Kurrent周流
Stateless compute · System as the unit

The six lines flow, above and below without constancy; the firm and the yielding interchange — it adapts to whatever change may come. — the I Ching · Great Commentary

Cloud-native · Stateless · Bare metal

Compute should not
be owned by hardware.

Kurrent strips identity, system and state away from the machine. The node stays empty; the system becomes the only unit of scheduling. The machine is merely where the system happens to be.

00Proposition

Statelessness makes a machine replaceable again.

Not hiding state out of sight, but giving every piece of state a clear owner and returning the node to its only role: a location.

A node can be pulled, replaced and re-racked while the system still stands.

Because the system was never inside that machine.

Identity lives in the device ledger, the system disk on storage, the declaration in the repository, and credentials are issued by the control plane. What remains on the machine is a temporary connection for one boot.
01Unit

Schedule a whole system, not a workload on a machine.

A system is defined by four things. They move, exist and are replaced together; remove any one and it is no longer the same system.

ObjectContentOwner
IdentityWorker id, hostname, bound device public keyDevice ledger / control plane
System diskFull disk NQN, os_tag, image versionStorage node
Declarationkurrent.yaml: network, backend, data directory, NQN namespaceRepository / node
CredentialsDHHC-1 authentication key; TLS PSK derived from itControl plane / target
NodeHolds none of the aboveEmpty
02State

State returns to the system itself, not to another infrastructure layer.

The system disk carries the whole system, credentials follow the disk, and binding has a single authority. No extra storage abstraction is introduced just to claim statelessness.

/ Persistence

The disk is the system

Boot, runtime and data live on the same disk. Move the disk and the system moves with it; no separate volume and snapshot layer.

/ Authorization

Binding is authentication

Devices and Workers are one-to-one. At boot only the bound device receives its system's connection data; the binding is the authentication boundary.

/ Delivery

One boot, one boundary

The boot chain hands the system to the next boot. It is the delivery entry, not the project itself; Kurrent schedules systems, not boot processes.

Fig. 1 — State has an owner; the node is empty.

03Verified

Verified distributions.

The following distributions have completed whole-machine cold-boot verification; the list does not limit what can boot.

/ Whole machine
Debian 12/13
Ubuntu 24.04/26.04
Fedora 44
Cold boot to system login
/ Data plane
4421
NVMe/TCP · TLS 1.3
shared by firmware and kernel
/ Authentication
DHHC-1
Issued at disk creation
rotation / revocation immediate
/ Plaintext
None
Missing key or unready port
boot refused