GenOS: An AI-Native Microkernel Architecture with Hardware-Isolated Capabilities, Decentralized Information Flow Control, and Post-Quantum Causal Verification
Year: 2026
Type: preprint
Abstract: Traditional operating system architectures, including Linux, Windows, and POSIX microkernels, were engineered under the foundational assumption that software processes execute deterministic, human-authored machine binaries within static protection boundaries. Both autonomous artificial intelligence (AI) agents governed by large language models (LLMs) and modern institutional cryptographic signing pipelines invalidate this paradigm: unverified control flow at the execution boundary leads to catastrophic blind execution. Autonomous agents ingest untrusted external text and invoke mutating tools via protocols such as the Model Context Protocol (MCP), rendering conventional access control vulnerable to Indirect Prompt Injection (IPI) and secret exfiltration; similarly, compromised developer endpoints and spoofed web interfaces trick human signers into blind-signing malicious smart-contract delegations (DELEGATECALL, EIP-7702 0x04 SetCode). In this paper, we introduce GenOS, a tri-engine Zero-Trust security architecture implemented in 100% stable Rust (rustc 1.99.0) with zero external crate dependencies. GenOS shares a portable #![no_std] verification core (causal-core and capability-engine) across three execution planes:(1) A bare-metal x86-64 microkernel (kernel/) that boots via a SHA-256 verified UEFI Limine 8.7.0 protocol and enforces hardware CPU security registers (CR0.WP, EFER.NXE, CR4.SMEP, CR4.SMAP, and CR4.UMIP).(2) genos-guard, a drop-in user-space MCP security proxy featuring Decentralized Information Flow Control (DIFC), cryptographic Data Loss Prevention (DLP), scoped path rules, and a localhost transactional Escrow queue.(3) genos-sentinel, a dual-ring Zero-Trust Perimeter (GenOS Shield: IPv4/CIDR allowlisting, cryptographically signed binary manifests, and WOTS-signed peer envelopes with monotonic anti-replay nonces) paired with an independent Ethereum RLP and Safe{Wallet} EIP-712 Policy Co-Signer (GenOS Sentinel) that detects EIP-7702 0x04 SetCode delegations, DELEGATECALL blind-signing spoofs, and velocity anomalies before tripping a global multi-chain Circuit Breaker. Protection domains are mediated by a constant-time O(1) Capability Engine employing generational epoch tokens (CapId = <slot, generation>) and a Bell-LaPadula/Biba DIFC lattice. Auditability is anchored in a hash-chained causal ledger supporting post-quantum Winternitz One-Time Signatures (WOTS, w=16) immune to Shor's algorithm and cryptographic Merkle inclusion proofs (CausalMembershipProof). Resource arbitration is governed by SchedCP, achieving an empirical Jain's Fairness Index of 0.9996. User-space statistical evaluation (N=10 runs on an AMD Ryzen 9 3900X 12-Core / 24-Thread processor) demonstrates capability validation latencies of 1.9 ns/op (531.6M ops/s), Escrow staging latencies of 83.6 ns/action (12.0M ops/s), IPC DIFC routing in 1.1 us/msg, and a 100% pass rate across 97 automated unit, end-to-end MCP proxy, Lazarus Red-Team replay, and adversarial security tests. ---Resumen en Español:Presentamos GenOS, una arquitectura Zero-Trust de triple motor implementada íntegramente en Rust estable (rustc 1.99.0) con cero dependencias externas: (1) un microkernel bare-metal x86-64 (#![no_std]) con aislamiento en Ring 3; (2) genos-guard, un proxy de seguridad para agentes Model Context Protocol (MCP) con seguimiento de contaminación DIFC, prevención de fuga de secretos (DLP), alcances de rutas y retención en Escrow; y (3) genos-sentinel, un perímetro Zero-Trust (GenOS Shield: listas blancas CIDR IPv4, manifiestos de binarios firmados y sobres con nonces anti-replay) junto a un co-firmante de políticas (GenOS Sentinel) con decodificador independiente RLP/EIP-712, disyuntor de velocidad por ventana deslizante y quórum criptográfico M-de-N. Código fuente y suite reproducible: https://github.com/genaropass/Gen-OS
Author: Pássero, Genaro Agustin
Language: English
Subfield: Hardware and Architecture
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7225320225