System

The base is musl 1.2.6: libc, init, the shell, the system tools, the editors, the package manager and the compiler. A second, glibc runtime sits beside it as shared libraries only, for software you install yourself: CUDA, vendor binaries, pip wheels, Fedora packages.

No container or chroot separates them. Every ELF names its own interpreter in PT_INTERP, and the kernel loads the right one, so the boundary is a linking boundary: a musl program can exec a glibc one and the other way round. The rule runs in one direction and CI enforces it. Nothing Nerv ships links glibc, and the glibc runtime is never a dependency of a Nerv package.

S2 talks to the CUDA driver API and nothing above it: no cudart, no cuBLAS, no nvcc. Its kernels come from its own PTX generator, written in Rust. A model is two files: the weights, stored in the order the kernels read them, and a plan holding every allocation, every kernel as a cubin and every step's launches. At load, S2 captures each step as a CUDA graph, which takes under a second for all 128 steps. A model is serving 10 seconds after S2 starts, where vLLM takes 7 minutes.

The KV cache is paged from one pool, 64 positions to a page, out to a 262,144-token context. Finished sessions are kept as snapshots a new request can resume from. Speculative decoding uses block drafters, with acceptance decided on the GPU. At 64 concurrent sessions S2 serves 566 tokens per second, 1.7× vLLM and 7× llama.cpp. A single user gets 57, twice what Atlas and vLLM reach with MTP speculative decoding.

S2 is also the only engine we tested that loads NVIDIA's own NVFP4 checkpoint of Qwen 3.8 Flash-Next on one GB10, because it keeps the model's n-gram table on disk. Stock vLLM and Atlas ran out of memory or refused to load it.

The GB10 has no GPUDirect RDMA: its NIC cannot register GPU memory. So axon turns the problem around and keeps transfer buffers in pinned host memory the NIC can already reach, which on unified memory streams at 96% of device-memory bandwidth. A kernel signals a proxy thread, the proxy posts an RDMA write followed by an 8-byte flag, and the receiving kernel spins on that flag.

On that path axon ships its own libnccl.so.2, covering all of NCCL 2.32.3's API, so unmodified multi-GPU programs run collectives across two GB10s. Reductions run in rank order, so every rank gets a bit-identical result: all 84 type and operator combinations match on every rank. If a peer dies, the survivor gets ncclRemoteError instead of hanging.

Plexus connects your Nerv machines to each other and to you, wherever they are. Every device has an identity that is separate from its network address, so a machine that changes networks, sleeps or roams is still the same peer. Peers find each other through private discovery and connect directly over WireGuard, punching through NAT on both ends. When no direct path exists, traffic goes through an approved relay that forwards only ciphertext: it admits a short-lived token issued by your own authority, carrying a blinded session identifier, so the relay never learns which organisation, devices or keys it is carrying.

Access is a grant, not a network location. Grants expire, and revoking one ends active sessions. Each fleet chooses its connection policy, direct with relay fallback or approved relays only, and Plexus never relaxes it on its own: a path failure, a stale policy or a roaming laptop fails visibly instead of quietly falling back to something weaker. A central management layer for GPU provisioning, enrolment and fleet policy comes next.

Every change to the system is a new generation: a btrfs subvolume beside the running one, sealed into its own signed boot image. There is no fixed A/B pair; a machine keeps as many generations as it has reason to. A new generation boots on trial with a counter. If it fails to complete a boot three times, the machine falls back to the generation that worked, with nobody present. Only a generation that has booted becomes the default.

Before anything goes to hardware, the new generation is booted in a VM from its own boot image and driven through a real login. The mechanism is cage.

Five keys sign or unlock different things, and each machine generates its own rather than being issued a fleet's. A machine's private keys never leave it, and its signing key doubles as its identity, so there is no central secret whose loss compromises every machine at once.

Every package Nerv compiles is built with LLVM 22 and linked with lld, for the GB10's Cortex-X925. Programs get LTO, -O3, ARM branch protection (PAC and BTI), full RELRO, _FORTIFY_SOURCE=3, a stack protector and a non-executable stack by default.

musl implements no fortified functions, so _FORTIFY_SOURCE is silently inert on other musl systems. Nerv ships fortify headers in every build root, so every package is fortified apart from the listed exemptions.

Builds run in a pure-musl chroot composed from Nerv's own repository, never a glibc build root, because a musl binary built inside a glibc environment picks up glibc-shaped answers that surface as bugs much later.

Small by construction. Nerv's base image, nerv-minimal, is 87 MB with a shell, coreutils and dnf, 40% smaller than fedora-minimal's 146 MB. It is built from the same signed packages as the machine, and every container you build on it starts from fewer than 1,400 files. For a single program, nerv-static is 1.8 MB: musl, the CA certificates and time zones, with no shell, no package manager and nothing to exploit. It's smaller than Google's distroless/static and still runs any program built on Nerv.