A NixOS-native, capability-oriented distributed runtime substrate.

Strata implements a logical microkernel/exokernel-style control layer on top of Linux namespaces, cgroups, and systemd. It is not a Linux replacement, not an AI orchestration system, and not a monolithic application. It is a distributed capability-based service runtime.

Version: 0.3.2

┌───────────────────────────────────────────────┐
│                 Supervisor                     │
│  (Manager state machine, crash recovery,      │
│   backoff, quarantine, control socket)         │
│                                               │
│  ┌──────────┐  ┌──────────┐  ┌──────────┐    │
│  │ Registry │  │ Identity │  │    FS    │    │
│  │(discover)│  │ (tokens) │  │ (files)  │    │
│  └────┬─────┘  └────┬─────┘  └────┬─────┘    │
│       │              │             │           │
│  registry.sock  identity.sock   fs.sock       │
└───────┴──────────────┴─────────────┴───────────┘
          Unix Domain Sockets
          Length-prefixed JSON

• Supervisor manages all services via a state machine with dependency-ordered startup (topological sort), exponential backoff crash recovery, and sliding window quarantine. Exposes supervisor.status, supervisor.svc.list, supervisor.svc.start, supervisor.svc.stop
• Registry provides in-memory service endpoint discovery (registry.register, registry.resolve, registry.list). No auth required (socket-level trust)
• Identity generates an ed25519 keypair, issues PASETO v2.public capability tokens, maintains an in-memory revocation list
• FS provides capability-gated filesystem operations (open, read, list), verifies tokens locally using identity's public key, enforces path prefix constraints via centralized policy
• strata-ctl is the CLI client; resolves target sockets via registry with fallback to convention

Declared → Starting → Healthy → Crashed → Restarting → (back to Starting)

A service that crashes too many times within a window is Quarantined and requires manual restart. Stopped services can be restarted via supervisor.svc.start.

Supervisor → starts registry (no deps) → starts identity (no deps) → waits for identity.pub → starts fs (depends on identity) → opens control socket. Healthy services are auto-registered in registry.

All protected handlers call policy.Authorize(claims, method, ctx) — deny-by-default. Tokens are service-scoped and carry fully-qualified rights (e.g., fs.open). FS handles are bound to the cap_id that opened them and checked for revocation on every access.

nix build .#supervisor
nix build .#identity
nix build .#fs
nix build .#registry
nix build .#strata-ctl

go build -o ./bin/ ./cmd/...

Produces: ./bin/supervisor, ./bin/identity, ./bin/fs, ./bin/registry, ./bin/strata-ctl

Build bootable NixOS images with Strata pre-configured:

# ISO image (live environment, x86_64)
nix build .#nixosConfigurations.strata-iso-x86_64.config.system.build.isoImage
# Output: ./result/iso/strata-*.iso

# QEMU VM image (x86_64)
nix build .#nixosConfigurations.strata-vm-x86_64.config.system.build.vm
# Output: ./result/bin/run-strata-vm
# Run: ./result/bin/run-strata-vm

# Boot the ISO in QEMU
qemu-system-x86_64 -cdrom ./result/iso/strata-*.iso -m 2G

# Via Nix flake
nix develop

# Via devenv
devenv shell
strata-build   # builds all binaries to ./bin/
strata-run     # starts the supervisor
strata-clean   # removes ./bin and /tmp/strata

# Build first
go build -o ./bin/ ./cmd/...

# Start the supervisor (creates runtime dir, starts all services)
export STRATA_RUNTIME_DIR=/tmp/strata
mkdir -p $STRATA_RUNTIME_DIR
./bin/supervisor

The supervisor finds registry, identity, and fs binaries in the same directory as itself. Override with STRATA_REGISTRY_BIN, STRATA_IDENTITY_BIN, and STRATA_FS_BIN environment variables.

With the supervisor running in one terminal:

export STRATA_RUNTIME_DIR=/tmp/strata

./bin/strata-ctl identity.issue \
  '{"service":"fs","actions":["open","read","list"],"path_prefix":"/tmp"}'

Response:

{
  "v": 1,
  "req_id": "...",
  "ok": true,
  "result": {
    "token": "v2.public.eyJq...",
    "cap_id": "abc123...",
    "expires": 1700000000
  }
}

TOKEN="v2.public.eyJq..."   # from step 1

./bin/strata-ctl -token "$TOKEN" fs.list '{"path":"/tmp"}'

# Create a test file
echo "hello strata" > /tmp/test.txt

# Open it
./bin/strata-ctl -token "$TOKEN" fs.open '{"path":"/tmp/test.txt"}'
# → {"handle": "h1"}

# Read from the handle
./bin/strata-ctl -token "$TOKEN" fs.read '{"handle":"h1","offset":0,"size":4096}'
# → {"data": "hello strata\n", "bytes_read": 13}

./bin/strata-ctl supervisor.status

./bin/strata-ctl supervisor.svc.list

./bin/strata-ctl registry.resolve '{"service":"fs"}'

./bin/strata-ctl registry.list

# Run unit tests
go test ./internal/...

# Run with race detector
go test -race ./internal/...

# Run smoke test (with supervisor running in another terminal)
sh scripts/smoke.sh

A scaffold NixOS module is provided at modules/strata.nix:

{
  imports = [ strataOS.nixosModules.strata ];

  services.strata = {
    enable = true;
    nodeId = "node-1";
    package = strataOS.packages.x86_64-linux.supervisor;
    identityPackage = strataOS.packages.x86_64-linux.identity;
    fsPackage = strataOS.packages.x86_64-linux.fs;
    registryPackage = strataOS.packages.x86_64-linux.registry;
  };
}

See api/protocol.md for the full IPC protocol specification.

Error codes:

cmd/
  supervisor/    Node-local process supervisor (Manager state machine)
  registry/      In-memory service endpoint registry
  identity/      Capability token issuer (PASETO v2.public)
  fs/            Capability-gated filesystem service
  strata-ctl/    CLI client for interacting with services
internal/
  ipc/           Length-prefixed JSON framing and UDS server
  auth/          Ed25519 keys, PASETO signing/verification, revocation
  capability/    Token claims and constraint types
  policy/        Centralized authorization and constraint enforcement
  supervisor/    Service lifecycle state machine, backoff, quarantine, Manager
  registry/      Thread-safe in-memory service registry
modules/
  strata.nix     NixOS module scaffold
api/
  protocol.md    IPC protocol specification
docs/
  PLAN.md        Roadmap (v0.3 → v0.4)
  EXECUTION.md   Iteration workflow and review checklists
  POLICY_REVIEW.md  Security review and known issues
scripts/
  smoke.sh       Integration smoke test