Skip to content
@AxonOS-org

AxonOS

A real-time Rust microkernel for safety-critical BCI. Deterministic EDF scheduling · Zero-copy signal path · Hardware-gated stimulation interlock.

AxonOS is the hard real-time layer between neural hardware and the applications that use it: an open-source kernel in #![no_std] Rust on ARM Cortex-M, with worst-case response times that are analysed before they run, not benchmarked after, and privacy enforced below the application layer, where no application can bypass it.

Applications receive typed, consent-bound intent events — never raw neural streams.

It is not an AI-agent framework, a chatbot runtime or a token project. Every guarantee it makes is specified, openly licensed, and built to be checked by someone else.

Note

axonos-consent 0.9.2. Consent now changes only on a verified Ed25519 signature, never twice for the same sequence number, and a withdrawal is final the instant it is stored. Ten Kani proofs, three loom models, twenty conformance vectors and three fuzz targets run on every push. The line closes AXC-2026-001, a critical advisory against our own consent layer, published with its fix. Release notes · Specification


The ecosystem

Build — AxonOS
The operating layer: kernel, signal pipeline, consent, protocol and SDK. Specified openly, verified by machine.

Measure — DY-WCET
Worst-case response-time analysis in integer arithmetic. Zero dependencies, eight Kani proofs, every one closing in CI.

Discover — Radar
A living map of open neurotech: over a hundred projects, scored from public evidence and refreshed every three hours.

Verify — DY Research
Independent technical due diligence for investors, founders and engineering teams. A written verdict on what the evidence supports.

Prove — DY PROOF
Independent technology diagnostics: where a running system breaks under load, located and reproduced.


In focus · DY-WCET

Timing analysis that refuses rather than rounds. Worst-case response time for real-time systems, computed exactly in integer arithmetic — and a named refusal wherever a bound cannot be justified.

Two tasks. A runs 100 µs every 400 µs at higher priority; B runs 200 µs every 1,000 µs. The common answer for B is 400 µs. The correct one is 300 µs — and with other periods, the same mistake reports a deadline as met that is missed on hardware.

The schedule for the two tasks: A preempts B at the start, B runs from 100 to 300 microseconds and finishes long before its 1,000 microsecond deadline.

The schedule, drawn by simulating the scheduler rather than the formula. On 5,000 random task pairs it lands exactly on the analysis's answer.

0dependencies, and no floating point anywhere
8Kani proofs, every one closing in CI
100tests, fifteen of them derived by hand
6named refusals — a bound is never guessed

Try it live → · Source · The method · The bounty


The architecture

The AxonOS stack from electrodes to applications: hardware abstraction, signal pipeline, kernel with an analytical 1,000 microsecond response bound and 0.5 microsecond IPC bound, consent that changes only on a verified signature and whose withdrawal is final, SDK and protocol, then a privacy boundary that raw neural data never crosses, then applications.

The numbers, and where each one comes from

Every figure published here, its evidence level, and the artefact it derives from. L1 formally proven · L2 measured on reference hardware · L3 independently reproduced · CI checked mechanically on every push · analytical derived by hand from a reference. Graded as in CLAIMS.md, which this table follows. A figure absent from this table is not claimed.

Figure Value Source
End-to-end WCRT, upper bound ≤ 1,000 µs · analytical response-time analysis over analytical per-task WCETs · derivation pending · the scheduler harnesses prove admission and EDF selection, not a time
End-to-end WCRT, worst observed 972 µs · L2 RFC-0001 · 12 h, 10.8 M epochs, 0 misses · raw traces pending
IPC slot latency, upper bound ≤ 0.5 µs · analytical derivation pending · the SPSC harnesses prove the slot loop-free and FIFO, not a time
Consent changes only on an authenticated frame; withdrawal is final proven · L1 src/proofs.rs · ten harnesses, a blocking CI job · the former kani/ harnesses never compiled and are removed
Consent withdrawal, transition time retracted at consent 0.9.0 the 1,648-cycle figure was derived for a tag path that no longer exists; Ed25519 verification now dominates admission · SPEC §4.1
Release jitter, σ 2.1 µs · L2 RFC-0001 · raw traces pending
Kani proofs re-run in CI 57 · L1 kernel 30 · consent 10 · signal pipeline 9 · DY-WCET 8
unsafe in the kernel one crate · CI confined to axonos-spsc; #![forbid(unsafe_code)] in consent, protocol and five kernel crates
Wire format, reference against SDK byte-identical · CI conformance: Python reference and Rust SDK on every push; C header by _Static_assert
Projects on the live map 100+ · live data/radar.json, refreshed every 3 h

≤ 1,000 µs is derived; 972 µs is the worst anyone has seen. A derivation, a proof and an observation are different kinds of statement. Until the raw traces land in axonos-validation, every L2 row is held as pending and graded in CLAIMS.md. L3 independent reproduction is not claimed for anything.

Not in this table, and therefore not claimed: classification accuracy, information transfer rate, power draw, on-hardware latency in a deployment, session length, electrode count in real use.


