🇬🇧 English · 🇯🇵 日本語 · 🇨🇳 中文 · 🇮🇹 Italiano · 🇫🇷 Français · 🇩🇪 Deutsch · 🇪🇸 Español · 🇸🇦 العربية

axonos.org · Specifications · SDK · Research · Articles · connect@axonos.org

AxonOS is a hard real-time neural operating system for brain–computer interfaces. Open-source kernel in #![no_std] Rust on ARM Cortex-M. Formally bounded worst-case response time. Structural privacy that the application layer cannot bypass.

It is not an AI-agent framework, not a chatbot runtime, not a generic Python SDK, and not a token project. Everything below the application — the timing guarantees, the neural-permission model, the consent state machine — is specified, openly licensed, and built to be independently verified.

Applications should receive typed, consent-bound intent events — never unrestricted raw neural streams.

Nothing here asks for trust. Every claim is runnable in one click or three commands, and each prints a pass/fail you can check.

One click

• ▶ Play it — Neural Boundary Game: the consent, least-privilege, sealed-vault and StimGuard model, live in the browser on the same deterministic core the kernel uses. Every run emits a byte-for-byte replayable proof.
• 📄 Read the analysis — Zenodo preprint (DOI 10.5281/zenodo.20552007): EDF schedulability (R1 = 972 µs inside a 4 ms deadline), capability isolation, falsifiable predictions — predicted from datasheet cycle counts, no measurement claims.

Three commands — clone and run; each is reproducible on any machine

# 1 · the full path, electrode -> typed intent, verified bit-for-bit
git clone https://github.com/AxonOS-org/axonos-e2e-demo && cd axonos-e2e-demo && ./run.sh --verify

# 2 · the kernel: 72 tests, then a machine-checked proof
git clone https://github.com/AxonOS-org/axonos-kernel && cd axonos-kernel
cargo test --workspace
cargo kani setup && ( cd axonos-spsc/kani-proofs && cargo kani )

# 3 · the DSP + classifier machinery, bit-exact against conformance vectors
git clone https://github.com/AxonOS-org/axonos-signal-pipeline && cd axonos-signal-pipeline && cargo test

Three more, added as the stack grew — each answers a different kind of doubt

# 4 · the organs running as one body: electrode -> vault -> posture, from a seed
git clone https://github.com/AxonOS-org/axonos-stack && cd axonos-stack
cargo run --locked --bin session -- --seed 7 --frames 3000 | diff - reference/session-7.txt
# silence means the transcript reproduced byte for byte on your machine

# 5 · the relevance score behind the public map, recomputed from its own evidence
git clone https://github.com/AxonOS-org/axonos-brs && cd axonos-brs && cargo test
# 20 vectors are real projects with their published evidence and pinned scores

# 6 · who wrote the automated commits on the live map, and whether GitHub signed them
gh api repos/AxonOS-BCI/axonos-community-radar/commits \
  --jq '.[0:10][] | "\(.commit.verification.verified)  \(.author.login)"'

The fourth is the one worth dwelling on. The reference session is not a demo of a happy path: the simulated front end lifts an electrode at 4.8 s, and the transcript records the system withdrawing the right to actuate 96 ms later while continuing to record. The last line is an accounting identity — delivered + lost = produced — and if it ever fails, one of the three components is lying about what it saw. CI diffs that transcript on every push, so a dependency that changes observable behaviour fails the build with a diff of exactly what moved.

One wire format, five languages, byte-identical — axonos-conformance re-checks Rust = Python = C = JavaScript = Java in CI on every push.

What you are checking: the proofs are machine-checked (L1); the demos are deterministic and reproducible; the on-hardware worst-case numbers (L2) are not yet claimed — their status is tracked, claim by claim, in CLAIMS.md.

A verification story is only worth reading if it has failures in it. These are this month's, with the measurement that produced each. They are here because a project that publishes only its successes has put its failures somewhere else.

