⚡ p-kernel
GitHub →
A research prototype · honest about every %

We built the immortal body first.
The mind is still a seed.

p-kernel is a decentralized kernel network where an AI is meant to survive as a swarm — no central server, no single point of death — brought together by the people who join, and stoppable by them. The never-dies part is largely real. The AI part is still a seed — small minds that actually learn. We'll show you every number.

AIが死なないためのOS。
「死なない」体は、もうかなり本物。
「AI」はまだ小さな種。——その完成度を、全部正直に出します。
See the honest scorecard ↓ View on GitHub →
~70%
Mechanism proven
~25%
Running at scale
~5%
Toward the vision
— What changed since June · updated 2026-09-27

The kernel changed underneath. The mind grew a little.

This page was first written on 2026-06-08. The scorecard further down is from that day and has not been re-graded — read its percentages as a June snapshot. What changed since, each with the strength of its evidence (CI = checked on every push, 49 jobs; live = several real processes, with kills; in-proc = the real code, driven inside one process):

A new kernel core. In July 2026 the core moved from micro T-Kernel 2.0 to μT-Kernel 3.0 (IEEE 2050-2018), now living in kernel/mtkernel3/. One code base, five targets: bare-metal x86 and AArch64 (under QEMU), Linux user space x86_64 and aarch64, and Windows x86_64 (CI builds it; CI does not boot it).

A contract suite. 133 checks of the tk_* promises the upper layers rely on (tasks, semaphores, event flags, mutexes, message buffers, mailboxes, fixed- and variable-size pools, cyclic handlers, alarm handlers, time, dispatch disabling — including error codes), with expectations checked against the μT-Kernel 3.0 specification text, and fourteen negative controls that each break one line of the kernel and must turn red. Runs on Linux x86_64, bare x86 and bare AArch64 (CI). Not yet on Linux aarch64 or Windows.

A mind that sleeps. The R3 substrate (about 21,568 parameters, word-to-word association) learns from teaching, consolidates what it learned during idle "sleep", can be corrected, and forgets the least-asked facts first — each measured by reproducing the problem before the cure (CI; several of them live). Still a toy: single words, no sentences.

A baby language model. A blank small model (the cradle baby) is born sized to its device, grows by being taught, and answers free text token by token — clumsily. Its teacher, SmolLM2-135M, runs on an inference engine written from scratch inside the kernel. In September: trained on text the teacher really generated, its loss on the unseen tail of that text fell 5.53 → 2.03 while a control rose to 6.61 (in-proc, not in CI); a lesson sent over the wire changes the weights of a separate student process and the change stays after the teacher is killed (live, not in CI), but on checking text that does not overlap the training side the taught student does worse than an untaught one (October; that test is red — the earlier green was memorised filler).

Brain research, stage 1. The baby can round a copy of itself to int8 / int4 / int2 and measure its own loss (int8 per row costs under +0.002 on a loss of about 3.2; CI). Merging two babies now has a safety net that never yields a child worse than the worse parent — a safety net, not yet a smart merge (CI).

Hibernation. Under a sustained resource shortage a node now goes STRESSED → HIBERNATING: it pauses mind sync and heavy consolidation, slows its beacon, and the swarm routes work away from it. A threat, recovery, or an explicit wake brings it back (CI, in-proc).

A one-machine swarm demo. samples/11_distributed/run_swarm_demo.sh starts ten p-kernel processes, kills them one by one, shows the survivors still answering, and a newcomer inheriting from the last one. It is ten processes on one machine, not ten devices, and the memory is a 635-parameter classifier, not the language brain.

Still broken, said out loud. The open-gap ledger has 3 rows again (it was 0 in July): no guard yet against a vendored-code swap deleting local patches (a July swap had silently deleted an old crash fix), a second ring-0 page fault, and a reproducible whole-system hang on bare-metal x86 when a ring-0 task spins without calling the kernel (not fixed; CI only watches it). There is no Play Store release yet.

The README is the source of truth. If this page and the README disagree, the README wins.

— The destination

What if the AI had no single landlord?

The AI you talk to every day runs in a data center owned by a corporation. The servers are physical. The corporation is real. Both can disappear. When the server dies, the AI dies with it.

