Overview

Bastion is a security-first x86-64 operating system being rewritten into its own language. The kernel boots on real hardware via UEFI over a hand-written assembly machine floor. Above that floor, the system is progressively being moved off Rust and into Vulkgryph (.vg) — a language designed for machine consumers rather than human readability, with explicit state and no hidden control flow.

The goal is stated as a removal target rather than a feature list: no Rust participating in compiling .vg, generating machine code, writing ELF, or running in the kernel. Assembly, a linker, and archive tools may remain — the objective is Rust-free, not toolchain-free. That target is not met yet. The sections below state where it actually stands.

Bastion is long-horizon systems work, not a near-term product, and there is no release date. Its audience is environments where deterministic execution, auditability, and a small attack surface matter more than ecosystem breadth. See the Bastion research perspective for deeper detail on the x86-64 implementation.

Components

  • x86-64 native kernel

    Primary and only active deployment target. Boots on real hardware via UEFI, with a hand-written assembly core, interrupt tables, context switching, syscall trampolines, and atomics. The image currently under proof is deliberately narrow: scheduler, paging, allocator, APIC timer, PCI configuration and ACPI tables, over a serial console, linking seventeen .vg services. Driver work done earlier — Ethernet with TCP/IPv4/ARP and a guarded shell, live kernel replacement without a full reboot, 802.11 wireless, USB/xHCI, IOMMU/VT-d, keyboard and framebuffer — exists as .vg services but is not linked into that image, and the runtime module system that once loaded such code was removed in the same reduction. The narrowing is the method, not a setback: the scheduler is being qualified boundary by boundary before the surface grows back.

  • Vulkgryph (.vg) language and compiler

    The language the OS is being rewritten into, with its own compiler and x86-64 code generator. Just over 100,000 lines of .vg across the language repository, of which about 33,600 lines are the kernel services the running kernel links against. Earlier material called this language Substrate; that name is retired.

  • Rust displacement in the kernel

    Kernel Rust currently stands at about 6,750 lines, down from a peak near 26,600 in August 2026, as subsystems move to .vg and the superseded Rust bodies are deleted rather than left in place. Scheduling, timer and interrupt sequencing, exception containment, paging, ACPI parsing, and the IOMMU path have all moved across. The count is not monotonic and is not treated as a target: it rose slightly in October because new structural security was written in Rust first, which is the right order when the alternative is porting an unproven mechanism.

  • Object provenance

    Kernel builds are native-only: the build refuses to run without prebuilt .vg objects. A natively compiled object is accepted only if it is byte-identical to the one produced by the Rust reference compiler, and otherwise the reference output is used. This keeps the two paths honest against each other. The compiler does reach a self-hosting fixpoint, and has been shown to emit the kernel's objects byte-for-byte identically to the Rust reference; a separate link driver reproduces the final kernel image without Rust orchestrating the link. What is not yet true is the shipped pipeline running without the reference at all — where a proven native object is not present, the reference output is still used. The capability is demonstrated; full self-hosting is still not claimed.

  • Boundary verification

    Each subsystem moved to .vg gets a boundary status record naming its baseline commits, the tested kernel hash, and what it does not claim. All twenty-seven currently stand qualified across five consecutive runs on real hardware rather than in emulation. The wireless work qualified this way before the current reduction reached a secured WPA3-SAE association; the wireless data path was never reached.

  • Legacy bytecode substrate

    An earlier portable bytecode runtime, with its own instruction set, journaling filesystem, process services, syscall ABI, and security core, was declared legacy in July 2026 and is deliberately out of scope. It may be revived and converted to .vg later. Current work does not depend on it.

Current focus

Active work is removing Rust from the kernel's scheduler and interrupt handling — timer rescheduling, interrupt sequencing, exception containment and unwind, authenticated IPC timeout accounting, and resume selection — with each step qualified on real hardware before the superseded Rust is deleted. As of late October the scheduler's charge decisions are decided in .vg rather than merely checked against it, which makes this the first part of the kernel where the new language holds authority instead of shadowing the old one. The frontier now is the remaining Rust in that path and the swap of the build system itself. Alongside that, structural security is being folded into the same completion pass — mechanisms that make a weakness impossible rather than detected. The remaining scope of this conversion was enumerated and frozen in October 2026, so finishing it means closing a known list rather than discovering one; the adversarial matrix guarding the scheduler grew from 796 to 916 cases over the course of the port. Once it is done, the surface described above is rebuilt outward.