Verify it yourself

One command, ninety seconds, no account:

git clone https://github.com/AxonOS-org/axonos-stack && cd axonos-stack
cargo run --locked --bin session -- --seed 7 --frames 3000 | diff - reference/session-7.txt

Silence means the whole chain — electrode to conditioning to privacy boundary to the right to act — reproduced byte for byte on your machine. The session is not a happy path: an electrode lifts partway through, and the transcript records the system withdrawing the right to actuate 96 ms later while it keeps recording.

More to run — the path, the kernel proofs, the signal chain, the timing analysis
# the full path, electrode to typed intent, verified bit for bit
git clone https://github.com/AxonOS-org/axonos-e2e-demo && cd axonos-e2e-demo && ./run.sh --verify

# the kernel: its tests, then a machine-checked proof
git clone https://github.com/AxonOS-org/axonos-kernel && cd axonos-kernel
cargo test --workspace
cargo kani setup && ( cd axonos-spsc/kani-proofs && cargo kani )

# the signal chain, bit-exact against conformance vectors
git clone https://github.com/AxonOS-org/axonos-signal-pipeline && cd axonos-signal-pipeline && cargo test

# the timing analysis, and every number it states against its source
git clone https://github.com/DYResearch/dy-wcet && cd dy-wcet && cargo test && ./audit.sh
Where to push, if you want to prove this wrong
  • The 1,000 µs bound. It is analytical: check the derivation when it is published, or run the reference hardware past it. The scheduler harnesses falsify something narrower, the admission and EDF logic, and a counterexample from Kani does that outright.
  • The 972 µs observation. It is L2 and pending until the raw traces are published; until then, treat it as a claim with its evidence outstanding.
  • Consent. Run cargo kani in axonos-consent: the ten harnesses in src/proofs.rs, the job CI runs on every push. Or forge a frame: the auth_forgery fuzz target verifies against a key whose secret no one holds, so any frame it admits is a forgery.
  • dy-wcet. Find a task set where it returns a bound the recurrence does not support. There is a bounty for the first one.
  • The Radar's scores. Every score is published with the evidence it rests on. Recompute any of them.

The open BCI field, live

A living map of every open-source brain–computer-interface project, tool and team, scored from public evidence and refreshed every three hours. AxonOS is ranked by the same formula as everyone else, with no boosting.

projects: 120 active 30d: 112 total stars: 49k builders: 11

The State of Open BCI — read the full report →

Leading by reach: omi · wukong-robot · mne-python · NeuroKit · 18 languages · last refreshed 02 Oct 2026, 20:07 UTC


Work with DY Research

The discipline behind AxonOS, applied to your system. DY Research carries out independent technical due diligence for investors, founders and engineering teams: every claim traced to its code, its tests and its evidence, ending in a written verdict.

Engagement The question it answers
Snapshot · 5 business days What does this technology actually do, and what does its evidence support?
Focused Audit · 2–3 weeks Does one critical property — timing, determinism, concurrency — actually hold?
Due Diligence · 3–4 weeks Is the technology what the company says it is, and what could break the investment?

Fixed price, from $5,000, agreed in writing before any work begins. Revenue funds AxonOS. Engagements and full scope →


Repositories

Repository Role
axonos-kernel Scheduler, lock-free SPSC IPC, capabilities, intent, time — #![no_std]
axonos-signal-pipeline Conditioning, DSP and classification, bit-exact against conformance vectors
axonos-consent Consent enforced by the kernel: Ed25519-authenticated, replay-proof, final the instant it is withdrawn
axonos-protocol · axonos-sdk The wire format and the application interface
axonos-hal Hardware abstraction for ARM Cortex-M
axonos-stack · axonos-e2e-demo The layers running as one system, reproducible from a seed
axonos-standard · axonos-rfcs The specification, its claims ledger and its design records
axonos-conformance · axonos-validation Test vectors and bindings; measurement campaigns and their traces
DYResearch/dy-wcet Worst-case response-time analysis, standalone
AxonOS-BCI/axonos-community-radar The live map of open neurotech

Stated plainly

AxonOS does not currently claim, and this organisation must not be read as claiming: FDA clearance, CE marking or medical-device approval in any jurisdiction; clinical efficacy or independent clinical validation; certified medical-device status or production-implant readiness; complete compliance with IEC 62304, ISO 14971 or ISO 13485. These are possible future milestones, not present facts.

Five problems nobody has solved, AxonOS included
  • Calibration-free decoding across subjects
  • Worst-case execution time on a modern core
  • Long-session non-stationarity
  • Enforcing consent at the point of use
  • Establishing that a signal is voluntary

Cite this work

@article{axonos2026microkernel,
  title   = {An Analytical Microkernel Design for Safety-Critical
             Brain--Computer Interfaces: Schedulability, Capability
             Isolation, and Falsifiable Predictions},
  author  = {Yermakou, Denis},
  year    = {2026},
  doi     = {10.5281/zenodo.20552007},
  url     = {https://doi.org/10.5281/zenodo.20552007},
  note    = {Analytical bounds; predictions P1--P5; no measurement claims},
  license = {CC-BY-4.0}
}

Every repository exposes Cite this repository through CITATION.cff.

