The XRUIOS

Write the app. Skip the plumbing.

The XRUIOS puts the hard parts (keys, permissions, tamper checks, audit logs, OS differences) behind a handful of calls. Here is what that looks like in practice.

Five lines in

This is the whole app.

Connect to the local orchestrator, add an event, get the day's events. The Manager does the rest.

C# · Agenda

var cred = await Xruios.CredentialsAsync("agenda");
await using var mgr = await Xruios.ConnectAsync(cred, "agenda");

string today = DateTime.Today.ToString("yyyy-MM-dd");
string uid = await mgr.InvokeAsync<string>("AddEvent",
    new() { ["day"] = today, ["summary"] = "Stand-up" });
string events = await mgr.InvokeAsync<string>("GetEvents", new() { ["day"] = today });

What a secure cross-device app usually has to build itself

Storing and protecting credentials
A key exchange and an encrypted session
Proving who is calling
A permission model, checked on every call
Reconnect and retry logic
An audit trail
Checks that nothing was tampered with
A different code path for each operating system

With The XRUIOS, none of that is in your code.

What you never write

Passwords and keys

Your app never holds a secret. The Manager hands it an id and a password when it starts or enrolls. Copy the exe to another machine and it authenticates as nobody.

The handshake

ConnectAsync does enrollment, a post-quantum key exchange and the transcript check in one call. Everything after that is AES-256-GCM.

Reconnecting

If a session goes idle, the client handshakes again and retries once. Calls on one client are queued for you.

Permission checks

List what you need in a manifest. Anything not granted is refused before it reaches a worker. Answers are remembered for 15 seconds, so a slider drag never hits the 100-checks-a-minute limit.

Audit logs

Every call is written to a tamper-evident log by the Manager and again by the worker. You write nothing.

Tamper checks

Workers and apps only start if their folder matches a signature the Manager made. Workers re-check themselves every 30 seconds.

Parsing glue

Replies are plain text, so any client can read them. A | or ; inside user text is shown as / or , and can never split a row.

Polling loops

Get granted Events.AlarmFired, subscribe once, and your handler is called. The long-polling happens underneath.

OS-specific code

Volume, power, clipboard, notifications, keyboard layouts and appearance are handled by the Interpreter on Windows and Linux, or handed to an Aether Engine shell.

File paths across devices

Save a folder by UUID with Bindings. The XRUIOS resolves it on each device, or asks the user to locate it.

Three common jobs

A capability is a method with an attribute. Arguments are bound by name, and a parameter with a default can be left out, so you can add an optional argument later without breaking older callers. To add one to an existing worker you edit only its Capabilities.cs.

C# · Capabilities.cs

public static class GreeterCapabilities
{
    [SeaOfDirac("Greeter.Ping", new[] { "input" }, typeof(string), typeof(string))]
    public static string Ping(string input) => "XRUIOS.Worker.Greeter: " + input;

    [SeaOfDirac("Greet", new[] { "name", "language" }, typeof(string), typeof(string), typeof(string))]
    public static string Greet(string name, string language = "en")
    {
        // Who asked? Stamped by the Manager, so the app cannot fake it.
        string who = WorkerCall.CallerAppId ?? "unknown";
        WorkerEvents.Publish("GreetingMade", $"{{\"for\":\"{name}\",\"by\":\"{who}\"}}");
        return GreeterClass.Greet(name, language);
    }
}

Then add the name to an app's grant list, rebuild, run XRUIOS.Manager baseline and restart the Manager.

An app is a manifest: a name, the executable allowed to enroll as it, its capabilities and its events. No grant code. Remove a name later and it is revoked on the next start.

JSON · myapp.json

{
  "name": "MyCalendarWidget",
  "exe": "C:\\Apps\\MyCalendarWidget\\MyCalendarWidget.exe",
  "capabilities": [ "GetEvents", "ListCalendars" ],
  "events": [ "AlarmFired" ]
}

Shell

XRUIOS.Manager install-app manifest.json
XRUIOS.Manager stop
XRUIOS.Manager start

A screen connects once, then calls a hole: a one-line wrapper around a capability. The XAML never sees the broker, a password or a worker.

