Docs / Concepts / Architecture
Architecture
The layers of QingOS, what each layer does, and how the layers talk to each other.
Layers
| Layer | What it is |
|---|---|
| Faces | Where the person sees and hears the system: screen, voice, light ring, LAN console |
| Apps | Wasm modules, isolated inside the runtime |
| Runtime | The qing program: mind, guard, storage, model service, console |
| Base | qinit, the network qnet, the audio process, the state disk, updates |
| Kernel | Mainline Linux, configured from allnoconfig, with only the drivers in use |
| Hardware | The SoC runs all of the above; an MCU controls lights, keys and sensors |
Kernel
We do not write the kernel, but we configure it. We turn on only what three things need: drivers, process isolation and a fast start. There are no modules and no graphics stack. The x86_64 kernel for QEMU is 3.2 MB.
Base
The base is all our own Rust:
qinitis process 1. It mounts the file systems, starts the runtime and feeds the hardware watchdog. If the runtime has no heartbeat for 60 seconds,qinitstops it and starts it again.qnetsets up the network card and does DHCP, DNS and SNTP. It also does the Wi‑Fi WPA2 handshake itself. There is no wpa_supplicant.- The audio process uses ALSA directly. The screen uses DRM directly. There is no PulseAudio and no window system.
- Update packages are signed. The new system goes into the second system slot. If the new system does not start, the device goes back to the old one.
Runtime
| Part | What it does |
|---|---|
| Mind | Builds the prompt, calls the model, and gives the actions that the model wants to the guard |
| Guard | The only way to call a capability. It checks permissions, asks when it must, runs the action and writes the log |
| Storage | One SQLite file: permissions, memory, settings |
| Model service | Selects the model for each role, keeps to a budget, and replaces private data before a request goes out |
| Console | An HTTP service on the local network. A phone opens it for settings and logs |
The parts talk to each other only through events on a bus.
Three rules
- The mind can act only through the guard. The mind does not touch the network, files or hardware directly.
- The guard does not call a model. If the model stops, the guard continues to work.
- The operating system layer does not know that the agent exists. The audio process does not know who gets the recording.
The person and the agent both call apps
The person calls apps through the faces and the keys. The agent calls apps through the guard. Apps use the network and push cards without the agent.
The agent has one job: when the person says something, it decides which capability of which app to call.