bytevortex - kernels, security tooling and automation, built on merit

bytevortex [--kernel] [--security] [--automation] [--web] problem

ByteVortex Labs is the workshop of one developer who writes operating system kernels, security tooling and automation, mostly in C, Rust, Lua and TypeScript. The code is open. The opinions are unfashionable. Neither comes with an apology.

You will not find a diversity statement here, a corporate code of conduct or a land acknowledgement. You will find a test suite. The only pronouns on this site are this and self.

horus(8)

A 64-bit capability-based microkernel for x86-64. A small C kernel, with a no_std Rust core for the parts that must not go wrong: capability checks, ELF parsing, cryptography and the random number generator. It boots under QEMU and on real machines, installs itself onto a disk, and gives you a login and a shell that runs GNU coreutils and the Tiny C Compiler.

Nothing is granted for who you are.

That is the first rule of Horus. A task holds exactly the authority it has been handed, and nothing for being root, being first or being started by the kernel. Rights can be narrowed but never widened, and revoking one reaches every copy made from it. Privilege has to be earned, and the page tables enforce it.

Status

Research system, latest release v0.4.1-alpha

Last commit

2026-10-20

Boots on

x86-64 via GRUB, BIOS or UEFI, QEMU or real hardware

Hardening

SMEP, SMAP, kernel W^X, IOMMU-confined DMA, encrypted swap

Licence

MIT

Source on GitHub Documentation Known limitations

Horus has not been independently reviewed and its cryptography is unaudited. Read the limitations before you rely on it. Honesty is a security property too.

emunah(6)

Client-side automation for Achaea, the long-running text MUD, on the Mudlet client. It tracks the game's GMCP state, works out what the character can actually do at any moment, and drives curing, healing, hunting and movement from that. Section 6 of the manual is for games; this one takes them seriously.

Last commit

2026-10-24

Curing

Per-balance action queue over a 133-affliction cure table

Movement

Self-driving area walker with no mapper dependency

Combat

PvP is opt-in only, and an ally can never be targeted

Platform

Mudlet 4.10 or later, Lua 5.1, Priest class for now

Licence

MIT

Source on GitHub Documentation

folic-check(1)

A mobile-first web app that tells you whether a UK food product is likely to contain added folic acid under the new mandatory fortification rules, which apply in full from 13 December 2026. Search by name or barcode, or scan one with your camera, and it shows the exact ingredient text behind its verdict instead of asking you to take its word for it.

The state has decided what goes into your bread. FolicCheck tells you where it went, so what you eat stays your decision.

Last commit

2026-08-14

Verdicts

A rules-based, unit-tested classifier that shows its evidence and hedges rather than guesses

Data

Product search and barcode lookup from Open Food Facts

Runs as

An installable TypeScript web app that works offline

Licence

MIT

Source on GitHub

General information, not medical advice. Always check the label on the product itself.

Merit over mandates

Code is judged on whether it works, not on who wrote it. A compiler has never asked anyone how they identify, and it is all the better for it.

Least privilege is limited government

Every component gets the smallest authority it needs and not a byte more. Small government, smaller kernel.

Free speech, free software

Read it, fork it, criticise it. Heresy is welcome. Reproducible bug reports are more welcome still.

Privacy is a right, not a privilege

This site sets no cookies, loads no trackers and runs no JavaScript. There is no consent banner because there is nothing to consent to.

Personal responsibility

If my code breaks, I own it and I fix it. There are no safe spaces in kernel mode.

Standards are not oppression

They are RFCs. Read them, follow them, and stop reinventing them badly.

I take on new projects from clients. If your problem is hard, low level or security critical, it is probably a good fit.

--kernel

Kernels, drivers, bootloaders, embedded C and Rust, and porting software to places it was never meant to run.

--security

Code review, hardening, threat modelling and secure design, with a written report you can act on rather than a scanner's output in a nicer font.

--automation

Tooling, scripting and client automation in Lua, Python and shell, for work your team should not be doing by hand.

--web

Fast, locked-down sites and web apps like this one: no frameworks you do not need and nothing that phones home.

How an engagement runs:

1. You describe the problem through the contact form.
2. I reply within two working days with questions or a quote.
3. We agree a fixed price or a day rate. An NDA is fine.
4. You receive working code with tests and documentation, and you own it.

Not available for diversity-quota dashboards, ESG scoring engines or anything that needs a mandatory unconscious bias module before it will compile.

Start a project

This site practises what it preaches. It is plain HTML and CSS served over TLS with HSTS, under a Content Security Policy that forbids every script, frame and third-party request. The contact form is checked on the server and works without JavaScript. Check the headers yourself:

$ curl -sI https://www.bytevortex.net/

Leave off the -I and you get this page as terminal text, the way a manual should be read.

Found a vulnerability in this site or in my projects? See security.txt for how to report it. Responsible disclosure is credited.

github(1), horus(8), emunah(6), folic-check(1), contact(1), privacy(7), security.txt(5)

Holds opinions. Status: WONTFIX.