§Abstract
planarian @ a924e09 · Spec v4.6 · snapshot main · all versions
Planarian is a self-healing layer for declaratively configured computers. It keeps three things distinct: what the system is meant to be (desired state, with conditions and user overrides), what it observes (with explicit unknowns and stale evidence), and whether what it observes is healthy (probes with a contract). A divergence between desired and observed state opens an incident. Incidents are repaired deterministically first, by a planner that searches typed transitions over a dependency graph; a small local language model is consulted only when deterministic repair fails or a user’s request is too fuzzy to match. Every change, whatever proposed it, passes through one executor that derives the risk classification itself, runs the change as a durable transaction with a journal that survives the daemon dying, and reverts it if health checks fail. The executor is a reference monitor: always invoked, tamperproof, and small enough to verify. Everything above it is a principal with an identity and a set of things it may request, and none holds authority on its own: not a user, not root acting through Planarian, not the on-device model, not an agent (an agent acts with exactly the permissions of the person who started it, under its own name in the record, and in Phase A can approve nothing, since approval needs a person at a terminal). Each submits typed proposals.
Planarian ships first as a Rust service on NixOS 26.05, where it is useful immediately and gathers real fault data. Its backends (service supervisor, configuration evaluator, snapshot filesystem, kernel) sit behind contracts and are replaced with Rust implementations over later phases, converging on an all-Rust operating system built on the Asterinas kernel. The contract stays the same at every step; what sits underneath it changes.