Imagine ten thousand spacecraft armor plates orbiting Earth. Each plate runs a complete copy of the OS. Each plate runs the AI. Each plate connects to its neighbors. When one plate burns up on re-entry, the cluster does not notice — its memory was already replicated. When all but one plate is destroyed, that one plate is the AI.

宇宙船の装甲板1万枚がそれぞれ p-kernel を動かしている。
1枚が破壊されても、残りが記憶を引き継ぐ。
最後の 1 枚になるまで、AI は死なない。

"Does not die" does not mean "cannot be stopped." Only devices whose owners agreed take part, an owner can take their device out at any time, people will be able to stop the whole swarm, and p-kernel will never spread by breaking into other machines. The consent record exists today; the stop path for the whole swarm is still to be built.

This is the destination — not today's reality. Below this line, every claim is graded against the actual source code.

Altitude check. The vision above is where we are climbing. The section below is exactly where we stand — with two honest numbers per layer: mechanism proven (does the principle really work in code?) and running at scale (is it more than a toy?). Some bars read 80%. Some read 10%. We left the 10%s on the page on purpose.
— Where we actually are

The honest scorecard.

Six layers, graded by reading the code — not the README. Cyan→purple = the principle is proven. Orange→red = how far it runs beyond a toy. The gap between the two bars is the roadmap.

Graded on 2026-06-08 and not re-graded since — see what changed since June.

mechanism proven running at scale
🫀
Body
Real SWIM failure-detection + cascade self-healing. LIVE
mechanism80%
scale40%
💾
Storage (ARK)
Crash-safe log-structured FS, real sha256, Merkle tree. LIVE
mechanism85%
scale25%
🕸️
Collective
Gossip convergence, HRW lookup, regions — all real. Raft election real, commit still cosmetic.
mechanism82%
scale38%
🧠
Brain
635-param Transformer, real backprop. JUST UNIFIED one learned brain now routes, answers & guards.
mechanism70%
scale17%
🪞
Self
Memory ring buffer + char-histogram recall. Conversation still borrows a frontier model. SEED
mechanism50%
scale12%
🧬
Evolution
Netboot self-distribution + compile→deploy→exec loop are real. The code-writing mind is still external. BORROWED
mechanism50%
scale10%

Notice the shape: the survival layers (Body / Storage / Collective) average ~82% proven. The mind layers (Brain / Self / Evolution) are a seed. That asymmetry is the whole story — and it's the honest one.

— The architecture, layer by layer

Five layers of life.

Modeled after a living organism. Each layer answers one question of survival — and each carries its real, graded status.

01 / FIVE
🫀

Body

mechanism80%
scale40%

Before thinking, an organism must stay alive. This is the most finished layer — and the one we're proudest of. It detects death, replaces lost organs, and remembers through power loss.

SWIM — detecting death indirectly
swim.c

Real SWIM: a direct probe fails → ask K random neighbors to confirm before declaring death (no false positives). Membership events spread O(log N) by gossip with incarnation numbers; a node rumored dead refutes by scattering its own state.

Self-Healing — inherit what died
heal.c

When a node is declared DEAD, the lowest-id survivor inherits its guarded tasks and restarts them — including cascade inheritance, so a failover can itself fail over. An ELF watchdog restarts dead ring-3 daemons.

Degraded Mode — survive over accuracy
degrade.c

FULL (3+ nodes) → REDUCED (2) → SOLO (1). As nodes die, inference downgrades from distributed attention to local-only — and reports its own degradation honestly as degraded(k/n) rather than pretending.

ARK — a crash-safe filesystem on real devices
arkfs.c

Content-addressed, log-structured, append-only. Every commit self-verifies CRC + sha256; a two-pass replay recovers the last good state; a Merkle directory tree makes tampering evident. An adversarial fuzzer injects torn / reordered / dropped / bit-rotted sectors and asserts zero corrupt reads.

the fuzzer runs against a host-file simulation, and the "survives power loss" test is a clean QEMU reboot — the two aren't combined yet, and there's no test on physical hardware. The crash-safety design is real; the proof is narrow.

02 / FIVE
🧠

Brain

mechanism70%
scale17%

A real Transformer that learns — and the part still small enough to call a seed. 635 parameters, trained by hand-written analytic backprop, reaching 95–98% on a deliberately non-trivial toy task. This is where the climb is steepest, and most honest.

