Processes all
the way down.

Conventional operating systems organize the machine around address spaces, files, privilege boundaries, and threads. Language runtimes then rebuild another world above them: lightweight processes, schedulers, mailboxes, supervision, and code loading.

Yggdrasil removes that duplication. Its central abstraction is the same at the language level and at the bottom of the machine: a process that owns its state, receives values, yields under a reduction budget, and can fail without making failure ambient.

The wager is not that every resource literally becomes executable. It is that every durable activity has a process owner, and every boundary is expressed in process terms.

This shifts operating-system design away from “which syscall exposes this facility?” toward “which process owns it, what messages cross its boundary, and how is it supervised?” Files, sockets, timers, and devices remain real. They stop being the organizing principle.

A Yggdrasil process owns an isolated heap and native stack. It shares neither with its neighbors. Its public surface is a mailbox.

Messages move ownership into the open.

A sender constructs a self-contained heap fragment. A receiver copies the fragment into its own heap when it receives. No core writes another process’s heap, and no borrowed pointer silently extends the lifetime of another process’s data. Copying is a cost, but it is also an accounting boundary and a concurrency protocol.

Yggdrasil currently runs the runtime and verified programs in ring zero. That makes the verifier, code generator, allocator, and quota system part of the security boundary.

This is not a claim that software isolation is free or automatically equivalent to an MMU boundary. It concentrates trust differently. The benefit is a common runtime model without a privilege transition on every useful act; the obligation is unusually strong verification, testing, fuzzing, and resource discipline.

Verified bytecode begins in the interpreter and may be promoted to native code. The interpreter remains the semantic baseline; differential tests keep both engines honest.

Proper tail calls return a reserved sentinel to an outer dispatch loop instead of nesting the native stack. At that same outer hop, stashed arguments are the complete root set for moving garbage collection. Hot-code migration, constant-stack execution, and reclamation therefore meet at one explicit runtime boundary.

Serial, block, network, and GPU transports appear as queue pairs. Submission enters a port; completion returns to the owner’s mailbox as an ordinary term.

The kernel need not grow a protocol-shaped API for every device. In M11, a Lux process encoded virtio-gpu commands, owned a pinned framebuffer, parsed responses, paced an animation, and presented real pixels. The kernel supplied protected physical-memory facts and moved opaque buffers. Protocol policy stayed in the supervised process.

Each milestone turns another conventional operating-system boundary into a runtime primitive.

1. M0BootLimine · serial · paging
2. M1Memoryframes · heaps · stacks
3. M2Processesspawn · yield · exit
4. M3Semanticsmailboxes · links · monitors
5. M4Bytecodeterms · interpreter · assembler
6. M5Portsrings · IRQs · timers
7. M6Virtioblock · net · persistence
8. M7Verifierisolation · mutation fuzzing
9. M8Native codehot load · Cranelift JIT
10. M9MulticoreSMP · IPIs · work stealing
11. M10Lux TCP/IP54 verified modules · real host TCP
12. M11Device driversGC · tail calls · Lux GPU