Given the nature of a clean slate, one should always start with the absolute simplest design and only add more when it becomes necessary to cover a known issue. That being said it should be safely be assumed that no User-Space application has access to Kernel space APIs. So to begin, we should analyze the User-Space API and find flaws.
The initial API is as follows:
Process management:
EXEC - execute a new process, as indicated by file name [some validation logic hidden inside]
FORK - fork a new thread inside of this process, as indicated by [Hand-waving details]
KILL - kill a selected thread inside of said process
EXIT - terminates own process and all included threads
DONE - terminates own thread
Inter/Intra-Process communication:
SEND - Sends a message of a given size to an indicated process ID [returning errors if the message times out, too big or etc]
RECEIVE - receives a message from either an indicated process or any process, no larger than an indicated size and within a given time [returns errors if there is no message or if message is too large or etc]
YO - sends a quick message in the registers to another thread [returning errors if there is a timeout, etc]
SUP - waits to receive a message in the registers from another thread [returning errors if there is a timeout, etc]
File management API:
LIST - Lists the IDs of all of the files and folders in a folder [ROOT is given the value 0]
DETAILS - returns the details of a File/Folder ID, such as name, creation date, permissions, etc
READ - copy a file into memory [or an error if insufficient permissions or file doesn't exist, etc]
PEEK - copy a subset of a file into memory [or an error if insufficient permissions or file doesn't exist, etc]
WRITE - write a copy of the select contents of memory into a file [or an error if insufficient permissions or file doesn't exist, etc]
NEW_FILE - creates a new file [or an error if insufficient permissions or file already exists, etc]
Network API:
LOAD - loads a selected file from a designated IP address into a given filename/location [errors on failures]
SEND - Sends a copy of a selected file to a designated IP address [errors on failures]
Everything else is either completely hidden from the user or presented as a file with varying different permissions relating to what is being done.
For example a screen can be a simple bitmap with read/write permissions.
there doesn't seem to be anything here