Nyxis

Nyxis is an open-source Lean backend framework from Nyx Foundation, aimed at solo developers who ship web applications written by AI agents. The developer writes and approves only a Cedar schema and policies, and the Lean kernel checks an authorization-safety theorem on every build. The latest listed release is v0.1.1, and the project describes itself as under active development.

What It Is

Nyxis is a backend framework in which authorization is formally verified. Every backend built on it comes with a proof that no sequence of HTTP requests can let an authenticated principal read, modify, delete, or grant access to data beyond its legitimate permissions. The main theorem is Nyxis.Runtime.authorization_safety. Reviewing authorization comes down to reading the schema and policies and confirming that the proof checks.

How the Workflow Works

The developer writes and approves a Cedar schema and policies. The schema doubles as the table definition, with entity types as tables and attributes as columns. Each action carries exactly one effect defined by Nyxis. Handlers, written by hand or by an AI agent such as Claude Code, have the type Nyxis.Handler. Their only effect is calling actions on the authorization layer, so they cannot perform IO or reach the database directly. Running lake build binds the app to the approved sources, audits the application code, and checks the proofs. Clients then call the backend over HTTP with a Supabase Auth JWT.

Effects and Runtime Model

Effects include read, list, insert, update with an explicit column list, and delete. They also cover file storage via signed URLs, email notifications, and external API calls, all routed through the authorization layer and covered by the same theorem. Nyxis derives the principal from the JWT, the resource from the current database row, and the time and unique IDs per request, so handlers cannot forge them. At runtime it needs PostgreSQL (Supabase) and Supabase Auth.

Setup and Samples

Building requires Lean 4 via elan, Python 3.12 or later, the OpenSSL CLI, a C compiler, pkg-config, and libpq and libcrypto development files. Applications pull Nyxis in as a Lake package with require. Two official samples are included: a bulletin board with a Next.js frontend, and a team-docs backend with memberships, roles, attachments, and email notifications.

Current Status

The README says Nyxis is under development and points readers to ASSUMPTIONS.md, which spells out the scope of the guarantee and the assumptions trusted outside the proof, before production use. Most documentation other than the README and ASSUMPTIONS is in Japanese.