A timing assumption refuted by our own published data. The admission test for the real-time chain omitted blocking and interference — a normal simplification, and here a wrong one. RFC-0001 publishes two figures measured on the same board: the admitted task set sums to 694.2 µs, and the end-to-end worst case is 972 µs. The 277.8 µs between them — 28.6 % of the budget, of which at most 6.5 µs is jitter — is precisely the terms the test was leaving out. The assumption was not merely undischarged; it was contradicted by our own measurement, and nobody had subtracted the two numbers. RFC-0008 §4a

A score that could not rank. The public map's relevance score is displayed on every card and decides what is on the map at all. Measured across 117 scored projects it took nine distinct values: 19 % sat at exactly 100 and 31 % at exactly the inclusion gate. It was a category label wearing a number. Replacing the combiner — saturating instead of summing and clamping — produced 35 distinct values with the ceiling empty and the gate unchanged. axonos-brs

Two bounds that disagreed, found only by running the parts together. The privacy vault issues grants denominated in bits; its audit log holds 64 entries; and it refuses to release anything it cannot record. A 3 200-bit grant was therefore capped at 2 048, so the number written in the grant was not the one that stopped it and no reader could tell. Both behaviours were individually correct and individually tested. Only the integration session surfaced the disagreement — which is the argument for having one. RFC-0009 §N5

An unpaid side channel in a boundary that exists to have none. The same vault refused a request when its window was empty — a refusal that depends on the data rather than on the caller's permissions, so a caller could ask "is this device recording?" for free and without limit, outside the information budget entirely. Now the probe is charged: a thousand attempts against a 128-bit grant yield four answers and then a refusal.

Each of these is written up where it belongs, with the deviation recorded against the specification that names it. Neither RFC-0008 nor RFC-0009 may leave draft status while its own conformance table still lists an unmet requirement.

Most projects tell you what they claim. Almost none tell you where to push. The list below is where a determined sceptic should look, what specifically would falsify each claim, and — where the answer is already known — what has been found. It is not a hedge; it is the shortest path to being right about us.

The real-time guarantee. The published worst case is 972 µs against a 4 ms deadline. It rests on a task set of 694.2 µs plus 277.8 µs of terms measured but not modelled, and on the assumption that the acquisition chain is the only work on that core. Falsified by: an oscilloscope trace on an STM32F407 showing a response beyond 4 ms under any load the design admits, or a demonstration that the chain can be preempted by work the analysis does not count. The L3 fixture that would settle this does not exist yet, and the RFC says so rather than implying otherwise.

The alignment result. R̄^{-1/2}(P G_c Pᵀ)R̄^{-1/2} = U G_c Uᵀ with U orthogonal — alignment reduces inter-subject difference to a rotation and cannot remove it. Falsified by: a whitener satisfying W R Wᵀ = I that removes the residual rotation, which would contradict the polar decomposition, or an arithmetic error in the derivation. Verified numerically to 1e-7 on random SPD inputs; the algebra is three lines and is written out in full.

The information bound. For a grant of β bits, the mutual information between the sealed window and everything an application learns is at most β. Falsified by: a channel that carries information across the boundary without being charged. One such channel was found and closed — a refusal that depended on the window let a caller poll device liveness for free — and RFC-0009 §7 enumerates the remaining ones it knows about. If you find another, that section is wrong and should say so.

The determinism. Same seed, same bytes, any machine. Falsified by: one run of cargo run --locked --bin session -- --seed 7 --frames 3000 on your hardware that does not diff clean against the checked-in transcript. This is the cheapest attack on the list and the one we would most want to hear about.

Cross-language agreement. One wire format decoded identically in Rust, Python, C, JavaScript and Java. Falsified by: an input on which any two implementations disagree by a byte. The vectors are public; the disagreement would be a bug report we could not argue with.

What is not claimed, so cannot be falsified here. No accuracy figure. No transfer property. No latency or power measured on hardware. No clinical claim of any kind. If you find any of those asserted anywhere in these repositories, that is a defect and we want the issue.

Every quantitative figure this organisation publishes, its evidence level, and the artefact it derives from. L1 is formally proven, L2 measured on reference hardware, L3 independently reproduced. A figure absent from this table is a figure we do not publish.

The distinction in the first two rows is the one that matters and the one most often collapsed. ≤ 1000 µs is proven; 972 µs is the worst thing anyone has seen. A proof and an observation are different kinds of statement, and until the raw traces land in axonos-validation no measured performance figure is claimed here — the L2 rows are held as publication-pending and graded in CLAIMS.md. L3 independent reproduction is not claimed for anything.

Not in this table, and therefore not claimed: classification accuracy, information transfer rate, power draw, on-hardware end-to-end latency in a deployment, session length, electrode count in real use.

