FUAI: A Measurement-Parameterized Safety Envelope for AI-Integrated Operating Systems

**Status.** Preprint / early-exploration record. Formal submission to arXiv (cs.OS) and a student journal are in preparation; this deposit establishes the priority timestamp. Archiving here does not constitute formal publication.

**Abstract.** We do not claim whole-system safety. FUAI defines and validates an executable safety envelope at the model–kernel interface. Three modal duties matched by epistemic status: S1 (mechanism) a hard bound — actual actions ⊆ domain ∩ grant, enforced by a kernel capability gate and checkable as offline invariants (A1–A4, blast-radius theorem); S2 (entrustment) a measured quantity — how much of the bounded surface the deployed model deserves, quantified as blind-spot coverage on a goldset and turned into a trust-adaptive domain width via an explicit loss model (τ is a derived policy parameter, not a constant); S3 (policy) a declared operator choice (rule-based final arbiter, staleness TTL, model absence as a first-class auditable state). The model needs not be trusted to be correct or obedient; it is trusted only to produce a proposal. The reference realization is FujoOS: a zero-dependency x86_64 no_std Rust kernel, every layer self-built, evaluated over 100 milestones plus M112–M150 with a 40-case regression suite, three execution modes (TCG/WHPX/KVM), and a 15-model × 100-sample evaluation with leave-one-model-out robustness.

**Files.** `paper.pdf` (manuscript, 21 pages, figures embedded) + `supplementary.zip` (evidence appendix: 6 analysis docs + figures; every number regenerable).

**Artifact.** https://github.com/FujoJTOP/FujoOS (branch fujoos-ai-dev, MIT for code).