Surface Manager
Planned
The Surface Manager is the Nexus sovereign compositor. It handles display composition, input routing, and surface lifecycle management.
Key Features
Zero-Copy Rendering
Applications write their frame data directly into shared memory surfaces. The compositor reads from these surfaces during composition — no pixel data is copied between processes.
120Hz Photon Scheduling
Display composition runs in the Photon spectrum (2ms deadline), ensuring consistent frame delivery for 120Hz displays without frame drops.
Per-Surface Pledge
Each surface carries a capability that restricts what its owning application can do. A terminal surface pledges STDIO. A browser surface pledges INET. The compositor enforces these boundaries during input routing.
Surface Submission Protocol (SSP)
Applications communicate with the Surface Manager through SSP messages over ION Rings:
| Message | Direction | Purpose |
|---|---|---|
SURFACE_CREATE | App → Compositor | Request a new surface |
SURFACE_DESTROY | App → Compositor | Release a surface |
SURFACE_SUBMIT | App → Compositor | Submit a new frame |
SURFACE_RESIZE | Compositor → App | Notify of size change |
INPUT_EVENT | Compositor → App | Deliver keyboard/mouse input |
Isolation Model
The Surface Manager provides display-level isolation comparable to Qubes OS but without the VM overhead:
- Applications cannot read each other's surfaces
- Input events are routed only to the focused surface
- The compositor runs in a separate fiber with its own capability set
- GPU access is mediated through the Surface Manager — no direct framebuffer access for applications
Plan 9 Rio Heritage
The design is inspired by Plan 9's Rio window manager:
- Windows are resources, not objects
- The compositor namespace is visible at
/Bus/hud/ - Applications discover and interact with display resources through the filesystem interface