Axis · start here
Every box in the stack exists to guess something the work never said.
Open any cloud console and you see the same boxes: compute, storage, a database, queues, load balancers, firewalls, identity, the thing that keeps it all running, and the code that describes it.
Here is each of them, stripped to what it is actually for — what changes when the work carries its own meaning — and which part of axStack is building it. Most of it is designed, not built, and each box says which.
A modern cloud stack is a pile of services that do not trust each other, and have no way to.
The code you hand them says nothing about what it is for or what it is allowed to touch. So every layer has to work it out again, from the outside. A firewall guesses from ports and addresses. An identity policy guesses from a document somebody wrote. A load balancer guesses from health checks. Terraform guesses from a state file, which is wrong as soon as anyone touches the console.
Each of those guesses is a product, a team and an outage waiting to happen. Most of the stack is the same missing fact, worked out again and again in different ways.
The question here is the one from strip it to what's load-bearing, asked of each box: what is it actually for? And what is left of it if the work tells you that itself?
Today. You rent a machine or a container, ship it an image with half an operating system inside, and fence it in — because the code inside could do anything.
What it is for. Running the work, close to the data it needs.
What changes. Code that can only do what it declared needs no fence. The unit stops being a machine or an image and becomes the piece of work itself: nothing to install, nothing pinned to one machine, nothing to keep in sync between copies. Work goes wherever there is capacity and the data is, and a second copy is free to run, because nothing it does can collide.
In axStack. axHost runs it, on top of Linux first; axCompute spreads it across machines. Designed.
Today. Files and objects kept by where they are — a bucket, a path, a disk — with copies everywhere and backups of the copies.
What it is for. Keeping things, and finding them again.
What changes. Things are kept by what they are. The same thing is stored once and recognised everywhere, so duplicates were never two things in the first place. Nothing is overwritten, so nothing can be left half-written. And it can be encrypted and spread across many places, so holding one disk gets nobody anything.
In axStack. axStorage. Sketched.
Today. Every write is done twice — once into a journal, then for real — so that a crash halfway does not leave things broken. And every change to the shape of the data is a migration someone has to plan.
What it is for. Answering questions about what is true, and what was true.
What changes. A write that never overwrites anything has no halfway to protect, so the journal loses its job. Old versions are still there, so "what did this say last Tuesday" is a lookup, not a restore.
In axStack. axVerity. Building — and the furthest along of anything here: written in the language, it already runs, and ordinary database tools can connect to it.
Today. Every hop — gateway, queue, service, service mesh — packs the message up, sends it, and unpacks it again. A gateway checks the request is well-formed; a mesh adds retries and hopes they are safe.
What it is for. Getting a meaning from here to there, intact.
What changes. The message travels as what it means, all the way, so there is no packing and unpacking at every step. If the far end already has something, a tiny fingerprint of it is sent instead of the whole thing. A request to something that does not exist cannot be written, so a whole class of "malformed request" never reaches the wire. Encryption is not reinvented — the well-proven kind sits underneath, and the meaning rides on top.
In axStack. axComms. Designed.
Today. Traffic is spread across servers the balancer cannot see inside. Health checks guess which ones are fine. Retries are only safe if somebody made them safe, by hand.
What it is for. Getting each piece of work done by whoever can do it.
What changes. Work that only works something out is safe to retry, safe to run twice and take the first answer, and safe to move. So the balancer stops being a router of packets and becomes a scheduler of work: it decides where each piece runs, and how many times.
In axStack. Part of axHost and axCompute. Designed.
Today. Thousands of rules about ports and addresses, between every service and every other, because anything that can reach a port might be hostile.
What it is for. Stopping code from doing things it should not.
What changes. Code can only reach what it declared, and the list is known before it runs. The rules between services have nothing left to guard. Firewalls do not vanish — a few plain ones still stand at the edge, around the runtime and the storage — but the spaghetti inside goes.
In axStack. The declared list is the registry, which is built. Enforcing it at the edge of a running system is axHost. Designed.