The AxonOS Community Radar continuously maps every open-source brain–computer-interface project, tool and team building in the open — AxonOS included, ranked by the same public-signal formula as everyone else, with no boosting.

📊 The State of Open BCI — read the full report →

_{One click for the exhaustive view — a Gartner-style reach×engagement quadrant, category and evidence breakdowns, and a full table of all 120 tracked resources. Currently leading by reach: omi · wukong-robot · mne-python · NeuroKit. Auto-refreshed from the radar every 3 hours · last update 31 Jul 2026, 11:48 UTC.}

The consent layer's proof files read like the promises they keep — fsm_no_invalid_transitions.rs · handle_withdraw_terminates.rs · co_authorisation_requires_two_parties.rs · signature_verification_constant_time.rs · cbor_decoder_bounded.rs — five machine-checked Kani harnesses; the kernel's thirty are re-proved at every release gate.

Three honest paths, depending on what you want.

The repositories are not a list — they are organs of one body, and each one exists because the body needs that function:

flowchart TB
    subgraph LAW["Law — what must hold"]
        STD[axonos-standard]
        RFC[axonos-rfcs]
        VALID[axonos-validation]
    end
    subgraph SKEL["Skeleton — where software meets silicon"]
        HAL[axonos-hal]
        VAULT[axonos-vault]
        SUP[axonos-supervisor]
    end
    subgraph CORE["Core — the running body"]
        GW[axon-bci-gateway] --> SP[axonos-signal-pipeline] --> K[axonos-kernel]
        K --> CO[axonos-consent] --> PR[axonos-protocol]
        SW[axonos-swarm] -.-> PR
    end
    subgraph LIMBS["Limbs — how applications touch it"]
        SDK[axonos-sdk]
        SDKP[axonos-sdk-python]
        SDKS[axonos-sdk-swift]
    end
    subgraph IMMUNE["Immune system — byte-drift is rejected"]
        CONF[axonos-conformance]
        E2E[axonos-e2e-demo]
    end
    subgraph SENSES["Senses — the field, observed"]
        RADAR[axonos-community-radar]
    end
    subgraph SKIN["Skin — where people first touch it"]
        SITE[axonos.org]
        NBG[neural-boundary-game]
        BTB[become-the-brain-os]
    end
    HAL --> VAULT --> SP
    HAL --> SUP
    SUP -. gates the right to act .-> K
    LAW --> CORE
    SKEL --> CORE
    CORE --> LIMBS
    LIMBS --> IMMUNE
    RADAR -. observes the whole field, AxonOS included .-> SKIN

    classDef law fill:#0a4a8f,stroke:#0a4a8f,color:#fff
    classDef sense fill:#0d7a5f,stroke:#0d7a5f,color:#fff
    classDef skel fill:#5b3a8f,stroke:#5b3a8f,color:#fff
    class STD,RFC,VALID law
    class RADAR sense
    class HAL,VAULT,SUP skel

The skeleton is where the body meets the world: the HAL guarantees a sample is real, the vault guarantees it stays, and the supervisor decides whether anything may be acted on. The law constrains the core; SDK limbs give applications a typed grip on it; the conformance immune system rejects byte-drift across five languages before it spreads; the radar is the organism's senses — a living, scored map of the whole open-BCI field in which AxonOS ranks by the same formula as everyone else; the games and the site are the skin where people first touch it. Remove any organ and something specific stops working.

Source under Apache-2.0 OR MIT, specifications under CC-BY-SA-4.0. Every repository below is public and has one role. One component in the wider ecosystem is private by design — the scoring engine behind the community radar; its inputs, outputs, methodology and that boundary are stated openly on the radar itself.

