The XRUIOS

The full XRUIOS solution: one Manager, a worker per class, and a permission wall between every one of them.

This is the assembled system, ported from XRUIOS.Barebones onto the Plagues trust model. Barebones was one project with ~400 functions. Here each system class is its own worker process with its own password and its own key, and a single XRUIOS.Manager holds the master key, gates login, and brokers every request through a permission check.

This wiki is about the permissions. If you want the function catalog, that lives in the Barebones wiki; here we cover the walls: the groups, the per-worker isolation, the login that unlocks everything, and how one program shares data with another without either of them touching a key they shouldn't.

This is a project I knew I wanted to make back since 2017 and after thousands of hours of work, grinding and time it seems things are finally coming together.

The XRUIOS.XR library and Linux Distro are next, although keep in mind the XRUIOS works on Linux and Windows right now.

How it fits together

   apps  ──►  XRUIOS.Manager (broker)  ──►  worker (one class)
                    │  permission check           │  its own key + password
                    │  per-worker key handoff      ▼
                    └────────────────────────►  another worker

One Manager per device. It takes a global lock on start; a second Manager steps aside. It holds the master key and never hands it out.
A worker per class. ~27 of them. Each compiles only its own class, so a breached worker doesn't even contain another class's code. Each gets its own password (PSK) and its own encryption key, both from the Manager.
Nothing talks to a worker directly. Apps ask the Manager; the Manager checks the permission, then routes to the worker. Cross-class work goes worker → Manager → worker, so the same wall applies between workers.

The three walls

Process isolation. One class per worker. Compromise the Songs worker and you still can't reach Calendar's code - it isn't loaded there.
Password isolation. Each worker has its own PSK. Only the Manager holds it, so only the Manager can talk to a worker, and a leaked PSK unlocks exactly one worker.
Key isolation. Each worker's store is encrypted under its own key, derived from the master. A worker only ever receives its own key, so a breach reads its own data and nothing else.

"Least privilege isn't a setting. It's the architecture."


Code by WalkerDev "Loving coding is the same as hating yourself" Discord	Art & Code by Kennaness "When will I get my isekai?" Bluesky • ArtStation

What's inside

1 - The Model - permission groups, the per-class workers, the three walls, and the threat model.
2 - Login and Keys - the login gate: Argon2 + OS-seal, and how one master key becomes a key per worker.
3 - Capabilities and Sharing - the capability naming, and the Höllvania calendar sharing events safely.
4 - Installing - start it in the background and at boot.
5 - Permission Catalog - every capability, by group and worker.
6 - Aether Engine Integration - the same gate that walls off Aether Engine mods, with a real test.
7 - Proven at Runtime - the end-to-end run, the pentest, and the bug the parallel launch found.
8 - Building a XRUIOS App - writing an app three ways: CMD, desktop, and an Aether Engine mod.

Building - project setup, with the exact .csproj and DLLs for each kind:

1 - Project Types - the five project types and the reference matrix.
2 - A Worker - a system class as an isolated worker process.
3 - A CMD App - the smallest broker client.
4 - A Desktop App - the client behind a WPF/Avalonia window.
5 - An Aether Mod - a mod, and the multi-mod proving ground that registers each as its own app.
6 - The Diagnostics Harness - the fleet self-test.

Dependencies

XRUIOS.Permission - the encrypted {app → {capability: level}} grant store the Manager checks.
Pariah Cybersecurity - post-quantum primitives, SecureData, the anti-tamper watchdog every worker + the Manager run on start.
Eclipse - the AES-256-GCM + Kyber encrypted transport between apps, the Manager, and workers.
Notary - the Blake3 anti-tamper check the Manager runs on a worker before it launches, and periodically after.

Check 2 - Projects This Relies On to see all of these (They're Open Source)

License & Artwork

Code: NON-AI MPL 2.0
Artwork: — NO AI training. NO reproduction. NO exceptions.