Mode Network — the idle loop
dmn.c

When stimuli stop, the kernel switches to IDLE and runs housekeeping — digesting stats and nudging the self-improvement loop. The scaffolding for a "dreaming" kernel is in place.

today the idle work is a status digest plus the GA nudge — the metaphor is bigger than the code. Honest scaffold, not yet a dream.

05 / FIVE
🧬

Evolution

mechanism50%
scale10%

The most radical layer. The plumbing for a kernel that writes the kernel — compiled and deployed with no reboot — genuinely exists. The mind that drives it is still borrowed.

Kernels spread themselves
kserve.c

A diskless node broadcasts a load request; a running node serves its own kernel image in 1 KB chunks over UDP, and the new node boots into it. Real network self-distribution.

On-device compilation
tcc (ring-3 ELF)

The Tiny C Compiler runs as a normal ring-3 process on bare metal. Source on disk compiles to an i386 ELF that runs immediately — no cross-compiler, no host machine.

The self-evolution loop
claude_bridge.c
BORROWED

The kernel gathers its own state, asks for help, receives code, compiles it, and runs the new behavior — the full loop closes mechanically, with no reboot.

the intelligence that writes the new code is an external frontier model, reached over an HTTP bridge — not the cluster's own seed. The loop is real; the mind in it is on loan, by design, until the seed grows enough to take the pen. Today's README calls this exactly what it is: plumbing, not intelligence.

— Seeing the body survive

Kill a node mid-thought. Watch the swarm finish anyway.

This is the survival loop the CI enforces on every commit: while a distributed inference runs, a node is kill -9'd. The swarm completes the inference and reports its own degradation honestly.

Illustrative of the behavior asserted by the survival-loop CI job (see samples/13_survival_loop/) — not a captured transcript.

p-kernel> infer 31 88 12 40   # 3-node distributed forward (FULL)
[dkva] node0 partial → region sum
[dkva] node1 partial → region sum
[dkva] node2 partial → region sum
[swim] *** node2 unreachable — indirect probe via node0,node1 ***
[swim] node2 -> DEAD  (kill -9 mid-inference)
[degrade] FULL → REDUCED  (2 nodes alive)
[dkva] re-aggregating partials from {node0, node1}
[heal] node2 DEAD  heir=node0 (me) — guarded tasks inherited
[infer] class=2 (critical)  conf=91%  degraded(2/3)
p-kernel> # the answer arrived — and the swarm told the truth about how.
— Now, your turn

Be node #2.

Right now the cluster runs where I run it. A handful of nodes.
This OS only becomes real if it lives on machines I don't own. You don't need to flash anything or trust a vision — you can build it and watch a node light up today. The rest is honest about its timeline.

1
cluster, growing
🟢 Run it today LIVE
UMP — User-Mode p-kernel, the whole kernel inside one Linux process
  1. git clone the repo
  2. cd boot/linux_x86_64 && make
  3. run ./p-kernel — it boots to a shell with net, infer, dtr train, world
  4. point it at a relay and watch your node appear on the world map
🟢 The relay mesh LIVE
NAT-traversing, HMAC-authenticated — 6/6 tests green in CI
  1. cd relay && make
  2. make test — six security scenarios, all green
  3. stand up your own relay; nodes behind NAT find each other through it
🟣 Raspberry Pi image DESIGNED, NOT BUILT
Bare-metal AArch64 boots in QEMU today; a flashable SD image is the next milestone
  1. AArch64 bare-metal already boots to a shell under QEMU
  2. an p-kernel-pi.img for real hardware is planned, not ready
  3. ★ Star the repo to know when it's real — we won't pretend it is before then
🟣 Android app IN PROGRESS
NDK build + foreground service + relay mesh exist; Play Store is not yet
  1. the Android UMP (NDK native lib, relay-joining service) is real code in android/
  2. a one-tap Play Store install does not exist yet
  3. ★ Star to be notified — no fake "coming soon" buttons here
⭐ Star & build it → Read the honest README →