The repositories are not a list. They are organs of one body, and each one exists because the body needs that function:

The skeleton is where the body meets the world: the HAL guarantees a sample is real, the vault guarantees it stays, and the supervisor decides whether anything may be acted on. The law constrains the core; SDK limbs give applications a typed grip on it; the conformance immune system rejects byte-drift across five languages before it spreads; the radar is the organism's senses: a living, scored map of the whole open-BCI field in which AxonOS ranks by the same formula as everyone else; the games and the site are the skin where people first touch it. Remove any organ and something specific stops working.

A complete brain–computer interface operating system is a continuous chain, from a raw electrode signal to a typed, consented intent, and back to a safe failure state. AxonOS is building that chain in the open. This map is deliberately honest about what is shipped, what is partial, and what is still ahead.

The execution core, the consent and capability layer, and the conformance surface are in place. To be a full operating system, not only a standard and a kernel — AxonOS still needs, and is sequencing on its roadmap:

Closed since this list was written:

• the acquisition contract — axonos-hal defines what a sample is, what time the chain may take, and what happens when the hardware misbehaves. Half of an item: the contract and a simulated backend exist; a register-level ADS1299 driver does not, and the OpenBCI bridge above is still the only path to physical silicon;
• the deterministic simulator running the full path without hardware — axonos-stack wires the organs into one seeded session whose transcript is byte-exact and diffed in CI;
• the privacy-vault enforcement layer — axonos-vault makes raw samples unreadable by construction and meters every reduction that leaves against a declared information budget, because a permission answered per request is defeated by asking many times.

Still needed, and sequenced on the roadmap:

• a trained model and measured accuracy / latency / power for the fixed-point DSP and classifier machinery already shipped in axonos-signal-pipeline: the pipeline is implemented and vector-pinned; what is pending is a trained model and on-hardware numbers;
• secure boot, firmware attestation and signed update: the canonical hardware carries an ATECC608B secure element that no software in this organisation currently uses. For a device that reads a brain, unauthenticated firmware is the largest single hole in the design;
• power and energy management, and, specifically, its interaction with the timing proofs: a frequency or sleep-state transition changes worst-case execution time, so axonos-hal's budget must be re-closed at every transition rather than assumed across it;
• a structured safety case (hazard analysis, FMEA, residual-risk argument) and a formal threat model for cognitive data, as engineering artifacts, not regulatory claims;
• a public conformance program and an independent-implementer challenge: the real test of a standard is whether a stranger can build a byte-compatible kernel and SDK from axonos-standard and the RFCs alone, with no access to this source, and pass axonos-conformance unchanged. That is the bar AxonOS is building toward;
• a path from founder-led to foundation / technical-steering governance.

These are roadmap items, not present capabilities. They are published here so the distance between today's reference implementation and a complete, independently implementable BCI operating system is visible rather than hidden.

flowchart LR
A[EEG/EMG sensors<br/>ADS1299 · 24-bit] -->|raw| B[Acquisition gateway<br/>nRF52840]
B -->|filtered| C[AxonOS kernel<br/>Rust no_std<br/>Cortex-M4F]
C -->|WCRT ≤ 1 ms, proven L1| D[Cognitive scheduler]
D -->|typed intent| E[Application<br/>via SDK]
F[Cognitive Hypervisor<br/>TrustZone-S] -.->|isolates| C
G[Consent FSM<br/>axonos-consent] -.->|gates| D
%% Grey is deliberate here, unlike in the organ diagram above. Colour marks
%% what AxonOS owns; the sensors, the gateway and the applications are
%% somebody else's and are left plain on purpose. Filling every node would
%% delete the only thing this diagram says.
classDef kernel fill:#0a4a8f,stroke:#083a70,color:#fff,stroke-width:2px
classDef secure fill:#0d7a5f,stroke:#0a5f4a,color:#fff,stroke-width:2px
class C kernel
class F,G secure

Every arrow is a contract. The Standard defines what must hold at each boundary; an implementation is free in everything else.

Nothing here asks for trust. Every claim is runnable in one click or three commands, and each prints a pass/fail you can check.

One click

• ▶ Play it — Neural Boundary Game: the consent, least-privilege, sealed-vault and StimGuard model, live in the browser on the same deterministic core the kernel uses. Every run emits a byte-for-byte replayable proof.
• Read the analysis — Zenodo preprint (DOI 10.5281/zenodo.20552007): EDF schedulability (R1 = 972 µs inside a 4 ms deadline), capability isolation, falsifiable predictions — predicted from datasheet cycle counts, no measurement claims.