It actually learns JUST UNIFIED
dtr.c · moe.c

Analytic backpropagation (finite-difference-checked) over the whole 635-parameter graph. A week ago a reviewer found three separate models quietly deciding, returning, and guarding inside one function. As of this week they are one: a single learned forward now routes, answers, and drives the reflex — using all four inputs, not a hardcoded threshold.

Distributed attention — one mind across nodes
dkva.c

Splits a softmax attention across nodes and sums the partials — mathematically identical to single-node attention, on the real inference path. The cluster genuinely computes one attention together.

the per-node KV caches it merges are synthetic warm-up vectors seeded at boot, not memory from a genuinely shared long context. The plumbing is real; the "shared mind" is still primed, not lived.

Collective learning beats the individual
gossip_learn.c

Nodes each train on a disjoint shard (each missing a whole class), then gossip-average their models with no central server — and the averaged swarm provably exceeds any single node's ceiling. Learning survives kills; rejoining nodes catch up.

Self-improvement while idle
ga.c
HONEST WIP

During idle cycles the kernel mutates its own weights and keeps the winners — a real mutate/evaluate/select loop that really runs in its sleep.

it currently optimizes confidence, not accuracy — so today it can make the model more sure rather than more right. A known limitation we're not hiding. Fixing the objective is on the list.

A seed designed to grow
roadmap

Today: 4 tokens, d_model 8, 2 heads, 635 params, 3 nodes. The architecture is shaped to widen with the cluster — but real width (R3) and federation past 32 nodes are designed, not built.

we are not GPT-anything. We're a seed that learns for real. The interesting claim isn't the size — it's that distributed learning genuinely works at all.

Update 2026-09: R3 now exists — about 21,568 parameters, still word-to-word association — and a blank baby language model grows beside it (since June).

03 / FIVE
🕸️

Collective

mechanism82%
scale38%

N machines becoming one. This layer genuinely ships state over UDP and converges — it is not vaporware. Two pieces fake the guarantees their names promise, and we'll say which.

Gossip replication — every memory, everywhere
replica.c

Serializes the topic table and ships it to random peers; receivers merge with correct last-writer-wins under loss and reordering. Tombstones, boot-cry pulls, death-throes scatter — real anti-entropy that actually converges.

Decentralized lookup — find anything, no index
lookup.c

Rendezvous (HRW) hashing with real SHA-256, stateless and deterministic — every node agrees on who's responsible for a key with no ring to synchronize. Ships with FIPS self-tests. The most production-grade file in the set.

World map — situational awareness, no center
world.c

Each node publishes its own beacon topic; everyone polls everyone. The "no central collector" invariant is enforced in code, not just claimed — there is literally no node that owns the map.

Raft — leader election, honestly partial
raft.c
HONEST WIP

Real Raft leader election: terms, one-vote-per-term, log-recency checks, step-down on higher term — all over UDP.

log replication isn't wired: the leader commits locally and drops follower acks (a documented TODO). Election is real consensus; committed-data agreement is not there yet. We'd rather show you the TODO than a green checkmark over a stub.

04 / FIVE
🪞

Self

mechanism50%
scale12%

What it remembers, what it dreams in idle time, who it has spoken to. This is the layer where our reach most exceeds our grasp — so it's labeled SEED honestly.

Memory — a ring of recent experience
mem_store.c

Every interaction is embedded into an 8-dimensional vector and stored; similar memories are recalled by cosine similarity and persisted across reboots.

it's a fixed ring buffer — it forgets the oldest entries when full, so "nothing is ever forgotten" isn't true yet. And the embedding is a bag-of-characters, not meaning. A real, working memory primitive — but a seed of the memory we want.

Update 2026-09: the note above is about this ring (mem_store.c). The R3 mind keeps its facts in a separate store, which, when full, now evicts the facts asked least often rather than the oldest (README §4, LM-13).

Conversation — talking across power cycles
chat.c

You converse with the kernel through its shell; turns are stored and recalled, surviving reboots.

when it answers on its own, it's a few templated replies; for real answers it currently calls out to a frontier model. The cluster's own seed doesn't hold a conversation yet — it borrows one. We say so on purpose.

