Skip to content
PointSav Digital Systems

Revision as of · 754f0c6a

Historical revision — this record as it stood on 2 July 2026, not the current version. View the current record →

OS family — eight operating systems, one substrate

PointSav builds eight purpose-built operating systems that share a common seL4 microkernel substrate, a common Rust language discipline, and a common Diode-based communication protocol. Each OS does one job and contains no feature it does not need. The family ranges from a human-facing terminal to a sovereign cloud appliance, yet every member compiles from the same kernel and speaks the same protocol. This article covers the eight members of the OS family, the substrate they share, how they compose into deployments, and the Diode discipline that governs command flow across all of them.

The eight operating systems

OS Role Operated by
os-console Universal human terminal — the Command Ledger The operator at the keyboard
os-totebox Sovereign vault and service host — the data archive An entity (person, corporation, property)
os-orchestration Fleet aggregator — multi-archive view for commercial operators Enterprise administrator
os-infrastructure Compute substrate that hosts the others Fleet administrator
os-network-admin Network control plane — routing, pairing registry, mesh policy Network architect
os-mediakit Public web appliance — marketing, wiki, compliance newsroom Reporting Issuer or SMB
os-privategit Sovereign source and design hosting PointSav internal and customer
os-workplace Sovereign desktop with native Rust apps Community and SMB customer

Why eight, not one

Conventional operating systems try to be everything: accounting, email, secure browsing, video editing. The result is a large attack surface and constant feature drift. PointSav inverts the model: every OS is small, single-purpose, and replaceable. If a deployment does not need a fleet aggregator, it does not include os-orchestration. If it has no public website, it does not include os-mediakit. Each OS is a piece of precision plumbing, not a platform.

The shared substrate

All eight operating systems share the same foundational layer:

Layer Component Purpose
Kernel seL4 microkernel Mathematically verified hardware isolation
Language Rust (memory-safe; no garbage collector) All system-*, service-*, and os-* code; C/C++ banned at L3 and above
Drivers sDDF (seL4 Device Driver Framework) Direct hardware access without runtime bloat
Protocol PointSav Protocol (PSP) Capability-based binary protocol; tunnels through TLS and VirtIO at the edge
Trust service-pairing Hardware-bound cryptographic pairings; no usernames, no passwords
Audit Append-only ledger (planned) Tamper-resistant event record that cannot be disabled by an administrator
Transferability Sovereign Addendum (planned) The running instance remains the operator's property in any cloud provider

How they compose into deployments

The minimum viable deployment is one operator running os-console, connected to one os-totebox hosted in the cloud. The Console is the keyboard and screen; the Totebox is the vault and the worker.

The largest deployment is hundreds of os-totebox instances spread across on-premises, leased, and cloud os-infrastructure nodes, governed by one os-network-admin, and aggregated through os-orchestration for executive review. Both extremes use the same binaries. Scale is a configuration matter, not a code fork.

The six canonical compositions are covered in detail in deployment-patterns.

The Diode discipline

Across all eight, command flow is unidirectional. os-console and os-orchestration can issue commands to the others. The others emit telemetry upward — never commands in the reverse direction. This constraint is enforced at the Diode protocol level, not by policy. A compromised public-facing os-mediakit instance cannot reach back into a corporate os-totebox because the code to do so is absent from the binary. The sovereign airlock principle describes why absent code is the only reliable enforcement mechanism.

See also

Important Information

Important Information

Corporate structure. PointSav Digital Systems ("PointSav") is a trade name of Woodfine Capital Projects Inc. ("Woodfine"). PointSav does not itself offer, sell, or solicit any security. Any securities offering associated with Woodfine's real-property direct-hold solutions is made exclusively by Woodfine, and only by means of the applicable Private Placement Memorandum.

No investment advice. This wiki's content is provided for engineering, operational, research, and development purposes. Nothing on this wiki constitutes investment advice or a solicitation to invest in any Woodfine partnership or direct-hold solution.

Intellectual property. The PointSav name, trade name, wordmark, and marks, together with all current and future PointSav- and Totebox-branded products, services, and offerings — and the software, source code, documentation, design system, and all related materials — are proprietary to Woodfine and its affiliates, except for components identified as open source. No rights are granted except as expressly set out in a written license or agreement. See TRADEMARK.md in this repository for the full trademark notice.

Open source components. Portions of the platform are made available under permissive open-source licenses identified in the accompanying repository. Use of those components is governed by their respective license terms.

No warranty; informational use. Content on this wiki is provided for general informational purposes only and does not constitute a representation, warranty, or commitment with respect to product functionality, availability, pricing, or roadmap. Some articles describe planned or intended features, capabilities, and milestones — language such as "planned," "intended," "targeted," "may," and "expected" marks this forward-looking content, which is subject to change and does not constitute a commitment regarding future performance.

Confidentiality. Where an article describes an operational or deployment detail that is not intended for public disclosure, that article is not published on this wiki. Content here is general-purpose engineering documentation, not customer-specific configuration.

Jurisdiction. Woodfine Capital Projects Inc. is organized in British Columbia, Canada. References to the Sovereign Data Foundation on this wiki describe a planned or intended initiative only, not a current equity holder or active governance body.

Changes to this notice. PointSav may update this notice from time to time; the version posted on this page governs.

Not a filing system. This wiki is not a securities filing system, an electronic disclosure repository, or a substitute for SEDAR+ or any other regulatory filing system. Formal securities filings are made through the applicable regulatory filing system, not through this wiki.

Full disclaimer. This notice supplements, and does not replace, the full Disclaimers article. In the event of any conflict, the full Disclaimers article governs.

Read the full disclaimer →