# Advanced Peios

> The deeper end of Peios — internals and behaviour beyond everyday operation.

All of Advanced Peios as one markdown file: [/peios/advanced-peios/print.md](/peios/advanced-peios/print.md)

- [Conventions for Specifications and TRMs](/peios/advanced-peios/conventions.md): How the documents of this anthology are written and read — normative language, required structure, citation and addressing, and the style rules for specifications and for technical reference manuals.
- [Peios Common Data Structures](/peios/advanced-peios/pcds.md): The common binary data structures shared across Peios subsystems: the GUID, LUID, and SID identifier types, and the security descriptor family.
- [Peios Generic System Standards](/peios/advanced-peios/pgss.md): The cross-platform standards a system must implement to be Peios — contracts between two roles, either of which a third party may replace.
- [Peios System Protocols Kernel](/peios/advanced-peios/pspk.md): The contracts spoken across the kernel boundary — the protocols a Peios kernel subsystem depends on a userspace process to fulfil, and the formats it exchanges with one.
- [Peios System Protocols Userspace](/peios/advanced-peios/pspu.md): The foundational userspace protocols — public, stable contracts between the components a Peios system is built from, which third parties may implement.
- [Peios Kernel](/peios/advanced-peios/peios-kernel.md): The Peios kernel as it is built: the KMES event subsystem, the KACS access control system, the stratafs layered filesystem, and the LCS registry.
- [peinit](/peios/advanced-peios/peinit.md): Technical Reference Manual — the init system and service manager: boot, the service model, identity, supervision, jobs and operations, and shutdown.
- [loregd](/peios/advanced-peios/loregd.md): Local Registry Daemon — the SQLite-backed RSI source that provides the Machine and Users hives: storage, concurrency, and request handling.
- [eventd](/peios/advanced-peios/eventd.md): Technical Reference Manual Proposal — the observability daemon as designed: event, log and metric ingestion, three storage engines, adaptive acceleration, and query execution.
- [peipkg](/peios/advanced-peios/peipkg.md): Technical Reference Manual — the package manager: repositories and trust, dependency resolution, installation, transactions and rollback, roles and claims, and package production.

## Linux compatibility

- [Linux compatibility](/peios/advanced-peios/linux-compatibility/overview.md): Peios runs Linux software with little to no modification. The Linux identity APIs return values projected from KACS; the token stays authoritative.
- [Credential projection](/peios/advanced-peios/linux-compatibility/credential-projection.md): The token's identity is projected into Linux UID/GID fields — computed from the SID-to-UID mapping, cached on the token, and never written back.
- [DAC neutralisation and capabilities](/peios/advanced-peios/linux-compatibility/dac-neutralization-and-capabilities.md): Every process carries a mandatory capability substrate that defers Linux DAC to KACS, and the 41 capabilities are classified ALLOW, PRIVILEGE, or DENY.
- [setuid and uid0](/peios/advanced-peios/linux-compatibility/setuid-and-uid0.md): Without SeAssignPrimaryTokenPrivilege, setuid is a no-op; with it, a full identity swap via authd. The uid0 utility gives legacy programs a cosmetic UID 0.
- [Peer credentials](/peios/advanced-peios/linux-compatibility/peer-credentials.md): SO_PEERCRED and SCM_CREDENTIALS return projected UIDs — fine for logging, insufficient for security. kacs_open_peer_token is the real tool.
- [Linux relics](/peios/advanced-peios/linux-compatibility/linux-relics.md): Linux features that survive for compatibility but are superseded — each with the privilege it needs and the native replacement to use instead.
- [Identity for POSIX programs](/peios/advanced-peios/linux-compatibility/name-service-switch.md): How getpwnam and friends reach Peios principals — no nsswitch.conf entry, no /etc/passwd, no PAM, and nothing resolves before authd is running.