TacidOS
DevelopersGitHub

Decision 0003

Rust for every Tacid component, Nix for the system layer

Architecture decision record 0003: Rust for every Tacid component, Nix for the system layer

Status
Accepted
Date
2026-09-03

Context

Beauty on a code basis means one language, one type system, one protocol crate shared by every process. The trusted components must be memory-safe and auditable.

The three plans

  • Grok: Rust or Go for the TUI and daemon; inference stays upstream C++ (Q-8).
  • Fable: Rust daemon and TUI; a GTK4/libadwaita panel with gtk-rs.
  • Codex: Rust for trusted services; QML/Quickshell for visible surfaces; Python as a workload language outside the trust boundary.

Decision

Rust for the daemon, keeper, stem, egress, inference supervisor, session, CLI, TUI, graphical shell and installer. Nix for modules, profiles, images and tests. No Python, TypeScript or QML in the core. Python is permitted only in tune/, the offline fine-tuning pipeline, which never runs on a machine’s trust path.

C and C++ inference engines are never linked into a Rust process. They parse hostile files (model weights, audio) and are run as sandboxed subprocesses (ADR-0016). This was strengthened after review.

Consequences

  • One Cargo workspace; shared types; JSON Schema generated from the protocol crate.
  • The graphical shell is written in Iced (ADR-0019) rather than a second UI language.
  • Contributors need Rust and Nix; nothing else.

Alternatives rejected

  • Go: fine for daemons, weaker for sandboxing and for a native Wayland shell.
  • QML/Quickshell: the fastest way to a beautiful shell, at the cost of a second language, a Qt runtime in the core, and a shell the daemon cannot share types with.
  • GTK4/libadwaita: fights any design system that is not GNOME’s.