This is a working model of a microkernel operating system — the design lineage of QNX and MINIX — running entirely in your browser. A tiny kernel passes messages between isolated services and enforces a security policy, while a supervisor keeps everything alive by watching heartbeats and reviving whatever dies.
Four parts, mirroring a real microkernel:
- Kernel — a publish/subscribe message router plus a capability policy. Pure mechanism: it moves messages and checks permissions, and knows nothing about what the services actually do.
- Services — seven isolated “drivers,” each in its own Web Worker. Any one can crash without touching the others.
- Supervisor — a reincarnation server. Every service emits a heartbeat; miss enough of them and the supervisor declares it dead and restarts it.
- Operator — the dashboard you’re looking at: a privileged consumer of the bus.
The bus tape at the top is an oscilloscope of the message bus — every blip is one real message crossing the kernel: teal for heartbeats, blue for app traffic, amber for the supervisor, red for a denied or faulted message.
Nothing here is faked. Crash a service, pull its worker offline, hot-swap its code, tighten the security policy — and watch the system react live. The Tutorial tab walks you through it.
Try these in order — each demonstrates a different OS idea. Keep an eye on the bus tape and the event log as you go.
- Stop / Play (top of the control room) freezes the entire runtime — every worker, timer and heartbeat — then resumes exactly where it left off. Scheduling in one switch.
- Hang or Crash a service card. Hang stops its heartbeats (it looks alive but isn’t); Crash terminates its worker. Either way the supervisor notices within ~1.9s and reincarnates it.
- Set Reincarnation: OFF, then crash something — it stays dead. Turn supervision back on and it’s revived. That’s the difference a supervisor makes.
- Run the compute service (N up to 400,000). The prime count runs inside a worker, so the interface never freezes — isolation buys responsiveness.
- Race at a difficulty. The same SHA-256 proof-of-work runs in pure JavaScript and in Rust→WebAssembly (4-way SIMD) at once; both land on the same nonce, and you watch the live hashrate gap.
- Watch the analyzer — it rides on the telemetry service’s readings (a service consuming a service) and flags spikes. Crash telemetry: with reincarnation on it heals before the analyzer notices; with it off, the analyzer reports “input lost.”
- Upgrade compute → v2. Its code is replaced in place (trial division → sieve) with no page reload — a live hot-swap. Run a job before and after to compare.
- Move → worker / local on any card. Callers address services by topic, not by location, so nothing else changes. That’s location transparency.
- Provoke a violation: telemetry tries to publish a privileged control message. Under Strict policy the kernel denies it (a red blip and a denial in the log); flip to Permissive and the same message flows. Same mechanism, different policy.
The six services
- clock — emits a tick every second. Pure liveness.
- telemetry — streams a fluctuating sensor reading into the sparkline.
- compute — counts primes on request; ships in two versions for the hot-swap demo.
- wasmcompute — SHA-256 mining in a real WebAssembly module (4-way SIMD, scalar fallback).
- jsminer — the identical mining in pure JavaScript, to race wasm.
- analyzer — a telemetry watchdog: rolling stats, spike alerts, and input-loss detection.
- pi — decimal digits of π via the BBP spigot; runs on the GPU (WebGPU) when available, else the CPU.
Concept → where to see it
| Message passing (pub/sub) | every blip on the bus tape |
| Fault isolation | crash one service; the rest run on |
| Supervision / reincarnation | Reincarnation toggle + heartbeats |
| Capability security | Strict / Permissive policy |
| Hot code swap | Upgrade compute → v2 |
| Location transparency | Move → worker / local |
| Worker isolation | each service is its own thread |
| WebAssembly & SIMD | the JS-vs-wasm race |
| Service composition | analyzer consuming telemetry |
| GPU compute (WebGPU) | the π digit service |
Controls
- Stop / Play — freeze or resume the whole runtime.
- Reincarnation — enable or disable the supervisor’s auto-restart.
- Policy: Strict / Permissive — enforce or relax the capability rules.
- Hang / Crash / Move — per-service fault injection and migration.
Full architecture notes, the message-topic catalog, and the WebAssembly ABI are in README.md in the download.