A secure place to serve a model.
BraiNIX is a security-first microkernel built to serve LLM inference securely to remote clients. The security model is the product — capabilities, W^X, measured boot, and a dependency closure of itself, turned outward against hostile clients, hostile prompts, and model compromise. Every guarantee is enforced by the design, never by what an attacker doesn’t know.
First principles
These decide every tradeoff. When they conflict with convenience, convenience loses.
Least authority
Nothing holds a capability it does not need, and no capability is ambient. A remote client is granted only its own session.
Fail closed
Absence of an explicit grant is denial. A malformed request, a corrupt model blob, an error path that cannot prove safety — all deny.
Structure over secrecy
Security is a property of the design, enforced by the capability model, the type system, or a machine-checked proof — never by what an attacker doesn’t know.
Minimize & name the trust
The set of components that can violate security is small, written down, and justified. Every client, every prompt, every model token is treated as hostile.
Every claim is falsifiable
A property that is asserted but not checked does not count as enforced. If it isn’t verified, it isn’t a guarantee.
The model gets all the compute. It gets none of the authority.
The contract
Each invariant is named, documented, and individually checkable. Asserted is not enforced.
No ambient authority. Every server’s capability set is frozen at launch; capabilities are unforgeable typed tokens. A client is granted only its own session.
W^X holds for every page, always. No dynamic kernel heap — fixed pools only. Model weights and KV-cache live in fixed reserved regions, never a growing allocator.
Inter-process communication is synchronous rendezvous only. No shared-memory IPC and no async queues exist in tree.
Every release is measured into the TPM, reproducibly built, and Ed25519-signed — with predicted PCRs published before the artifact ships.
Inbound clients are mutually isolated — none can name another’s session, weights, or KV state. The request decoder is a fail-closed, zero-allocation hostile-input parser.
The served model is a confined tenant, never a trusted authority. Weights are integrity-checked; it cannot escalate, read another session, or reach the network outside the serving channel — even under adversarial prompting.
The observe-only auditor watches the serving stack and reports — nothing else. It holds no spawn, kernel-mutation, or network capability; its compromise costs visibility, never privilege.
Accelerator DMA is confined by the IOMMU; the GPU driver is an ordinary capability-bounded server. Inference is CPU-first; GPU is a later hardware milestone.
Architecture
The smallest possible ring-0 surface. Everything else is an isolated, bounded userspace process.
Microkernel core
Drivers, filesystem, network stack, the serving front end, and the inference engine all run in userspace. Ring 0 holds only what cannot live anywhere else.
Secure serving path
An authenticated, capability-gated inbound protocol — in-tree Ed25519 / X25519 / ChaCha20-Poly1305 — with mutually isolated per-client sessions and a fail-closed request parser.
Confined inference engine
A no_std transformer runtime. The served model gets all the compute and reserved memory it needs, weights in fixed regions — and zero authority.
Capability-mediated everything
No ambient authority. Every resource is reached through an unforgeable, typed, bounded, revocable token.
KPTI & W^X, structurally
The kernel is never mapped in user page tables. No page is ever simultaneously writable and executable — anywhere.
Multi-arch by design
A hardware abstraction layer targets x86-64 and aarch64 servers as compile-time backends — one kernel, more metal.
Decomposed network stack
Link, IP, and transport run as three separate isolated servers, chained only by synchronous IPC. Containment is the default.
Measured, reproducible boot
Bootloader through kernel is measured into the TPM and Ed25519-signed, reproducibly built from source the project owns.
Hard lines
Do not cross without explicit sign-off. These are not preferences.
- — No ambient authority anywhere. Capability sets are frozen at launch.
- — W^X enforced globally and structurally. No page is ever writable and executable.
- — Synchronous rendezvous IPC only. No shared memory, no async queues.
- — No dynamic kernel heap. Fixed-size pool allocators only — model weights included.
- — The dependency closure only ever shrinks toward zero external code. The inference engine and drivers are written in-tree.
- — The served model and every remote client are untrusted. No path to security depends on attacker ignorance.
Non-goals: POSIX compatibility · dynamic loading · ambient authority · treating the served model or any client as trusted · telemetry or phone-home of any kind · and any security argument that rests on obscurity.