Today. Permission policies written by hand, which everyone hopes are least-privilege and nobody can prove are. Keys and passwords — shared secrets — that leak, because shared secrets do.
What it is for. Deciding who and what may do which things.
What changes. What a piece of work may do is what it declared, so the least-privilege list is not hoped for — it is printed, before it runs. Instead of a shared secret you hold a permission, which cannot be phished out of you the way a password can.
In axStack. The capability list comes from the registry (built). Passwordless identity on top of it is designed.
Today. Something like Kubernetes compares what you asked for with what is actually running, and nudges one towards the other, forever — because what is actually running keeps drifting.
What it is for. Keeping what runs matching what you meant.
What changes. Nothing changes in place, so there is no "actual state" to wander away from what you asked for. Starting something becomes looking up what it needs, not replaying a sequence of steps that can fail halfway. There is much less left to reconcile.
In axStack. axHost, then axOS as the boundary is pushed down below Linux. Designed.
Today. A plan of steps, run against a state file that goes stale whenever someone clicks in the console. Apply in order, hope nothing fails halfway, and find out about drift later.
What it is for. Saying what should exist.
What changes. You say what it is for, once. A change is a new version, and the old one is still there to go back to. What changed between two versions is exactly computable, not a guess from a plan. And there is no state file to drift, because nothing is changing behind your back for it to lose track of.
In axStack. Written in the language itself (built), kept in axVerity (building). Describing whole systems in it is designed.
Today. Logs as lines of text, traces stitched across services, dashboards — and tools to guess the meaning back out of all of it.
What it is for. Knowing what happened, and why.
What changes. Every run can be replayed exactly, with the same inputs. "Why was this flagged?" points straight at what it was decided from. You debug by running it again, not by reading the tea leaves.
In axStack. Comes with the runtime in axHost. Designed.
The same boxes turn up wherever software meets the physical world — and there the guesses are not just expensive, they are dangerous.
Today. A device asks "has anything happened yet?" thousands of times a second, and almost every answer is no. That asking is where most of the battery goes, and it still adds delay.
What it is for. Noticing when something happens, and acting on it.
What changes. The device says what it is waiting for, and is woken when it is true. Less delay and less power — normally you have to trade one for the other.
Today. Nearly every serious failure of a self-driving system is one that was confidently wrong: it did not know, and it acted anyway.
What it is for. Getting there safely — which includes knowing when you do not know.
What changes. "I don't know" is a real answer with a defined response — slow down, hold, hand back to the driver — not a confident guess. A controller built on that never acts while it does not know.
In axStack. axAporia, the self-driving controller that never acts during an unknown. Designed; the specification is written. Robotics without the asking loop: designed.
Not nothing. You still need machines, networks, disks and power. You still need a few firewalls at the edge, and well-proven encryption underneath. The hard parts — doing many things at once, talking to devices, other people's code — do not disappear. They move to one place, the bridge, where they are solved once instead of in every service.
And none of it needs a flag day. It runs on top of the machines and operating systems you already have, and reaches existing software through the bridge, so it can start in one corner and grow.
What goes is the guessing: the layers whose whole job was to work out, from the outside, something the work could simply have said.
axStack is the name for all of it — the pieces above, built on one foundation, in one order.
The foundation — built. The language, the bridge, and the registry of everything the bridge can do. This is what every box above stands on, and it runs today.
Storage — building. axVerity, the database. It runs, and ordinary database tools can connect to it.
Making code — building. axAI: given a requirement, search the known list for a program that passes its tests, rather than guess one.
Running it — designed. axHost on top of Linux, then axOS underneath. This is where compute, load balancing, the control plane and the firewall's job end up.
Talking — designed. axComms.
Spreading out — sketched. axStorage and axCompute, across many machines.
The surface — designed. axDisplay: the same running thing, shown properly on whatever screen you are in front of.
The first proof is small on purpose: the stack starts up and shows a live page through its own screen. Everything after that is box by box.