Three commands, clone and run; each is reproducible on any machine

# 1 · the full path, electrode -> typed intent, verified bit-for-bit
git clone https://github.com/AxonOS-org/axonos-e2e-demo &&cd axonos-e2e-demo && ./run.sh --verify
# 2 · the kernel: 72 tests, then a machine-checked proof
git clone https://github.com/AxonOS-org/axonos-kernel &&cd axonos-kernel
cargo test --workspace
cargo kani setup && ( cd axonos-spsc/kani-proofs && cargo kani )
# 3 · the DSP + classifier machinery, bit-exact against conformance vectors
git clone https://github.com/AxonOS-org/axonos-signal-pipeline &&cd axonos-signal-pipeline && cargo test

Three more, added as the stack grew, each answers a different kind of doubt

# 4 · the organs running as one body: electrode -> vault -> posture, from a seed
git clone https://github.com/AxonOS-org/axonos-stack &&cd axonos-stack
cargo run --locked --bin session -- --seed 7 --frames 3000 | diff - reference/session-7.txt
# silence means the transcript reproduced byte for byte on your machine# 5 · the relevance score behind the public map, recomputed from its own evidence
git clone https://github.com/AxonOS-org/axonos-brs &&cd axonos-brs && cargo test# 20 vectors are real projects with their published evidence and pinned scores# 6 · who wrote the automated commits on the live map, and whether GitHub signed them
gh api repos/AxonOS-BCI/axonos-community-radar/commits \
--jq '.[0:10][] | "\(.commit.verification.verified) \(.author.login)"'

The fourth is the one worth dwelling on. The reference session is not a demo of a happy path: the simulated front end lifts an electrode at 4.8 s, and the transcript records the system withdrawing the right to actuate 96 ms later while continuing to record. The last line is an accounting identity — delivered + lost = produced, and if it ever fails, one of the three components is lying about what it saw. CI diffs that transcript on every push, so a dependency that changes observable behaviour fails the build with a diff of exactly what moved.

One wire format, five languages, byte-identical — axonos-conformance re-checks Rust = Python = C = JavaScript = Java in CI on every push.

What you are checking: the proofs are machine-checked (L1); the demos are deterministic and reproducible; the on-hardware worst-case numbers (L2) are not yet claimed, their status is tracked, claim by claim, in CLAIMS.md.

A verification story is only worth reading if it has failures in it. These are this month's, with the measurement that produced each. They are here because a project that publishes only its successes has put its failures somewhere else.

A timing assumption refuted by our own published data. The admission test for the real-time chain omitted blocking and interference: a normal simplification, and here a wrong one. RFC-0001 publishes two figures measured on the same board: the admitted task set sums to 694.2 µs, and the end-to-end worst case is 972 µs. The 277.8 µs between them — 28.6 % of the budget, of which at most 6.5 µs is jitter, is precisely the terms the test was leaving out. The assumption was not merely undischarged; it was contradicted by our own measurement, and nobody had subtracted the two numbers. RFC-0008 §4a

A score that could not rank. The public map's relevance score is displayed on every card and decides what is on the map at all. Measured across 117 scored projects it took nine distinct values: 19 % sat at exactly 100 and 31 % at exactly the inclusion gate. It was a category label wearing a number. Replacing the combiner, saturating instead of summing and clamping, produced 35 distinct values with the ceiling empty and the gate unchanged. axonos-brs

Two bounds that disagreed, found only by running the parts together. The privacy vault issues grants denominated in bits; its audit log holds 64 entries; and it refuses to release anything it cannot record. A 3 200-bit grant was therefore capped at 2 048, so the number written in the grant was not the one that stopped it and no reader could tell. Both behaviours were individually correct and individually tested. Only the integration session surfaced the disagreement. That is the argument for having one. RFC-0009 §N5

An unpaid side channel in a boundary that exists to have none. The same vault refused a request when its window was empty: a refusal that depends on the data rather than on the caller's permissions, so a caller could ask "is this device recording?" for free and without limit, outside the information budget entirely. Now the probe is charged: a thousand attempts against a 128-bit grant yield four answers and then a refusal.

Each of these is written up where it belongs, with the deviation recorded against the specification that names it. Neither RFC-0008 nor RFC-0009 may leave draft status while its own conformance table still lists an unmet requirement.

Most projects tell you what they claim. Almost none tell you where to push. The list below is where a determined sceptic should look, what specifically would falsify each claim, and, where the answer is already known, what has been found. It is not a hedge; it is the shortest path to being right about us.

The real-time guarantee. The published worst case is 972 µs against a 4 ms deadline. It rests on a task set of 694.2 µs plus 277.8 µs of terms measured but not modelled, and on the assumption that the acquisition chain is the only work on that core. Falsified by: an oscilloscope trace on an STM32F407 showing a response beyond 4 ms under any load the design admits, or a demonstration that the chain can be preempted by work the analysis does not count. The L3 fixture that would settle this does not exist yet, and the RFC says so rather than implying otherwise.

