A compute model where every state change must be permitted by a named authority choosing among enumerated alternatives — and where a refusal is arithmetic rather than an exception.
Two bootable kernels built on a balanced-ternary decision substrate — signals are yea, nay, or abstain, and the third state is a value rather than an absence.
Everything below is verified at every boot; the parts that are not are marked.
qemu-system-x86_64 -cdrom cnos.iso -serial stdio -display none -m 256Scroll to the scheduler tally:
option yea nay abstain
dom.storage 1 0 2
dom.netstack 2 0 1
dom.compositor 0 0 3
dom.telemetry 0 1 2
authority commits dom.compositor -> held: no yea, only abstention
authority commits dom.telemetry -> held: option carries a nay
authority commits dom.netstack -> committed
Nobody objected to compositor. It was refused anyway, because silence is not consent and the substrate can tell the difference between "no" and "no opinion." In any binary system where non-votes pass, that commits.
Then the last line:
CONFORMANCE: COMPLETE — all axioms held and all were exercised.
The machine checked itself against nine properties and distinguished held from vacuous — an axiom never exercised during a run is not reported as passing. That report replaced an exit code, because "did it behave like a normal program" is the wrong question to ask of this.
Authorization in every operating system in production is two-valued. Permitted or denied. A non-response has to be forced into one of them at design time, by someone who cannot know the situation.
Cooren's substrate is three-valued, and the third state is not "unknown pending resolution" — it is a first-class signal that participates in the tally and is preserved in the record:
| yea | supports | the only thing that can carry a commit |
| nay | blocks | one dissent disqualifies, regardless of support |
| abstain | present, recorded, not consent | neither supports nor blocks |
Consequences that are not expressible in a two-valued system:
- Silence is not consent. An option with only abstentions cannot be committed, even by an authority with no opposition to it.
- A degraded sensor abstains rather than failing closed or failing open. Binary multi-factor authorization must pre-commit to one of those, and both are wrong — one locks out the engineer during the emergency, the other makes the factor theatre.
- Unreachable and abstaining are different states, which is what makes partition behaviour reasonable rather than guessed.
Balanced ternary specifically: {−1, 0, +1}, so zero is genuinely neutral, negation is a digit swap with no two's-complement asymmetry, and truncation rounds to nearest with no bias. All 19,683 trytes round-trip exactly, verified at every boot.
Prior art, as far as I am aware: Setun (Moscow State University, 1958) was ternary hardware. I know of no operating system, before or since, using three-valued logic as its authorization substrate. If one exists, open an issue — that is a correction worth having.
S(t+1) = G(t) · A(S(t), I(t)) + (1 − G(t)) · S(t)
G = 1: the transition applies. G = 0: the second term is the identity and the state persists.
There is no third term. A refusal is the branch where the transition is multiplied by zero — which is why refusal is a value rather than an exception, and why a held decision needs no rollback. Nothing was half-done; the identity was applied.
Both halves are primitives. A is bound to an option and applied by the gate, on both paths:
decide debit -> held: option carries a nay
g=0. A(S,I) = 750 was computed and discarded.
S written back: 1000 -> 1000 (identity, not a skip)
Extended to three-valued signalling, g⁺ + g⁰ + g⁻ = 1 for every G — a partition of unity, which is why the expression is total. Some arm always applies, so nothing is undefined, so nothing needs a trap.
Input → process → output is three stages. Cooren is five:
signal → evaluation → authority → consequence → evidence
The two extra are who permitted this and what proves it happened.
Verified — enforced in code, checked at every boot on two machines:
- Six axioms plus three completeness properties, with the verifier honest about the scope of its own proofs
- Balanced ternary substrate; all 19,683 trytes round-trip exactly
- Session-tree allocator over the real Multiboot2 memory map, with frame provenance
- A compiler where a participant token in a
decidedoes not compile, an unconsumed session does not compile, and the backend emitscmovand neverjcc— checked mechanically on every build - Keys carrying standing, with no user table anywhere in the system
Early: ~5,000 lines. Two kernels that should be one. No drivers, no network stack, no persistence, no SMP, no distribution. A compiler with no loops. Nothing has run on real hardware.