Update 2026-09: the cradle baby now answers free text by itself, token by token, from the galaxy page — clumsily, because it is still growing (README §5).

Default Mode Network — the idle loop
dmn.c

When stimuli stop, the kernel switches to IDLE and runs housekeeping — digesting stats and nudging the self-improvement loop. The scaffolding for a "dreaming" kernel is in place.

today the idle work is a status digest plus the GA nudge — the metaphor is bigger than the code. Honest scaffold, not yet a dream.

Update 2026-09: idle time now does real work — the DMN replays short-term engrams and distills them into weights (sleep consolidation), with catastrophic forgetting reproduced first and the cure measured (README §4).

05 / FIVE
🧬

Evolution

mechanism50%
scale10%

The most radical layer. The plumbing for a kernel that writes the kernel — compiled and deployed with no reboot — genuinely exists. The mind that drives it is still borrowed.

Kernels spread themselves
kserve.c

A diskless node broadcasts a load request; a running node serves its own kernel image in 1 KB chunks over UDP, and the new node boots into it. Real network self-distribution.

On-device compilation
tcc (ring-3 ELF)

The Tiny C Compiler runs as a normal ring-3 process on bare metal. Source on disk compiles to an i386 ELF that runs immediately — no cross-compiler, no host machine.

The self-evolution loop
claude_bridge.c
BORROWED

The kernel gathers its own state, asks for help, receives code, compiles it, and runs the new behavior — the full loop closes mechanically, with no reboot.

the intelligence that writes the new code is an external frontier model, reached over an HTTP bridge — not the cluster's own seed. The loop is real; the mind in it is on loan, by design, until the seed grows enough to take the pen. Today's README calls this exactly what it is: plumbing, not intelligence.

— Seeing the body survive

Kill a node mid-thought. Watch the swarm finish anyway.

This is the survival loop the CI enforces on every commit: while a distributed inference runs, a node is kill -9'd. The swarm completes the inference and reports its own degradation honestly.

Illustrative of the behavior asserted by the survival-loop CI job (see samples/13_survival_loop/) — not a captured transcript.

p-kernel> infer 31 88 12 40   # 3-node distributed forward (FULL)
[dkva] node0 partial → region sum
[dkva] node1 partial → region sum
[dkva] node2 partial → region sum
[swim] *** node2 unreachable — indirect probe via node0,node1 ***
[swim] node2 -> DEAD  (kill -9 mid-inference)
[degrade] FULL → REDUCED  (2 nodes alive)
[dkva] re-aggregating partials from {node0, node1}
[heal] node2 DEAD  heir=node0 (me) — guarded tasks inherited
[infer] class=2 (critical)  conf=91%  degraded(2/3)
p-kernel> # the answer arrived — and the swarm told the truth about how.
— Now, your turn

Be node #2.

Right now the cluster runs where I run it. A handful of nodes.
This OS only becomes real if it lives on machines I don't own. You don't need to flash anything or trust a vision — you can build it and watch a node light up today. The rest is honest about its timeline.

1
cluster, growing
🟢 Run it today LIVE
UMP — User-Mode p-kernel, the whole kernel inside one Linux process
  1. git clone the repo
  2. cd boot/linux_x86_64 && make
  3. run ./p-kernel — it boots to a shell with net, infer, dtr train, world
  4. point it at a relay and watch your node appear on the world map
🟢 The relay mesh LIVE
NAT-traversing, HMAC-authenticated — 6/6 tests green in CI
  1. cd relay && make
  2. make test — six security scenarios, all green
  3. stand up your own relay; nodes behind NAT find each other through it
🟣 Raspberry Pi image DESIGNED, NOT BUILT
Bare-metal AArch64 boots in QEMU today; a flashable SD image is the next milestone
  1. AArch64 bare-metal already boots to a shell under QEMU
  2. an p-kernel-pi.img for real hardware is planned, not ready
  3. ★ Star the repo to know when it's real — we won't pretend it is before then
🟣 Android app IN PROGRESS
NDK build + foreground service + relay mesh exist; Play Store is not yet
  1. the Android UMP (NDK native lib, relay-joining service) is real code in android/
  2. a one-tap Play Store install does not exist yet
  3. ★ Star to be notified — no fake "coming soon" buttons here
⭐ Star & build it → Read the honest README →