anvil / bionickernel

Pre-alpha · Phase 0.7

Anvil.
Build on the editor.

A Linux-first terminal editor with a selection-first Rust kernel, a per-session Go policy gateway, and a plugin host that is a real process boundary. Pre-alpha, but the seams are deliberate.

Read the source ↗Architecture
01 fn main() {
02 let kernel = Anvil::new();
03 kernel.open("src/main.rs");
04 }
~ ├─ src/main.rs rust
~ └─ src/session.rs modified
NORMAL LSP ready · split: 2 panes · gateway: per-session
Kernelselection-first Rust
Policyper-session Go gateway
Pluginsuntrusted host
LicenseMIT / Apache-2.0

01 · Architecture

Separate the editor
from the authority.

The gateway is not the sandbox. The plugin host is. The editor owns text and selection; the gateway owns system policy; neither owns the other's state.

TrustedRust editor

PieceTable · selection · view · snapshots · commands

Per sessionGo gateway

openat2 · fetch policy · exec policy · capability token

UntrustedPlugin host

Lua/QuickJS · Landlock · seccomp · no ambient authority

02 · The pieces

An editor kernel
with fewer assumptions.

01

Selection-first core

Every action has an explicit target. Caret is an empty selection. Multi-cursor is not a separate mode.

02

Go gateway

openat2 workspace resolution, DNS-pinned fetch, sandboxed exec, and per-session capability grants.

03

Process isolation

Lua/QuickJS never run in the editor process. A compromised plugin is not the editor.

04

LSP, not a monolith

Diagnostics, completion, hover, definition, rename, actions, formatting, and symbols — as a replaceable layer.

05

Terminal native

Ratatui/crossterm, vertical splits, fuzzy file finding, file tree, and dirty-only redraws.

06

Distro boundary

The standard edition is one composition. Third parties can build their own UI on the kernel without forking it.

03 · Current state

Pre-alpha,
with explicit seams.

Anvil is not a drop-in Helix or Vim replacement yet. The kernel, gateway, and sandbox are real; the standard-edition and third-party distribution surface is still being extracted.

Roadmap ↗
  • NOWSelection-first kernel, PieceTable, multi-selection, undo, snapshots · shipped
  • NOWLSP subset and terminal UI · shipped
  • NEXTExtract anvil-session from the TUI · in design
  • NEXTVersioned gateway protocol and compatibility tests
  • LATERLua/TS plugin runtime and a third-party distribution example

04 · Boundary

No stable Rust ABI.
No fake zero trust.

Compiled Rust code in a distribution is trusted kernel code. Lua/TS plugins are untrusted runtime code. PGO/BOLT is an optional release step, not part of the interface.

Kernel boundary ADR ↗Security policy ↗Governance ↗