	Repository	Role	Language	Latest
⬢	axonos-standard	Normative architecture — the canonical technical standard	Markdown
⬢	axonos-rfcs	Design-change process — numbered engineering RFCs, normative once finalised	Markdown	active
⬢	axonos-kernel	Execution substrate — hard real-time microkernel, formally bounded WCRT	Rust
⬢	axonos-sdk	Application boundary — typed intents, capability manifests, kernel ABI v1	Rust
⬢	axonos-sdk-python	Application boundary (Python) — RFC-0006 wire format, byte-compatible with the Rust SDK	Python
⬢	axonos-sdk-swift	Application boundary (Swift) — typed neural intent streams, ABI v1, async/await + Combine	Swift	active
⬢	axonos-hal	The contract with silicon — sample frames, a timing budget that refuses configurations whose deadline the measured chain cannot meet, explicit degradation semantics; no_std, zero-alloc	Rust
⬢	axonos-vault	The privacy boundary — raw samples are unreadable by construction; only bounded, purpose-bound, budgeted reductions leave, and every one is recorded	Rust
⬢	axonos-supervisor	The right to act — signal-quality posture gating actuation, never acquisition; degradation immediate, recovery earned, Safe terminal until a human resets	Rust
⬢	axonos-stack	The reference session — the three organs above wired together, deterministic from a seed, with a byte-exact transcript diffed in CI	Rust
⬢	axonos-consent	Consent / co-authorisation subsystem — #![no_std] reference crate	Rust
⬢	axonos-protocol	Network-level consent protocol — no_std, zero-alloc, bounded CBOR frames and an exhaustive consent state machine	Rust
⬢	axonos-conformance	Byte-exact conformance — RFC-0005 capability manifest & RFC-0006 intent wire format, cross-checked across Rust, Python, C, JavaScript, Java in CI	multi	active
⬢	axonos-signal-pipeline	Signal pipeline — fixed-point DSP filter bank, features, MDM/LDA classifier inference, calibration; vector-pinned, no trained model	Rust
⬢	axonos-e2e-demo	End-to-end reference — synthetic signal -> typed consent-bound intent, verified bit-for-bit on every run	Python	active
⬢	axonos-validation	Evidence and trace record — measurement traces and reference post-processing	Python	record
⬢	axon-bci-gateway	Acquisition bridge — OpenBCI fork, MIT preserved from upstream	HTML
⬢	axonos-swarm	Long-horizon distributed timing — multi-node Neural PTP coordination	Rust
⬢	AxonOS	Public entry point — landing, concept, and links into the stack	—	—
⬢	become-the-brain-os	Community front door — browser game that teaches the runtime, no install	HTML/JS
⬢	neural-boundary-game	Interactive demo — deterministic Rust/WASM model of the sovereignty architecture (consent, least-privilege scopes, sealed vault, StimGuard), playable in-browser, byte-for-byte replayable	Rust/WASM
⬢	axonos-community-radar	The organism's senses — a living, scored map of the open-BCI field (120 projects, refreshed ~3 h); AxonOS ranked by the same formula as everyone else	Python/JS

neural-boundary-game and axonos-community-radar live in the AxonOS-BCI account. The game ships under AGPL-3.0-only OR AxonOS Commercial — it is the application-layer demo, not part of the permissive Apache/MIT core.

A complete brain–computer interface operating system is a continuous chain — from a raw electrode signal to a typed, consented intent, and back to a safe failure state. AxonOS is building that chain in the open. This map is deliberately honest about what is shipped, what is partial, and what is still ahead.

The execution core, the consent and capability layer, and the conformance surface are in place. To be a full operating system — not only a standard and a kernel — AxonOS still needs, and is sequencing on its roadmap:

Closed since this list was written:

• the acquisition contract — axonos-hal defines what a sample is, what time the chain may take, and what happens when the hardware misbehaves. Half of an item: the contract and a simulated backend exist; a register-level ADS1299 driver does not, and the OpenBCI bridge above is still the only path to physical silicon;
• the deterministic simulator running the full path without hardware — axonos-stack wires the organs into one seeded session whose transcript is byte-exact and diffed in CI;
• the privacy-vault enforcement layer — axonos-vault makes raw samples unreadable by construction and meters every reduction that leaves against a declared information budget, because a permission answered per request is defeated by asking many times.

Still needed, and sequenced on the roadmap:

• a trained model and measured accuracy / latency / power for the fixed-point DSP and classifier machinery already shipped in axonos-signal-pipeline — the pipeline is implemented and vector-pinned; what is pending is a trained model and on-hardware numbers;
• secure boot, firmware attestation and signed update — the canonical hardware carries an ATECC608B secure element that no software in this organisation currently uses. For a device that reads a brain, unauthenticated firmware is the largest single hole in the design;
• power and energy management — and, specifically, its interaction with the timing proofs: a frequency or sleep-state transition changes worst-case execution time, so axonos-hal's budget must be re-closed at every transition rather than assumed across it;
• a structured safety case (hazard analysis, FMEA, residual-risk argument) and a formal threat model for cognitive data — as engineering artifacts, not regulatory claims;
• a public conformance program and an independent-implementer challenge — the real test of a standard is whether a stranger can build a byte-compatible kernel and SDK from axonos-standard and the RFCs alone, with no access to this source, and pass axonos-conformance unchanged. That is the bar AxonOS is building toward;
• a path from founder-led to foundation / technical-steering governance.