C# · MainPage.xaml.cs

Loaded += async (_, _) =>
{
    // One connection for the whole app. Credentials come from the Manager.
    await AppShell.InitializeAsync("XRUIOS.App.Time");

    // A hole is one line: it calls the Now capability and parses the reply.
    ActiveCountLine.Text = await TimeSource.NowAsync();

    // Live updates instead of polling. Needs the Events.AlarmFired grant.
    _alarms = EventFeed.On<AlarmInfo>(XruiosEventNames.AlarmFired,
        alarm => Dispatcher.BeginInvoke(() => ShowAlarm(alarm)));
};

Same code, every device

The Interpreter decides how

A capability says what the user asked for. The Interpreter decides how that happens on this machine: Windows, Linux, or an Aether Engine game acting as the shell. Areas without a built-in behaviour (themes, alarms, weather, the assistant model) are yours to register. The design means a future Android or macOS worker can slot in without changing any caller.

C# · Interpreter

// Swap how ONE area behaves; every other area keeps the OS behaviour.
XruiosInterpreter.Use<IThemeInterpreter>(new MyThemeApplier());

// An app that handles ThemeChanged only needs that interpreter registered:
InterpreterEvents.Dispatch(name, payload);

Folders follow the user

Bindings reference a folder by UUID instead of a path, so the same project resolves on every device.

C# · Bindings

var bindings = new Bindings.DirectoryManager(
    Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
                 "XRUIOS", "Bindings"));
await bindings.LoadBindings();

// Save the UUID, not the path.
var project = await bindings.GetOrCreateDirectory(@"D:\XRUIOS\Projects\MyProject");

// On any device, later:
var projectPath = await bindings.GetDirectoryById(project.Uuid);
if (projectPath == null) { /* ask the user to locate it */ }

Failures are small and loud

A refused call is more often the model working exactly as intended.

Failure	It means	Do
Handshake fails	The Manager is locked, not running, or the password is wrong.	Tell the user to log in and start the Manager. Do not retry-storm.
Capability denied	The app was not granted it.	Expected. Do not crash; explain, or do not offer the action.
Worker error	The call was granted and ran, then failed inside the worker.	Show the worker's own message. It is a real error, not a permission one.

C# · a call that is refused

try   { await mgr.InvokeAsync<string>("DeleteEvent", new() { ["uid"] = uid }); }
catch { /* XRUIOS.Permission denied 'DeleteEvent' for app:myapp */ }

Pick the project that fits

Six kinds of project. They differ in what they reference and how they start. The security contract underneath is the same: your project holds a capability and asks. It never holds the authority.

Type	It is	Entry point
Worker	One system class in its own process, with a curated capability surface.	`SecureWorkerHost.Run(...)`
CMD app	A headless program that calls capabilities through the broker.	`EclipseSecureClient.ConnectAsync(...)`
Desktop app	The same client behind a window (OpenSilver and Photino as shipped; WPF and Avalonia work too).	`AppShell.InitializeAsync(...)`
Engine shell	A game engine acting as the XRUIOS shell.	`AetherShell.ConnectAsync(...)`
Aether mod	Untrusted code under CasCore, gated by the same permission store.	`The host loads it; the mod asks the host`
Diagnostics	A client that probes every worker and asserts the walls hold.	`EclipseSecureClient.ConnectAsync(...)`

Mods use the same gate

A mod from the Aether Engine is just another requester in the same permission store. Its identity comes from the host, never from the mod, so it cannot claim another mod's grants.

Mod	`GetEvents`	`DeleteEvent`
`com.hollvania.calendarwidget`	ALLOW	DENY
`com.evil.dataslurp`	DENY	DENY

Same mod code, different registrations: access follows the grant, not the code. Raw file, process and socket calls are blocked by CasCore regardless of grants.

Checked, not just claimed

28 / 28workers launched

33 / 33diagnostics probes passed

180 / 180end-to-end checks passed

4 / 4original attacks refused

The diagnostics harness connects as a normal app and probes every worker, a real Calendar round trip and the refusal checks. Run it against a live Manager any time.

How it is protected GitHub See Yuuko Protocol