# Nyxis

> A Lean backend framework that formally proves authorization safety for backends defined by Cedar schemas and policies.

Nyxis is an open-source Lean backend framework from Nyx Foundation, aimed at solo developers who ship web applications written by AI agents. The developer writes and approves only a Cedar schema and policies, and the Lean kernel checks an authorization-safety theorem on every build. The latest listed release is v0.1.1, and the project describes itself as under active development.

## What It Is

Nyxis is a backend framework in which authorization is formally verified. Every backend built on it comes with a proof that no sequence of HTTP requests can let an authenticated principal read, modify, delete, or grant access to data beyond its legitimate permissions. The main theorem is `Nyxis.Runtime.authorization_safety`. Reviewing authorization comes down to reading the schema and policies and confirming that the proof checks.

## How the Workflow Works

The developer writes and approves a Cedar schema and policies. The schema doubles as the table definition, with entity types as tables and attributes as columns. Each action carries exactly one effect defined by Nyxis. Handlers, written by hand or by an AI agent such as Claude Code, have the type `Nyxis.Handler`. Their only effect is calling actions on the authorization layer, so they cannot perform IO or reach the database directly. Running `lake build` binds the app to the approved sources, audits the application code, and checks the proofs. Clients then call the backend over HTTP with a Supabase Auth JWT.

## Effects and Runtime Model

Effects include read, list, insert, update with an explicit column list, and delete. They also cover file storage via signed URLs, email notifications, and external API calls, all routed through the authorization layer and covered by the same theorem. Nyxis derives the principal from the JWT, the resource from the current database row, and the time and unique IDs per request, so handlers cannot forge them. At runtime it needs PostgreSQL (Supabase) and Supabase Auth.

## Setup and Samples

Building requires Lean 4 via elan, Python 3.12 or later, the OpenSSL CLI, a C compiler, pkg-config, and libpq and libcrypto development files. Applications pull Nyxis in as a Lake package with `require`. Two official samples are included: a bulletin board with a Next.js frontend, and a team-docs backend with memberships, roles, attachments, and email notifications.

## Current Status

The README says Nyxis is under development and points readers to ASSUMPTIONS.md, which spells out the scope of the guarantee and the assumptions trusted outside the proof, before production use. Most documentation other than the README and ASSUMPTIONS is in Japanese.

## Features
- Formally proven authorization safety checked by the Lean kernel on every lake build
- Cedar schema and policies as the only developer-approved artifacts
- Schema doubles as table definition
- Handlers restricted to calling authorization-layer actions with no direct IO or database access
- Effects for read, list, insert, update, delete, file storage via signed URLs, email notifications, and external API calls
- Principal, resource, time, and unique IDs determined by the runtime per request
- HTTP API authenticated with Supabase Auth JWT
- Official bulletin-board and team-docs samples

## Integrations
Cedar, Supabase Auth, PostgreSQL, Supabase, Lean 4, Claude Code, Next.js, Google OAuth

## Platforms
MACOS, WEB, API, DEVELOPER_SDK, CLI

## Pricing
Open Source

## Version
v0.1.1

## Links
- Website: https://github.com/NyxFoundation/nyxis
- Documentation: https://github.com/NyxFoundation/nyxis/blob/main/ASSUMPTIONS.md
- Repository: https://github.com/NyxFoundation/nyxis
- EveryDev.ai: https://www.everydev.ai/tools/nyxis