The UDA runtime · open standard
One bytecode, lowered per coordinate. A single-level store where the in-memory bytes are the durable bytes. An energy-tiered cascade that reaches inference only as a last resort. JouleOS measures where it runs — and tells you the truth in joules.
The premise
Every layer we added — the database, the cache, the serializer, the model that answers a question a lookup could have — spends energy nobody measures. We taught computers to forget physics. JouleOS is built on the opposite premise: every operation has a price, and you should be able to see it.
The cascade
Every intent descends a cost-ordered ladder of refine families and stops at the
first one that can satisfy it. A lookup never wakes a model. The dispatcher always
reaches for the cheapest tier that closes the request — and check is
deterministic, never an LLM grading itself.
The single-level store
No serialize. No deserialize. No save. State lives in an mmap'd arena keyed by stable object IDs; every mutation is wrapped in a transaction with an undo log — so a power loss at any instruction boundary either rolls back or commits. It never tears.
Lineage: Twizzler (ATC '20) and Corundum (ASPLOS '21), rebuilt lean.
The capability ledger
A capability can only be minted by the kernel's ledger — the type system makes a forged
one unrepresentable. Eight typed classes gate every I/O path; delegation only narrows;
revocation is constructive. The kernel TCB is no_std; the JIT lives outside
it and literally cannot link in. That's the proof, not the policy.
The energy oracle
Real energy, read from the hardware — AMU on Apple Silicon, RAPL on Linux, an honest estimator everywhere else. The HUD shows you which: ⚡AmuAgx versus ~Estimator. Work is pinned across eight non-fungible classes, so joules-per-watt stays per-class. The system never claims an accuracy it can't deliver.
Lowered per coordinate
One intent IR is specialized at boot against the coordinate it lands on — address-space ownership, capability enforcement, persistence directness, dispatch reach. The same program runs as a native app, in a browser, and on bare metal. Conformance asserts AOT ≡ JIT, bit-for-bit.
The shape of the thing
It runs right now
The full JouleOS shell compiles to 2 MB of WebAssembly and runs in this tab — intent bar, surfaces, live energy attribution. Or boot the real bare-metal kernel inside an in-browser virtual machine.