Written but never executed: the VMXON/VMCS/VMLAUNCH path in cnhv/vmx.c. The build host had no /dev/kvm.
Six limits are genuine — two physics, one proven impossibility (FLP), one arithmetic, one structural to all capability systems, one epistemic. They bound the model without contradicting it. See docs/85-limits.md.
The caveat that travels with everything else:
Cooren makes decisions accountable. It does not make them correct.
Axiom 1 guarantees the machine never enters a state it did not enumerate. It guarantees nothing about whether the enumeration was right. If the correct answer was not in the option set, the machine commits the best available wrong thing — with a perfect tally, a valid authority, and a flawless audit trail.
| No ambient authority | Running is not permission. Holding the token is. |
| No fiat | A one-option session is not representable. |
| No traps | A refusal returns the same shape as an acceptance. |
| Silence is not consent | An option with only abstentions cannot be committed. |
| A veto disqualifies | One dissent outranks any amount of support. |
| No unlimited privilege | Maximum authority still cannot commit what nobody chose. |
| No optional audit | The record is emitted by construction; a gap in the sequence is proof of an unrecorded transition. |
| No user table | A key carries standing. Nothing to enumerate, nothing to exfiltrate, no reset path. |
The sixth line is the one people miss. This is the first architecture in which maximum privilege is not the same as unlimited action — an authority holding a valid token, at full privilege, with no bug present, still cannot commit an option nobody supported.
sudo apt-get install -y build-essential nasm xorriso mtools dosfstools \
grub-pc-bin grub-efi-amd64-bin grub-common qemu-system-x86
cd cnos && make export && make test # kernel
cd ../cnhv && make export && make test # hypervisorBoth produce hybrid BIOS + UEFI ISOs and dd-able USB images in dist/. Both boot-tests pass on the machine's own criterion.
sudo ./scripts/mkusb.sh cnos/dist/cnos-usb.img /dev/sdXBefore wiping anything: cnOS has no drivers, no filesystem, no input, and no shell. It boots, runs its demonstrations, prints the conformance report, and halts — identically on a laptop and in QEMU. The one result real hardware gives that QEMU did not is cnHV finding actual VT-x, and a USB stick gets that without touching the internal drive.
Cooren is larger than this repository. This is the compute model and two machines implementing it — two of the six appliances the original brief asked for, and not yet unified into the SuperKernel it specified.
Key infrastructure, the wire protocol, IAM, and governance surfaces are
separate efforts. The identity code here is the OS-side seam, not an IAM
system: cn_demo_key_mint() is a test fixture, and a deployment replaces
it with a provider.
See SCOPE.md for the full boundary.
cnos/ kernel — session core, ternary substrate, allocator, keys, verifier
cnhv/ Type 1 hypervisor — VT-x probe, admission, exit resolution
cnc/ the compiler — Cn source to x86-64, branchless
docs/ specification and findings
scripts/ USB writer with verification
00-cooren-compute-model.md |
The specification. First principles, the gate equation, six axioms, costs |
85-limits.md |
What the model genuinely cannot do. Read before proposing fixes |
30-ternary-substrate.md |
Why yes/no/undecided is three states, not two |
40-memory-as-sessions.md |
Allocation as a decision tree with provenance |
70-cooren-compiler.md |
The language, and what C could not express |
75-identity.md |
Keys not accounts; admission as a session |
76-key-integration.md |
Provider contract; the attributability/unlinkability tradeoff |
60-the-seam.md |
Every inherited assumption, interrogated, with verdicts |
90-record.md |
How this was actually built, including what was wrong for four revisions |
Read cnos/trit.h, cnos/session.c, and cnc/cnc.py. Together they are the whole of the semantics; everything else is plumbing.
Von Neumann was brilliant and working under wartime pressure. The claim here is not that he was wrong. It is that eighty years of hardware advanced on one answer to the question under what conditions may a machine change state?, and the question was never re-asked.
This is what a second answer looks like when you build it far enough to boot.
See CONTRIBUTING.md. The short version: make test must still print CONFORMANCE: COMPLETE, and the most valuable issues are not "this is broken" but "why is it shaped like that." The machine can verify its own axioms. It cannot verify that the axioms are the right ones.
Apache License 2.0. See LICENSE.