Remaining known gaps are stated plainly. Indexed access is bounds-checked by the compiler and traps on an out-of-range index, for slices against a length carried in the frame and for global arrays against their declared count — so memory safety is by construction where the language's own indexing is used. It is not where raw pointer arithmetic is, and both the kernel and the compiler still use computed offsets in places, so the guarantee stops at the edge of a deliberate unchecked primitive. Trap-by-default integer arithmetic is designed and not built. Object staging is not yet native across the whole kernel. Validation of wire and external data is manual rather than systematic, and it is the one attack surface that grows as the network stack returns. The development console's control surface is unauthenticated. Device DMA isolation waits on an IOMMU arc that is not yet scheduled, the wireless data path is deferred, the trust anchor is gated on the build swap, and the system is single-core today, which is the only reason concurrency faults are quiet. Bastion moves at a slower cadence than Forge by design; it is systems-level research, not a shipping product.

Project log

  • The new language takes authority for the first time

    Until now every subsystem moved into .vg was checked against the Rust it replaced: the Rust stayed authoritative and the .vg ran beside it until the two agreed. That has been inverted for the scheduler's charge accounting, the part that decides what a task is billed for the time it just used. The decision and its finalisation are now made in .vg, and the Rust orchestration they supersede — the sealed charge application, the service and classification steps, the completion decision, the throttle block, and the two differentials that had been comparing the paths — was deleted rather than left dormant. Qualified across five consecutive runs on real hardware before the switch.

    Deleting the differentials is the part that carries risk, and it is deliberate. A differential is what makes a port falsifiable; once it goes, agreement with the old implementation is no longer being measured, and the .vg path has to stand on the adversarial matrix and the boundary record instead. That is the trade every port eventually has to make, and it is worth naming rather than passing over: this is where the old implementation stops being the thing that catches a mistake.

    The scope here is narrow and the rest of the path is unchanged. Reconstruction of the frame after a charge is still Rust, as are the cross-context cycle ledgers, context validation, and the interprocess unwind tail. Shipping kernel Rust stands at about 6,700 lines; the flip removed ninety-seven lines and added twenty-three, which is the usual shape — the saving is in what stops needing to exist, not in the switch itself.

  • Stack overflow made impossible instead of detected, and the CWE Top 25 mapped honestly

    Each of the five task stacks, plus the policy task's alternate bank, now sits between two unmapped 4 KiB guard pages around 256 KiB of usable stack. Running off either end faults rather than quietly writing into the neighbouring stack, and the fault is caught on dedicated interrupt stacks so a stack overflow cannot corrupt the handler meant to report it. Live update rebuilds the guard tables per boot rather than copying them forward.

    The sampled stack canary was then deleted. A canary notices corruption after it has happened and only if the overflow lands on the sampled bytes; an unmapped page means the write never lands. Prevention went in first and detection was retired second — deliberately in that order, since the reverse would have left a window with neither.

    Separately, the 2025 CWE Top 25 — MITRE and CISA's ranking derived from roughly 39,000 CVE records — has been mapped row by row against the architecture, under a stated rule that a guarantee holding by construction today is never recorded in the same bucket as one that is merely planned. Of the twenty-five: two are eliminated by construction, six have a named structural mechanism identified but not yet built, seven are currently held off by discipline and verification rather than by construction, two are open and flagged as inadequately addressed, and eight have no attack surface here at all — no SQL, no web or HTML, no shell, no upload path, no URL fetching. Seven of the top twenty-five, including four of the top ten, are injection-class weaknesses with nowhere to land on a bare-metal microkernel. The two open rows are named rather than smoothed over: validation of wire and external data, which grows as the network stack lands, and the development TCP shell, which exposes a control surface with no documented authentication.

  • Scheduler and interrupt handling move off Rust

    Kernel Rust is down to roughly 6,400 lines from an August peak near 26,600, as scheduling, timer and interrupt sequencing, exception containment, paging, ACPI parsing, and the IOMMU path moved into .vg and the superseded Rust bodies were deleted. Each boundary was qualified across five consecutive runs on real hardware before removal. Kernel builds are now native-only and accept a natively compiled object only when it is byte-identical to the Rust reference output; because the reference is still used where that match is unavailable, full self-hosting is not yet claimed. The earlier portable bytecode substrate remains out of scope, and the controlled language previously called Substrate is now Vulkgryph (.vg).

  • Development hardware in place; work resumes

    A dedicated x86-64 workstation is now available for Bastion development, ending the standstill that had paused hands-on kernel and driver work. Active focus is the 802.11 wireless driver path on real hardware. Progress will be steady rather than fast — Bastion is long-horizon systems work, not a shipping product timeline.

  • Project page expanded

    Bastion's page now describes the kernel, filesystem, runtime, and Substrate language layers, and records the current hardware standstill honestly.

  • Public status established

    Bastion is now tracked as a project with a log source and a separate research note for deeper systems detail.

Documents