IPNX v12

a reimagining of Unix — the counterfactual next Research edition, running in this tab

IPNX is a new operating system — not a distribution of an old one, not an emulator. Its kernel is original, written in Rust — and the very same kernel runs native on macOS and, compiled to WebAssembly, inside this tab: one core, one conformance suite green on both, plus a JavaScript twin held as the frozen conformance oracle. The architecture takes what Plan 9 proved and Unix never shipped — per-process namespaces, 9P as the only IPC, everything a file — with none of Plan 9's kernel code, and WebAssembly as the executable format.

What boots below is the complete system, entirely in this tab: the reimagined userland on /dev/canvas — a display that is a semantic file tree you can cat, echo and grep — with con, acme and sam (each name inherited by passing its ancestor's tests; the raster originals still run as sam9 and acme9), the real 4th-edition rc, twenty-four real commands, V10 binaries from the TUHS tapes in /v10/bin, real Go and CPython 3.14, a C compiler, a package manager, whole-system snapshots and a process orchestrator. Nothing you type leaves the page. No other wasm runtime, development environment or Linux distribution can easily claim this: a whole operating system — kernel, editors, compilers, Python with pip — running securely in a browser tab, in an internet café if need be; and the same system runs native on macOS with full JIT.

Boot IPNX v12 — the whole world: the canvas console and editor, shells, sam, acme, cc, the real Go compiler, Python with pip. The desktop appears in seconds; the toolchains (~260 MB) stream in while you look around. Nothing persists by default; pick home: browser storage or grant a real local folder from the menu and your files outlive the tab — a granted directory is a bind. Run the conformance suite

What's inside

acme — the one editor, acme reimagined for modern surfaces and answering the 1994 paper example for example: columns of windows, every tag an editable line whose words are the commands, a directory listing as the file browser, sam's structural regexps in every tag (Edit ,x/re/c/text/), the dirty box (and Put appears in the tag only while it's needed). Execute any command in a tag — its output opens in a dir/+Errors window; |, < and > filter the selection through real programs; Undo/Redo unwind by sequence; right-click hello.c:3 and the file opens at line three. And the editor is itself files: mount acme /mnt/acme, then grep -n main *.c > /mnt/acme/new/body puts grep's output in a fresh window — the paper's own example, running. sam — the same language as a standalone filter: sam file < commands, ed's true heir; it earned the name by passing the original's tests. con — the console as an editable transcript: scrollback is a buffer, search is the editor, no terminal emulation anywhere in the native path.

pkg — the package manager where installing is a bind: a package is a verified subtree, pkg install ruby binds its binaries into /bin, versions coexist, conflicts are refused at install time, and a subshell that does rfork n owns a private dev environment that vanishes with it — no venv, no nvm, no flatpak, because the kernel can say bind.

#V — every system is a time machine: echo snap t1 > '#V/ctl' freezes the filesystem by copy-on-write (nine megabytes for twenty whole-system snapshots), cat '#V/t1/tmp/f' reads the past, and rollback is bind '#V/t1/dir' /dir. Nobody rewrites history — not even the owner.

run & svc — containers and orchestration without the industry: a process spec is a directory (a Dockerfile is a script because installing is mutation; here it's a declaration because installing is a bind); svc keeps N replicas alive and kubectl is cat and echo: echo start web /spec 3 > /n/svc/ctl.

Real toolchains — cc is clang and wasm-ld running as guests; go drives the real gc compiler; python is CPython 3.14 with the full stdlib and pip talking to the real PyPI. And the display itself is files: every window's UI can be cat-ed, echo-ed into, and grep-ed — which is why the test suite drives real editors without a screen.

The browser surface

Press Boot, then:

Choose a home from the menu selector: play (the shipped examples; nothing persists), browser storage (your files survive reload, private to this site), or local folder… (grant a real directory on your disk — Put writes to it; a granted directory is a bind). Console opens con: type at the caret, Enter runs the line, and the whole transcript is an ordinary editable, searchable buffer. acme opens the workspace: two columns with your home listed — right-click a name to open it (directories open as more listings), alt-click (or middle-click) any word in any tag to execute it — Put, Get, Del, New, Newcol — and sweep a selection first to execute it with arguments, e.g. select Edit ,x/harses/c/horses/ in a tag and alt-click it. Rename the tag's first word and Put writes to the new name. Your ⌘C/⌘X/⌘V are snarf: cat /dev/snarf reads what you last copied. The display really is files — from the console, try cat '#w/2/canvas/12/data' to read an editor's buffer as text, or rc /rc/tile to run a window manager written in a dozen lines of shell.

The macOS surface

The same system runs native — full JIT under wasmtime, real windows, your real pasteboard, and host storage. With Rust, wasi-sdk, binaryen, bison and go installed (versions and paths in docs/handbook.md):

git clone https://github.com/ChristineTham/ipnx-v12 && cd ipnx-v12
bash userspace/mk.sh                                      # build the guest world
cargo run --release -p host -- userspace/rootfs           # headless: init runs the suite
cargo run --release -p host -- userspace/rootfs --app -i  # windows: con, acme, canvas
cargo run --release -p host -- userspace/rootfs --live    # writes persist to the rootfs dir
bash hosts/macos/mkapp.sh                                 # wrap it as IPNX.app

Under --app the canvas renders natively; /dev/snarf is the Mac pasteboard (echo hi > /dev/snarf then paste anywhere); and the versioning layer runs everywhere: echo snap t1 > '#V/ctl' freezes the filesystem, bind '#V/t1/dir' /dir is the rollback — twenty whole-system snapshots cost nine megabytes.

Once the prompt appears, take the guided tour:

rc /rc/tour

You boot as kitty, at home in /usr/kitty, where hello.c, hello.py and hello.go are waiting. With the toolchain aboard, cc hello.c then ./a.out runs real clang and wasm-ld as guests, then the binary you built — Hello Kitty. It is a real cc(1): flags, -o, -c and multiple files all work. Python interprets in the tab too (python hello.py); real Go binaries run, though Go's compiler is host-side (go explains why). The tour shows everything.

Heritage is one command away: font=/lib/font/bit/go/regular.13.font win acme9 & opens the 1993 raster acme, verbatim source, beside its successor; @{bind /lib/alt /etc; cat /etc/motd} shows a subshell rearranging its own private namespace; /v10/bin/echo -e 'a\nb' | wc pipes 1989 into 1992.

Everything runs in your browser — nothing you type leaves this tab, and reloading forgets it all unless you chose a persistent home. Measured green in Chromium (Chrome, Edge, Brave, Arc) and in Safari — the full conformance suite (151 tests today; the floor is 131) passes in both. (Safari needed real engineering: WebKit deterministically fails concurrent module-worker loads through a service worker — minimal repro and file-ready report in the repository under demo/webkit-repro/ — so this page serializes worker startup.) Firefox is untested. The whole system — kernel, sources, the conformance suite, and the documents that argue for it — is at github.com/ChristineTham/ipnx-v12. Third-party licences: NOTICES.