GLaDOS OS

An operating system written from nothing, in Rust, for one specific laptop. It boots as a UEFI application, runs entirely in ring 0, and has a language model living inside the kernel. There are no processes, no syscalls, and one address space. A tool call from the model is a function call.

The tree is 108 files and roughly fifty thousand lines. The only code in the kernel that was not written here is Rust core and one file of RTL8188EU initialisation tables taken from Linux, which says so at the top of itself.

The structural choice

Most systems that put a model near an operating system put it in a process, hand it a shell, and let it type. That design has an interesting property: every capability the model has is mediated by text, and text has to be generated, parsed, and validated at each crossing.

Removing the privilege boundary removes the reason for any of that. The sampler can read the live applet table while it is choosing the next token, so an applet that does not exist is unreachable during generation. The model's answer is an index into a table that is already in memory. Nothing is rendered into a prompt and nothing is parsed back out.

What that costs is described plainly on the ring 0 page. There is no isolation here of any kind, and the documentation says so in every place a reader might otherwise assume otherwise.

Boot

UEFI already delivers long mode, CPL 0 and an identity map, so the UEFI application is the kernel. There is no ELF loading, no relocation, and no handoff ABI. The model, the tokenizer and the root certificate bundle are read before ExitBootServices, because that is the last moment a filesystem exists. Everything after that runs on page tables the kernel built for itself.

Boot prints twenty self-test sections. Thirteen of them can be re-run on demand with diag. Reading that output is the test suite, and it has caught real breakage more than once while somebody was grepping it down to the section they were working on.

What is in it

• The model. Qwen3-0.6B at int8, around 570 MB, referenced in place, with no copy on the heap. SmolLM2-135M is the small checkpoint for emulator work. Qwen3.5 hybrids load through a separate layer-major format.
• Aiksi, the system language. Everything above the kernel is written in it. Source to tokens to AST to evaluation, with an allowlist of builtins and a capability gate that fits on one screen.
• A desktop. Windows 98 icons and Start menu over Windows 3.1 bevels, composed into a heap back buffer and presented by row-span diff. Paintbrush, Write and Minesweeper are real applications with their own client areas.
• A network stack from ARP up to TLS 1.3, all of it written here, with the certificate validation reporting what it established and saying so.
• Content-addressed storage on NVMe, objects named by the hash of their contents, snapshots as a single root hash, writes locked to a claimed range by default.
• A self-modification loop that proposes changes to the machine's own routing, adapters, skills and configuration, and adopts one only when four independent judges agree.

Results worth knowing about

Several of the more interesting numbers here came from measurements that contradicted a confident argument, and those are the ones worth publishing.

• The closed-form router beats the transformer at choosing tools. A ridge regression over one hidden state, 12,672 parameters, about 1.6 ms and no forward pass, with better held-out accuracy than decoding the applet name under a grammar.
• Three cores vote and their agreement is the signal. When all three agree they are right 90.3% of the time. When they split, 50%.
• The console was the dominant cost of a frame because blank cells were being painted one pixel at a time under a background that had just been filled. Fixing that took a repaint from 2,376 us to 1,629 us.
• An Aiksi step costs about 14 ns. That was measured for the first time recently, and it refuted the plan that asked for it: a routing vote spends 20 steps against a budget of 20,000, and the tree walk was never the cost. Three rounds of removing allocations made a vote 2.9 times faster.
• QEMU with the Windows hypervisor runs this about 160 times faster than emulation. Everything previously treated as needing real hardware was an untested assumption about the emulator.