Status
Every claim on this site carries a grade, and this page is the table those grades come from. Nothing else here is allowed to stand above it.
Three grades, and only three. runs built, exercised, and described in the indicative. designed thought through and written down, never executed. open a question standing — a decision we have not taken, or a surface whose behaviour is not settled.
The grades are for architecture, at the size of a piece of the platform. A defect in a piece that runs does not change its grade, and the ones worth a stranger’s attention are named in place, on the page that teaches the thing.
Distribution and install
| piece | grade | why |
|---|---|---|
Releases and bootstrap.sh — macOS, Linux | runs | a release carries per-platform binaries and a manifest declaring each one; the bootstrap picks the host’s and installs it into ~/.bentos/bin |
bentos install — the userland from the manifest | runs | the manifest is the registry, so the prefix holds exactly what the release declares and no second list can disagree; bentos replaces itself while it works, and bentos list reports drift, a shadowed name, or a prefix off PATH |
| A Windows installation path | open | Windows executables are built and published; no bootstrap script ships in a release, so there is no installation path to copy. No date is being promised |
bentos update · rollback · self-update | open | published surface, each taking a release stream; what they do across two published releases is not something we will state in the indicative yet |
The primitives
| piece | grade | why |
|---|---|---|
| Place — a directory declared a space | runs | .place/ marks it, the control plane ignores itself, and the tree of places is the search path a name resolves up |
| The constellation — installed entities as gitlinks | runs | the pin is a 160000 entry in the place’s own tree, so a place’s tracked mass stays tiny however large what it holds |
| Timelines — a place’s branches as version time | runs | several stand at once as worktrees, sharing one object store, so forking a timeline forks configuration and never mass |
| When a place advances a pin | open | a policy, not a mechanism, and undecided: record every mutation and the timeline becomes a transaction log; record snapshots and a clone materializes state already left behind. See Place |
| Steering a timeline from the primitive | open | place timeline reads; creating and switching are git branch and git worktree, and whether the primitive should own those verbs is not decided |
| Entity — the named thing, one Git repository | runs | create, instance, act and read, with the branches as the instances and the commit as the action |
| The act — private materialization, then compare-and-swap | runs | two actors that read the same tip cannot both land, and the loser is refused rather than merged |
| The manifest as in-band self-description | runs | entity.yaml at the root of the genesis tree, readable without a worktree; an entity without one says so |
| The manifest’s schema | open | one required field is paved and the rest arrives by demand; how deep the declaration goes decides whether a stranger can render an entity it never saw, and the cost is schema governance |
Federation — publish / fetch / remotes | open | installing takes any URL Git accepts, and federation is the substrate’s own operation; the verbs are published surface and no two sites have been run against each other |
| Event — arming and firing | runs | subscribing arms a command line at a coordinate, and the act that lands there runs it, with nothing resident in between |
| The three phases as a vocabulary | runs | attempted, landed, refused are enforced by name; landed is the one wired end to end |
attempted with the power to refuse the act | designed | declared in the substrate — a listener inside the ref transaction, refusing before the act becomes true — and not yet wired end to end |
| Process — the unit of value | designed | no binary, no verb, no line to copy; and its own frontier is open, since what would settle it is applications rather than more design. See Process |
The kernel and the device model
| piece | grade | why |
|---|---|---|
Inference as a device — /dev/llm/<vendor>/<model> | runs | opened by name, streamed, closed, with an errno vocabulary that survives up to the shell |
| The kernel inside the process | runs | the kernel is a library every coreutil carries; a device opens with nothing running on the machine |
| The consumer never holds the credential | runs | no key flag on any surface; a device with no credential fails eacces at open, before any application byte |
| Driver in three layers — runtime · subsystem · provider | runs | the ABI gives mechanics, the subsystem owns the wire types of a device class, the provider maps one vendor onto them |
| One subsystem per class, never per vendor | runs | two vendors stand under chat, and two providers from the same vendor under stt, bounded and live capture being two devices |
A separate kernel daemon (bentosd) | designed | the daemon does not exist, even by name — and today it is unnecessary, since each process opens its own devices and takes them with it |
A CUSE/FUSE portal — a real node under /dev | designed | /dev/llm/... is the in-process kernel’s namespace; ls /dev/llm/ shows nothing and POSIX open() will not find it. llm models is the enumeration, and says so itself |
The subsystem catalogue
| piece | grade | why |
|---|---|---|
chat | runs | the class that is finished enough to build on, with fixture devices that need no credential |
stt · tts | runs | packaged with providers beneath them, the device path carrying the verb; both need a real credential, and no fixture stands in for audio |
vision · embed | designed | named in the design; no package, no device |
im · email · voip | designed | deliberately outside AI, and each of them today a swamp of one SDK per application. This is the wager the floor is making |
The programming model
| piece | grade | why |
|---|---|---|
llm as a single-turn filter, the script owning the while | runs | a whole agent loop is a POSIX sh script: the transcript is a file, memory is >>, and dispatch is any program on the machine |
| Typed streams between ordinary filters | runs | one JSON record per line on the wire, which is the only contract two programs that share no library have ever needed |
| Nothing is resident | runs | no daemon behind any line on this site; each coreutil is born, runs, exits |
| Application architecture — entities and actors | designed | the floor gives the vertex, the act and the arming; the application graph has no executable form, and the wiring is written by hand |
| Federation as a matter of deployment | designed | it falls out of the shape — arming is per installation and a push crosses the same hook a local commit does — and no two sites were ever run |
Above the platform
| piece | grade | why |
|---|---|---|
| HumanOS — the computer you talk to | designed | no artifact; it is the promise stated on its page and nothing more |
What is open source, and what is not
The platform is MIT: the kernel, the ABI, the userland, the ports tree, the driver SDK, the inference subsystems, and a driver per vendor beneath them. Contributing says which of those is the place to start. Repositories outside that set — the commercial product above the platform, and work not yet licensed — are not open source, and are not linked here as if they were.