Introduction

ChloeKernel is a Roblox game framework with an OS-style architecture: a genre-agnostic kernel (scheduler, processes, services, IPC, hooks) plus server-side drivers for networking, persistence, replication, anti-exploit, and commerce. Game code registers as services and communicates through kernel primitives — the kernel contains no game rules.

The analogy is load-bearing, not decorative:

OS concept	ChloeKernel equivalent
Kernel	One `Kernel` per machine — server and client each boot one
Processes	Coroutines with PIDs, lifecycles, and exit signals, stepped by the scheduler
Scheduler	Priority queues drained under a per-frame budget
System calls	Network intents through fail-closed validation chains
IPC	Topic pub/sub bus + typed signals
Drivers	NetDriver, DataDriver, ReplicaService, AntiExploit, Commerce — server-side, privileged
Userspace	Your services, kits, and Bootstrap code

What you get

Priority-scheduled work under a frame budget. Everything the framework does per frame drains through the Scheduler — frame-aware budgets on the server, a fixed slice on the client, Background work only on spare budget. Hot paths are measured in nanoseconds and published in Benchmarks.
Server-authoritative networking. Clients send intents, never state. Every intent passes a fail-closed hook chain: a crashing validator rejects the action, and a handler-bearing channel with no validator rejects every payload — missing permission is not permission. Buffer-packed serialization at every boundary keeps the wire small.
Loss-hardened persistence. DataDriver wires session locks, atomic retried writes, schema migrations, and rotated backups with automatic restore — and a failed load kicks instead of substituting defaults, because defaults overwriting a real record is how data wipes happen.
Genre kits. Weapons, melee, spells, movement abilities, inventory, loot, crafting, shops, quests, rounds, teams, parties, NPCs — each one is server-validated gameplay wired through the same primitives, usable in a few lines and replaceable without touching the kernel.
A media stack. Bone physics, automatic hair rigging, voxel dissolve, audio, animation and IK, all budgeted per device by DeviceBench.
505 specs on every boot. Pressing Play in Studio runs the full spec suite at server boot. Verification status is documented per feature — what is spec-proven and exactly what still needs a published place.

The security posture, in one paragraph

The client is a renderer with opinions. Everything privileged lives in ServerScriptService where it cannot be decompiled; nothing the client says is trusted; validation chains fail closed; rate limits are per-player, per-channel; hit validation is lag-compensated server-side. Client code is always readable by exploiters — the defense is never trusting it, not hiding it. The full model is in Architecture & Security.

How to read these docs

Getting Started boots the framework and your first service.
Core Concepts is the five-minute mental model: kernel, services, sessions, hooks, bus. Read it before anything else.
The Cookbook is task-first — “I want to save player data”, “I want to validate hits” — complete, copyable recipes that link into the deep pages.
Kernel / Networking / Data / Systems / Kits sections go module-by-module into how each system actually works: the internals, the API surface, the hooks and bus topics, the sharp edges.
Press Ctrl+K anywhere. The search index covers every page.