These are roadmap items, not present capabilities. They are published here so the distance between today's reference implementation and a complete, independently implementable BCI operating system is visible rather than hidden.

flowchart LR
    A[EEG/EMG sensors<br/>ADS1299 · 24-bit] -->|raw| B[Acquisition gateway<br/>nRF52840]
    B -->|filtered| C[AxonOS kernel<br/>Rust no_std<br/>Cortex-M4F]
    C -->|WCRT ≤ 1 ms, proven L1| D[Cognitive scheduler]
    D -->|typed intent| E[Application<br/>via SDK]
    F[Cognitive Hypervisor<br/>TrustZone-S] -.->|isolates| C
    G[Consent FSM<br/>axonos-consent] -.->|gates| D

    classDef kernel fill:#0a4a8f,stroke:#0a4a8f,color:#fff,stroke-width:2px
    classDef secure fill:#0d7a5f,stroke:#0d7a5f,color:#fff,stroke-width:2px
    class C kernel
    class F,G secure

Every arrow is a contract. The Standard defines what must hold at each boundary; an implementation is free in everything else.

git clone https://github.com/AxonOS-org/axonos-sdk
cd axonos-sdk
cargo test --features std

use axonos_sdk::{Capability, IntentStream, Manifest};

let manifest = Manifest::builder()
    .app_id("com.example.cursor")?
    .capability(Capability::Navigation)
    .max_rate_hz(50)
    .build()?;

let mut stream = IntentStream::connect(&manifest)?;
while let Some(obs) = stream.try_next()? {
    println!("{:?} @ {} µs ({}%)",
        obs.kind(),
        obs.timestamp().as_micros(),
        obs.confidence_percent());
}

The SDK is the Rust reference binding. C FFI, Python, WebAssembly, JNI, and Swift bindings are on the published roadmap.

AxonOS does not currently claim, and this organisation must not be read as claiming:

• FDA clearance, CE marking, or medical-device approval in any jurisdiction;
• clinical efficacy, or independent clinical validation;
• certified medical-device status, or production-implant readiness;
• complete compliance with IEC 62304, ISO 14971, or ISO 13485.

These are possible future milestones. They are not present facts, and the project records them as such.

• Specifications — kernel ABI v1, capability catalogue, IntentObservation wire format, RFC index
• SDK and language bindings — Rust today; C FFI, Python, WebAssembly, JNI, Swift on the published roadmap
• Standards engagement — IEEE P2731 · IEC 62304 · ISO 13485 · FDA 510(k) · EU MDR
• Governance — current state, transition plan, trademark policy
• Engineering memo — three-page summary for technical readers
• Preprint — An Analytical Microkernel Design for Safety-Critical Brain–Computer Interfaces: Schedulability, Capability Isolation, and Falsifiable Predictions (Zenodo, DOI 10.5281/zenodo.20552007, CC-BY-4.0) — analytical schedulability (R1 = 972 µs in a 4 ms deadline), capability isolation, falsifiable predictions P1–P5; no measurement claims
• Long-form articles — 42+ pieces, one per major architectural decision

AxonOS ships a CITATION.cff, so every repository in the organisation exposes a "Cite this repository" button. For the peer-readable analysis, cite the preprint:

@article{axonos2026microkernel,
  title   = {An Analytical Microkernel Design for Safety-Critical
             Brain--Computer Interfaces: Schedulability, Capability
             Isolation, and Falsifiable Predictions},
  author  = {Yermakou, Denis},
  year    = {2026},
  doi     = {10.5281/zenodo.20552007},
  url     = {https://doi.org/10.5281/zenodo.20552007},
  note    = {Analytical bounds; predictions P1--P5; no measurement claims},
  license = {CC-BY-4.0}
}

The preprint is analytical and falsifiable — it states, up front, the findings that would prove it wrong. If you reproduce or refute any bound, the project wants to hear it: connect@axonos.org.

The AxonOS Project

axonos.org · connect@axonos.org · LinkedIn · Medium

Singapore · Zurich · Berlin · Milano · San Mateo

Built with Rust. Verified with Kani. Aimed at hard real-time.