Capabilities, not identity
A process acts not because of who it is, but because it holds a specific, unforgeable capability. No ambient privilege. No escalation.
ARCHITECTURE
A kernel that isolates, and nothing more.
Every line of privileged code is a permanent liability. The Tirys core exists to isolate, schedule, route and enforce; filesystems, networking and drivers all live in user space, reachable only through capabilities.
FIG.1 - SYSTEM LAYERS
USER SPACE · SERVICES
TFSfilesystem
TNetnetworking
TAIroadmap
driversnetdrv · usb · gfx
cap:// - unforgeable authority
T-Core
RING 0 · ISOLATE · SCHEDULE · ROUTE · ENFORCE
hardware abstraction kernels
x86
ARM
RISC-V
Contained failure
A crashing network stack cannot destroy unrelated applications. Restart a filesystem service without rebooting the machine.
Resources are contracts
Applications declare what they require. The OS either guarantees those resources or refuses to start them. Predictability over optimism.