What can run today

Plain English. These are in-kernel samples (or one short user-mode stub) that already have probes on this tree. They are not third-party applications and not a product runtime.

Status of each probe: honesty ledger. How we measure: measure.md. Isolation of user programs stays Planned. Do not say “apps,” “userspace,” or “secure OS” as if a general-purpose OS existed.

Privilege — where code runs

The CPU has privilege levels. EL1 is kernel privilege (where ctos runs). EL0 is lower privilege (user mode). A process would be a loaded program with its own address space, files, and a public ABI. That process does not exist yet.

flowchart TD
  EL1["EL1 — kernel privilege<br/>Verified: this is where ctos runs"]
  EL0["EL0 — lower privilege<br/>Verified: a short standing stub only"]
  PROC["A process / application<br/>Planned: not built"]
  EL1 --> EL0
  EL0 -.-> PROC

The stub is not a process. Umbrella “EL0 isolated” stays Planned.

A supervisor call (SVC) is the instruction the stub uses to ask the kernel for something. Today’s SVC #1 / #2 are test miles, not a public syscall list.

1. Cooperative UART workers

Two tasks on heap stacks that print a line and yield to each other. Same class as the smoke markers sched: task a / sched: task b / sched: ok (ADR-010, cooperative scheduling — FR-11).

A natural variant is a serial heartbeat or counter: print a tick, yield, repeat. Still cooperative EL1. Still UART text. Not preemptive. Not two CPUs.

2. UART RX echo gadget

Read a byte from the serial receive path (PL011 RX) and print it. Same class as input: rx 0x41 (ADR-007).

That is a byte in, a line out. No TTY, no line editor, no canonical mode, no virtio-keyboard.

3. Standing EL0 stub

A short payload in user mode (EL0) that does an SVC round-trip and returns. Same class as el0: standing / el0: restored (ADR-013, el0.md).

This is not a process. There is no libc, no files, no argv, no loader for a foreign ELF. “EL0 isolated” stays Planned.

What cannot run

flowchart TD
  Q{"Want to run it on ctos today?"}
  Q -->|UART worker / echo / stub| Y["Yes — extend the kernel in-tree"]
  Q -->|Linux binary, shell, Python| N1["No"]
  Q -->|Network server or files| N2["No — no NIC, no filesystem"]
  Q -->|Docker / OCI container| N3["No — not a goal"]

“Yes” means rebuild the kernel. It does not mean drop in an app.

Do not imply these work:

• Linux binaries (no Linux ABI, no ELF loader for third-party programs)
• A shell
• Python (or any hosted language runtime)
• Network servers (no NIC, no sockets, no DMA)
• Filesystem apps (no block device, no VFS — Filesystem (Planned))
• Extra-CPU workloads (one CPU, cooperative yield only)

Also not claimed: POSIX, GPU, Raspberry Pi, certified security, “production ready,” or containers (Hosting apps / containers).

How you would add something in-tree (and why Linux apps do not port): Building or porting.