Licensing

Artefact License
Kernel, SDK, consent, swarm, gateway Apache-2.0 OR MIT
RFCs and specifications CC-BY-SA-4.0
axon-bci-gateway MIT, preserved from upstream OpenBCI_GUI
neural-boundary-game AGPL-3.0-only OR AxonOS Commercial

© The AxonOS Project / Denis Yermakou

connect@axonos.org · security@axonos.org · LinkedIn · axonos.org

Offices and a headquarters are under consideration for the future.

日本語 · 中文 · Italiano · Français · Deutsch · Español · العربية — translations summarise this page; the English page is canonical.

Pinned Loading

  1. axonos-rfcs axonos-rfcs Public

    Proposals, design documents, and architectural decisions for the AxonOS project.

    3

  2. axonos-kernel axonos-kernel Public

    Hard real-time Rust microkernel for brain-computer interfaces. #![no_std] on Cortex-M, EDF scheduling with Kani-verified WCRT bounds, zero-copy intent path, capability-based privacy by construction…

    Rust 10

  3. axonos-consent axonos-consent Public

    Kernel-level consent state machine for brain–computer interfaces — no_std, zero-alloc, #![forbid(unsafe_code)], formally bounded (Kani), with optional guardian co-authorisation.

    Rust 6

  4. axonos-sdk-python axonos-sdk-python Public

    Python SDK for AxonOS — RFC-0006 intent wire format and capability model, byte-compatible with the Rust reference.

    Python 2

  5. axonos-conformance axonos-conformance Public

    Verified conformance vectors + multi-language codecs for AxonOS wire formats (RFC-0006, RFC-0005). Rust ≡ Python ≡ C ≡ JS ≡ Java, byte-identical.

    Python 2

Repositories

Showing 10 of 25 repositories
  • .github Public

    Cognitive operating-system layer for brain-computer-interface software infrastructure.

    AxonOS-org/.github's past year of commit activity
    Python 2 0 0 0 Updated Oct 2, 2026
  • axonos-standard Public

    Canonical technical standard and architecture manual for AxonOS: deterministic BCI software, neural permissions, consent, validation, and governance.

    AxonOS-org/axonos-standard's past year of commit activity
    Python 6 CC-BY-SA-4.0 0 0 0 Updated Oct 2, 2026
  • core-v.2.2 Public

    A modular framework for secure AI inference, real-time signal processing, and hardware abstraction.

    AxonOS-org/core-v.2.2's past year of commit activity
    Rust 2 0 0 0 Updated Oct 2, 2026
  • become-the-brain-os Public

    🧠 Become the Brain OS — a local-only cognitive-firewall game: allow derived intent, block raw cognition, distortions, revoked consent and artifacts across the mind↔world boundary. Scenarios, daily seed, challenge-a-friend. A game about the real AxonOS real-time OS. No sensor, no neural data.

    AxonOS-org/become-the-brain-os's past year of commit activity
    HTML 2 Apache-2.0 0 0 0 Updated Oct 2, 2026
  • axonos-vault Public

    Raw neural data does not leave. Only bounded, purpose-bound, budgeted reductions do — and every one is recorded. no_std, zero-alloc, 19 tests.

    AxonOS-org/axonos-vault's past year of commit activity
    Rust 1 Apache-2.0 0 0 0 Updated Oct 2, 2026
  • axonos-validation Public

    Reference-hardware validation record for AxonOS: raw timing traces, deterministic post-processing, and reproducible L2 evidence artifacts.

    AxonOS-org/axonos-validation's past year of commit activity
    Python 3 0 0 0 Updated Oct 2, 2026
  • axonos-swarm Public

    Real-time coordination layer for AxonOS mesh nodes: clock sync, co-availability windows, and fault detection for distributed BCI pipelines.

    AxonOS-org/axonos-swarm's past year of commit activity
    Rust 3 0 0 0 Updated Oct 2, 2026
  • axonos-supervisor Public

    A chain can meet every deadline and still be unfit to act on. Signal-quality posture that gates the right to act, never the right to record. no_std, zero-alloc, 20 tests.

    AxonOS-org/axonos-supervisor's past year of commit activity
    Rust 1 Apache-2.0 0 0 0 Updated Oct 2, 2026
  • axonos-stack Public

    The reference session: three AxonOS organs wired together, running deterministically from a seed, with the transcript checked in and diffed by CI.

    AxonOS-org/axonos-stack's past year of commit activity
    Rust 1 Apache-2.0 0 0 0 Updated Oct 2, 2026
  • axonos-signal-pipeline Public

    Deterministic, vector-pinned BCI signal pipeline for AxonOS: raw acquisition frame -> typed, consent-bound decision. no_std, zero-deps, unsafe-free, fixed-point. Engineering demonstrator, not a medical device.

    AxonOS-org/axonos-signal-pipeline's past year of commit activity
    Rust 3 Apache-2.0 0 0 1 Updated Oct 2, 2026

Top languages

Loading…

Most used topics

Loading…