Overview

Bastion is a security-first x86-64 operating system being rewritten into its own language. The kernel boots on real hardware via UEFI over a hand-written assembly machine floor. Above that floor, the system is progressively being moved off Rust and into Vulkgryph (.vg) — a language designed for machine consumers rather than human readability, with explicit state and no hidden control flow.

The goal is stated as a removal target rather than a feature list: no Rust participating in compiling .vg, generating machine code, writing ELF, or running in the kernel. Assembly, a linker, and archive tools may remain — the objective is Rust-free, not toolchain-free. That target is not met yet. The sections below state where it actually stands.

Bastion is long-horizon systems work, not a near-term product, and there is no release date. Its audience is environments where deterministic execution, auditability, and a small attack surface matter more than ecosystem breadth. See the Bastion research perspective for deeper detail on the x86-64 implementation.

Components

  • x86-64 native kernel

    Primary and only active deployment target. Boots on real hardware via UEFI, with a hand-written assembly core, interrupt tables, context switching, syscall trampolines, and atomics. Driver work covers Ethernet (TCP/IPv4/ARP, a guarded TCP shell, and live kernel replacement without a full reboot), 802.11 wireless, framebuffer, PCI, DMA allocation, serial, PS/2 keyboard, ACPI, USB/xHCI, and IOMMU/VT-d DMA confinement.

  • Vulkgryph (.vg) language and compiler

    The language the OS is being rewritten into, with its own compiler and x86-64 code generator. Roughly 97,000 lines of .vg across the language repository, of which about 33,000 lines are the kernel services the running kernel links against. Earlier material called this language Substrate; that name is retired.

  • Rust displacement in the kernel

    Kernel Rust currently stands at about 6,400 lines across 22 files, down from a peak near 26,600 in August 2026, as subsystems move to .vg and the superseded Rust bodies are deleted rather than left in place. Scheduling, timer and interrupt sequencing, exception containment, paging, ACPI parsing, and the IOMMU path have all moved across.

  • Object provenance

    Kernel builds are native-only: the build refuses to run without prebuilt .vg objects. A natively compiled object is accepted only if it is byte-identical to the one produced by the Rust reference compiler, and otherwise the reference output is used. This keeps the two paths honest against each other, and it is also the reason full self-hosting cannot be claimed yet — Rust still participates in producing some kernel objects.

  • Boundary verification

    Each subsystem moved to .vg gets a boundary status record naming its baseline commits, the tested kernel hash, and what it does not claim. Most are qualified across five consecutive runs on real hardware rather than in emulation. A secured WPA3-SAE wireless association has been qualified this way; the wireless data path has not.

  • Legacy bytecode substrate

    An earlier portable bytecode runtime, with its own instruction set, journaling filesystem, process services, syscall ABI, and security core, was declared legacy in July 2026 and is deliberately out of scope. It may be revived and converted to .vg later. Current work does not depend on it.

Current focus

Active work is removing Rust from the kernel's scheduler and interrupt handling — timer rescheduling, interrupt sequencing, exception containment and unwind, authenticated IPC timeout accounting, and resume selection — with each step qualified on real hardware before the superseded Rust is deleted. Remaining known gaps are stated plainly: object staging is not yet native across the whole kernel, the operator shells are still on Rust, C interoperability needed for ACPI has not landed, the wireless data path is deferred, and the trust-anchor work is designed but not built. Bastion moves at a slower cadence than Forge by design; it is systems-level research, not a shipping product.

Project log

  • Scheduler and interrupt handling move off Rust

    Kernel Rust is down to roughly 6,400 lines from an August peak near 26,600, as scheduling, timer and interrupt sequencing, exception containment, paging, ACPI parsing, and the IOMMU path moved into .vg and the superseded Rust bodies were deleted. Each boundary was qualified across five consecutive runs on real hardware before removal. Kernel builds are now native-only and accept a natively compiled object only when it is byte-identical to the Rust reference output; because the reference is still used where that match is unavailable, full self-hosting is not yet claimed. The earlier portable bytecode substrate remains out of scope, and the controlled language previously called Substrate is now Vulkgryph (.vg).

  • Development hardware in place; work resumes

    A dedicated x86-64 workstation is now available for Bastion development, ending the standstill that had paused hands-on kernel and driver work. Active focus is the 802.11 wireless driver path on real hardware. Progress will be steady rather than fast — Bastion is long-horizon systems work, not a shipping product timeline.

  • Project page expanded

    Bastion's page now describes the kernel, filesystem, runtime, and Substrate language layers, and records the current hardware standstill honestly.

  • Public status established

    Bastion is now tracked as a project with a log source and a separate research note for deeper systems detail.

Documents