The alignment result.R̄^{-1/2}(P G_c Pᵀ)R̄^{-1/2} = U G_c Uᵀ with U orthogonal, alignment reduces inter-subject difference to a rotation and cannot remove it. Falsified by: a whitener satisfying W R Wᵀ = I that removes the residual rotation, which would contradict the polar decomposition, or an arithmetic error in the derivation. Verified numerically to 1e-7 on random SPD inputs; the algebra is three lines and is written out in full.

The information bound. For a grant of β bits, the mutual information between the sealed window and everything an application learns is at most β. Falsified by: a channel that carries information across the boundary without being charged. One such channel was found and closed: a refusal that depended on the window let a caller poll device liveness for free, and RFC-0009 §7 enumerates the remaining ones it knows about. If you find another, that section is wrong and should say so.

The determinism. Same seed, same bytes, any machine. Falsified by: one run of cargo run --locked --bin session -- --seed 7 --frames 3000 on your hardware that does not diff clean against the checked-in transcript. This is the cheapest attack on the list and the one we would most want to hear about.

Cross-language agreement. One wire format decoded identically in Rust, Python, C, JavaScript and Java. Falsified by: an input on which any two implementations disagree by a byte. The vectors are public; the disagreement would be a bug report we could not argue with.

What is not claimed, so cannot be falsified here. No accuracy figure. No transfer property. No latency or power measured on hardware. No clinical claim of any kind. If you find any of those asserted anywhere in these repositories, that is a defect and we want the issue.

Written down because the honest version of a roadmap includes the parts nobody knows how to do, and because a project that lists only tractable work is describing a product and not a field.

Calibration-free decoding across subjects. Alignment reduces the difference between two people's recordings to a residual rotation and provably cannot remove it. Whether that rotation is benign depends on the montage, and nobody has a general answer: the successful reports come from fixed layouts where the mixing matrices were already similar. An implementation cannot settle this; only recordings can.

Worst-case execution time on a modern core. Caches, branch prediction and memory controllers make a tight upper bound either unattainable or so conservative it wastes most of the machine. Every hard-real-time system on such hardware is trading one of those away, and saying which is the honest part.

Long-session non-stationarity. Signal statistics drift over an hour in ways that are not a simple function of anything observable at the electrode. Online adaptation tracks the drift it can see; the part it cannot see is why decoders degrade over a session and why a fresh calibration still helps after one.

Enforcing consent at the point of use. A revocation is enforceable on the device that holds the data. Once a reduction has left, the guarantee becomes a legal one and not a technical one, and no protocol yet makes an already transmitted value unusable on request. Bounding what leaves is a partial answer, and it is stated as partial.

Establishing that a signal is voluntary. A decoder reports what it detects. Whether the person meant it, whether it was intent and not a reflex, a startle, or the residue of a previous instruction, is not visible in the signal, and the difference matters most in exactly the cases where a device is most useful.

• Specifications, kernel ABI v1, capability catalogue, IntentObservation wire format, RFC index
• SDK and language bindings. Rust today; C FFI, Python, WebAssembly, JNI, Swift on the published roadmap
• Standards engagement. IEEE P2731 · IEC 62304 · ISO 13485 · FDA 510(k) · EU MDR
• Governance, current state, transition plan, trademark policy
• Engineering memo, three-page summary for technical readers
• Preprint — An Analytical Microkernel Design for Safety-Critical Brain–Computer Interfaces: Schedulability, Capability Isolation, and Falsifiable Predictions (Zenodo, DOI 10.5281/zenodo.20552007, CC-BY-4.0), analytical schedulability (R1 = 972 µs in a 4 ms deadline), capability isolation, falsifiable predictions P1–P5; no measurement claims
• Long-form articles — 42+ pieces, one per major architectural decision

AxonOS ships a CITATION.cff, so every repository in the organisation exposes a "Cite this repository" button. For the peer-readable analysis, cite the preprint:

@article{axonos2026microkernel,
title = {An Analytical Microkernel Design for Safety-Critical Brain--Computer Interfaces: Schedulability, Capability Isolation, and Falsifiable Predictions},
author = {Yermakou, Denis},
year = {2026},
doi = {10.5281/zenodo.20552007},
url = {https://doi.org/10.5281/zenodo.20552007},
note = {Analytical bounds; predictions P1--P5; no measurement claims},
license = {CC-BY-4.0}
}

The preprint is analytical and falsifiable. It states, up front, the findings that would prove it wrong. If you reproduce or refute any bound, the project wants to hear it: connect@axonos.org.